{"schema":"archetypal-rule-registry/1.0","release":"2026-10-03.2","updatedAt":"2026-10-03","missionId":"mis_fg_ebc661d105513d4a3b5d78c5615430c83f20f34c7bbe5d11b7ac81f185efc0af","coverageStatement":"A growing, source-linked starter registry. No claim of global completeness. All source interpretations require review before organizational adoption.","deduplication":"Stable hash of action + object groups exact normalized intents. Actor, authority, scope, timing and exceptions remain separate source variants. Semantic near-duplicate review remains open.","sources":[{"id":"nc-public-genai","title":"Use of Publicly Available Generative Artificial Intelligence Policy","publisher":"North Carolina Department of Information Technology","url":"https://it.nc.gov/documents/use-publicly-available-generative-artificial-intelligence/download?attachment=","jurisdiction":"North Carolina, US","type":"organizational-policy","edition":"1.1 — April 14, 2026","effectiveDate":null,"checkedAt":"2026-09-28","coverage":"partial","summary":"State-agency minimum requirements for public GenAI tools.","limitations":"Selected employee rules. Full PDF read; extraction incomplete. Separate web guidance differs. Effective date unstated.","tags":["state-government","generative-ai","data-protection","North Carolina"],"fingerprint":"eb79447a45563393feec0d8eb94807a4e26174a1c47eca173eede98254d8f5be","reviewStatus":"prior-researched-partial-index","lastVerifiedAt":"2026-09-28","rights":"Link to publisher; selective original paraphrases. No licensed standard text is mirrored.","ruleCount":8},{"id":"va-ai-ea400","title":"Artificial Intelligence (AI) Utilization Policy","publisher":"Virginia Information Technologies Agency","url":"https://www.vita.virginia.gov/media/vitavirginiagov/it-governance/ea/pdf/Artificial-Intelligence-(AI)-Utilization-Policy.pdf","jurisdiction":"Virginia, US","type":"organizational-policy","edition":"EA400 — June 2026","effectiveDate":null,"checkedAt":"2026-09-28","coverage":"partial","summary":"Executive-branch AI governance and approvals.","limitations":"Effective-date field is an unfilled placeholder. Higher-education research and instruction excluded. Reconfirm adoption before enforcement.","tags":["state-government","approval","human-review","transparency"],"fingerprint":"2752e8df4f1c7488837ab7f3dcc8a1b74b7e9b349cf75e960df393d93d2f81f6","reviewStatus":"prior-researched-partial-index","lastVerifiedAt":"2026-09-28","rights":"Link to publisher; selective original paraphrases. No licensed standard text is mirrored.","ruleCount":6},{"id":"pa-ai-2026","title":"Artificial Intelligence Policy","publisher":"Pennsylvania Office of Administration","url":"https://www.pa.gov/content/dam/copapwp-pagov/en/oa/documents/policies/it-policies/artificial%20intelligence%20policy.pdf","jurisdiction":"Pennsylvania, US","type":"organizational-policy","edition":"Revision January 13, 2026","effectiveDate":"2026-01-13","checkedAt":"2026-09-28","coverage":"partial","summary":"Commonwealth AI governance and employee-use restrictions.","limitations":"Partial extraction. Scope includes Governor-jurisdiction agencies and Commonwealth-network entities. Formal exceptions use IT Policy Governance.","tags":["state-government","generative-ai","retention","disclosure"],"fingerprint":"f02f2e947d173f480bf386674ab3dc7c01b5892c3aec710e25f3fb440b7f3756","reviewStatus":"prior-researched-partial-index","lastVerifiedAt":"2026-09-28","rights":"Link to publisher; selective original paraphrases. No licensed standard text is mirrored.","ruleCount":6},{"id":"brookline-genai","title":"Generative Artificial Intelligence Use Policy","publisher":"Town of Brookline, Massachusetts","url":"https://www.brooklinema.gov/3975/Generative-AI-Use","jurisdiction":"Brookline, Massachusetts, US","type":"organizational-policy","edition":"1.7 — August 2025","effectiveDate":null,"checkedAt":"2026-09-28","coverage":"partial","summary":"Rules for users exposing town systems or data to GenAI.","limitations":"Selected rules. Sensitive-data prohibition and constrained-tool permission need reconciliation. Exceptions require IT security review; adoption August 19, 2025.","tags":["local-government","generative-ai","approval","human-review"],"fingerprint":"f88055fe772f4fdf64cddb84e749822d4204369ff50933a3a2e41ac50cafb305","reviewStatus":"prior-researched-partial-index","lastVerifiedAt":"2026-09-28","rights":"Link to publisher; selective original paraphrases. No licensed standard text is mirrored.","ruleCount":6},{"id":"harvard-genai-guidelines","title":"Generative AI Guidelines","publisher":"Harvard University Information Technology","url":"https://www.huit.harvard.edu/ai/guidelines","jurisdiction":"Harvard University, US","type":"organizational-policy","edition":"Edition unspecified; prepared index checked 2026-09-28","effectiveDate":null,"checkedAt":"2026-09-28","coverage":"partial","summary":"Institutional guidance for Harvard AI use.","limitations":"Guidelines, not legislation. Revision/effective dates unavailable; school policies also apply.","tags":["university","generative-ai","confidentiality","procurement"],"fingerprint":"17fccd7682a4db1fbc185d3e0c7d89eee1c4f141b17287526522c589e97ba441","reviewStatus":"prior-researched-partial-index","lastVerifiedAt":"2026-09-28","rights":"Link to publisher; selective original paraphrases. No licensed standard text is mirrored.","ruleCount":4},{"id":"msu-genai-guidelines","title":"Guidelines for the Use of Generative Artificial Intelligence Tools","publisher":"Michigan State University","url":"https://ai.msu.edu/guidelines","jurisdiction":"Michigan State University, US","type":"organizational-policy","edition":"Approved August 12, 2025; no revisions listed","effectiveDate":null,"checkedAt":"2026-09-28","coverage":"partial","summary":"University guidance spanning academic and administrative AI.","limitations":"Partial extraction of institutional guidelines. Approval date is not an explicit effective date.","tags":["university","generative-ai","education","research"],"fingerprint":"9082b619d9a71d8373dff619801545bed89a05e7506ba0bce9a4d957ac8bf350","reviewStatus":"prior-researched-partial-index","lastVerifiedAt":"2026-09-28","rights":"Link to publisher; selective original paraphrases. No licensed standard text is mirrored.","ruleCount":6},{"id":"nist-ai-rmf-1","title":"AI Risk Management Framework 1.0","publisher":"NIST","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","jurisdiction":"United States","type":"framework","edition":"AI RMF 1.0 (2023)","effectiveDate":null,"publishedDate":"2023-01-26","checkedAt":"2026-10-03","coverage":"partial","summary":"Voluntary AI risk outcomes across the lifecycle.","limitations":"All 72 core subcategories mapped to selected atomic actions. Compound outcomes may require additional actions; this is not full Playbook extraction.","tags":["AI governance","inventory","risk management"],"authority":"voluntary","lastReviewedAt":null,"reviewStatus":"publisher-core-read","sourceContentFingerprint":null,"sourceFingerprintStatus":"not-captured","evidence":[{"url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","readAt":"2026-09-28","method":"Primary publisher document retrieved with web search; selected sections read"}],"preparedRuleCount":4,"coverageDetail":{"indexedControls":["GOVERN 1.1","GOVERN 1.5","GOVERN 1.6","GOVERN 1.7"],"fullSourceReviewed":false,"missing":"All sections and independent clauses not explicitly indexed","adoptionStatus":"not-adopted"},"indexFingerprint":"sha256:b1183dbe301b7cbde20ab8b0d1ad6035e561f6165c0c01a6accf90691b3a68fd","fingerprint":"570d6996fff58a679befc826cd489145fdabb2013912e93704bdd7e0ab0a71d6","lastVerifiedAt":"2026-10-03","rights":"Link to publisher; selective original paraphrases. No licensed standard text is mirrored.","ruleCount":72},{"id":"nist-genai-profile","title":"Generative AI Profile","publisher":"NIST","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf","jurisdiction":"United States","type":"framework","edition":"AI 600-1","effectiveDate":null,"publishedDate":"2024-07-26","checkedAt":"2026-10-03","coverage":"partial","summary":"Suggested generative AI risk-management actions.","limitations":"Selected precisely located atomic templates from AI 600-1; full 211-action extraction remains a coverage gap.","tags":["generative AI","inventory","shutdown","provenance"],"authority":"voluntary","lastReviewedAt":null,"reviewStatus":"selected-publisher-actions-read","sourceContentFingerprint":null,"sourceFingerprintStatus":"not-captured","evidence":[{"url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf","readAt":"2026-09-28","method":"Primary publisher document retrieved with web search; selected sections read"}],"preparedRuleCount":5,"coverageDetail":{"indexedControls":["GV-1.3-007","GV-1.5-003","GV-1.6-001","GV-1.6-002","GV-1.7-001"],"fullSourceReviewed":false,"missing":"All sections and independent clauses not explicitly indexed","adoptionStatus":"not-adopted"},"indexFingerprint":"sha256:c4ad40875bcac148ab8f66c168b9e44b7e9e194e70f7407dd8c205a96da6f189","fingerprint":"854b49562c3fcbd2c491c3096dbe4cd9332bf64eac581448292dde4c17a39c5d","lastVerifiedAt":"2026-10-03","rights":"Link to publisher; selective original paraphrases. No licensed standard text is mirrored.","ruleCount":10},{"id":"nist-csf-2","title":"Cybersecurity Framework 2.0","publisher":"NIST","url":"https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf","jurisdiction":"United States","type":"framework","edition":"CSWP 29 / 2.0","effectiveDate":null,"publishedDate":"2024-02-26","checkedAt":"2026-09-28","coverage":"partial","summary":"Cybersecurity outcomes for organizational risk management.","limitations":"Five selected outcomes; this is not a complete CSF profile.","tags":["cybersecurity","inventory","logging","data protection"],"authority":"voluntary","lastReviewedAt":null,"reviewStatus":"prior-researched-partial-index","sourceContentFingerprint":null,"sourceFingerprintStatus":"not-captured","evidence":[{"url":"https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf","readAt":"2026-09-28","method":"Primary publisher document retrieved with web search; selected sections read"}],"preparedRuleCount":5,"coverageDetail":{"indexedControls":["ID.AM-01","ID.AM-02","PR.DS-02","PR.PS-04","PR.PS-05"],"fullSourceReviewed":false,"missing":"All sections and independent clauses not explicitly indexed","adoptionStatus":"not-adopted"},"indexFingerprint":"sha256:1616137186c21fd736d139aaa6448eb70458e479cd6dc11b5b4432815491a637","fingerprint":"a39b6ed597fcc0a7d4e15fc04b1e0186985631c3ff05405558cc587a24fedf39","lastVerifiedAt":"2026-09-28","rights":"Link to publisher; selective original paraphrases. No licensed standard text is mirrored.","ruleCount":5},{"id":"nist-privacy-1","title":"Privacy Framework 1.0","publisher":"NIST","url":"https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.01162020.pdf","jurisdiction":"United States","type":"framework","edition":"CSWP 10 / 1.0","effectiveDate":null,"publishedDate":"2020-01-16","checkedAt":"2026-09-28","coverage":"partial","summary":"Voluntary privacy risk-management outcomes.","limitations":"Inventory subset only. Publisher also advertises a 1.1 initial public draft; draft is not substituted here.","tags":["privacy","data inventory","data purpose"],"authority":"voluntary","lastReviewedAt":null,"reviewStatus":"prior-researched-partial-index","sourceContentFingerprint":null,"sourceFingerprintStatus":"not-captured","versionState":"final-baseline","updatePointer":"https://www.nist.gov/privacy-framework","evidence":[{"url":"https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.01162020.pdf","readAt":"2026-09-28","method":"Primary publisher document retrieved with web search; selected sections read"},{"url":"https://www.nist.gov/privacy-framework","readAt":"2026-09-28","method":"Publisher version metadata checked"}],"preparedRuleCount":4,"coverageDetail":{"indexedControls":["ID.IM-P1","ID.IM-P3","ID.IM-P4","ID.IM-P5"],"fullSourceReviewed":false,"missing":"All sections and independent clauses not explicitly indexed","adoptionStatus":"not-adopted"},"indexFingerprint":"sha256:aca377a8893100dc77d1c1a88d358aa047019fdc5ebcedbaacca99a69bee8e8c","fingerprint":"f6c65f5795ec4b430c2e81ed947a1e55c5d6768f4be9264380520ff6f9fafc36","lastVerifiedAt":"2026-09-28","rights":"Link to publisher; selective original paraphrases. No licensed standard text is mirrored.","ruleCount":4},{"id":"nist-800-53-r5","title":"Security and Privacy Controls","publisher":"NIST","url":"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf","jurisdiction":"United States","type":"framework","edition":"SP 800-53 Rev.5 / Dec-2020 updates","effectiveDate":null,"publishedDate":"2020-09-23","checkedAt":"2026-09-28","coverage":"partial","summary":"Tailorable security and privacy control catalog.","limitations":"Baseline PDF only; publisher lists Release 5.2.0 (2025-08-27). Reconcile newer release before adoption. Controls require selection and parameters.","tags":["security controls","least privilege","privacy"],"authority":"technical-controls-when-adopted","lastReviewedAt":null,"reviewStatus":"prior-researched-partial-index","sourceContentFingerprint":null,"sourceFingerprintStatus":"not-captured","versionState":"newer-release-needs-reconciliation","updatePointer":"https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final","evidence":[{"url":"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf","readAt":"2026-09-28","method":"Primary publisher document retrieved with web search; selected sections read"},{"url":"https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final","readAt":"2026-09-28","method":"Publisher version metadata checked"}],"preparedRuleCount":5,"coverageDetail":{"indexedControls":["AC-3","AC-6","PT-2(a)","PT-2(b)"],"fullSourceReviewed":false,"missing":"All sections and independent clauses not explicitly indexed","adoptionStatus":"not-adopted"},"indexFingerprint":"sha256:6253e0836e2c9c832252aba60e9a91aac38b13eba7b15c3ffd1e48ed0a0ba88b","fingerprint":"f90285ebe9f7628c21a3c2a1c5887626002e0aab40d63ec84655fff809a50392","lastVerifiedAt":"2026-09-28","rights":"Link to publisher; selective original paraphrases. No licensed standard text is mirrored.","ruleCount":5},{"id":"nist-800-171-r3","title":"Protecting Controlled Unclassified Information","publisher":"NIST","url":"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171r3.pdf","jurisdiction":"United States","type":"guidance","edition":"SP 800-171 Rev.3","effectiveDate":null,"publishedDate":"2024-05-14","checkedAt":"2026-09-28","coverage":"partial","summary":"Recommended CUI safeguards for nonfederal systems.","limitations":"Four selected requirements. Contract incorporation and required revision must be verified; publication alone does not bind every organization.","tags":["CUI","access control","federal contractors"],"authority":"technical-requirements-when-incorporated","lastReviewedAt":null,"reviewStatus":"prior-researched-partial-index","sourceContentFingerprint":null,"sourceFingerprintStatus":"not-captured","evidence":[{"url":"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171r3.pdf","readAt":"2026-09-28","method":"Primary publisher document retrieved with web search; selected sections read"}],"preparedRuleCount":4,"coverageDetail":{"indexedControls":["03.01.02","03.01.05(a)","03.01.07(a)","03.01.07(b)"],"fullSourceReviewed":false,"missing":"All sections and independent clauses not explicitly indexed","adoptionStatus":"not-adopted"},"indexFingerprint":"sha256:5bc814d991eed9d9478f00d730d9a0091af6f82888232deadc81ef3e6fd48958","fingerprint":"345e6f1c845ad7bb3fe7642ffe3cc2c553fd3cc8c66a62eea1203845ec65f20a","lastVerifiedAt":"2026-09-28","rights":"Link to publisher; selective original paraphrases. No licensed standard text is mirrored.","ruleCount":4},{"id":"nist-ssdf-1-1","title":"Secure Software Development Framework","publisher":"NIST","url":"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-218.pdf","jurisdiction":"United States","type":"framework","edition":"SP 800-218 / SSDF 1.1","effectiveDate":null,"publishedDate":"2022-02-03","checkedAt":"2026-09-28","coverage":"partial","summary":"Recommended secure software development practices.","limitations":"Selected practices only. Revision 1 initial public draft exists; this index retains final 1.1.","tags":["software security","supply chain","vulnerability response"],"authority":"voluntary","lastReviewedAt":null,"reviewStatus":"prior-researched-partial-index","sourceContentFingerprint":null,"sourceFingerprintStatus":"not-captured","versionState":"final-baseline","updatePointer":"https://csrc.nist.gov/pubs/sp/800/218/final","evidence":[{"url":"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-218.pdf","readAt":"2026-09-28","method":"Primary publisher document retrieved with web search; selected sections read"},{"url":"https://csrc.nist.gov/pubs/sp/800/218/final","readAt":"2026-09-28","method":"Publisher version metadata checked"}],"preparedRuleCount":4,"coverageDetail":{"indexedControls":["PS.1.1","PS.2.1","RV.1.1"],"fullSourceReviewed":false,"missing":"All sections and independent clauses not explicitly indexed","adoptionStatus":"not-adopted"},"indexFingerprint":"sha256:938270e36b849dbaf065a70ec30318f8b91cba2f639f89a94c89a0c51fff47cd","fingerprint":"ada47701174cc35e7ebaed3eb003ca0222bd920f4bb30e30a527e263e238cb7d","lastVerifiedAt":"2026-09-28","rights":"Link to publisher; selective original paraphrases. No licensed standard text is mirrored.","ruleCount":4},{"id":"cisa-ncsc-secure-ai-development","title":"Guidelines for Secure AI System Development","publisher":"NCSC, CISA and partners","url":"https://www.ncsc.gov.uk/collection/guidelines-secure-ai-system-development/guidelines/secure-development","jurisdiction":"United States","type":"guidance","edition":"1.0","effectiveDate":null,"publishedDate":"2023-11-27","checkedAt":"2026-09-28","coverage":"partial","summary":"Lifecycle security recommendations for AI providers.","limitations":"Four selected development recommendations; other lifecycle sections remain unindexed.","tags":["AI security","development","supply chain","sensitive data"],"authority":"voluntary","lastReviewedAt":null,"reviewStatus":"prior-researched-partial-index","sourceContentFingerprint":null,"sourceFingerprintStatus":"not-captured","jurisdictionDetail":"Joint international guidance","evidence":[{"url":"https://www.ncsc.gov.uk/collection/guidelines-secure-ai-system-development/guidelines/secure-development","readAt":"2026-09-28","method":"Primary publisher document retrieved with web search; selected sections read"}],"preparedRuleCount":4,"coverageDetail":{"indexedControls":["Secure development / assets","Secure development / documentation"],"fullSourceReviewed":false,"missing":"All sections and independent clauses not explicitly indexed","adoptionStatus":"not-adopted"},"indexFingerprint":"sha256:f0e5b3bdf7c95b67d87c1194bd3883e616a42c1572eb3a7eb4f68be05a16803b","fingerprint":"3887e1b0420cfda9908d30c4887cbb157678194db20a4ee2aac0e326b6f8e602","lastVerifiedAt":"2026-09-28","rights":"Link to publisher; selective original paraphrases. No licensed standard text is mirrored.","ruleCount":4},{"id":"nsa-cisa-secure-ai-deployment","title":"Deploying AI Systems Securely","publisher":"NSA AISC, CISA, FBI and partners","url":"https://www.cyber.gov.au/business-government/secure-design/artificial-intelligence/deploying-ai-systems-securely","jurisdiction":"United States","type":"guidance","edition":"April 2024 / 1.0","effectiveDate":null,"publishedDate":"2024-04-15","checkedAt":"2026-09-28","coverage":"partial","summary":"Security guidance for deploying externally developed AI.","limitations":"Selected recommendations. Applies to deployers; not merely users of others’ hosted AI. Official coauthor HTML used after NSA PDF returned 403.","tags":["AI security","deployment","model weights","threat modeling"],"authority":"voluntary","lastReviewedAt":null,"reviewStatus":"prior-researched-partial-index","sourceContentFingerprint":null,"sourceFingerprintStatus":"not-captured","jurisdictionDetail":"Joint international guidance","primaryPublisherPointer":"https://media.defense.gov/2024/Apr/15/2003439257/-1/-1/0/CSI-DEPLOYING-AI-SYSTEMS-SECURELY.PDF","evidence":[{"url":"https://www.cyber.gov.au/business-government/secure-design/artificial-intelligence/deploying-ai-systems-securely","readAt":"2026-09-28","method":"Primary publisher document retrieved with web search; selected sections read"}],"preparedRuleCount":4,"coverageDetail":{"indexedControls":["Deployment governance / threat model","Deployment architecture / boundaries","Summary / validation","Summary / model weights"],"fullSourceReviewed":false,"missing":"All sections and independent clauses not explicitly indexed","adoptionStatus":"not-adopted"},"indexFingerprint":"sha256:c46c4b15947f61b1067d4175985bd261b3d813e7a487030e3c1a2099fc2f7c70","fingerprint":"5a2b6af416a7db93086cd04c8accccfaebba166d07ef5a071f3566e34ea8eaa5","lastVerifiedAt":"2026-09-28","rights":"Link to publisher; selective original paraphrases. No licensed standard text is mirrored.","ruleCount":4},{"id":"omb-m-25-21","title":"Accelerating Federal Use of AI","publisher":"Office of Management and Budget","url":"https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-21-Accelerating-Federal-Use-of-AI-through-Innovation-Governance-and-Public-Trust.pdf","jurisdiction":"United States","type":"policy","edition":"M-25-21","effectiveDate":"2025-04-03","publishedDate":"2025-04-03","checkedAt":"2026-09-28","coverage":"partial","summary":"Federal agency AI governance policy.","limitations":"Three clauses only. NSS excluded; inventory excludes DoD/IC; §4(a)-(b) excludes IC. High-impact practices have conditional pilot exemptions and CAIO waivers.","tags":["federal AI","impact assessment","inventory","waivers"],"authority":"binding-within-defined-federal-scope","lastReviewedAt":null,"reviewStatus":"prior-researched-partial-index","sourceContentFingerprint":null,"sourceFingerprintStatus":"not-captured","supersedes":["OMB M-24-10"],"evidence":[{"url":"https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-21-Accelerating-Federal-Use-of-AI-through-Innovation-Governance-and-Public-Trust.pdf","readAt":"2026-09-28","method":"Primary publisher document retrieved with web search; selected sections read"}],"preparedRuleCount":3,"coverageDetail":{"indexedControls":["3(b)(v)","4(b)(ii)","4(a)(ii)"],"fullSourceReviewed":false,"missing":"All sections and independent clauses not explicitly indexed","adoptionStatus":"not-adopted"},"indexFingerprint":"sha256:51038bec3f6608e7a8d52074dd8f85af7232dea13c7aa49ce09d83183acb62f8","fingerprint":"ecef40be10a4ce3aa18ebb38bff1d891d4a566c1be5b55d134ba49831bbaf3c9","lastVerifiedAt":"2026-09-28","rights":"Link to publisher; selective original paraphrases. No licensed standard text is mirrored.","ruleCount":3},{"id":"omb-m-25-22","title":"Driving Efficient Acquisition of AI","publisher":"Office of Management and Budget","url":"https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-22-Driving-Efficient-Acquisition-of-Artificial-Intelligence-in-Government.pdf","jurisdiction":"United States","type":"policy","edition":"M-25-22","effectiveDate":"2025-04-03","publishedDate":"2025-04-03","checkedAt":"2026-09-28","coverage":"partial","summary":"Federal AI acquisition requirements.","limitations":"Selected clauses only. §2 limits scope, excludes NSS and some embedded AI, and specifies contract transition dates.","tags":["procurement","federal AI","evaluation","authorization"],"authority":"binding-within-defined-federal-scope","lastReviewedAt":null,"reviewStatus":"prior-researched-partial-index","sourceContentFingerprint":null,"sourceFingerprintStatus":"not-captured","supersedes":["OMB M-24-18"],"evidence":[{"url":"https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-22-Driving-Efficient-Acquisition-of-Artificial-Intelligence-in-Government.pdf","readAt":"2026-09-28","method":"Primary publisher document retrieved with web search; selected sections read"}],"preparedRuleCount":4,"coverageDetail":{"indexedControls":["4(d)(i)","4(d)(ii)(E)","4(d)(ii)(E)(I)","4(e)(i)"],"fullSourceReviewed":false,"missing":"All sections and independent clauses not explicitly indexed","adoptionStatus":"not-adopted"},"indexFingerprint":"sha256:819b375905f73f1b06bac23dc2ec49316737caf641df12b4cd543104ef8baea5","fingerprint":"d950443a125c5bf4dda71e469bedf029813704e5ba4e3c0b613cf8219a9fc941","lastVerifiedAt":"2026-09-28","rights":"Link to publisher; selective original paraphrases. No licensed standard text is mirrored.","ruleCount":4},{"id":"omb-m-26-04","title":"Increasing Public Trust Through Unbiased AI Principles","publisher":"Office of Management and Budget","url":"https://www.whitehouse.gov/wp-content/uploads/2025/12/M-26-04-Increasing-Public-Trust-in-Artificial-Intelligence-Through-Unbiased-AI-Principles-1.pdf","jurisdiction":"United States","type":"policy","edition":"M-26-04","effectiveDate":"2025-12-11","publishedDate":"2025-12-11","checkedAt":"2026-09-28","coverage":"partial","summary":"Additional federal LLM procurement requirements.","limitations":"Three clauses only; exclusions and open-source treatment require scope review. Sunset: two years after issuance unless OMB directs otherwise.","tags":["LLM procurement","federal AI","transparency"],"authority":"binding-within-defined-federal-scope","lastReviewedAt":null,"reviewStatus":"prior-researched-partial-index","sourceContentFingerprint":null,"sourceFingerprintStatus":"not-captured","evidence":[{"url":"https://www.whitehouse.gov/wp-content/uploads/2025/12/M-26-04-Increasing-Public-Trust-in-Artificial-Intelligence-Through-Unbiased-AI-Principles-1.pdf","readAt":"2026-09-28","method":"Primary publisher document retrieved with web search; selected sections read"}],"preparedRuleCount":3,"coverageDetail":{"indexedControls":["Agency Actions (a)","Agency Actions (c)","Appendix A.1(A)(i)"],"fullSourceReviewed":false,"missing":"All sections and independent clauses not explicitly indexed","adoptionStatus":"not-adopted"},"indexFingerprint":"sha256:f8794e4df44d7a3d18c8dd9b86db768253f639236749d84bb574e12fdb48a86b","fingerprint":"d844d521b5f24a0745be44d963a1907257304ec739c5afef5af7696345c4d116","lastVerifiedAt":"2026-09-28","rights":"Link to publisher; selective original paraphrases. No licensed standard text is mirrored.","ruleCount":3},{"id":"eu-ai-act","title":"EU Artificial Intelligence Act","publisher":"European Union","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","jurisdiction":"European Union","type":"law","edition":"Regulation 2024/1689; 2026 amendments tracked separately","authority":"binding-within-scope","checkedAt":"2026-10-03","lastVerifiedAt":"2026-10-03","coverage":"partial","reviewStatus":"publisher-text-read","summary":"Provider, deployer or other specified operator; territorial and risk-category scope must be assessed.","limitations":"Selected original-text obligations. AI Omnibus amendments require consolidated clause review; high-risk deadlines follow the Commission timeline. Do not assume every clause is currently applicable.","rights":"Selective original paraphrases; authoritative text remains with publisher.","tags":[],"timelineUrl":"https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai","applicabilityNote":"Commission reports Annex III high-risk rules apply 2027-12-02; Annex I product rules 2028-08-02 after the 2026 AI Omnibus. Original text retained as source edition; clause reconciliation pending.","ruleCount":49,"fingerprint":"4faacfc940d07c320a04fd01df149dd266f3fd7df675842b2d628694508bb589"},{"id":"eu-gdpr","title":"General Data Protection Regulation","publisher":"European Union","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","jurisdiction":"European Union","type":"law","edition":"Regulation 2016/679","authority":"binding-within-scope","checkedAt":"2026-10-03","lastVerifiedAt":"2026-10-03","coverage":"partial","reviewStatus":"publisher-text-read","summary":"Personal-data processing within GDPR material and territorial scope.","limitations":"Selected data-protection obligations relevant to AI; full GDPR and national overlays are not extracted.","rights":"Selective original paraphrases; authoritative text remains with publisher.","tags":[],"ruleCount":22,"fingerprint":"85767c145543fcffff25030496963a6df99affce4c5e494f0207757afe1e98e8"},{"id":"cn-genai-interim","title":"Interim Measures for Generative AI Services","publisher":"Cyberspace Administration of China and six departments","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","jurisdiction":"China","type":"law","edition":"Order 15; effective 2023-08-15","authority":"binding-within-scope","checkedAt":"2026-10-03","lastVerifiedAt":"2026-10-03","coverage":"partial","reviewStatus":"publisher-text-read","summary":"GenAI services offered to the public in mainland China; nonpublic research and enterprise development excluded by Article 2.","limitations":"Selected English paraphrases of Chinese provisions; professional translation and later measures require reconciliation.","rights":"Selective original paraphrases; authoritative text remains with publisher.","tags":[],"ruleCount":26,"fingerprint":"f3a1e4c8093d56999b178a4b5614fb931dd00d1cf6a607a0d8832f32aedcabed"},{"id":"ca-automated-decisions","title":"Directive on Automated Decision-Making","publisher":"Treasury Board of Canada","url":"https://www.tbs-sct.canada.ca/pol/doc-eng.aspx?id=32592","jurisdiction":"Canada federal government","type":"policy","edition":"Modified 2025-06-24","authority":"binding-within-federal-scope","checkedAt":"2026-10-03","lastVerifiedAt":"2026-10-03","coverage":"partial","reviewStatus":"publisher-index-retrieved-direct-fetch-rejected","summary":"Federal administrative decisions; scope and department exemptions apply; research and test-only systems excluded.","limitations":"Indexed search retrieval available; direct publisher fetch rejected. Selected clauses only; Appendix C severity-specific obligations remain unextracted.","rights":"Selective original paraphrases; authoritative text remains with publisher.","tags":[],"ruleCount":9,"fingerprint":"9b20a10c09087ef5d40744e11bbb0f33f0a7e0aad94faa9035b88f600770fb3c"}],"rules":[{"id":"AIR-4DC94000A9","version":2,"title":"AI providers should control the data their AI systems can access.","text":"AI provider should control AI data access.","topic":"Data & IP","intent":"control ai data access","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"cisa-ncsc-secure-ai-development","control":"Secure development / assets","sourceVersion":"1.0","url":"https://www.ncsc.gov.uk/collection/guidelines-secure-ai-system-development/guidelines/secure-development","actor":"AI provider","modality":"should","action":"control","object":"AI data access","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"AI provider follows the recommendation to \"control\" for AI data access within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"AI provider omits the recommended action \"control\" for AI data access. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves AI data access. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: control AI data access.","examples":{"meetsRule":"AI provider follows the recommendation to \"control\" for AI data access within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"AI provider omits the recommended action \"control\" for AI data access. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-AB2476BBAB","version":2,"title":"AI providers should document the lifecycle of models, datasets and system prompts.","text":"AI provider should document model, dataset and prompt lifecycle.","topic":"Data & IP","intent":"document model dataset and prompt lifecycle","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"cisa-ncsc-secure-ai-development","control":"Secure development / documentation","sourceVersion":"1.0","url":"https://www.ncsc.gov.uk/collection/guidelines-secure-ai-system-development/guidelines/secure-development","actor":"AI provider","modality":"should","action":"document","object":"model, dataset and prompt lifecycle","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"AI provider follows the recommendation to \"document\" for model, dataset and prompt lifecycle within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"AI provider omits the recommended action \"document\" for model, dataset and prompt lifecycle. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves model, dataset and prompt lifecycle. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: document model, dataset and prompt lifecycle.","examples":{"meetsRule":"AI provider follows the recommendation to \"document\" for model, dataset and prompt lifecycle within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"AI provider omits the recommended action \"document\" for model, dataset and prompt lifecycle. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-DA02521292","version":2,"title":"Avoid infringing training-data intellectual property","text":"Covered GenAI service providers must avoid infringing training-data intellectual property.","topic":"Data & IP","intent":"avoid infringing training data intellectual property","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"cn-genai-interim","control":"Article 7(2)","sourceVersion":"Order 15; effective 2023-08-15","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","actor":"Covered GenAI service providers","modality":"must","action":"avoid","object":"infringing training-data intellectual property","condition":"Covered training activities","exception":"Article 2 scope and cross-referenced Chinese laws apply","timing":null,"authority":"binding-within-scope","jurisdiction":"China","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"avoid\" for infringing training-data intellectual property within these source conditions: Covered training activities, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"avoid\" for infringing training-data intellectual property while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves infringing training-data intellectual property. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: avoid infringing training-data intellectual property.","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"avoid\" for infringing training-data intellectual property within these source conditions: Covered training activities, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"avoid\" for infringing training-data intellectual property while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-4849919367","version":2,"title":"Complete state and agency GenAI training.","text":"Employees must complete training.","topic":"Data & IP","intent":"complete training","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nc-public-genai","control":"p.5, appropriate use, bullet 1","sourceVersion":"1.1 — April 14, 2026","url":"https://it.nc.gov/documents/use-publicly-available-generative-artificial-intelligence/download?attachment=","actor":"employees","modality":"must","action":"complete","object":"training","condition":"before use","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"North Carolina, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"employees performs the required action \"complete\" for training within these source conditions: before use, and retains evidence.","doesNotMeetRule":"employees omits the required action \"complete\" for training while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves training. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: complete training.","examples":{"meetsRule":"employees performs the required action \"complete\" for training within these source conditions: before use, and retains evidence.","doesNotMeetRule":"employees omits the required action \"complete\" for training while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-727F5459C2","version":2,"title":"Covered agencies must use agency-defined data for independent AI evaluations.","text":"Covered agency must use agency-defined evaluation data.","topic":"Data & IP","intent":"use agency defined evaluation data","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"omb-m-25-22","control":"4(d)(ii)(E)(I)","sourceVersion":"M-25-22","url":"https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-22-Driving-Efficient-Acquisition-of-Artificial-Intelligence-in-Government.pdf#page=10","actor":"Covered agency","modality":"must","action":"use","object":"agency-defined evaluation data","condition":"Independent evaluations","exception":null,"timing":null,"authority":"binding-within-defined-federal-scope","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Covered agency performs the required action \"use\" for agency-defined evaluation data within these source conditions: Independent evaluations, and retains evidence.","doesNotMeetRule":"Covered agency omits the required action \"use\" for agency-defined evaluation data while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves agency-defined evaluation data. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: use agency-defined evaluation data.","examples":{"meetsRule":"Covered agency performs the required action \"use\" for agency-defined evaluation data within these source conditions: Independent evaluations, and retains evidence.","doesNotMeetRule":"Covered agency omits the required action \"use\" for agency-defined evaluation data while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-36FDB9AAD2","version":2,"title":"Create facial recognition databases by untargeted scraping","text":"AI operators must not create facial recognition databases by untargeted scraping.","topic":"Data & IP","intent":"create facial recognition databases by untargeted scraping","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 5(1)(e)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"AI operators","modality":"must not","action":"create","object":"facial recognition databases by untargeted scraping","condition":"Internet or CCTV facial images","exception":"Assess statutory scope","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI operators does not perform the prohibited action \"create\" for facial recognition databases by untargeted scraping while these conditions apply: Internet or CCTV facial images.","doesNotMeetRule":"AI operators performs the prohibited action \"create\" for facial recognition databases by untargeted scraping while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves facial recognition databases by untargeted scraping. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: create facial recognition databases by untargeted scraping.","examples":{"meetsRule":"AI operators does not perform the prohibited action \"create\" for facial recognition databases by untargeted scraping while these conditions apply: Internet or CCTV facial images.","doesNotMeetRule":"AI operators performs the prohibited action \"create\" for facial recognition databases by untargeted scraping while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-8E3444C5DD","version":2,"title":"Demonstrate compliance with data-protection principles","text":"Data controllers must demonstrate compliance with data-protection principles.","topic":"Data & IP","intent":"demonstrate compliance with data protection principles","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-gdpr","control":"Article 5(2)","sourceVersion":"Regulation 2016/679","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","actor":"Data controllers","modality":"must","action":"demonstrate","object":"compliance with data-protection principles","condition":"Controller accountability","exception":"See article-specific exceptions and safeguards","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Data controllers performs the required action \"demonstrate\" for compliance with data-protection principles within these source conditions: Controller accountability, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"demonstrate\" for compliance with data-protection principles while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves compliance with data-protection principles. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: demonstrate compliance with data-protection principles.","examples":{"meetsRule":"Data controllers performs the required action \"demonstrate\" for compliance with data-protection principles within these source conditions: Controller accountability, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"demonstrate\" for compliance with data-protection principles while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-653ED4C38B","version":2,"title":"Determine appropriate software licensing","text":"Responsible senior federal officials must determine appropriate software licensing.","topic":"Data & IP","intent":"determine appropriate software licensing","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"ca-automated-decisions","control":"6.2.4","sourceVersion":"Modified 2025-06-24","url":"https://www.tbs-sct.canada.ca/pol/doc-eng.aspx?id=32592","actor":"Responsible senior federal officials","modality":"must","action":"determine","object":"appropriate software licensing","condition":"Including consideration of open source","exception":"Directive scope and Appendix C apply","timing":null,"authority":"binding-within-federal-scope","jurisdiction":"Canada federal government","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Responsible senior federal officials performs the required action \"determine\" for appropriate software licensing within these source conditions: Including consideration of open source, and retains evidence.","doesNotMeetRule":"Responsible senior federal officials omits the required action \"determine\" for appropriate software licensing while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves appropriate software licensing. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: determine appropriate software licensing.","examples":{"meetsRule":"Responsible senior federal officials performs the required action \"determine\" for appropriate software licensing within these source conditions: Including consideration of open source, and retains evidence.","doesNotMeetRule":"Responsible senior federal officials omits the required action \"determine\" for appropriate software licensing while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-AA8C667747","version":2,"title":"Do not enter Class C data into GenAI.","text":"Users must-not enter Class C data.","topic":"Data & IP","intent":"enter class c data","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"pa-ai-2026","control":"5.2.6.2, p.7","sourceVersion":"Revision January 13, 2026","url":"https://www.pa.gov/content/dam/copapwp-pagov/en/oa/documents/policies/it-policies/artificial%20intelligence%20policy.pdf","actor":"users","modality":"must-not","action":"enter","object":"Class C data","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"Pennsylvania, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"users performs the required action \"enter\" for Class C data within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"users omits the required action \"enter\" for Class C data while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves Class C data. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: enter Class C data.","examples":{"meetsRule":"users performs the required action \"enter\" for Class C data within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"users omits the required action \"enter\" for Class C data while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-ABAA5F0412","version":2,"title":"Document dataset design choices","text":"High-risk AI providers must document dataset design choices.","topic":"Data & IP","intent":"document dataset design choices","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 10(2)(a)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI providers","modality":"must","action":"document","object":"dataset design choices","condition":"Systems trained with data","exception":"Applicable statutory provisions","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI providers performs the required action \"document\" for dataset design choices within these source conditions: Systems trained with data, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"document\" for dataset design choices while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves dataset design choices. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: document dataset design choices.","examples":{"meetsRule":"High-risk AI providers performs the required action \"document\" for dataset design choices within these source conditions: Systems trained with data, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"document\" for dataset design choices while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-584850ADDF","version":2,"title":"Enable data-subject access","text":"Data controllers must enable data-subject access.","topic":"Data & IP","intent":"enable data subject access","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-gdpr","control":"Article 15(1)","sourceVersion":"Regulation 2016/679","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","actor":"Data controllers","modality":"must","action":"enable","object":"data-subject access","condition":"Subject to statutory exceptions","exception":"See article-specific exceptions and safeguards","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Data controllers performs the required action \"enable\" for data-subject access within these source conditions: Subject to statutory exceptions, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"enable\" for data-subject access while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves data-subject access. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: enable data-subject access.","examples":{"meetsRule":"Data controllers performs the required action \"enable\" for data-subject access within these source conditions: Subject to statutory exceptions, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"enable\" for data-subject access while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-0EAF27F441","version":2,"title":"Ensure dataset representativeness","text":"High-risk AI providers must ensure dataset representativeness.","topic":"Data & IP","intent":"ensure dataset representativeness","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 10(3)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI providers","modality":"must","action":"ensure","object":"dataset representativeness","condition":"Intended purpose of high-risk AI","exception":"To the extent applicable","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI providers performs the required action \"ensure\" for dataset representativeness within these source conditions: Intended purpose of high-risk AI, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"ensure\" for dataset representativeness while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves dataset representativeness. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: ensure dataset representativeness.","examples":{"meetsRule":"High-risk AI providers performs the required action \"ensure\" for dataset representativeness within these source conditions: Intended purpose of high-risk AI, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"ensure\" for dataset representativeness while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-2D3230CFEA","version":2,"title":"Ensure relevant input data","text":"High-risk AI deployers must ensure relevant input data.","topic":"Data & IP","intent":"ensure relevant input data","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 26(4)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI deployers","modality":"must","action":"ensure","object":"relevant input data","condition":"Input data under deployer control","exception":"Sufficient representativeness","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI deployers performs the required action \"ensure\" for relevant input data within these source conditions: Input data under deployer control, and retains evidence.","doesNotMeetRule":"High-risk AI deployers omits the required action \"ensure\" for relevant input data while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves relevant input data. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: ensure relevant input data.","examples":{"meetsRule":"High-risk AI deployers performs the required action \"ensure\" for relevant input data within these source conditions: Input data under deployer control, and retains evidence.","doesNotMeetRule":"High-risk AI deployers omits the required action \"ensure\" for relevant input data while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-41D9F2CC95","version":2,"title":"Enter CUI/export-controlled data only into tools formally approved within the research enclave.","text":"Users must use enclave-approved tools.","topic":"Data & IP","intent":"use enclave approved tools","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"msu-genai-guidelines","control":"Non-Permissible Uses, final paragraph","sourceVersion":"Approved August 12, 2025; no revisions listed","url":"https://ai.msu.edu/guidelines","actor":"users","modality":"must","action":"use","object":"enclave-approved tools","condition":"CUI/export-controlled data","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"Michigan State University, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"users performs the required action \"use\" for enclave-approved tools within these source conditions: CUI/export-controlled data, and retains evidence.","doesNotMeetRule":"users omits the required action \"use\" for enclave-approved tools while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves enclave-approved tools. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: use enclave-approved tools.","examples":{"meetsRule":"users performs the required action \"use\" for enclave-approved tools within these source conditions: CUI/export-controlled data, and retains evidence.","doesNotMeetRule":"users omits the required action \"use\" for enclave-approved tools while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-3867F71ADB","version":2,"title":"Evaluate environmental impacts of AI training","text":"AI governance owners should evaluate environmental impacts of AI training.","topic":"Data & IP","intent":"evaluate environmental impacts of ai training","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Measure 2.12","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"evaluate","object":"environmental impacts of AI training","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"evaluate\" for environmental impacts of AI training within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"evaluate\" for environmental impacts of AI training. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves environmental impacts of AI training. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: evaluate environmental impacts of AI training.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"evaluate\" for environmental impacts of AI training within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"evaluate\" for environmental impacts of AI training. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-9A5BD1A87A","version":2,"title":"Implement a copyright-compliance policy","text":"GPAI model providers must implement a copyright-compliance policy.","topic":"Data & IP","intent":"implement a copyright compliance policy","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 53(1)(c)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"GPAI model providers","modality":"must","action":"implement","object":"a copyright-compliance policy","condition":"Covered general-purpose AI models","exception":"Including rights reservations under EU copyright law","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"GPAI model providers performs the required action \"implement\" for a copyright-compliance policy within these source conditions: Covered general-purpose AI models, and retains evidence.","doesNotMeetRule":"GPAI model providers omits the required action \"implement\" for a copyright-compliance policy while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves a copyright-compliance policy. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: implement a copyright-compliance policy.","examples":{"meetsRule":"GPAI model providers performs the required action \"implement\" for a copyright-compliance policy within these source conditions: Covered general-purpose AI models, and retains evidence.","doesNotMeetRule":"GPAI model providers omits the required action \"implement\" for a copyright-compliance policy while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-6BBD510385","version":2,"title":"Implement data protection by design","text":"Data controllers must implement data protection by design.","topic":"Data & IP","intent":"implement data protection by design","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-gdpr","control":"Article 25(1)","sourceVersion":"Regulation 2016/679","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","actor":"Data controllers","modality":"must","action":"implement","object":"data protection by design","condition":"Appropriate to processing risks","exception":"See article-specific exceptions and safeguards","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Data controllers performs the required action \"implement\" for data protection by design within these source conditions: Appropriate to processing risks, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"implement\" for data protection by design while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves data protection by design. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: implement data protection by design.","examples":{"meetsRule":"Data controllers performs the required action \"implement\" for data protection by design within these source conditions: Appropriate to processing risks, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"implement\" for data protection by design while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-19AAD3D220","version":2,"title":"Improve training-data quality","text":"Covered GenAI service providers must improve training-data quality.","topic":"Data & IP","intent":"improve training data quality","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"cn-genai-interim","control":"Article 7(4)","sourceVersion":"Order 15; effective 2023-08-15","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","actor":"Covered GenAI service providers","modality":"must","action":"improve","object":"training-data quality","condition":"Covered training activities","exception":"Article 2 scope and cross-referenced Chinese laws apply","timing":null,"authority":"binding-within-scope","jurisdiction":"China","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"improve\" for training-data quality within these source conditions: Covered training activities, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"improve\" for training-data quality while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves training-data quality. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: improve training-data quality.","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"improve\" for training-data quality within these source conditions: Covered training activities, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"improve\" for training-data quality while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-1C31FD0739","version":2,"title":"Organizations should inventory categories of people whose data they process.","text":"Organization should inventory affected person categories.","topic":"Data & IP","intent":"inventory affected person categories","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-privacy-1","control":"ID.IM-P3","sourceVersion":"CSWP 10 / 1.0","url":"https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.01162020.pdf#page=24","actor":"Organization","modality":"should","action":"inventory","object":"affected person categories","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Organization follows the recommendation to \"inventory\" for affected person categories within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"inventory\" for affected person categories. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves affected person categories. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: inventory affected person categories.","examples":{"meetsRule":"Organization follows the recommendation to \"inventory\" for affected person categories within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"inventory\" for affected person categories. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-A0754F863D","version":2,"title":"Organizations should inventory purposes for data actions.","text":"Organization should inventory data-action purposes.","topic":"Data & IP","intent":"inventory data action purposes","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-privacy-1","control":"ID.IM-P5","sourceVersion":"CSWP 10 / 1.0","url":"https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.01162020.pdf#page=24","actor":"Organization","modality":"should","action":"inventory","object":"data-action purposes","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Organization follows the recommendation to \"inventory\" for data-action purposes within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"inventory\" for data-action purposes. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves data-action purposes. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: inventory data-action purposes.","examples":{"meetsRule":"Organization follows the recommendation to \"inventory\" for data-action purposes within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"inventory\" for data-action purposes. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-32A014BA72","version":2,"title":"Organizations should inventory systems that process data.","text":"Organization should inventory data-processing systems.","topic":"Data & IP","intent":"inventory data processing systems","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-privacy-1","control":"ID.IM-P1","sourceVersion":"CSWP 10 / 1.0","url":"https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.01162020.pdf#page=24","actor":"Organization","modality":"should","action":"inventory","object":"data-processing systems","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Organization follows the recommendation to \"inventory\" for data-processing systems within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"inventory\" for data-processing systems. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves data-processing systems. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: inventory data-processing systems.","examples":{"meetsRule":"Organization follows the recommendation to \"inventory\" for data-processing systems within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"inventory\" for data-processing systems. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-7265A37732","version":2,"title":"Organizations should inventory the data actions performed by their systems.","text":"Organization should inventory system data actions.","topic":"Data & IP","intent":"inventory system data actions","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-privacy-1","control":"ID.IM-P4","sourceVersion":"CSWP 10 / 1.0","url":"https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.01162020.pdf#page=24","actor":"Organization","modality":"should","action":"inventory","object":"system data actions","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Organization follows the recommendation to \"inventory\" for system data actions within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"inventory\" for system data actions. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves system data actions. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: inventory system data actions.","examples":{"meetsRule":"Organization follows the recommendation to \"inventory\" for system data actions within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"inventory\" for system data actions. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-54647B2218","version":2,"title":"Perform a data-protection impact assessment","text":"Data controllers must perform a data-protection impact assessment.","topic":"Data & IP","intent":"perform a data protection impact assessment","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-gdpr","control":"Article 35(1)","sourceVersion":"Regulation 2016/679","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","actor":"Data controllers","modality":"must","action":"perform","object":"a data-protection impact assessment","condition":"Processing likely to create high risk","exception":"See article-specific exceptions and safeguards","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Data controllers performs the required action \"perform\" for a data-protection impact assessment within these source conditions: Processing likely to create high risk, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"perform\" for a data-protection impact assessment while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves a data-protection impact assessment. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: perform a data-protection impact assessment.","examples":{"meetsRule":"Data controllers performs the required action \"perform\" for a data-protection impact assessment within these source conditions: Processing likely to create high risk, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"perform\" for a data-protection impact assessment while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-4FA53D5DDD","version":2,"title":"Publish a training-content summary","text":"GPAI model providers must publish a training-content summary.","topic":"Data & IP","intent":"publish a training content summary","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 53(1)(d)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"GPAI model providers","modality":"must","action":"publish","object":"a training-content summary","condition":"Covered general-purpose AI models","exception":"AI Office template and transition provisions","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"GPAI model providers performs the required action \"publish\" for a training-content summary within these source conditions: Covered general-purpose AI models, and retains evidence.","doesNotMeetRule":"GPAI model providers omits the required action \"publish\" for a training-content summary while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves a training-content summary. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: publish a training-content summary.","examples":{"meetsRule":"GPAI model providers performs the required action \"publish\" for a training-content summary within these source conditions: Covered general-purpose AI models, and retains evidence.","doesNotMeetRule":"GPAI model providers omits the required action \"publish\" for a training-content summary while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-2ABDCD7376","version":2,"title":"Respect intellectual-property rights","text":"Covered GenAI service providers must respect intellectual-property rights.","topic":"Data & IP","intent":"respect intellectual property rights","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"cn-genai-interim","control":"Article 4(3)","sourceVersion":"Order 15; effective 2023-08-15","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","actor":"Covered GenAI service providers","modality":"must","action":"respect","object":"intellectual-property rights","condition":"Covered service use and provision","exception":"Article 2 scope and cross-referenced Chinese laws apply","timing":null,"authority":"binding-within-scope","jurisdiction":"China","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"respect\" for intellectual-property rights within these source conditions: Covered service use and provision, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"respect\" for intellectual-property rights while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves intellectual-property rights. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: respect intellectual-property rights.","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"respect\" for intellectual-property rights within these source conditions: Covered service use and provision, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"respect\" for intellectual-property rights while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-A31D302A1B","version":2,"title":"Retain prompts and input data under records-management requirements.","text":"Agencies must retain inputs.","topic":"Data & IP","intent":"retain inputs","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"pa-ai-2026","control":"5.1.4, p.2","sourceVersion":"Revision January 13, 2026","url":"https://www.pa.gov/content/dam/copapwp-pagov/en/oa/documents/policies/it-policies/artificial%20intelligence%20policy.pdf","actor":"agencies","modality":"must","action":"retain","object":"inputs","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"Pennsylvania, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"agencies performs the required action \"retain\" for inputs within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"agencies omits the required action \"retain\" for inputs while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves inputs. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: retain inputs.","examples":{"meetsRule":"agencies performs the required action \"retain\" for inputs within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"agencies omits the required action \"retain\" for inputs while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-B1B0E054D0","version":2,"title":"Share only public data with public GenAI.","text":"Employees must share public data.","topic":"Data & IP","intent":"share public data","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nc-public-genai","control":"p.5, data sharing, bullets 1–2","sourceVersion":"1.1 — April 14, 2026","url":"https://it.nc.gov/documents/use-publicly-available-generative-artificial-intelligence/download?attachment=","actor":"employees","modality":"must","action":"share","object":"public data","condition":"state work","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"North Carolina, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"employees performs the required action \"share\" for public data within these source conditions: state work, and retains evidence.","doesNotMeetRule":"employees omits the required action \"share\" for public data while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves public data. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: share public data.","examples":{"meetsRule":"employees performs the required action \"share\" for public data within these source conditions: state work, and retains evidence.","doesNotMeetRule":"employees omits the required action \"share\" for public data while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-50088C8736","version":2,"title":"Use lawfully sourced training data","text":"Covered GenAI service providers must use lawfully sourced training data.","topic":"Data & IP","intent":"use lawfully sourced training data","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"cn-genai-interim","control":"Article 7(1)","sourceVersion":"Order 15; effective 2023-08-15","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","actor":"Covered GenAI service providers","modality":"must","action":"use","object":"lawfully sourced training data","condition":"Pretraining and fine-tuning","exception":"Article 2 scope and cross-referenced Chinese laws apply","timing":null,"authority":"binding-within-scope","jurisdiction":"China","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"use\" for lawfully sourced training data within these source conditions: Pretraining and fine-tuning, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"use\" for lawfully sourced training data while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves lawfully sourced training data. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: use lawfully sourced training data.","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"use\" for lawfully sourced training data within these source conditions: Pretraining and fine-tuning, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"use\" for lawfully sourced training data while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-6E435F72F8","version":2,"title":"AI deployers should validate the AI system before deployment.","text":"AI deployer should validate AI system.","topic":"Evaluation","intent":"validate ai system","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nsa-cisa-secure-ai-deployment","control":"Summary / validation","sourceVersion":"April 2024 / 1.0","url":"https://www.cyber.gov.au/business-government/secure-design/artificial-intelligence/deploying-ai-systems-securely","actor":"AI deployer","modality":"should","action":"validate","object":"AI system","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":"Before deployment","authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"AI deployer follows the recommendation to \"validate\" for AI system within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"AI deployer omits the recommended action \"validate\" for AI system. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves AI system. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: validate AI system.","examples":{"meetsRule":"AI deployer follows the recommendation to \"validate\" for AI system within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"AI deployer omits the recommended action \"validate\" for AI system. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-9B67275315","version":2,"title":"Adapt AI measurements to deployment context","text":"AI governance owners should adapt AI measurements to deployment context.","topic":"Evaluation","intent":"adapt ai measurements to deployment context","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Measure 4.1","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"adapt","object":"AI measurements to deployment context","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"adapt\" for AI measurements to deployment context within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"adapt\" for AI measurements to deployment context. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves AI measurements to deployment context. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: adapt AI measurements to deployment context.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"adapt\" for AI measurements to deployment context within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"adapt\" for AI measurements to deployment context. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-1BE3C102BD","version":2,"title":"Chief AI Officers must annually certify that each minimum-practice waiver remains valid.","text":"Chief AI Officer must certify waiver continuing validity.","topic":"Evaluation","intent":"certify waiver continuing validity","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"omb-m-25-21","control":"4(a)(ii)","sourceVersion":"M-25-21","url":"https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-21-Accelerating-Federal-Use-of-AI-through-Innovation-Governance-and-Public-Trust.pdf#page=15","actor":"Chief AI Officer","modality":"must","action":"certify","object":"waiver continuing validity","condition":"In coordination with relevant officials","exception":null,"timing":"Annually","authority":"binding-within-defined-federal-scope","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Chief AI Officer performs the required action \"certify\" for waiver continuing validity within these source conditions: In coordination with relevant officials, and retains evidence.","doesNotMeetRule":"Chief AI Officer omits the required action \"certify\" for waiver continuing validity while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves waiver continuing validity. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: certify waiver continuing validity.","examples":{"meetsRule":"Chief AI Officer performs the required action \"certify\" for waiver continuing validity within these source conditions: In coordination with relevant officials, and retains evidence.","doesNotMeetRule":"Chief AI Officer omits the required action \"certify\" for waiver continuing validity while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-587EDFB2DD","version":2,"title":"Consider risk tracking for difficult-to-measure risks","text":"AI governance owners should consider risk tracking for difficult-to-measure risks.","topic":"Evaluation","intent":"consider risk tracking for difficult to measure risks","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Measure 3.2","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"consider","object":"risk tracking for difficult-to-measure risks","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"consider\" for risk tracking for difficult-to-measure risks within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"consider\" for risk tracking for difficult-to-measure risks. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves risk tracking for difficult-to-measure risks. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: consider risk tracking for difficult-to-measure risks.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"consider\" for risk tracking for difficult-to-measure risks within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"consider\" for risk tracking for difficult-to-measure risks. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-B4750175C0","version":2,"title":"Consider stakeholder input in trustworthiness measurements","text":"AI governance owners should consider stakeholder input in trustworthiness measurements.","topic":"Evaluation","intent":"consider stakeholder input in trustworthiness measurements","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Measure 4.2","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"consider","object":"stakeholder input in trustworthiness measurements","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"consider\" for stakeholder input in trustworthiness measurements within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"consider\" for stakeholder input in trustworthiness measurements. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves stakeholder input in trustworthiness measurements. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: consider stakeholder input in trustworthiness measurements.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"consider\" for stakeholder input in trustworthiness measurements within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"consider\" for stakeholder input in trustworthiness measurements. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-CFAE0A69A5","version":2,"title":"Covered agencies must test proposed AI solutions to the greatest practicable extent.","text":"Covered agency must test proposed AI solutions.","topic":"Evaluation","intent":"test proposed ai solutions","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"omb-m-25-22","control":"4(d)(i)","sourceVersion":"M-25-22","url":"https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-22-Driving-Efficient-Acquisition-of-Artificial-Intelligence-in-Government.pdf#page=9","actor":"Covered agency","modality":"must","action":"test","object":"proposed AI solutions","condition":"During proposal evaluation; practicable extent","exception":null,"timing":null,"authority":"binding-within-defined-federal-scope","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Covered agency performs the required action \"test\" for proposed AI solutions within these source conditions: During proposal evaluation; practicable extent, and retains evidence.","doesNotMeetRule":"Covered agency omits the required action \"test\" for proposed AI solutions while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves proposed AI solutions. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: test proposed AI solutions.","examples":{"meetsRule":"Covered agency performs the required action \"test\" for proposed AI solutions within these source conditions: During proposal evaluation; practicable extent, and retains evidence.","doesNotMeetRule":"Covered agency omits the required action \"test\" for proposed AI solutions while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-33B04C2296","version":2,"title":"Demonstrate AI validity within tested conditions","text":"AI governance owners should demonstrate AI validity within tested conditions.","topic":"Evaluation","intent":"demonstrate ai validity within tested conditions","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Measure 2.5","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"demonstrate","object":"AI validity within tested conditions","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"demonstrate\" for AI validity within tested conditions within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"demonstrate\" for AI validity within tested conditions. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves AI validity within tested conditions. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: demonstrate AI validity within tested conditions.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"demonstrate\" for AI validity within tested conditions within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"demonstrate\" for AI validity within tested conditions. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-F1A3CFC876","version":2,"title":"Document AI test sets and evaluation metrics","text":"AI governance owners should document AI test sets and evaluation metrics.","topic":"Evaluation","intent":"document ai test sets and evaluation metrics","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Measure 2.1","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"document","object":"AI test sets and evaluation metrics","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"document\" for AI test sets and evaluation metrics within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"document\" for AI test sets and evaluation metrics. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves AI test sets and evaluation metrics. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: document AI test sets and evaluation metrics.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"document\" for AI test sets and evaluation metrics within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"document\" for AI test sets and evaluation metrics. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-A271230967","version":2,"title":"Document measurable AI performance changes","text":"AI governance owners should document measurable AI performance changes.","topic":"Evaluation","intent":"document measurable ai performance changes","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Measure 4.3","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"document","object":"measurable AI performance changes","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"document\" for measurable AI performance changes within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"document\" for measurable AI performance changes. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves measurable AI performance changes. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: document measurable AI performance changes.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"document\" for measurable AI performance changes within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"document\" for measurable AI performance changes. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-AD7B04DC9D","version":2,"title":"Evaluate the effectiveness of AI evaluation processes","text":"AI governance owners should evaluate the effectiveness of AI evaluation processes.","topic":"Evaluation","intent":"evaluate the effectiveness of ai evaluation processes","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Measure 2.13","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"evaluate","object":"the effectiveness of AI evaluation processes","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"evaluate\" for the effectiveness of AI evaluation processes within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"evaluate\" for the effectiveness of AI evaluation processes. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves the effectiveness of AI evaluation processes. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: evaluate the effectiveness of AI evaluation processes.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"evaluate\" for the effectiveness of AI evaluation processes within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"evaluate\" for the effectiveness of AI evaluation processes. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-DFA60F69C7","version":2,"title":"Involve independent assessors in AI evaluation","text":"AI governance owners should involve independent assessors in AI evaluation.","topic":"Evaluation","intent":"involve independent assessors in ai evaluation","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Measure 1.3","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"involve","object":"independent assessors in AI evaluation","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"involve\" for independent assessors in AI evaluation within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"involve\" for independent assessors in AI evaluation. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves independent assessors in AI evaluation. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: involve independent assessors in AI evaluation.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"involve\" for independent assessors in AI evaluation within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"involve\" for independent assessors in AI evaluation. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-E80EDA7CD6","version":2,"title":"Measure AI performance under deployment-like conditions","text":"AI governance owners should measure AI performance under deployment-like conditions.","topic":"Evaluation","intent":"measure ai performance under deployment like conditions","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Measure 2.3","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"measure","object":"AI performance under deployment-like conditions","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"measure\" for AI performance under deployment-like conditions within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"measure\" for AI performance under deployment-like conditions. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves AI performance under deployment-like conditions. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: measure AI performance under deployment-like conditions.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"measure\" for AI performance under deployment-like conditions within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"measure\" for AI performance under deployment-like conditions. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-95915B3947","version":2,"title":"Perform model evaluations","text":"Systemic-risk GPAI providers must perform model evaluations.","topic":"Evaluation","intent":"perform model evaluations","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 55(1)(a)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"Systemic-risk GPAI providers","modality":"must","action":"perform","object":"model evaluations","condition":"Covered systemic-risk models","exception":"Applicable statutory provisions","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Systemic-risk GPAI providers performs the required action \"perform\" for model evaluations within these source conditions: Covered systemic-risk models, and retains evidence.","doesNotMeetRule":"Systemic-risk GPAI providers omits the required action \"perform\" for model evaluations while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves model evaluations. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: perform model evaluations.","examples":{"meetsRule":"Systemic-risk GPAI providers performs the required action \"perform\" for model evaluations within these source conditions: Covered systemic-risk models, and retains evidence.","doesNotMeetRule":"Systemic-risk GPAI providers omits the required action \"perform\" for model evaluations while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-1237C81D58","version":2,"title":"Retain rights to test proprietary decision software","text":"Responsible senior federal officials must retain rights to test proprietary decision software.","topic":"Evaluation","intent":"retain rights to test proprietary decision software","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"ca-automated-decisions","control":"6.2.6.1","sourceVersion":"Modified 2025-06-24","url":"https://www.tbs-sct.canada.ca/pol/doc-eng.aspx?id=32592","actor":"Responsible senior federal officials","modality":"must","action":"retain","object":"rights to test proprietary decision software","condition":"Audits, investigations and other specified purposes","exception":"Directive scope and Appendix C apply","timing":null,"authority":"binding-within-federal-scope","jurisdiction":"Canada federal government","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Responsible senior federal officials performs the required action \"retain\" for rights to test proprietary decision software within these source conditions: Audits, investigations and other specified purposes, and retains evidence.","doesNotMeetRule":"Responsible senior federal officials omits the required action \"retain\" for rights to test proprietary decision software while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves rights to test proprietary decision software. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: retain rights to test proprietary decision software.","examples":{"meetsRule":"Responsible senior federal officials performs the required action \"retain\" for rights to test proprietary decision software within these source conditions: Audits, investigations and other specified purposes, and retains evidence.","doesNotMeetRule":"Responsible senior federal officials omits the required action \"retain\" for rights to test proprietary decision software while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-2EBCC14EEF","version":2,"title":"Select metrics for prioritized AI risks","text":"AI governance owners should select metrics for prioritized AI risks.","topic":"Evaluation","intent":"select metrics for prioritized ai risks","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Measure 1.1","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"select","object":"metrics for prioritized AI risks","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"select\" for metrics for prioritized AI risks within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"select\" for metrics for prioritized AI risks. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves metrics for prioritized AI risks. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: select metrics for prioritized AI risks.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"select\" for metrics for prioritized AI risks within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"select\" for metrics for prioritized AI risks. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-ABF5BBD0E9","version":2,"title":"Test risk-management measures","text":"High-risk AI providers must test risk-management measures.","topic":"Evaluation","intent":"test risk management measures","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 9(7)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI providers","modality":"must","action":"test","object":"risk-management measures","condition":"Before placing high-risk systems on the market","exception":"Applicable statutory provisions","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI providers performs the required action \"test\" for risk-management measures within these source conditions: Before placing high-risk systems on the market, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"test\" for risk-management measures while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves risk-management measures. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: test risk-management measures.","examples":{"meetsRule":"High-risk AI providers performs the required action \"test\" for risk-management measures within these source conditions: Before placing high-risk systems on the market, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"test\" for risk-management measures while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-AA1B934A14","version":2,"title":"Covered agencies must include Unbiased AI Principles compliance terms in new LLM solicitations.","text":"Covered agency must include compliance terms.","topic":"Fairness","intent":"include compliance terms","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"omb-m-26-04","control":"Agency Actions (a)","sourceVersion":"M-26-04","url":"https://www.whitehouse.gov/wp-content/uploads/2025/12/M-26-04-Increasing-Public-Trust-in-Artificial-Intelligence-Through-Unbiased-AI-Principles-1.pdf#page=3","actor":"Covered agency","modality":"must","action":"include","object":"compliance terms","condition":"Covered solicitations issued after memorandum","exception":"Scope exclusions; free open-source licenses","timing":null,"authority":"binding-within-defined-federal-scope","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Covered agency performs the required action \"include\" for compliance terms within these source conditions: Covered solicitations issued after memorandum, and retains evidence.","doesNotMeetRule":"Covered agency omits the required action \"include\" for compliance terms while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves compliance terms. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: include compliance terms.","examples":{"meetsRule":"Covered agency performs the required action \"include\" for compliance terms within these source conditions: Covered solicitations issued after memorandum, and retains evidence.","doesNotMeetRule":"Covered agency omits the required action \"include\" for compliance terms while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-9958F2923D","version":2,"title":"Evaluate AI fairness and bias","text":"AI governance owners should evaluate AI fairness and bias.","topic":"Fairness","intent":"evaluate ai fairness and bias","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Measure 2.11","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"evaluate","object":"AI fairness and bias","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"evaluate\" for AI fairness and bias within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"evaluate\" for AI fairness and bias. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves AI fairness and bias. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: evaluate AI fairness and bias.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"evaluate\" for AI fairness and bias within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"evaluate\" for AI fairness and bias. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-0370617F00","version":2,"title":"Examine possible biases in datasets","text":"High-risk AI providers must examine possible biases in datasets.","topic":"Fairness","intent":"examine possible biases in datasets","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 10(2)(f)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI providers","modality":"must","action":"examine","object":"possible biases in datasets","condition":"Training, validation and testing data","exception":"Applicable statutory provisions","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI providers performs the required action \"examine\" for possible biases in datasets within these source conditions: Training, validation and testing data, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"examine\" for possible biases in datasets while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves possible biases in datasets. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: examine possible biases in datasets.","examples":{"meetsRule":"High-risk AI providers performs the required action \"examine\" for possible biases in datasets within these source conditions: Training, validation and testing data, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"examine\" for possible biases in datasets while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-50B746363D","version":2,"title":"Have humans validate outcomes for bias and unintended consequences.","text":"Agencies must validate outcomes.","topic":"Fairness","intent":"validate outcomes","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"va-ai-ea400","control":"p.5, Ethical Use","sourceVersion":"EA400 — June 2026","url":"https://www.vita.virginia.gov/media/vitavirginiagov/it-governance/ea/pdf/Artificial-Intelligence-(AI)-Utilization-Policy.pdf","actor":"agencies","modality":"must","action":"validate","object":"outcomes","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"Virginia, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"agencies performs the required action \"validate\" for outcomes within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"agencies omits the required action \"validate\" for outcomes while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves outcomes. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: validate outcomes.","examples":{"meetsRule":"agencies performs the required action \"validate\" for outcomes within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"agencies omits the required action \"validate\" for outcomes while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-04955B1030","version":2,"title":"Include diverse perspectives in AI risk decisions","text":"AI governance owners should include diverse perspectives in AI risk decisions.","topic":"Fairness","intent":"include diverse perspectives in ai risk decisions","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Govern 3.1","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"include","object":"diverse perspectives in AI risk decisions","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"include\" for diverse perspectives in AI risk decisions within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"include\" for diverse perspectives in AI risk decisions. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves diverse perspectives in AI risk decisions. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: include diverse perspectives in AI risk decisions.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"include\" for diverse perspectives in AI risk decisions within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"include\" for diverse perspectives in AI risk decisions. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-4483D77189","version":2,"title":"Prevent discriminatory generation","text":"Covered GenAI service providers must prevent discriminatory generation.","topic":"Fairness","intent":"prevent discriminatory generation","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"cn-genai-interim","control":"Article 4(2)","sourceVersion":"Order 15; effective 2023-08-15","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","actor":"Covered GenAI service providers","modality":"must","action":"prevent","object":"discriminatory generation","condition":"Algorithm design, training and service provision","exception":"Article 2 scope and cross-referenced Chinese laws apply","timing":null,"authority":"binding-within-scope","jurisdiction":"China","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"prevent\" for discriminatory generation within these source conditions: Algorithm design, training and service provision, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"prevent\" for discriminatory generation while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves discriminatory generation. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: prevent discriminatory generation.","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"prevent\" for discriminatory generation within these source conditions: Algorithm design, training and service provision, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"prevent\" for discriminatory generation while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-3307E11EB9","version":2,"title":"AI deployers should establish protections between the IT environment and AI system.","text":"AI deployer should establish IT/AI boundary protections.","topic":"Governance","intent":"establish it ai boundary protections","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nsa-cisa-secure-ai-deployment","control":"Deployment architecture / boundaries","sourceVersion":"April 2024 / 1.0","url":"https://www.cyber.gov.au/business-government/secure-design/artificial-intelligence/deploying-ai-systems-securely","actor":"AI deployer","modality":"should","action":"establish","object":"IT/AI boundary protections","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"AI deployer follows the recommendation to \"establish\" for IT/AI boundary protections within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"AI deployer omits the recommended action \"establish\" for IT/AI boundary protections. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves IT/AI boundary protections. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: establish IT/AI boundary protections.","examples":{"meetsRule":"AI deployer follows the recommendation to \"establish\" for IT/AI boundary protections within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"AI deployer omits the recommended action \"establish\" for IT/AI boundary protections. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-8566190520","version":2,"title":"AI deployers should require a threat model from the primary developer.","text":"AI deployer should require developer threat model.","topic":"Governance","intent":"require developer threat model","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nsa-cisa-secure-ai-deployment","control":"Deployment governance / threat model","sourceVersion":"April 2024 / 1.0","url":"https://www.cyber.gov.au/business-government/secure-design/artificial-intelligence/deploying-ai-systems-securely","actor":"AI deployer","modality":"should","action":"require","object":"developer threat model","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"AI deployer follows the recommendation to \"require\" for developer threat model within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"AI deployer omits the recommended action \"require\" for developer threat model. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves developer threat model. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: require developer threat model.","examples":{"meetsRule":"AI deployer follows the recommendation to \"require\" for developer threat model within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"AI deployer omits the recommended action \"require\" for developer threat model. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-602BA32576","version":2,"title":"AI deployers should restrict access to model weights.","text":"AI deployer should restrict model-weight access.","topic":"Governance","intent":"restrict model weight access","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nsa-cisa-secure-ai-deployment","control":"Summary / model weights","sourceVersion":"April 2024 / 1.0","url":"https://www.cyber.gov.au/business-government/secure-design/artificial-intelligence/deploying-ai-systems-securely","actor":"AI deployer","modality":"should","action":"restrict","object":"model-weight access","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"AI deployer follows the recommendation to \"restrict\" for model-weight access within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"AI deployer omits the recommended action \"restrict\" for model-weight access. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves model-weight access. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: restrict model-weight access.","examples":{"meetsRule":"AI deployer follows the recommendation to \"restrict\" for model-weight access within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"AI deployer omits the recommended action \"restrict\" for model-weight access. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-08171EB6BD","version":2,"title":"Achieve appropriate AI accuracy","text":"High-risk AI providers must achieve appropriate AI accuracy.","topic":"Governance","intent":"achieve appropriate ai accuracy","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 15(1)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI providers","modality":"must","action":"achieve","object":"appropriate AI accuracy","condition":"Throughout high-risk AI lifecycle","exception":"Applicable statutory provisions","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI providers performs the required action \"achieve\" for appropriate AI accuracy within these source conditions: Throughout high-risk AI lifecycle, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"achieve\" for appropriate AI accuracy while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves appropriate AI accuracy. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: achieve appropriate AI accuracy.","examples":{"meetsRule":"High-risk AI providers performs the required action \"achieve\" for appropriate AI accuracy within these source conditions: Throughout high-risk AI lifecycle, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"achieve\" for appropriate AI accuracy while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-599AAF4DAB","version":2,"title":"Agree service rights and obligations with users","text":"Covered GenAI service providers must agree service rights and obligations with users.","topic":"Governance","intent":"agree service rights and obligations with users","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"cn-genai-interim","control":"Article 9","sourceVersion":"Order 15; effective 2023-08-15","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","actor":"Covered GenAI service providers","modality":"must","action":"agree","object":"service rights and obligations with users","condition":"Registered service users","exception":"Article 2 scope and cross-referenced Chinese laws apply","timing":null,"authority":"binding-within-scope","jurisdiction":"China","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"agree\" for service rights and obligations with users within these source conditions: Registered service users, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"agree\" for service rights and obligations with users while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves service rights and obligations with users. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: agree service rights and obligations with users.","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"agree\" for service rights and obligations with users within these source conditions: Registered service users, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"agree\" for service rights and obligations with users while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-8B82635DEA","version":2,"title":"Apply impact-level requirements from Appendix C","text":"Responsible senior federal officials must apply impact-level requirements from Appendix C.","topic":"Governance","intent":"apply impact level requirements from appendix c","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"ca-automated-decisions","control":"6.1.2","sourceVersion":"Modified 2025-06-24","url":"https://www.tbs-sct.canada.ca/pol/doc-eng.aspx?id=32592","actor":"Responsible senior federal officials","modality":"must","action":"apply","object":"impact-level requirements from Appendix C","condition":"As determined by the assessment","exception":"Directive scope and Appendix C apply","timing":null,"authority":"binding-within-federal-scope","jurisdiction":"Canada federal government","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Responsible senior federal officials performs the required action \"apply\" for impact-level requirements from Appendix C within these source conditions: As determined by the assessment, and retains evidence.","doesNotMeetRule":"Responsible senior federal officials omits the required action \"apply\" for impact-level requirements from Appendix C while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves impact-level requirements from Appendix C. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: apply impact-level requirements from Appendix C.","examples":{"meetsRule":"Responsible senior federal officials performs the required action \"apply\" for impact-level requirements from Appendix C within these source conditions: As determined by the assessment, and retains evidence.","doesNotMeetRule":"Responsible senior federal officials omits the required action \"apply\" for impact-level requirements from Appendix C while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-2C5DD821EE","version":2,"title":"Apply mechanisms to sustain deployed AI value","text":"AI governance owners should apply mechanisms to sustain deployed AI value.","topic":"Governance","intent":"apply mechanisms to sustain deployed ai value","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Manage 2.2","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"apply","object":"mechanisms to sustain deployed AI value","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"apply\" for mechanisms to sustain deployed AI value within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"apply\" for mechanisms to sustain deployed AI value. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves mechanisms to sustain deployed AI value. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: apply mechanisms to sustain deployed AI value.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"apply\" for mechanisms to sustain deployed AI value within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"apply\" for mechanisms to sustain deployed AI value. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-342C0977BB","version":2,"title":"Apply prohibited social scoring","text":"AI operators must not apply prohibited social scoring.","topic":"Governance","intent":"apply prohibited social scoring","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 5(1)(c)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"AI operators","modality":"must not","action":"apply","object":"prohibited social scoring","condition":"Unrelated-context or unjustified adverse treatment","exception":"Statutory elements must all be assessed","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI operators does not perform the prohibited action \"apply\" for prohibited social scoring while these conditions apply: Unrelated-context or unjustified adverse treatment.","doesNotMeetRule":"AI operators performs the prohibited action \"apply\" for prohibited social scoring while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves prohibited social scoring. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: apply prohibited social scoring.","examples":{"meetsRule":"AI operators does not perform the prohibited action \"apply\" for prohibited social scoring while these conditions apply: Unrelated-context or unjustified adverse treatment.","doesNotMeetRule":"AI operators performs the prohibited action \"apply\" for prohibited social scoring while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-AC38374E07","version":2,"title":"Assess fundamental rights impacts","text":"Covered high-risk AI deployers must assess fundamental rights impacts.","topic":"Governance","intent":"assess fundamental rights impacts","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 27(1)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"Covered high-risk AI deployers","modality":"must","action":"assess","object":"fundamental rights impacts","condition":"Specified public bodies and private public-service deployers","exception":"Scope exclusions and applicability date require review","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered high-risk AI deployers performs the required action \"assess\" for fundamental rights impacts within these source conditions: Specified public bodies and private public-service deployers, and retains evidence.","doesNotMeetRule":"Covered high-risk AI deployers omits the required action \"assess\" for fundamental rights impacts while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves fundamental rights impacts. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: assess fundamental rights impacts.","examples":{"meetsRule":"Covered high-risk AI deployers performs the required action \"assess\" for fundamental rights impacts within these source conditions: Specified public bodies and private public-service deployers, and retains evidence.","doesNotMeetRule":"Covered high-risk AI deployers omits the required action \"assess\" for fundamental rights impacts while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-9E7F166E73","version":2,"title":"Assess systemic risks","text":"Systemic-risk GPAI providers must assess systemic risks.","topic":"Governance","intent":"assess systemic risks","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 55(1)(b)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"Systemic-risk GPAI providers","modality":"must","action":"assess","object":"systemic risks","condition":"Covered systemic-risk models","exception":"Applicable statutory provisions","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Systemic-risk GPAI providers performs the required action \"assess\" for systemic risks within these source conditions: Covered systemic-risk models, and retains evidence.","doesNotMeetRule":"Systemic-risk GPAI providers omits the required action \"assess\" for systemic risks while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves systemic risks. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: assess systemic risks.","examples":{"meetsRule":"Systemic-risk GPAI providers performs the required action \"assess\" for systemic risks within these source conditions: Covered systemic-risk models, and retains evidence.","doesNotMeetRule":"Systemic-risk GPAI providers omits the required action \"assess\" for systemic risks while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-4EA78BC0D9","version":2,"title":"Assess the effectiveness of existing AI controls","text":"AI governance owners should assess the effectiveness of existing AI controls.","topic":"Governance","intent":"assess the effectiveness of existing ai controls","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Measure 1.2","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"assess","object":"the effectiveness of existing AI controls","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"assess\" for the effectiveness of existing AI controls within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"assess\" for the effectiveness of existing AI controls. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves the effectiveness of existing AI controls. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: assess the effectiveness of existing AI controls.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"assess\" for the effectiveness of existing AI controls within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"assess\" for the effectiveness of existing AI controls. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-29043D921A","version":2,"title":"Assign executive accountability for AI risk decisions","text":"AI governance owners should assign executive accountability for AI risk decisions.","topic":"Governance","intent":"assign executive accountability for ai risk decisions","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Govern 2.3","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"assign","object":"executive accountability for AI risk decisions","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"assign\" for executive accountability for AI risk decisions within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"assign\" for executive accountability for AI risk decisions. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves executive accountability for AI risk decisions. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: assign executive accountability for AI risk decisions.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"assign\" for executive accountability for AI risk decisions within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"assign\" for executive accountability for AI risk decisions. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-184958056C","version":2,"title":"Avoid prohibited special-category processing","text":"Data controllers must avoid prohibited special-category processing.","topic":"Governance","intent":"avoid prohibited special category processing","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-gdpr","control":"Article 9(1)","sourceVersion":"Regulation 2016/679","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","actor":"Data controllers","modality":"must","action":"avoid","object":"prohibited special-category processing","condition":"Unless an Article 9 exception applies","exception":"See article-specific exceptions and safeguards","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Data controllers performs the required action \"avoid\" for prohibited special-category processing within these source conditions: Unless an Article 9 exception applies, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"avoid\" for prohibited special-category processing while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves prohibited special-category processing. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: avoid prohibited special-category processing.","examples":{"meetsRule":"Data controllers performs the required action \"avoid\" for prohibited special-category processing within these source conditions: Unless an Article 9 exception applies, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"avoid\" for prohibited special-category processing while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-E7F9A07274","version":2,"title":"Collect feedback from affected stakeholders","text":"AI governance owners should collect feedback from affected stakeholders.","topic":"Governance","intent":"collect feedback from affected stakeholders","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Govern 5.1","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"collect","object":"feedback from affected stakeholders","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"collect\" for feedback from affected stakeholders within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"collect\" for feedback from affected stakeholders. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves feedback from affected stakeholders. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: collect feedback from affected stakeholders.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"collect\" for feedback from affected stakeholders within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"collect\" for feedback from affected stakeholders. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-3B0B09F1A3","version":2,"title":"Complete required algorithm filings","text":"Covered GenAI service providers must complete required algorithm filings.","topic":"Governance","intent":"complete required algorithm filings","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"cn-genai-interim","control":"Article 17","sourceVersion":"Order 15; effective 2023-08-15","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","actor":"Covered GenAI service providers","modality":"must","action":"complete","object":"required algorithm filings","condition":"Applicable algorithm-filing provisions","exception":"Article 2 scope and cross-referenced Chinese laws apply","timing":null,"authority":"binding-within-scope","jurisdiction":"China","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"complete\" for required algorithm filings within these source conditions: Applicable algorithm-filing provisions, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"complete\" for required algorithm filings while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves required algorithm filings. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: complete required algorithm filings.","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"complete\" for required algorithm filings within these source conditions: Applicable algorithm-filing provisions, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"complete\" for required algorithm filings while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-F3D285541D","version":2,"title":"Consider viable non-AI alternatives","text":"AI governance owners should consider viable non-AI alternatives.","topic":"Governance","intent":"consider viable non ai alternatives","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Manage 2.1","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"consider","object":"viable non-AI alternatives","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"consider\" for viable non-AI alternatives within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"consider\" for viable non-AI alternatives. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves viable non-AI alternatives. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: consider viable non-AI alternatives.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"consider\" for viable non-AI alternatives within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"consider\" for viable non-AI alternatives. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-242001C9D0","version":2,"title":"Consult IT Services before using MSU credentials for AI products, including free tools.","text":"Users must consult IT Services.","topic":"Governance","intent":"consult it services","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"msu-genai-guidelines","control":"Procuring or Registering, paragraph 2","sourceVersion":"Approved August 12, 2025; no revisions listed","url":"https://ai.msu.edu/guidelines","actor":"users","modality":"must","action":"consult","object":"IT Services","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"Michigan State University, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"users performs the required action \"consult\" for IT Services within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"users omits the required action \"consult\" for IT Services while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves IT Services. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: consult IT Services.","examples":{"meetsRule":"users performs the required action \"consult\" for IT Services within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"users omits the required action \"consult\" for IT Services while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-1003DA2A0B","version":2,"title":"Covered AI information systems must receive agency authorization before deployment.","text":"Covered AI information system must receive authorization to operate.","topic":"Governance","intent":"receive authorization to operate","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"omb-m-25-22","control":"4(e)(i)","sourceVersion":"M-25-22","url":"https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-22-Driving-Efficient-Acquisition-of-Artificial-Intelligence-in-Government.pdf#page=11","actor":"Covered AI information system","modality":"must","action":"receive","object":"authorization to operate","condition":"Operated by or for an agency","exception":null,"timing":"Before deployment","authority":"binding-within-defined-federal-scope","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Covered AI information system performs the required action \"receive\" for authorization to operate within these source conditions: Operated by or for an agency, and retains evidence.","doesNotMeetRule":"Covered AI information system omits the required action \"receive\" for authorization to operate while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves authorization to operate. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: receive authorization to operate.","examples":{"meetsRule":"Covered AI information system performs the required action \"receive\" for authorization to operate within these source conditions: Operated by or for an agency, and retains evidence.","doesNotMeetRule":"Covered AI information system omits the required action \"receive\" for authorization to operate while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-4AD720A286","version":2,"title":"Covered agencies must complete an impact assessment before deploying high-impact AI.","text":"Covered agency must complete AI impact assessment.","topic":"Governance","intent":"complete ai impact assessment","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"omb-m-25-21","control":"4(b)(ii)","sourceVersion":"M-25-21","url":"https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-21-Accelerating-Federal-Use-of-AI-through-Innovation-Governance-and-Public-Trust.pdf#page=16","actor":"Covered agency","modality":"must","action":"complete","object":"AI impact assessment","condition":"High-impact use within §4 scope","exception":"Conditional pilot exemption or CAIO waiver under §4(a)","timing":"Before deployment","authority":"binding-within-defined-federal-scope","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Covered agency performs the required action \"complete\" for AI impact assessment within these source conditions: High-impact use within §4 scope, and retains evidence.","doesNotMeetRule":"Covered agency omits the required action \"complete\" for AI impact assessment while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves AI impact assessment. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: complete AI impact assessment.","examples":{"meetsRule":"Covered agency performs the required action \"complete\" for AI impact assessment within these source conditions: High-impact use within §4 scope, and retains evidence.","doesNotMeetRule":"Covered agency omits the required action \"complete\" for AI impact assessment while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-7939E9BF07","version":2,"title":"Covered agencies must inventory AI use cases at least annually.","text":"Covered agency must inventory AI use cases.","topic":"Governance","intent":"inventory ai use cases","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"omb-m-25-21","control":"3(b)(v)","sourceVersion":"M-25-21","url":"https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-21-Accelerating-Federal-Use-of-AI-through-Innovation-Governance-and-Public-Trust.pdf#page=12","actor":"Covered agency","modality":"must","action":"inventory","object":"AI use cases","condition":"Within the source scope; assess applicability before adoption.","exception":"DoD and Intelligence Community","timing":"At least annually","authority":"binding-within-defined-federal-scope","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Covered agency performs the required action \"inventory\" for AI use cases within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"Covered agency omits the required action \"inventory\" for AI use cases while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves AI use cases. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: inventory AI use cases.","examples":{"meetsRule":"Covered agency performs the required action \"inventory\" for AI use cases within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"Covered agency omits the required action \"inventory\" for AI use cases while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-8EB0EC219E","version":2,"title":"Define operator proficiency requirements","text":"AI governance owners should define operator proficiency requirements.","topic":"Governance","intent":"define operator proficiency requirements","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Map 3.4","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"define","object":"operator proficiency requirements","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"define\" for operator proficiency requirements within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"define\" for operator proficiency requirements. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves operator proficiency requirements. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: define operator proficiency requirements.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"define\" for operator proficiency requirements within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"define\" for operator proficiency requirements. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-B098FE0267","version":2,"title":"Define safe AI decommissioning procedures","text":"AI governance owners should define safe AI decommissioning procedures.","topic":"Governance","intent":"define safe ai decommissioning procedures","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Govern 1.7","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"define","object":"safe AI decommissioning procedures","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"define\" for safe AI decommissioning procedures within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"define\" for safe AI decommissioning procedures. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves safe AI decommissioning procedures. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: define safe AI decommissioning procedures.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"define\" for safe AI decommissioning procedures within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"define\" for safe AI decommissioning procedures. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-E069B1B813","version":2,"title":"Define tasks supported by the AI system","text":"AI governance owners should define tasks supported by the AI system.","topic":"Governance","intent":"define tasks supported by the ai system","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Map 2.1","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"define","object":"tasks supported by the AI system","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"define\" for tasks supported by the AI system within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"define\" for tasks supported by the AI system. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves tasks supported by the AI system. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: define tasks supported by the AI system.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"define\" for tasks supported by the AI system within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"define\" for tasks supported by the AI system. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-260ECC7519","version":2,"title":"Define the business value of AI use","text":"AI governance owners should define the business value of AI use.","topic":"Governance","intent":"define the business value of ai use","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Map 1.4","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"define","object":"the business value of AI use","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"define\" for the business value of AI use within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"define\" for the business value of AI use. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves the business value of AI use. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: define the business value of AI use.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"define\" for the business value of AI use within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"define\" for the business value of AI use. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-1394624FB2","version":2,"title":"Determine risk-management effort based on risk tolerance","text":"AI governance owners should determine risk-management effort based on risk tolerance.","topic":"Governance","intent":"determine risk management effort based on risk tolerance","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Govern 1.3","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"determine","object":"risk-management effort based on risk tolerance","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"determine\" for risk-management effort based on risk tolerance within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"determine\" for risk-management effort based on risk tolerance. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves risk-management effort based on risk tolerance. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: determine risk-management effort based on risk tolerance.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"determine\" for risk-management effort based on risk tolerance within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"determine\" for risk-management effort based on risk tolerance. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-65283B4BFC","version":2,"title":"Determine whether AI deployment should proceed","text":"AI governance owners should determine whether AI deployment should proceed.","topic":"Governance","intent":"determine whether ai deployment should proceed","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Manage 1.1","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"determine","object":"whether AI deployment should proceed","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"determine\" for whether AI deployment should proceed within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"determine\" for whether AI deployment should proceed. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves whether AI deployment should proceed. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: determine whether AI deployment should proceed.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"determine\" for whether AI deployment should proceed within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"determine\" for whether AI deployment should proceed. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-1A04293BCD","version":2,"title":"Do not base academic or grading decisions solely on AI-detection output.","text":"Instructors should-not rely detector output.","topic":"Governance","intent":"rely detector output","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"msu-genai-guidelines","control":"Teaching and Learning, detection paragraph","sourceVersion":"Approved August 12, 2025; no revisions listed","url":"https://ai.msu.edu/guidelines","actor":"instructors","modality":"should-not","action":"rely","object":"detector output","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"Michigan State University, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"instructors performs the required action \"rely\" for detector output within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"instructors omits the required action \"rely\" for detector output while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves detector output. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: rely detector output.","examples":{"meetsRule":"instructors performs the required action \"rely\" for detector output within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"instructors omits the required action \"rely\" for detector output while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-604F1B8C71","version":2,"title":"Do not use state-designated high-risk GenAI tools.","text":"Employees must-not use high-risk tools.","topic":"Governance","intent":"use high risk tools","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nc-public-genai","control":"p.5, appropriate use, bullet 2","sourceVersion":"1.1 — April 14, 2026","url":"https://it.nc.gov/documents/use-publicly-available-generative-artificial-intelligence/download?attachment=","actor":"employees","modality":"must-not","action":"use","object":"high-risk tools","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"North Carolina, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"employees performs the required action \"use\" for high-risk tools within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"employees omits the required action \"use\" for high-risk tools while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves high-risk tools. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: use high-risk tools.","examples":{"meetsRule":"employees performs the required action \"use\" for high-risk tools within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"employees omits the required action \"use\" for high-risk tools while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-6A21A315BB","version":2,"title":"Document AI experimental design considerations","text":"AI governance owners should document AI experimental design considerations.","topic":"Governance","intent":"document ai experimental design considerations","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Map 2.3","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"document","object":"AI experimental design considerations","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"document\" for AI experimental design considerations within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"document\" for AI experimental design considerations. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves AI experimental design considerations. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: document AI experimental design considerations.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"document\" for AI experimental design considerations within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"document\" for AI experimental design considerations. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-7B1A838FFF","version":2,"title":"Document AI knowledge limitations","text":"AI governance owners should document AI knowledge limitations.","topic":"Governance","intent":"document ai knowledge limitations","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Map 2.2","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"document","object":"AI knowledge limitations","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"document\" for AI knowledge limitations within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"document\" for AI knowledge limitations. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves AI knowledge limitations. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: document AI knowledge limitations.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"document\" for AI knowledge limitations within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"document\" for AI knowledge limitations. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-9EE4AB873B","version":2,"title":"Document AI risk tolerance","text":"AI governance owners should document AI risk tolerance.","topic":"Governance","intent":"document ai risk tolerance","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Map 1.5","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"document","object":"AI risk tolerance","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"document\" for AI risk tolerance within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"document\" for AI risk tolerance. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves AI risk tolerance. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: document AI risk tolerance.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"document\" for AI risk tolerance within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"document\" for AI risk tolerance. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-8822957DD8","version":2,"title":"Document AI risk-management responsibilities","text":"AI governance owners should document AI risk-management responsibilities.","topic":"Governance","intent":"document ai risk management responsibilities","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Govern 2.1","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"document","object":"AI risk-management responsibilities","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"document\" for AI risk-management responsibilities within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"document\" for AI risk-management responsibilities. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves AI risk-management responsibilities. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: document AI risk-management responsibilities.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"document\" for AI risk-management responsibilities within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"document\" for AI risk-management responsibilities. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-E477C3290A","version":2,"title":"Document AI risks and potential impacts","text":"AI governance owners should document AI risks and potential impacts.","topic":"Governance","intent":"document ai risks and potential impacts","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Govern 4.2","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"document","object":"AI risks and potential impacts","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"document\" for AI risks and potential impacts within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"document\" for AI risks and potential impacts. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves AI risks and potential impacts. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: document AI risks and potential impacts.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"document\" for AI risks and potential impacts within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"document\" for AI risks and potential impacts. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-5C041B0CCA","version":2,"title":"Document applicable AI legal requirements","text":"AI governance owners should document applicable AI legal requirements.","topic":"Governance","intent":"document applicable ai legal requirements","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Govern 1.1","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"document","object":"applicable AI legal requirements","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"document\" for applicable AI legal requirements within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"document\" for applicable AI legal requirements. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves applicable AI legal requirements. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: document applicable AI legal requirements.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"document\" for applicable AI legal requirements within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"document\" for applicable AI legal requirements. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-F61F6AC2CB","version":2,"title":"Document intended AI use contexts","text":"AI governance owners should document intended AI use contexts.","topic":"Governance","intent":"document intended ai use contexts","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Map 1.1","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"document","object":"intended AI use contexts","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"document\" for intended AI use contexts within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"document\" for intended AI use contexts. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves intended AI use contexts. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: document intended AI use contexts.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"document\" for intended AI use contexts within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"document\" for intended AI use contexts. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-AC404254CF","version":2,"title":"Document internal controls for AI components","text":"AI governance owners should document internal controls for AI components.","topic":"Governance","intent":"document internal controls for ai components","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Map 4.2","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"document","object":"internal controls for AI components","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"document\" for internal controls for AI components within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"document\" for internal controls for AI components. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves internal controls for AI components. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: document internal controls for AI components.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"document\" for internal controls for AI components within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"document\" for internal controls for AI components. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-98C41762F1","version":2,"title":"Document negative residual AI risks","text":"AI governance owners should document negative residual AI risks.","topic":"Governance","intent":"document negative residual ai risks","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Manage 1.4","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"document","object":"negative residual AI risks","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"document\" for negative residual AI risks within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"document\" for negative residual AI risks. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves negative residual AI risks. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: document negative residual AI risks.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"document\" for negative residual AI risks within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"document\" for negative residual AI risks. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-692200D867","version":2,"title":"Document organizational goals for AI","text":"AI governance owners should document organizational goals for AI.","topic":"Governance","intent":"document organizational goals for ai","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Map 1.3","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"document","object":"organizational goals for AI","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"document\" for organizational goals for AI within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"document\" for organizational goals for AI. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves organizational goals for AI. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: document organizational goals for AI.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"document\" for organizational goals for AI within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"document\" for organizational goals for AI. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-4306CEE8C8","version":2,"title":"Document potential benefits of AI functionality","text":"AI governance owners should document potential benefits of AI functionality.","topic":"Governance","intent":"document potential benefits of ai functionality","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Map 3.1","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"document","object":"potential benefits of AI functionality","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"document\" for potential benefits of AI functionality within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"document\" for potential benefits of AI functionality. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves potential benefits of AI functionality. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: document potential benefits of AI functionality.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"document\" for potential benefits of AI functionality within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"document\" for potential benefits of AI functionality. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-DD41393A6A","version":2,"title":"Elicit AI system requirements from stakeholders","text":"AI governance owners should elicit AI system requirements from stakeholders.","topic":"Governance","intent":"elicit ai system requirements from stakeholders","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Map 1.6","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"elicit","object":"AI system requirements from stakeholders","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"elicit\" for AI system requirements from stakeholders within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"elicit\" for AI system requirements from stakeholders. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves AI system requirements from stakeholders. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: elicit AI system requirements from stakeholders.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"elicit\" for AI system requirements from stakeholders within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"elicit\" for AI system requirements from stakeholders. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-C57A5D1D72","version":2,"title":"Enable automatic event logging","text":"High-risk AI providers must enable automatic event logging.","topic":"Governance","intent":"enable automatic event logging","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 12(1)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI providers","modality":"must","action":"enable","object":"automatic event logging","condition":"Covered high-risk systems","exception":"Applicable statutory provisions","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI providers performs the required action \"enable\" for automatic event logging within these source conditions: Covered high-risk systems, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"enable\" for automatic event logging while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves automatic event logging. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: enable automatic event logging.","examples":{"meetsRule":"High-risk AI providers performs the required action \"enable\" for automatic event logging within these source conditions: Covered high-risk systems, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"enable\" for automatic event logging while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-9EC219543F","version":2,"title":"Enable withdrawal of consent","text":"Data controllers must enable withdrawal of consent.","topic":"Governance","intent":"enable withdrawal of consent","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-gdpr","control":"Article 7(3)","sourceVersion":"Regulation 2016/679","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","actor":"Data controllers","modality":"must","action":"enable","object":"withdrawal of consent","condition":"Where consent is the lawful basis","exception":"See article-specific exceptions and safeguards","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Data controllers performs the required action \"enable\" for withdrawal of consent within these source conditions: Where consent is the lawful basis, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"enable\" for withdrawal of consent while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves withdrawal of consent. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: enable withdrawal of consent.","examples":{"meetsRule":"Data controllers performs the required action \"enable\" for withdrawal of consent within these source conditions: Where consent is the lawful basis, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"enable\" for withdrawal of consent while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-6630D57F8E","version":2,"title":"Ensure appropriate AI literacy","text":"Providers and deployers must ensure appropriate AI literacy.","topic":"Governance","intent":"ensure appropriate ai literacy","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 4","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"Providers and deployers","modality":"must","action":"ensure","object":"appropriate AI literacy","condition":"Staff and persons operating AI on their behalf","exception":"Consider technical knowledge, experience, training and context","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Providers and deployers performs the required action \"ensure\" for appropriate AI literacy within these source conditions: Staff and persons operating AI on their behalf, and retains evidence.","doesNotMeetRule":"Providers and deployers omits the required action \"ensure\" for appropriate AI literacy while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves appropriate AI literacy. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: ensure appropriate AI literacy.","examples":{"meetsRule":"Providers and deployers performs the required action \"ensure\" for appropriate AI literacy within these source conditions: Staff and persons operating AI on their behalf, and retains evidence.","doesNotMeetRule":"Providers and deployers omits the required action \"ensure\" for appropriate AI literacy while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-D8C5075D47","version":2,"title":"Ensure resilience to errors and faults","text":"High-risk AI providers must ensure resilience to errors and faults.","topic":"Governance","intent":"ensure resilience to errors and faults","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 15(4)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI providers","modality":"must","action":"ensure","object":"resilience to errors and faults","condition":"Covered high-risk systems","exception":"Appropriate technical measures","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI providers performs the required action \"ensure\" for resilience to errors and faults within these source conditions: Covered high-risk systems, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"ensure\" for resilience to errors and faults while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves resilience to errors and faults. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: ensure resilience to errors and faults.","examples":{"meetsRule":"High-risk AI providers performs the required action \"ensure\" for resilience to errors and faults within these source conditions: Covered high-risk systems, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"ensure\" for resilience to errors and faults while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-96F8E30D4E","version":2,"title":"Establish a post-market monitoring system","text":"High-risk AI providers must establish a post-market monitoring system.","topic":"Governance","intent":"establish a post market monitoring system","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 72(1)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI providers","modality":"must","action":"establish","object":"a post-market monitoring system","condition":"Covered high-risk systems","exception":"Applicability date and scope review required","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI providers performs the required action \"establish\" for a post-market monitoring system within these source conditions: Covered high-risk systems, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"establish\" for a post-market monitoring system while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves a post-market monitoring system. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: establish a post-market monitoring system.","examples":{"meetsRule":"High-risk AI providers performs the required action \"establish\" for a post-market monitoring system within these source conditions: Covered high-risk systems, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"establish\" for a post-market monitoring system while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-2D3F66EE87","version":2,"title":"Establish a quality-management system","text":"High-risk AI providers must establish a quality-management system.","topic":"Governance","intent":"establish a quality management system","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 17(1)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI providers","modality":"must","action":"establish","object":"a quality-management system","condition":"Covered high-risk systems","exception":"Proportionate to provider size","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI providers performs the required action \"establish\" for a quality-management system within these source conditions: Covered high-risk systems, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"establish\" for a quality-management system while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves a quality-management system. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: establish a quality-management system.","examples":{"meetsRule":"High-risk AI providers performs the required action \"establish\" for a quality-management system within these source conditions: Covered high-risk systems, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"establish\" for a quality-management system while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-972D7C9D89","version":2,"title":"Establish an AI risk-management system","text":"High-risk AI providers must establish an AI risk-management system.","topic":"Governance","intent":"establish an ai risk management system","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 9(1)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI providers","modality":"must","action":"establish","object":"an AI risk-management system","condition":"Covered high-risk systems","exception":"Applicability date and scope review required","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI providers performs the required action \"establish\" for an AI risk-management system within these source conditions: Covered high-risk systems, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"establish\" for an AI risk-management system while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves an AI risk-management system. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: establish an AI risk-management system.","examples":{"meetsRule":"High-risk AI providers performs the required action \"establish\" for an AI risk-management system within these source conditions: Covered high-risk systems, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"establish\" for an AI risk-management system while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-22E9FC8F8B","version":2,"title":"Establish complaint and reporting channels","text":"Covered GenAI service providers must establish complaint and reporting channels.","topic":"Governance","intent":"establish complaint and reporting channels","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"cn-genai-interim","control":"Article 15","sourceVersion":"Order 15; effective 2023-08-15","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","actor":"Covered GenAI service providers","modality":"must","action":"establish","object":"complaint and reporting channels","condition":"Covered public services","exception":"Article 2 scope and cross-referenced Chinese laws apply","timing":null,"authority":"binding-within-scope","jurisdiction":"China","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"establish\" for complaint and reporting channels within these source conditions: Covered public services, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"establish\" for complaint and reporting channels while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves complaint and reporting channels. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: establish complaint and reporting channels.","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"establish\" for complaint and reporting channels within these source conditions: Covered public services, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"establish\" for complaint and reporting channels while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-601E866E1A","version":2,"title":"Establish controls against prohibited GAI content","text":"AI governance owners should establish controls against prohibited GAI content.","topic":"Governance","intent":"establish controls against prohibited gai content","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-genai-profile","control":"GV-1.4-001","sourceVersion":"AI 600-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf","actor":"AI governance owners","modality":"should","action":"establish","object":"controls against prohibited GAI content","condition":"Generative AI lifecycle; voluntary suggested action","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"establish\" for controls against prohibited GAI content within these conditions: Generative AI lifecycle; voluntary suggested action.","doesNotMeetRule":"AI governance owners omits the recommended action \"establish\" for controls against prohibited GAI content. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves controls against prohibited GAI content. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: establish controls against prohibited GAI content.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"establish\" for controls against prohibited GAI content within these conditions: Generative AI lifecycle; voluntary suggested action.","doesNotMeetRule":"AI governance owners omits the recommended action \"establish\" for controls against prohibited GAI content. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-6F2EEB6462","version":2,"title":"Establish regular engagement with affected stakeholders","text":"AI governance owners should establish regular engagement with affected stakeholders.","topic":"Governance","intent":"establish regular engagement with affected stakeholders","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Map 5.2","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"establish","object":"regular engagement with affected stakeholders","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"establish\" for regular engagement with affected stakeholders within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"establish\" for regular engagement with affected stakeholders. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves regular engagement with affected stakeholders. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: establish regular engagement with affected stakeholders.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"establish\" for regular engagement with affected stakeholders within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"establish\" for regular engagement with affected stakeholders. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-D4E3A56AB8","version":2,"title":"Estimate likelihood and magnitude of AI impacts","text":"AI governance owners should estimate likelihood and magnitude of AI impacts.","topic":"Governance","intent":"estimate likelihood and magnitude of ai impacts","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Map 5.1","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"estimate","object":"likelihood and magnitude of AI impacts","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"estimate\" for likelihood and magnitude of AI impacts within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"estimate\" for likelihood and magnitude of AI impacts. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves likelihood and magnitude of AI impacts. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: estimate likelihood and magnitude of AI impacts.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"estimate\" for likelihood and magnitude of AI impacts within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"estimate\" for likelihood and magnitude of AI impacts. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-8F9AE0F269","version":2,"title":"Examine potential costs of AI errors","text":"AI governance owners should examine potential costs of AI errors.","topic":"Governance","intent":"examine potential costs of ai errors","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Map 3.2","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"examine","object":"potential costs of AI errors","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"examine\" for potential costs of AI errors within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"examine\" for potential costs of AI errors. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves potential costs of AI errors. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: examine potential costs of AI errors.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"examine\" for potential costs of AI errors within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"examine\" for potential costs of AI errors. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-7F4EB9435F","version":2,"title":"Follow provider instructions for use","text":"High-risk AI deployers must follow provider instructions for use.","topic":"Governance","intent":"follow provider instructions for use","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 26(1)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI deployers","modality":"must","action":"follow","object":"provider instructions for use","condition":"Covered high-risk AI use","exception":"Applicable statutory provisions","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI deployers performs the required action \"follow\" for provider instructions for use within these source conditions: Covered high-risk AI use, and retains evidence.","doesNotMeetRule":"High-risk AI deployers omits the required action \"follow\" for provider instructions for use while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves provider instructions for use. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: follow provider instructions for use.","examples":{"meetsRule":"High-risk AI deployers performs the required action \"follow\" for provider instructions for use within these source conditions: Covered high-risk AI use, and retains evidence.","doesNotMeetRule":"High-risk AI deployers omits the required action \"follow\" for provider instructions for use while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-C1F74ECF84","version":2,"title":"Identify a lawful basis for processing","text":"Data controllers must identify a lawful basis for processing.","topic":"Governance","intent":"identify a lawful basis for processing","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-gdpr","control":"Article 6(1)","sourceVersion":"Regulation 2016/679","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","actor":"Data controllers","modality":"must","action":"identify","object":"a lawful basis for processing","condition":"Before covered processing","exception":"See article-specific exceptions and safeguards","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Data controllers performs the required action \"identify\" for a lawful basis for processing within these source conditions: Before covered processing, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"identify\" for a lawful basis for processing while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves a lawful basis for processing. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: identify a lawful basis for processing.","examples":{"meetsRule":"Data controllers performs the required action \"identify\" for a lawful basis for processing within these source conditions: Before covered processing, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"identify\" for a lawful basis for processing while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-FD9E9E9724","version":2,"title":"Identify reasonably foreseeable AI risks","text":"High-risk AI providers must identify reasonably foreseeable AI risks.","topic":"Governance","intent":"identify reasonably foreseeable ai risks","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 9(2)(a)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI providers","modality":"must","action":"identify","object":"reasonably foreseeable AI risks","condition":"Intended purpose and foreseeable misuse","exception":"Applicability date and scope review required","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI providers performs the required action \"identify\" for reasonably foreseeable AI risks within these source conditions: Intended purpose and foreseeable misuse, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"identify\" for reasonably foreseeable AI risks while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves reasonably foreseeable AI risks. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: identify reasonably foreseeable AI risks.","examples":{"meetsRule":"High-risk AI providers performs the required action \"identify\" for reasonably foreseeable AI risks within these source conditions: Intended purpose and foreseeable misuse, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"identify\" for reasonably foreseeable AI risks while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-9E0C4702D4","version":2,"title":"Implement post-deployment AI monitoring plans","text":"AI governance owners should implement post-deployment AI monitoring plans.","topic":"Governance","intent":"implement post deployment ai monitoring plans","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Manage 4.1","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"implement","object":"post-deployment AI monitoring plans","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"implement\" for post-deployment AI monitoring plans within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"implement\" for post-deployment AI monitoring plans. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves post-deployment AI monitoring plans. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: implement post-deployment AI monitoring plans.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"implement\" for post-deployment AI monitoring plans within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"implement\" for post-deployment AI monitoring plans. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-03619CE6CD","version":2,"title":"Improve accuracy of generated content","text":"Covered GenAI service providers must improve accuracy of generated content.","topic":"Governance","intent":"improve accuracy of generated content","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"cn-genai-interim","control":"Article 4(5)","sourceVersion":"Order 15; effective 2023-08-15","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","actor":"Covered GenAI service providers","modality":"must","action":"improve","object":"accuracy of generated content","condition":"According to service characteristics","exception":"Article 2 scope and cross-referenced Chinese laws apply","timing":null,"authority":"binding-within-scope","jurisdiction":"China","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"improve\" for accuracy of generated content within these source conditions: According to service characteristics, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"improve\" for accuracy of generated content while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves accuracy of generated content. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: improve accuracy of generated content.","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"improve\" for accuracy of generated content within these source conditions: According to service characteristics, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"improve\" for accuracy of generated content while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-A7714C60EE","version":2,"title":"Incorporate adjudicated stakeholder feedback","text":"AI governance owners should incorporate adjudicated stakeholder feedback.","topic":"Governance","intent":"incorporate adjudicated stakeholder feedback","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Govern 5.2","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"incorporate","object":"adjudicated stakeholder feedback","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"incorporate\" for adjudicated stakeholder feedback within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"incorporate\" for adjudicated stakeholder feedback. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves adjudicated stakeholder feedback. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: incorporate adjudicated stakeholder feedback.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"incorporate\" for adjudicated stakeholder feedback within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"incorporate\" for adjudicated stakeholder feedback. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-F306231C79","version":2,"title":"Infer emotions in workplaces or schools","text":"AI operators must not infer emotions in workplaces or schools.","topic":"Governance","intent":"infer emotions in workplaces or schools","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 5(1)(f)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"AI operators","modality":"must not","action":"infer","object":"emotions in workplaces or schools","condition":"Covered emotion recognition systems","exception":"Medical or safety reasons","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI operators does not perform the prohibited action \"infer\" for emotions in workplaces or schools while these conditions apply: Covered emotion recognition systems.","doesNotMeetRule":"AI operators performs the prohibited action \"infer\" for emotions in workplaces or schools while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves emotions in workplaces or schools. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: infer emotions in workplaces or schools.","examples":{"meetsRule":"AI operators does not perform the prohibited action \"infer\" for emotions in workplaces or schools while these conditions apply: Covered emotion recognition systems.","doesNotMeetRule":"AI operators performs the prohibited action \"infer\" for emotions in workplaces or schools while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-FBD73FD1D8","version":2,"title":"Inform affected workers of high-risk AI use","text":"Employer deployers must inform affected workers of high-risk AI use.","topic":"Governance","intent":"inform affected workers of high risk ai use","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 26(7)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"Employer deployers","modality":"must","action":"inform","object":"affected workers of high-risk AI use","condition":"Before workplace use","exception":"National information rights also apply","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Employer deployers performs the required action \"inform\" for affected workers of high-risk AI use within these source conditions: Before workplace use, and retains evidence.","doesNotMeetRule":"Employer deployers omits the required action \"inform\" for affected workers of high-risk AI use while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves affected workers of high-risk AI use. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: inform affected workers of high-risk AI use.","examples":{"meetsRule":"Employer deployers performs the required action \"inform\" for affected workers of high-risk AI use within these source conditions: Before workplace use, and retains evidence.","doesNotMeetRule":"Employer deployers omits the required action \"inform\" for affected workers of high-risk AI use while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-8E51985BF0","version":2,"title":"Inform people before AI makes decisions about them.","text":"Agencies must notify affected people.","topic":"Governance","intent":"notify affected people","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"va-ai-ea400","control":"pp.6–7, AI Disclaimers","sourceVersion":"EA400 — June 2026","url":"https://www.vita.virginia.gov/media/vitavirginiagov/it-governance/ea/pdf/Artificial-Intelligence-(AI)-Utilization-Policy.pdf","actor":"agencies","modality":"must","action":"notify","object":"affected people","condition":"citizen/business impact","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"Virginia, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"agencies performs the required action \"notify\" for affected people within these source conditions: citizen/business impact, and retains evidence.","doesNotMeetRule":"agencies omits the required action \"notify\" for affected people while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves affected people. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: notify affected people.","examples":{"meetsRule":"agencies performs the required action \"notify\" for affected people within these source conditions: citizen/business impact, and retains evidence.","doesNotMeetRule":"agencies omits the required action \"notify\" for affected people while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-B9CECE710F","version":2,"title":"Inform people exposed to emotion recognition","text":"Covered AI deployers must inform people exposed to emotion recognition.","topic":"Governance","intent":"inform people exposed to emotion recognition","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 50(3)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"Covered AI deployers","modality":"must","action":"inform","object":"people exposed to emotion recognition","condition":"Covered systems","exception":"Specific legal exceptions","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered AI deployers performs the required action \"inform\" for people exposed to emotion recognition within these source conditions: Covered systems, and retains evidence.","doesNotMeetRule":"Covered AI deployers omits the required action \"inform\" for people exposed to emotion recognition while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves people exposed to emotion recognition. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: inform people exposed to emotion recognition.","examples":{"meetsRule":"Covered AI deployers performs the required action \"inform\" for people exposed to emotion recognition within these source conditions: Covered systems, and retains evidence.","doesNotMeetRule":"Covered AI deployers omits the required action \"inform\" for people exposed to emotion recognition while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-86AF529571","version":2,"title":"Inform people they are interacting with AI","text":"AI providers must inform people they are interacting with AI.","topic":"Governance","intent":"inform people they are interacting with ai","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 50(1)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"AI providers","modality":"must","action":"inform","object":"people they are interacting with AI","condition":"Direct interaction with natural persons","exception":"Obvious interaction and specified law-enforcement exceptions","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI providers performs the required action \"inform\" for people they are interacting with AI within these source conditions: Direct interaction with natural persons, and retains evidence.","doesNotMeetRule":"AI providers omits the required action \"inform\" for people they are interacting with AI while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves people they are interacting with AI. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: inform people they are interacting with AI.","examples":{"meetsRule":"AI providers performs the required action \"inform\" for people they are interacting with AI within these source conditions: Direct interaction with natural persons, and retains evidence.","doesNotMeetRule":"AI providers omits the required action \"inform\" for people they are interacting with AI while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-04690263D1","version":2,"title":"Integrate continual improvements into AI updates","text":"AI governance owners should integrate continual improvements into AI updates.","topic":"Governance","intent":"integrate continual improvements into ai updates","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Manage 4.2","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"integrate","object":"continual improvements into AI updates","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"integrate\" for continual improvements into AI updates within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"integrate\" for continual improvements into AI updates. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves continual improvements into AI updates. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: integrate continual improvements into AI updates.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"integrate\" for continual improvements into AI updates within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"integrate\" for continual improvements into AI updates. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-E3E35C8AE8","version":2,"title":"Integrate trustworthiness characteristics into AI policies","text":"AI governance owners should integrate trustworthiness characteristics into AI policies.","topic":"Governance","intent":"integrate trustworthiness characteristics into ai policies","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Govern 1.2","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"integrate","object":"trustworthiness characteristics into AI policies","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"integrate\" for trustworthiness characteristics into AI policies within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"integrate\" for trustworthiness characteristics into AI policies. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves trustworthiness characteristics into AI policies. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: integrate trustworthiness characteristics into AI policies.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"integrate\" for trustworthiness characteristics into AI policies within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"integrate\" for trustworthiness characteristics into AI policies. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-9365A6ADE2","version":2,"title":"Inventory organizational AI systems","text":"AI governance owners should inventory organizational AI systems.","topic":"Governance","intent":"inventory organizational ai systems","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Govern 1.6","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"inventory","object":"organizational AI systems","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"inventory\" for organizational AI systems within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"inventory\" for organizational AI systems. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves organizational AI systems. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: inventory organizational AI systems.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"inventory\" for organizational AI systems within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"inventory\" for organizational AI systems. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-6DAA5CD4FD","version":2,"title":"Inventory organizational generative AI systems","text":"AI governance owners should inventory organizational generative AI systems.","topic":"Governance","intent":"inventory organizational generative ai systems","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-genai-profile","control":"GV-1.6-001","sourceVersion":"AI 600-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf","actor":"AI governance owners","modality":"should","action":"inventory","object":"organizational generative AI systems","condition":"Generative AI lifecycle; voluntary suggested action","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"inventory\" for organizational generative AI systems within these conditions: Generative AI lifecycle; voluntary suggested action.","doesNotMeetRule":"AI governance owners omits the recommended action \"inventory\" for organizational generative AI systems. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves organizational generative AI systems. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: inventory organizational generative AI systems.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"inventory\" for organizational generative AI systems within these conditions: Generative AI lifecycle; voluntary suggested action.","doesNotMeetRule":"AI governance owners omits the recommended action \"inventory\" for organizational generative AI systems. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-B43991A570","version":2,"title":"Inventory third parties with access to organizational content","text":"AI governance owners should inventory third parties with access to organizational content.","topic":"Governance","intent":"inventory third parties with access to organizational content","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-genai-profile","control":"GV-6.1-007","sourceVersion":"AI 600-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf","actor":"AI governance owners","modality":"should","action":"inventory","object":"third parties with access to organizational content","condition":"Generative AI lifecycle; voluntary suggested action","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"inventory\" for third parties with access to organizational content within these conditions: Generative AI lifecycle; voluntary suggested action.","doesNotMeetRule":"AI governance owners omits the recommended action \"inventory\" for third parties with access to organizational content. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves third parties with access to organizational content. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: inventory third parties with access to organizational content.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"inventory\" for third parties with access to organizational content within these conditions: Generative AI lifecycle; voluntary suggested action.","doesNotMeetRule":"AI governance owners omits the recommended action \"inventory\" for third parties with access to organizational content. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-D1EC03300E","version":2,"title":"Involve interdisciplinary AI actors in context assessment","text":"AI governance owners should involve interdisciplinary AI actors in context assessment.","topic":"Governance","intent":"involve interdisciplinary ai actors in context assessment","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Map 1.2","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"involve","object":"interdisciplinary AI actors in context assessment","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"involve\" for interdisciplinary AI actors in context assessment within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"involve\" for interdisciplinary AI actors in context assessment. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves interdisciplinary AI actors in context assessment. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: involve interdisciplinary AI actors in context assessment.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"involve\" for interdisciplinary AI actors in context assessment within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"involve\" for interdisciplinary AI actors in context assessment. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-F027EE41CE","version":2,"title":"Limit processing to specified purposes","text":"Data controllers must limit processing to specified purposes.","topic":"Governance","intent":"limit processing to specified purposes","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-gdpr","control":"Article 5(1)(b)","sourceVersion":"Regulation 2016/679","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","actor":"Data controllers","modality":"must","action":"limit","object":"processing to specified purposes","condition":"All covered processing","exception":"See article-specific exceptions and safeguards","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Data controllers performs the required action \"limit\" for processing to specified purposes within these source conditions: All covered processing, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"limit\" for processing to specified purposes while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves processing to specified purposes. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: limit processing to specified purposes.","examples":{"meetsRule":"Data controllers performs the required action \"limit\" for processing to specified purposes within these source conditions: All covered processing, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"limit\" for processing to specified purposes while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-423A77F29F","version":2,"title":"Maintain model technical documentation","text":"GPAI model providers must maintain model technical documentation.","topic":"Governance","intent":"maintain model technical documentation","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 53(1)(a)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"GPAI model providers","modality":"must","action":"maintain","object":"model technical documentation","condition":"Covered general-purpose AI models","exception":"Specified open-source exceptions","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"GPAI model providers performs the required action \"maintain\" for model technical documentation within these source conditions: Covered general-purpose AI models, and retains evidence.","doesNotMeetRule":"GPAI model providers omits the required action \"maintain\" for model technical documentation while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves model technical documentation. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: maintain model technical documentation.","examples":{"meetsRule":"GPAI model providers performs the required action \"maintain\" for model technical documentation within these source conditions: Covered general-purpose AI models, and retains evidence.","doesNotMeetRule":"GPAI model providers omits the required action \"maintain\" for model technical documentation while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-689F104CE2","version":2,"title":"Maintain records of processing activities","text":"Data controllers must maintain records of processing activities.","topic":"Governance","intent":"maintain records of processing activities","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-gdpr","control":"Article 30(1)","sourceVersion":"Regulation 2016/679","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","actor":"Data controllers","modality":"must","action":"maintain","object":"records of processing activities","condition":"Applicable scope and exemptions","exception":"See article-specific exceptions and safeguards","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Data controllers performs the required action \"maintain\" for records of processing activities within these source conditions: Applicable scope and exemptions, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"maintain\" for records of processing activities while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves records of processing activities. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: maintain records of processing activities.","examples":{"meetsRule":"Data controllers performs the required action \"maintain\" for records of processing activities within these source conditions: Applicable scope and exemptions, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"maintain\" for records of processing activities while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-413925FF98","version":2,"title":"Map legal risks of AI components","text":"AI governance owners should map legal risks of AI components.","topic":"Governance","intent":"map legal risks of ai components","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Map 4.1","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"map","object":"legal risks of AI components","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"map\" for legal risks of AI components within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"map\" for legal risks of AI components. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves legal risks of AI components. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: map legal risks of AI components.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"map\" for legal risks of AI components within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"map\" for legal risks of AI components. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-5C96C1D94B","version":2,"title":"Mark generated content in machine-readable form","text":"Synthetic-content AI providers must mark generated content in machine-readable form.","topic":"Governance","intent":"mark generated content in machine readable form","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 50(2)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"Synthetic-content AI providers","modality":"must","action":"mark","object":"generated content in machine-readable form","condition":"Covered synthetic text, audio, images or video","exception":"Standard editing and specified law-enforcement exceptions; transitions apply","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Synthetic-content AI providers performs the required action \"mark\" for generated content in machine-readable form within these source conditions: Covered synthetic text, audio, images or video, and retains evidence.","doesNotMeetRule":"Synthetic-content AI providers omits the required action \"mark\" for generated content in machine-readable form while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves generated content in machine-readable form. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: mark generated content in machine-readable form.","examples":{"meetsRule":"Synthetic-content AI providers performs the required action \"mark\" for generated content in machine-readable form within these source conditions: Covered synthetic text, audio, images or video, and retains evidence.","doesNotMeetRule":"Synthetic-content AI providers omits the required action \"mark\" for generated content in machine-readable form while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-F6290E21EB","version":2,"title":"Monitor AI behavior in production","text":"AI governance owners should monitor AI behavior in production.","topic":"Governance","intent":"monitor ai behavior in production","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Measure 2.4","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"monitor","object":"AI behavior in production","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"monitor\" for AI behavior in production within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"monitor\" for AI behavior in production. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves AI behavior in production. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: monitor AI behavior in production.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"monitor\" for AI behavior in production within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"monitor\" for AI behavior in production. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-20C51AF468","version":2,"title":"Monitor AI operation in accordance with instructions","text":"High-risk AI deployers must monitor AI operation in accordance with instructions.","topic":"Governance","intent":"monitor ai operation in accordance with instructions","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 26(5)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI deployers","modality":"must","action":"monitor","object":"AI operation in accordance with instructions","condition":"Covered high-risk AI use","exception":"Suspend and notify when statutory risk threshold is met","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI deployers performs the required action \"monitor\" for AI operation in accordance with instructions within these source conditions: Covered high-risk AI use, and retains evidence.","doesNotMeetRule":"High-risk AI deployers omits the required action \"monitor\" for AI operation in accordance with instructions while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves AI operation in accordance with instructions. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: monitor AI operation in accordance with instructions.","examples":{"meetsRule":"High-risk AI deployers performs the required action \"monitor\" for AI operation in accordance with instructions within these source conditions: Covered high-risk AI use, and retains evidence.","doesNotMeetRule":"High-risk AI deployers omits the required action \"monitor\" for AI operation in accordance with instructions while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-91B7104B7C","version":2,"title":"Monitor emergent GAI risks","text":"AI governance owners should monitor emergent GAI risks.","topic":"Governance","intent":"monitor emergent gai risks","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-genai-profile","control":"GV-1.5-003","sourceVersion":"AI 600-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf","actor":"AI governance owners","modality":"should","action":"monitor","object":"emergent GAI risks","condition":"Generative AI lifecycle; voluntary suggested action","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"monitor\" for emergent GAI risks within these conditions: Generative AI lifecycle; voluntary suggested action.","doesNotMeetRule":"AI governance owners omits the recommended action \"monitor\" for emergent GAI risks. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves emergent GAI risks. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: monitor emergent GAI risks.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"monitor\" for emergent GAI risks within these conditions: Generative AI lifecycle; voluntary suggested action.","doesNotMeetRule":"AI governance owners omits the recommended action \"monitor\" for emergent GAI risks. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-E86C054724","version":2,"title":"Monitor pre-trained models used in development","text":"AI governance owners should monitor pre-trained models used in development.","topic":"Governance","intent":"monitor pre trained models used in development","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Manage 3.2","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"monitor","object":"pre-trained models used in development","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"monitor\" for pre-trained models used in development within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"monitor\" for pre-trained models used in development. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves pre-trained models used in development. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: monitor pre-trained models used in development.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"monitor\" for pre-trained models used in development within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"monitor\" for pre-trained models used in development. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-8FFA25BD3B","version":2,"title":"Obtain stakeholder input on unacceptable GAI use","text":"AI governance owners should obtain stakeholder input on unacceptable GAI use.","topic":"Governance","intent":"obtain stakeholder input on unacceptable gai use","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-genai-profile","control":"GV-1.3-004","sourceVersion":"AI 600-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf","actor":"AI governance owners","modality":"should","action":"obtain","object":"stakeholder input on unacceptable GAI use","condition":"Generative AI lifecycle; voluntary suggested action","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"obtain\" for stakeholder input on unacceptable GAI use within these conditions: Generative AI lifecycle; voluntary suggested action.","doesNotMeetRule":"AI governance owners omits the recommended action \"obtain\" for stakeholder input on unacceptable GAI use. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves stakeholder input on unacceptable GAI use. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: obtain stakeholder input on unacceptable GAI use.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"obtain\" for stakeholder input on unacceptable GAI use within these conditions: Generative AI lifecycle; voluntary suggested action.","doesNotMeetRule":"AI governance owners omits the recommended action \"obtain\" for stakeholder input on unacceptable GAI use. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-79A1D26388","version":2,"title":"Organizations should enforce approved access permissions for CUI and system resources.","text":"Organization should enforce approved CUI access permissions.","topic":"Governance","intent":"enforce approved cui access permissions","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-800-171-r3","control":"03.01.02","sourceVersion":"SP 800-171 Rev.3","url":"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171r3.pdf#page=18","actor":"Organization","modality":"should","action":"enforce","object":"approved CUI access permissions","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"technical-requirements-when-incorporated","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Organization follows the recommendation to \"enforce\" for approved CUI access permissions within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"enforce\" for approved CUI access permissions. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves approved CUI access permissions. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: enforce approved CUI access permissions.","examples":{"meetsRule":"Organization follows the recommendation to \"enforce\" for approved CUI access permissions within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"enforce\" for approved CUI access permissions. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-D151BEE055","version":2,"title":"Organizations should enforce approved logical-access permissions.","text":"Organization should enforce approved logical-access permissions.","topic":"Governance","intent":"enforce approved logical access permissions","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-800-53-r5","control":"AC-3","sourceVersion":"SP 800-53 Rev.5 / Dec-2020 updates","url":"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf#page=50","actor":"Organization","modality":"should","action":"enforce","object":"approved logical-access permissions","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"technical-controls-when-adopted","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Organization follows the recommendation to \"enforce\" for approved logical-access permissions within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"enforce\" for approved logical-access permissions. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves approved logical-access permissions. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: enforce approved logical-access permissions.","examples":{"meetsRule":"Organization follows the recommendation to \"enforce\" for approved logical-access permissions within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"enforce\" for approved logical-access permissions. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-239800B9C4","version":2,"title":"Organizations should generate log records for continuous monitoring.","text":"Organization should generate monitoring log records.","topic":"Governance","intent":"generate monitoring log records","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-csf-2","control":"PR.PS-04","sourceVersion":"CSWP 29 / 2.0","url":"https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf#page=25","actor":"Organization","modality":"should","action":"generate","object":"monitoring log records","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Organization follows the recommendation to \"generate\" for monitoring log records within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"generate\" for monitoring log records. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves monitoring log records. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: generate monitoring log records.","examples":{"meetsRule":"Organization follows the recommendation to \"generate\" for monitoring log records within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"generate\" for monitoring log records. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-6CFD9FC4BD","version":2,"title":"Organizations should keep inventories of managed software, services and systems current.","text":"Organization should maintain software, service and system inventories.","topic":"Governance","intent":"maintain software service and system inventories","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-csf-2","control":"ID.AM-02","sourceVersion":"CSWP 29 / 2.0","url":"https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf#page=23","actor":"Organization","modality":"should","action":"maintain","object":"software, service and system inventories","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Organization follows the recommendation to \"maintain\" for software, service and system inventories within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"maintain\" for software, service and system inventories. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves software, service and system inventories. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: maintain software, service and system inventories.","examples":{"meetsRule":"Organization follows the recommendation to \"maintain\" for software, service and system inventories within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"maintain\" for software, service and system inventories. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-64615EE538","version":2,"title":"Organizations should keep their managed hardware inventory current.","text":"Organization should maintain managed hardware inventory.","topic":"Governance","intent":"maintain managed hardware inventory","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-csf-2","control":"ID.AM-01","sourceVersion":"CSWP 29 / 2.0","url":"https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf#page=23","actor":"Organization","modality":"should","action":"maintain","object":"managed hardware inventory","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Organization follows the recommendation to \"maintain\" for managed hardware inventory within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"maintain\" for managed hardware inventory. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves managed hardware inventory. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: maintain managed hardware inventory.","examples":{"meetsRule":"Organization follows the recommendation to \"maintain\" for managed hardware inventory within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"maintain\" for managed hardware inventory. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-957F5E0FE9","version":2,"title":"Organizations should limit authorized access to what assigned tasks require.","text":"Organization should limit authorized access.","topic":"Governance","intent":"limit authorized access","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-800-53-r5","control":"AC-6","sourceVersion":"SP 800-53 Rev.5 / Dec-2020 updates","url":"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf#page=63","actor":"Organization","modality":"should","action":"limit","object":"authorized access","condition":"Assigned task needs","exception":null,"timing":null,"authority":"technical-controls-when-adopted","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Organization follows the recommendation to \"limit\" for authorized access within these conditions: Assigned task needs.","doesNotMeetRule":"Organization omits the recommended action \"limit\" for authorized access. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves authorized access. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: limit authorized access.","examples":{"meetsRule":"Organization follows the recommendation to \"limit\" for authorized access within these conditions: Assigned task needs.","doesNotMeetRule":"Organization omits the recommended action \"limit\" for authorized access. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-DD72BC62FE","version":2,"title":"Organizations should permit only authorized access needed for assigned tasks.","text":"Organization should permit task-necessary authorized access.","topic":"Governance","intent":"permit task necessary authorized access","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-800-171-r3","control":"03.01.05(a)","sourceVersion":"SP 800-171 Rev.3","url":"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171r3.pdf#page=20","actor":"Organization","modality":"should","action":"permit","object":"task-necessary authorized access","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"technical-requirements-when-incorporated","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Organization follows the recommendation to \"permit\" for task-necessary authorized access within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"permit\" for task-necessary authorized access. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves task-necessary authorized access. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: permit task-necessary authorized access.","examples":{"meetsRule":"Organization follows the recommendation to \"permit\" for task-necessary authorized access within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"permit\" for task-necessary authorized access. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-2711651405","version":2,"title":"Organizations should prevent nonprivileged users from performing privileged functions.","text":"Organization should prevent nonprivileged execution of privileged functions.","topic":"Governance","intent":"prevent nonprivileged execution of privileged functions","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-800-171-r3","control":"03.01.07(a)","sourceVersion":"SP 800-171 Rev.3","url":"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171r3.pdf#page=21","actor":"Organization","modality":"should","action":"prevent","object":"nonprivileged execution of privileged functions","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"technical-requirements-when-incorporated","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Organization follows the recommendation to \"prevent\" for nonprivileged execution of privileged functions within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"prevent\" for nonprivileged execution of privileged functions. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves nonprivileged execution of privileged functions. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: prevent nonprivileged execution of privileged functions.","examples":{"meetsRule":"Organization follows the recommendation to \"prevent\" for nonprivileged execution of privileged functions within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"prevent\" for nonprivileged execution of privileged functions. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-8014471E79","version":2,"title":"Organizations should prevent unauthorized software execution.","text":"Organization should prevent unauthorized software execution.","topic":"Governance","intent":"prevent unauthorized software execution","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-csf-2","control":"PR.PS-05","sourceVersion":"CSWP 29 / 2.0","url":"https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf#page=25","actor":"Organization","modality":"should","action":"prevent","object":"unauthorized software execution","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Organization follows the recommendation to \"prevent\" for unauthorized software execution within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"prevent\" for unauthorized software execution. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves unauthorized software execution. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: prevent unauthorized software execution.","examples":{"meetsRule":"Organization follows the recommendation to \"prevent\" for unauthorized software execution within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"prevent\" for unauthorized software execution. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-93CD199B6D","version":2,"title":"Organizations should record execution of privileged functions.","text":"Organization should record privileged-function execution.","topic":"Governance","intent":"record privileged function execution","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-800-171-r3","control":"03.01.07(b)","sourceVersion":"SP 800-171 Rev.3","url":"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171r3.pdf#page=21","actor":"Organization","modality":"should","action":"record","object":"privileged-function execution","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"technical-requirements-when-incorporated","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Organization follows the recommendation to \"record\" for privileged-function execution within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"record\" for privileged-function execution. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves privileged-function execution. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: record privileged-function execution.","examples":{"meetsRule":"Organization follows the recommendation to \"record\" for privileged-function execution within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"record\" for privileged-function execution. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-10D05FADF9","version":2,"title":"Plan responses to high-priority AI risks","text":"AI governance owners should plan responses to high-priority AI risks.","topic":"Governance","intent":"plan responses to high priority ai risks","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Manage 1.3","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"plan","object":"responses to high-priority AI risks","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"plan\" for responses to high-priority AI risks within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"plan\" for responses to high-priority AI risks. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves responses to high-priority AI risks. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: plan responses to high-priority AI risks.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"plan\" for responses to high-priority AI risks within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"plan\" for responses to high-priority AI risks. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-DDC1AF69E8","version":2,"title":"Predict criminal offending solely from profiling","text":"AI operators must not predict criminal offending solely from profiling.","topic":"Governance","intent":"predict criminal offending solely from profiling","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 5(1)(d)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"AI operators","modality":"must not","action":"predict","object":"criminal offending solely from profiling","condition":"Individual risk assessments","exception":"Human assessments based on objective verifiable crime facts are excepted","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI operators does not perform the prohibited action \"predict\" for criminal offending solely from profiling while these conditions apply: Individual risk assessments.","doesNotMeetRule":"AI operators performs the prohibited action \"predict\" for criminal offending solely from profiling while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves criminal offending solely from profiling. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: predict criminal offending solely from profiling.","examples":{"meetsRule":"AI operators does not perform the prohibited action \"predict\" for criminal offending solely from profiling while these conditions apply: Individual risk assessments.","doesNotMeetRule":"AI operators performs the prohibited action \"predict\" for criminal offending solely from profiling while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-6C1ECA98A1","version":2,"title":"Prepare technical documentation","text":"High-risk AI providers must prepare technical documentation.","topic":"Governance","intent":"prepare technical documentation","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 11(1)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI providers","modality":"must","action":"prepare","object":"technical documentation","condition":"Before market placement or service","exception":"Simplified forms may apply","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI providers performs the required action \"prepare\" for technical documentation within these source conditions: Before market placement or service, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"prepare\" for technical documentation while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves technical documentation. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: prepare technical documentation.","examples":{"meetsRule":"High-risk AI providers performs the required action \"prepare\" for technical documentation within these source conditions: Before market placement or service, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"prepare\" for technical documentation while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-1AE367EE4E","version":2,"title":"Prevent minors from overreliance on GenAI","text":"Covered GenAI service providers must prevent minors from overreliance on GenAI.","topic":"Governance","intent":"prevent minors from overreliance on genai","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"cn-genai-interim","control":"Article 10","sourceVersion":"Order 15; effective 2023-08-15","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","actor":"Covered GenAI service providers","modality":"must","action":"prevent","object":"minors from overreliance on GenAI","condition":"Covered public services","exception":"Article 2 scope and cross-referenced Chinese laws apply","timing":null,"authority":"binding-within-scope","jurisdiction":"China","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"prevent\" for minors from overreliance on GenAI within these source conditions: Covered public services, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"prevent\" for minors from overreliance on GenAI while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves minors from overreliance on GenAI. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: prevent minors from overreliance on GenAI.","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"prevent\" for minors from overreliance on GenAI within these source conditions: Covered public services, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"prevent\" for minors from overreliance on GenAI while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-8B497F4F74","version":2,"title":"Prioritize treatment of documented AI risks","text":"AI governance owners should prioritize treatment of documented AI risks.","topic":"Governance","intent":"prioritize treatment of documented ai risks","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Manage 1.2","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"prioritize","object":"treatment of documented AI risks","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"prioritize\" for treatment of documented AI risks within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"prioritize\" for treatment of documented AI risks. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves treatment of documented AI risks. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: prioritize treatment of documented AI risks.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"prioritize\" for treatment of documented AI risks within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"prioritize\" for treatment of documented AI risks. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-0156EA65AB","version":2,"title":"Protect against solely automated significant decisions","text":"Data controllers must protect against solely automated significant decisions.","topic":"Governance","intent":"protect against solely automated significant decisions","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-gdpr","control":"Article 22(1)","sourceVersion":"Regulation 2016/679","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","actor":"Data controllers","modality":"must","action":"protect","object":"against solely automated significant decisions","condition":"Subject to Article 22 exceptions and safeguards","exception":"See article-specific exceptions and safeguards","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Data controllers performs the required action \"protect\" for against solely automated significant decisions within these source conditions: Subject to Article 22 exceptions and safeguards, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"protect\" for against solely automated significant decisions while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves against solely automated significant decisions. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: protect against solely automated significant decisions.","examples":{"meetsRule":"Data controllers performs the required action \"protect\" for against solely automated significant decisions within these source conditions: Subject to Article 22 exceptions and safeguards, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"protect\" for against solely automated significant decisions while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-504A6F5FAE","version":2,"title":"Protect user input and usage records","text":"Covered GenAI service providers must protect user input and usage records.","topic":"Governance","intent":"protect user input and usage records","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"cn-genai-interim","control":"Article 11","sourceVersion":"Order 15; effective 2023-08-15","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","actor":"Covered GenAI service providers","modality":"must","action":"protect","object":"user input and usage records","condition":"Covered public services","exception":"Article 2 scope and cross-referenced Chinese laws apply","timing":null,"authority":"binding-within-scope","jurisdiction":"China","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"protect\" for user input and usage records within these source conditions: Covered public services, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"protect\" for user input and usage records while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves user input and usage records. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: protect user input and usage records.","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"protect\" for user input and usage records within these source conditions: Covered public services, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"protect\" for user input and usage records while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-837D00B454","version":2,"title":"Provide documentation to downstream system providers","text":"GPAI model providers must provide documentation to downstream system providers.","topic":"Governance","intent":"provide documentation to downstream system providers","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 53(1)(b)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"GPAI model providers","modality":"must","action":"provide","object":"documentation to downstream system providers","condition":"Covered general-purpose AI models","exception":"Specified open-source exceptions","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"GPAI model providers performs the required action \"provide\" for documentation to downstream system providers within these source conditions: Covered general-purpose AI models, and retains evidence.","doesNotMeetRule":"GPAI model providers omits the required action \"provide\" for documentation to downstream system providers while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves documentation to downstream system providers. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: provide documentation to downstream system providers.","examples":{"meetsRule":"GPAI model providers performs the required action \"provide\" for documentation to downstream system providers within these source conditions: Covered general-purpose AI models, and retains evidence.","doesNotMeetRule":"GPAI model providers omits the required action \"provide\" for documentation to downstream system providers while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-3E2FF36AEB","version":2,"title":"Provide instructions for use","text":"High-risk AI providers must provide instructions for use.","topic":"Governance","intent":"provide instructions for use","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 13(2)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI providers","modality":"must","action":"provide","object":"instructions for use","condition":"Covered high-risk systems","exception":"Applicable statutory provisions","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI providers performs the required action \"provide\" for instructions for use within these source conditions: Covered high-risk systems, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"provide\" for instructions for use while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves instructions for use. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: provide instructions for use.","examples":{"meetsRule":"High-risk AI providers performs the required action \"provide\" for instructions for use within these source conditions: Covered high-risk systems, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"provide\" for instructions for use while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-130AE1C465","version":2,"title":"Provide meaningful explanations of decisions","text":"Responsible senior federal officials must provide meaningful explanations of decisions.","topic":"Governance","intent":"provide meaningful explanations of decisions","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"ca-automated-decisions","control":"6.2.3","sourceVersion":"Modified 2025-06-24","url":"https://www.tbs-sct.canada.ca/pol/doc-eng.aspx?id=32592","actor":"Responsible senior federal officials","modality":"must","action":"provide","object":"meaningful explanations of decisions","condition":"After decisions; Appendix C applies","exception":"Directive scope and Appendix C apply","timing":null,"authority":"binding-within-federal-scope","jurisdiction":"Canada federal government","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Responsible senior federal officials performs the required action \"provide\" for meaningful explanations of decisions within these source conditions: After decisions; Appendix C applies, and retains evidence.","doesNotMeetRule":"Responsible senior federal officials omits the required action \"provide\" for meaningful explanations of decisions while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves meaningful explanations of decisions. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: provide meaningful explanations of decisions.","examples":{"meetsRule":"Responsible senior federal officials performs the required action \"provide\" for meaningful explanations of decisions within these source conditions: After decisions; Appendix C applies, and retains evidence.","doesNotMeetRule":"Responsible senior federal officials omits the required action \"provide\" for meaningful explanations of decisions while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-5E618A5099","version":2,"title":"Provide safe and stable GenAI services","text":"Covered GenAI service providers must provide safe and stable GenAI services.","topic":"Governance","intent":"provide safe and stable genai services","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"cn-genai-interim","control":"Article 13","sourceVersion":"Order 15; effective 2023-08-15","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","actor":"Covered GenAI service providers","modality":"must","action":"provide","object":"safe and stable GenAI services","condition":"Covered public services","exception":"Article 2 scope and cross-referenced Chinese laws apply","timing":null,"authority":"binding-within-scope","jurisdiction":"China","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"provide\" for safe and stable GenAI services within these source conditions: Covered public services, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"provide\" for safe and stable GenAI services while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves safe and stable GenAI services. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: provide safe and stable GenAI services.","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"provide\" for safe and stable GenAI services within these source conditions: Covered public services, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"provide\" for safe and stable GenAI services while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-134DC94A5A","version":2,"title":"Publish an algorithmic impact assessment","text":"Responsible senior federal officials must publish an algorithmic impact assessment.","topic":"Governance","intent":"publish an algorithmic impact assessment","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"ca-automated-decisions","control":"6.1.1","sourceVersion":"Modified 2025-06-24","url":"https://www.tbs-sct.canada.ca/pol/doc-eng.aspx?id=32592","actor":"Responsible senior federal officials","modality":"must","action":"publish","object":"an algorithmic impact assessment","condition":"Before production; accessible Open Government publication","exception":"Directive scope and Appendix C apply","timing":null,"authority":"binding-within-federal-scope","jurisdiction":"Canada federal government","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Responsible senior federal officials performs the required action \"publish\" for an algorithmic impact assessment within these source conditions: Before production; accessible Open Government publication, and retains evidence.","doesNotMeetRule":"Responsible senior federal officials omits the required action \"publish\" for an algorithmic impact assessment while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves an algorithmic impact assessment. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: publish an algorithmic impact assessment.","examples":{"meetsRule":"Responsible senior federal officials performs the required action \"publish\" for an algorithmic impact assessment within these source conditions: Before production; accessible Open Government publication, and retains evidence.","doesNotMeetRule":"Responsible senior federal officials omits the required action \"publish\" for an algorithmic impact assessment while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-687C1F2AA0","version":2,"title":"Publish intended GenAI audiences and uses","text":"Covered GenAI service providers must publish intended GenAI audiences and uses.","topic":"Governance","intent":"publish intended genai audiences and uses","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"cn-genai-interim","control":"Article 10","sourceVersion":"Order 15; effective 2023-08-15","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","actor":"Covered GenAI service providers","modality":"must","action":"publish","object":"intended GenAI audiences and uses","condition":"Covered public services","exception":"Article 2 scope and cross-referenced Chinese laws apply","timing":null,"authority":"binding-within-scope","jurisdiction":"China","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"publish\" for intended GenAI audiences and uses within these source conditions: Covered public services, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"publish\" for intended GenAI audiences and uses while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves intended GenAI audiences and uses. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: publish intended GenAI audiences and uses.","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"publish\" for intended GenAI audiences and uses within these source conditions: Covered public services, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"publish\" for intended GenAI audiences and uses while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-A98A489B02","version":2,"title":"Register with a state employee email address.","text":"Employees must register state email.","topic":"Governance","intent":"register state email","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nc-public-genai","control":"p.5, appropriate use, bullet 4","sourceVersion":"1.1 — April 14, 2026","url":"https://it.nc.gov/documents/use-publicly-available-generative-artificial-intelligence/download?attachment=","actor":"employees","modality":"must","action":"register","object":"state email","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"North Carolina, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"employees performs the required action \"register\" for state email within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"employees omits the required action \"register\" for state email while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves state email. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: register state email.","examples":{"meetsRule":"employees performs the required action \"register\" for state email within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"employees omits the required action \"register\" for state email while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-014E35D5FC","version":2,"title":"Report unlawful content to competent authorities","text":"Covered GenAI service providers must report unlawful content to competent authorities.","topic":"Governance","intent":"report unlawful content to competent authorities","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"cn-genai-interim","control":"Article 14","sourceVersion":"Order 15; effective 2023-08-15","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","actor":"Covered GenAI service providers","modality":"must","action":"report","object":"unlawful content to competent authorities","condition":"When unlawful content is discovered","exception":"Article 2 scope and cross-referenced Chinese laws apply","timing":null,"authority":"binding-within-scope","jurisdiction":"China","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"report\" for unlawful content to competent authorities within these source conditions: When unlawful content is discovered, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"report\" for unlawful content to competent authorities while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves unlawful content to competent authorities. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: report unlawful content to competent authorities.","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"report\" for unlawful content to competent authorities within these source conditions: When unlawful content is discovered, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"report\" for unlawful content to competent authorities while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-A3EACF1A4E","version":2,"title":"Respond to previously unknown AI risks","text":"AI governance owners should respond to previously unknown AI risks.","topic":"Governance","intent":"respond to previously unknown ai risks","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Manage 2.3","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"respond","object":"to previously unknown AI risks","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"respond\" for to previously unknown AI risks within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"respond\" for to previously unknown AI risks. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves to previously unknown AI risks. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: respond to previously unknown AI risks.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"respond\" for to previously unknown AI risks within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"respond\" for to previously unknown AI risks. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-1B927E390F","version":2,"title":"Retain automatically generated logs under their control","text":"High-risk AI providers must retain automatically generated logs under their control.","topic":"Governance","intent":"retain automatically generated logs under their control","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 19(1)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI providers","modality":"must","action":"retain","object":"automatically generated logs under their control","condition":"Covered high-risk systems","exception":"Applicable law and minimum statutory period","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI providers performs the required action \"retain\" for automatically generated logs under their control within these source conditions: Covered high-risk systems, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"retain\" for automatically generated logs under their control while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves automatically generated logs under their control. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: retain automatically generated logs under their control.","examples":{"meetsRule":"High-risk AI providers performs the required action \"retain\" for automatically generated logs under their control within these source conditions: Covered high-risk systems, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"retain\" for automatically generated logs under their control while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-FC504B8B3E","version":2,"title":"Retain required conformity documentation","text":"High-risk AI providers must retain required conformity documentation.","topic":"Governance","intent":"retain required conformity documentation","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 18(1)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI providers","modality":"must","action":"retain","object":"required conformity documentation","condition":"Following market placement","exception":"Retention period and amendments require review","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI providers performs the required action \"retain\" for required conformity documentation within these source conditions: Following market placement, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"retain\" for required conformity documentation while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves required conformity documentation. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: retain required conformity documentation.","examples":{"meetsRule":"High-risk AI providers performs the required action \"retain\" for required conformity documentation within these source conditions: Following market placement, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"retain\" for required conformity documentation while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-AEFB7467B3","version":2,"title":"Safeguard released versions of decision-system software","text":"Responsible senior federal officials must safeguard released versions of decision-system software.","topic":"Governance","intent":"safeguard released versions of decision system software","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"ca-automated-decisions","control":"6.2.5","sourceVersion":"Modified 2025-06-24","url":"https://www.tbs-sct.canada.ca/pol/doc-eng.aspx?id=32592","actor":"Responsible senior federal officials","modality":"must","action":"safeguard","object":"released versions of decision-system software","condition":"All released components","exception":"Directive scope and Appendix C apply","timing":null,"authority":"binding-within-federal-scope","jurisdiction":"Canada federal government","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Responsible senior federal officials performs the required action \"safeguard\" for released versions of decision-system software within these source conditions: All released components, and retains evidence.","doesNotMeetRule":"Responsible senior federal officials omits the required action \"safeguard\" for released versions of decision-system software while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves released versions of decision-system software. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: safeguard released versions of decision-system software.","examples":{"meetsRule":"Responsible senior federal officials performs the required action \"safeguard\" for released versions of decision-system software within these source conditions: All released components, and retains evidence.","doesNotMeetRule":"Responsible senior federal officials omits the required action \"safeguard\" for released versions of decision-system software while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-48A3BA0A96","version":2,"title":"Select processors with sufficient guarantees","text":"Data controllers must select processors with sufficient guarantees.","topic":"Governance","intent":"select processors with sufficient guarantees","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-gdpr","control":"Article 28(1)","sourceVersion":"Regulation 2016/679","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","actor":"Data controllers","modality":"must","action":"select","object":"processors with sufficient guarantees","condition":"Use of processing providers","exception":"See article-specific exceptions and safeguards","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Data controllers performs the required action \"select\" for processors with sufficient guarantees within these source conditions: Use of processing providers, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"select\" for processors with sufficient guarantees while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves processors with sufficient guarantees. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: select processors with sufficient guarantees.","examples":{"meetsRule":"Data controllers performs the required action \"select\" for processors with sufficient guarantees within these source conditions: Use of processing providers, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"select\" for processors with sufficient guarantees while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-7C668908A8","version":2,"title":"Software producers should give acquirers information for verifying release integrity.","text":"Software producer should provide release-integrity verification information.","topic":"Governance","intent":"provide release integrity verification information","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ssdf-1-1","control":"PS.2.1","sourceVersion":"SP 800-218 / SSDF 1.1","url":"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-218.pdf#page=19","actor":"Software producer","modality":"should","action":"provide","object":"release-integrity verification information","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Software producer follows the recommendation to \"provide\" for release-integrity verification information within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Software producer omits the recommended action \"provide\" for release-integrity verification information. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves release-integrity verification information. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: provide release-integrity verification information.","examples":{"meetsRule":"Software producer follows the recommendation to \"provide\" for release-integrity verification information within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Software producer omits the recommended action \"provide\" for release-integrity verification information. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-7AA947C3E4","version":2,"title":"Software producers should store code with access limited by least privilege.","text":"Software producer should store code.","topic":"Governance","intent":"store code","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ssdf-1-1","control":"PS.1.1","sourceVersion":"SP 800-218 / SSDF 1.1","url":"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-218.pdf#page=18","actor":"Software producer","modality":"should","action":"store","object":"code","condition":"Least-privilege access","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Software producer follows the recommendation to \"store\" for code within these conditions: Least-privilege access.","doesNotMeetRule":"Software producer omits the recommended action \"store\" for code. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves code. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: store code.","examples":{"meetsRule":"Software producer follows the recommendation to \"store\" for code within these conditions: Least-privilege access.","doesNotMeetRule":"Software producer omits the recommended action \"store\" for code. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-C25C44E28B","version":2,"title":"Specify the targeted AI application scope","text":"AI governance owners should specify the targeted AI application scope.","topic":"Governance","intent":"specify the targeted ai application scope","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Map 3.3","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"specify","object":"the targeted AI application scope","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"specify\" for the targeted AI application scope within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"specify\" for the targeted AI application scope. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves the targeted AI application scope. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: specify the targeted AI application scope.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"specify\" for the targeted AI application scope within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"specify\" for the targeted AI application scope. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-635250368A","version":2,"title":"Stop generation of unlawful content","text":"Covered GenAI service providers must stop generation of unlawful content.","topic":"Governance","intent":"stop generation of unlawful content","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"cn-genai-interim","control":"Article 14","sourceVersion":"Order 15; effective 2023-08-15","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","actor":"Covered GenAI service providers","modality":"must","action":"stop","object":"generation of unlawful content","condition":"When unlawful content is discovered","exception":"Article 2 scope and cross-referenced Chinese laws apply","timing":null,"authority":"binding-within-scope","jurisdiction":"China","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"stop\" for generation of unlawful content within these source conditions: When unlawful content is discovered, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"stop\" for generation of unlawful content while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves generation of unlawful content. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: stop generation of unlawful content.","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"stop\" for generation of unlawful content within these source conditions: When unlawful content is discovered, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"stop\" for generation of unlawful content while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-DA110B3EF2","version":2,"title":"Take corrective action for nonconforming AI","text":"High-risk AI providers must take corrective action for nonconforming AI.","topic":"Governance","intent":"take corrective action for nonconforming ai","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 20(1)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI providers","modality":"must","action":"take","object":"corrective action for nonconforming AI","condition":"Reason to consider system nonconforming","exception":"Applicable statutory provisions","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI providers performs the required action \"take\" for corrective action for nonconforming AI within these source conditions: Reason to consider system nonconforming, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"take\" for corrective action for nonconforming AI while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves corrective action for nonconforming AI. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: take corrective action for nonconforming AI.","examples":{"meetsRule":"High-risk AI providers performs the required action \"take\" for corrective action for nonconforming AI within these source conditions: Reason to consider system nonconforming, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"take\" for corrective action for nonconforming AI while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-C8E01637B6","version":2,"title":"Tell customers when they interact with agency AI.","text":"Agencies must disclose AI interaction.","topic":"Governance","intent":"disclose ai interaction","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"pa-ai-2026","control":"5.1.5, p.2","sourceVersion":"Revision January 13, 2026","url":"https://www.pa.gov/content/dam/copapwp-pagov/en/oa/documents/policies/it-policies/artificial%20intelligence%20policy.pdf","actor":"agencies","modality":"must","action":"disclose","object":"AI interaction","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"Pennsylvania, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"agencies performs the required action \"disclose\" for AI interaction within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"agencies omits the required action \"disclose\" for AI interaction while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves AI interaction. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: disclose AI interaction.","examples":{"meetsRule":"agencies performs the required action \"disclose\" for AI interaction within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"agencies omits the required action \"disclose\" for AI interaction while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-E4C9EA7E18","version":2,"title":"Track emerging AI risks","text":"AI governance owners should track emerging AI risks.","topic":"Governance","intent":"track emerging ai risks","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Measure 3.1","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"track","object":"emerging AI risks","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"track\" for emerging AI risks within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"track\" for emerging AI risks. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves emerging AI risks. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: track emerging AI risks.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"track\" for emerging AI risks within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"track\" for emerging AI risks. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-E528E1DA42","version":2,"title":"Train personnel in their AI risk responsibilities","text":"AI governance owners should train personnel in their AI risk responsibilities.","topic":"Governance","intent":"train personnel in their ai risk responsibilities","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Govern 2.2","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"train","object":"personnel in their AI risk responsibilities","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"train\" for personnel in their AI risk responsibilities within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"train\" for personnel in their AI risk responsibilities. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves personnel in their AI risk responsibilities. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: train personnel in their AI risk responsibilities.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"train\" for personnel in their AI risk responsibilities within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"train\" for personnel in their AI risk responsibilities. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-0BD6CF8CF8","version":2,"title":"Update published algorithmic impact assessments","text":"Responsible senior federal officials must update published algorithmic impact assessments.","topic":"Governance","intent":"update published algorithmic impact assessments","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"ca-automated-decisions","control":"6.1.3","sourceVersion":"Modified 2025-06-24","url":"https://www.tbs-sct.canada.ca/pol/doc-eng.aspx?id=32592","actor":"Responsible senior federal officials","modality":"must","action":"update","object":"published algorithmic impact assessments","condition":"Scheduled review and functionality or scope changes","exception":"Directive scope and Appendix C apply","timing":null,"authority":"binding-within-federal-scope","jurisdiction":"Canada federal government","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Responsible senior federal officials performs the required action \"update\" for published algorithmic impact assessments within these source conditions: Scheduled review and functionality or scope changes, and retains evidence.","doesNotMeetRule":"Responsible senior federal officials omits the required action \"update\" for published algorithmic impact assessments while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves published algorithmic impact assessments. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: update published algorithmic impact assessments.","examples":{"meetsRule":"Responsible senior federal officials performs the required action \"update\" for published algorithmic impact assessments within these source conditions: Scheduled review and functionality or scope changes, and retains evidence.","doesNotMeetRule":"Responsible senior federal officials omits the required action \"update\" for published algorithmic impact assessments while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-5F6922C679","version":2,"title":"Use GenAI for coursework only with instructor permission.","text":"Students must obtain permission.","topic":"Governance","intent":"obtain permission","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"msu-genai-guidelines","control":"Teaching and Learning, opening paragraph","sourceVersion":"Approved August 12, 2025; no revisions listed","url":"https://ai.msu.edu/guidelines","actor":"students","modality":"must","action":"obtain","object":"permission","condition":"coursework","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"Michigan State University, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"students performs the required action \"obtain\" for permission within these source conditions: coursework, and retains evidence.","doesNotMeetRule":"students omits the required action \"obtain\" for permission while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves permission. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: obtain permission.","examples":{"meetsRule":"students performs the required action \"obtain\" for permission within these source conditions: coursework, and retains evidence.","doesNotMeetRule":"students omits the required action \"obtain\" for permission while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-32BF4E5A3E","version":2,"title":"Use only approved Commonwealth enterprise GenAI tools.","text":"Users must use approved tools.","topic":"Governance","intent":"use approved tools","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"pa-ai-2026","control":"5.2, p.5","sourceVersion":"Revision January 13, 2026","url":"https://www.pa.gov/content/dam/copapwp-pagov/en/oa/documents/policies/it-policies/artificial%20intelligence%20policy.pdf","actor":"users","modality":"must","action":"use","object":"approved tools","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"Pennsylvania, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"users performs the required action \"use\" for approved tools within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"users omits the required action \"use\" for approved tools while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}},{"sourceId":"harvard-genai-guidelines","control":"Protect confidential data, paragraph 2","sourceVersion":"Edition unspecified; prepared index checked 2026-09-28","url":"https://www.huit.harvard.edu/ai/guidelines","actor":"users","modality":"must","action":"use","object":"approved tools","condition":"Harvard confidential data","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"Harvard University, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"users performs the required action \"use\" for approved tools within these source conditions: Harvard confidential data, and retains evidence.","doesNotMeetRule":"users omits the required action \"use\" for approved tools while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves approved tools. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: use approved tools.","examples":{"meetsRule":"users performs the required action \"use\" for approved tools within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"users omits the required action \"use\" for approved tools while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-1BD7B65A31","version":2,"title":"Use town credentials for official approved-tool access.","text":"Users must use town credentials.","topic":"Governance","intent":"use town credentials","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"brookline-genai","control":"Use, bullet 2","sourceVersion":"1.7 — August 2025","url":"https://www.brooklinema.gov/3975/Generative-AI-Use","actor":"users","modality":"must","action":"use","object":"town credentials","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"Brookline, Massachusetts, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"users performs the required action \"use\" for town credentials within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"users omits the required action \"use\" for town credentials while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves town credentials. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: use town credentials.","examples":{"meetsRule":"users performs the required action \"use\" for town credentials within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"users omits the required action \"use\" for town credentials while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-FED5F6D978","version":2,"title":"Apply human-subject protections in AI evaluation","text":"AI governance owners should apply human-subject protections in AI evaluation.","topic":"Human oversight","intent":"apply human subject protections in ai evaluation","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Measure 2.2","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"apply","object":"human-subject protections in AI evaluation","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"apply\" for human-subject protections in AI evaluation within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"apply\" for human-subject protections in AI evaluation. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves human-subject protections in AI evaluation. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: apply human-subject protections in AI evaluation.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"apply\" for human-subject protections in AI evaluation within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"apply\" for human-subject protections in AI evaluation. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-E59A08E459","version":2,"title":"Assign human oversight to competent personnel","text":"High-risk AI deployers must assign human oversight to competent personnel.","topic":"Human oversight","intent":"assign human oversight to competent personnel","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 26(2)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI deployers","modality":"must","action":"assign","object":"human oversight to competent personnel","condition":"Covered high-risk AI use","exception":"Necessary training and authority","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI deployers performs the required action \"assign\" for human oversight to competent personnel within these source conditions: Covered high-risk AI use, and retains evidence.","doesNotMeetRule":"High-risk AI deployers omits the required action \"assign\" for human oversight to competent personnel while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves human oversight to competent personnel. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: assign human oversight to competent personnel.","examples":{"meetsRule":"High-risk AI deployers performs the required action \"assign\" for human oversight to competent personnel within these source conditions: Covered high-risk AI use, and retains evidence.","doesNotMeetRule":"High-risk AI deployers omits the required action \"assign\" for human oversight to competent personnel while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-E98925E526","version":2,"title":"Define human oversight processes","text":"AI governance owners should define human oversight processes.","topic":"Human oversight","intent":"define human oversight processes","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Map 3.5","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"define","object":"human oversight processes","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"define\" for human oversight processes within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"define\" for human oversight processes. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves human oversight processes. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: define human oversight processes.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"define\" for human oversight processes within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"define\" for human oversight processes. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-2FB9BEA395","version":2,"title":"Define human oversight responsibilities","text":"AI governance owners should define human oversight responsibilities.","topic":"Human oversight","intent":"define human oversight responsibilities","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Govern 3.2","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"define","object":"human oversight responsibilities","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"define\" for human oversight responsibilities within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"define\" for human oversight responsibilities. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves human oversight responsibilities. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: define human oversight responsibilities.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"define\" for human oversight responsibilities within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"define\" for human oversight responsibilities. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-4D850F7FFA","version":2,"title":"Document AI models for review.","text":"Agencies must document models.","topic":"Human oversight","intent":"document models","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"va-ai-ea400","control":"p.5, Ethical Use","sourceVersion":"EA400 — June 2026","url":"https://www.vita.virginia.gov/media/vitavirginiagov/it-governance/ea/pdf/Artificial-Intelligence-(AI)-Utilization-Policy.pdf","actor":"agencies","modality":"must","action":"document","object":"models","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"Virginia, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"agencies performs the required action \"document\" for models within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"agencies omits the required action \"document\" for models while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves models. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: document models.","examples":{"meetsRule":"agencies performs the required action \"document\" for models within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"agencies omits the required action \"document\" for models while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-9F0606F820","version":2,"title":"Enable effective human oversight","text":"High-risk AI providers must enable effective human oversight.","topic":"Human oversight","intent":"enable effective human oversight","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 14(1)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI providers","modality":"must","action":"enable","object":"effective human oversight","condition":"During system use","exception":"Appropriate to risks and autonomy","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI providers performs the required action \"enable\" for effective human oversight within these source conditions: During system use, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"enable\" for effective human oversight while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves effective human oversight. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: enable effective human oversight.","examples":{"meetsRule":"High-risk AI providers performs the required action \"enable\" for effective human oversight within these source conditions: During system use, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"enable\" for effective human oversight while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-BF19955A9B","version":2,"title":"Enable oversight personnel to disregard AI output","text":"High-risk AI providers must enable oversight personnel to disregard AI output.","topic":"Human oversight","intent":"enable oversight personnel to disregard ai output","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 14(4)(d)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI providers","modality":"must","action":"enable","object":"oversight personnel to disregard AI output","condition":"When overseeing high-risk AI","exception":"Applicable statutory provisions","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI providers performs the required action \"enable\" for oversight personnel to disregard AI output within these source conditions: When overseeing high-risk AI, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"enable\" for oversight personnel to disregard AI output while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves oversight personnel to disregard AI output. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: enable oversight personnel to disregard AI output.","examples":{"meetsRule":"High-risk AI providers performs the required action \"enable\" for oversight personnel to disregard AI output within these source conditions: When overseeing high-risk AI, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"enable\" for oversight personnel to disregard AI output while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-72DBAB9908","version":2,"title":"Enable oversight personnel to interpret AI outputs appropriately","text":"High-risk AI providers must enable oversight personnel to interpret AI outputs appropriately.","topic":"Human oversight","intent":"enable oversight personnel to interpret ai outputs appropriately","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 14(4)(c)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI providers","modality":"must","action":"enable","object":"oversight personnel to interpret AI outputs appropriately","condition":"When overseeing high-risk AI","exception":"According to available tools","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI providers performs the required action \"enable\" for oversight personnel to interpret AI outputs appropriately within these source conditions: When overseeing high-risk AI, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"enable\" for oversight personnel to interpret AI outputs appropriately while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves oversight personnel to interpret AI outputs appropriately. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: enable oversight personnel to interpret AI outputs appropriately.","examples":{"meetsRule":"High-risk AI providers performs the required action \"enable\" for oversight personnel to interpret AI outputs appropriately within these source conditions: When overseeing high-risk AI, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"enable\" for oversight personnel to interpret AI outputs appropriately while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-0865D3E990","version":2,"title":"Enable oversight personnel to interrupt high-risk AI","text":"High-risk AI providers must enable oversight personnel to interrupt high-risk AI.","topic":"Human oversight","intent":"enable oversight personnel to interrupt high risk ai","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 14(4)(e)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI providers","modality":"must","action":"enable","object":"oversight personnel to interrupt high-risk AI","condition":"When overseeing high-risk AI","exception":"Safe stop procedure","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI providers performs the required action \"enable\" for oversight personnel to interrupt high-risk AI within these source conditions: When overseeing high-risk AI, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"enable\" for oversight personnel to interrupt high-risk AI while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves oversight personnel to interrupt high-risk AI. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: enable oversight personnel to interrupt high-risk AI.","examples":{"meetsRule":"High-risk AI providers performs the required action \"enable\" for oversight personnel to interrupt high-risk AI within these source conditions: When overseeing high-risk AI, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"enable\" for oversight personnel to interrupt high-risk AI while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-E0CAD3FF88","version":2,"title":"Establish GAI deployment approval thresholds","text":"AI governance owners should establish GAI deployment approval thresholds.","topic":"Human oversight","intent":"establish gai deployment approval thresholds","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-genai-profile","control":"GV-1.3-002","sourceVersion":"AI 600-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf","actor":"AI governance owners","modality":"should","action":"establish","object":"GAI deployment approval thresholds","condition":"Generative AI lifecycle; voluntary suggested action","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"establish\" for GAI deployment approval thresholds within these conditions: Generative AI lifecycle; voluntary suggested action.","doesNotMeetRule":"AI governance owners omits the recommended action \"establish\" for GAI deployment approval thresholds. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves GAI deployment approval thresholds. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: establish GAI deployment approval thresholds.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"establish\" for GAI deployment approval thresholds within these conditions: Generative AI lifecycle; voluntary suggested action.","doesNotMeetRule":"AI governance owners omits the recommended action \"establish\" for GAI deployment approval thresholds. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-6E499BCE84","version":2,"title":"Establish mechanisms to appeal AI outcomes","text":"AI governance owners should establish mechanisms to appeal AI outcomes.","topic":"Human oversight","intent":"establish mechanisms to appeal ai outcomes","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Measure 3.3","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"establish","object":"mechanisms to appeal AI outcomes","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"establish\" for mechanisms to appeal AI outcomes within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"establish\" for mechanisms to appeal AI outcomes. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves mechanisms to appeal AI outcomes. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: establish mechanisms to appeal AI outcomes.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"establish\" for mechanisms to appeal AI outcomes within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"establish\" for mechanisms to appeal AI outcomes. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-4045E1AF90","version":2,"title":"List available appeal options for external AI decisions.","text":"Agencies must list appeal options.","topic":"Human oversight","intent":"list appeal options","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"va-ai-ea400","control":"p.7, Transparency Requirements","sourceVersion":"EA400 — June 2026","url":"https://www.vita.virginia.gov/media/vitavirginiagov/it-governance/ea/pdf/Artificial-Intelligence-(AI)-Utilization-Policy.pdf","actor":"agencies","modality":"must","action":"list","object":"appeal options","condition":"external decisions","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"Virginia, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"agencies performs the required action \"list\" for appeal options within these source conditions: external decisions, and retains evidence.","doesNotMeetRule":"agencies omits the required action \"list\" for appeal options while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves appeal options. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: list appeal options.","examples":{"meetsRule":"agencies performs the required action \"list\" for appeal options within these source conditions: external decisions, and retains evidence.","doesNotMeetRule":"agencies omits the required action \"list\" for appeal options while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-D5475CA27F","version":2,"title":"Obtain IT approval for public meeting-recording or email/calendar-connecting apps.","text":"Users must obtain IT approval.","topic":"Human oversight","intent":"obtain it approval","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"brookline-genai","control":"Use, recording-app bullet","sourceVersion":"1.7 — August 2025","url":"https://www.brooklinema.gov/3975/Generative-AI-Use","actor":"users","modality":"must","action":"obtain","object":"IT approval","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"Brookline, Massachusetts, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"users performs the required action \"obtain\" for IT approval within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"users omits the required action \"obtain\" for IT approval while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves IT approval. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: obtain IT approval.","examples":{"meetsRule":"users performs the required action \"obtain\" for IT approval within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"users omits the required action \"obtain\" for IT approval while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-0AEC8A401C","version":2,"title":"Plan periodic AI risk-management reviews","text":"AI governance owners should plan periodic AI risk-management reviews.","topic":"Human oversight","intent":"plan periodic ai risk management reviews","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Govern 1.5","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"plan","object":"periodic AI risk-management reviews","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"plan\" for periodic AI risk-management reviews within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"plan\" for periodic AI risk-management reviews. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves periodic AI risk-management reviews. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: plan periodic AI risk-management reviews.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"plan\" for periodic AI risk-management reviews within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"plan\" for periodic AI risk-management reviews. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-9987CCC485","version":2,"title":"Review AI material before publishing or sharing it.","text":"Users should review AI material.","topic":"Human oversight","intent":"review ai material","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"harvard-genai-guidelines","control":"Review content before publishing or sharing","sourceVersion":"Edition unspecified; prepared index checked 2026-09-28","url":"https://www.huit.harvard.edu/ai/guidelines","actor":"users","modality":"should","action":"review","object":"AI material","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"Harvard University, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"users follows the recommendation to \"review\" for AI material within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"users omits the recommended action \"review\" for AI material. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves AI material. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: review AI material.","examples":{"meetsRule":"users follows the recommendation to \"review\" for AI material within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"users omits the recommended action \"review\" for AI material. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-FEDC04B3F1","version":2,"title":"Review administrative AI content for accuracy, tone, and appropriateness.","text":"Users must review content.","topic":"Human oversight","intent":"review content","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"msu-genai-guidelines","control":"General Expectations for Administrative Use","sourceVersion":"Approved August 12, 2025; no revisions listed","url":"https://ai.msu.edu/guidelines","actor":"users","modality":"must","action":"review","object":"content","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"Michigan State University, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"users performs the required action \"review\" for content within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"users omits the required action \"review\" for content while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves content. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: review content.","examples":{"meetsRule":"users performs the required action \"review\" for content within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"users omits the required action \"review\" for content while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-7899BD6734","version":2,"title":"Review and verify all GenAI output with relevant subject expertise.","text":"Users must verify outputs.","topic":"Human oversight","intent":"verify outputs","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"pa-ai-2026","control":"5.2.3, p.6","sourceVersion":"Revision January 13, 2026","url":"https://www.pa.gov/content/dam/copapwp-pagov/en/oa/documents/policies/it-policies/artificial%20intelligence%20policy.pdf","actor":"users","modality":"must","action":"verify","object":"outputs","condition":"Commonwealth business","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"Pennsylvania, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"users performs the required action \"verify\" for outputs within these source conditions: Commonwealth business, and retains evidence.","doesNotMeetRule":"users omits the required action \"verify\" for outputs while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves outputs. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: verify outputs.","examples":{"meetsRule":"users performs the required action \"verify\" for outputs within these source conditions: Commonwealth business, and retains evidence.","doesNotMeetRule":"users omits the required action \"verify\" for outputs while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-DCFE285C28","version":2,"title":"Use online tools on state devices; downloading requires ESRMO special approval.","text":"Employees must use online tools.","topic":"Human oversight","intent":"use online tools","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nc-public-genai","control":"p.5, appropriate use, bullet 3","sourceVersion":"1.1 — April 14, 2026","url":"https://it.nc.gov/documents/use-publicly-available-generative-artificial-intelligence/download?attachment=","actor":"employees","modality":"must","action":"use","object":"online tools","condition":"state device","exception":"ESRMO-approved download","timing":null,"authority":"organization-specific","jurisdiction":"North Carolina, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"employees performs the required action \"use\" for online tools within these source conditions: state device, and retains evidence.","doesNotMeetRule":"employees omits the required action \"use\" for online tools while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves online tools. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: use online tools.","examples":{"meetsRule":"employees performs the required action \"use\" for online tools within these source conditions: state device, and retains evidence.","doesNotMeetRule":"employees omits the required action \"use\" for online tools while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-6F83A570B6","version":2,"title":"AI providers should protect sensitive logs against unauthorized access.","text":"AI provider should protect sensitive logs.","topic":"Privacy","intent":"protect sensitive logs","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"cisa-ncsc-secure-ai-development","control":"Secure development / assets","sourceVersion":"1.0","url":"https://www.ncsc.gov.uk/collection/guidelines-secure-ai-system-development/guidelines/secure-development","actor":"AI provider","modality":"should","action":"protect","object":"sensitive logs","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"AI provider follows the recommendation to \"protect\" for sensitive logs within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"AI provider omits the recommended action \"protect\" for sensitive logs. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves sensitive logs. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: protect sensitive logs.","examples":{"meetsRule":"AI provider follows the recommendation to \"protect\" for sensitive logs within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"AI provider omits the recommended action \"protect\" for sensitive logs. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-D8BE1AA186","version":2,"title":"Avoid collecting unnecessary personal information","text":"Covered GenAI service providers must avoid collecting unnecessary personal information.","topic":"Privacy","intent":"avoid collecting unnecessary personal information","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"cn-genai-interim","control":"Article 11","sourceVersion":"Order 15; effective 2023-08-15","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","actor":"Covered GenAI service providers","modality":"must","action":"avoid","object":"collecting unnecessary personal information","condition":"Covered public services","exception":"Article 2 scope and cross-referenced Chinese laws apply","timing":null,"authority":"binding-within-scope","jurisdiction":"China","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"avoid\" for collecting unnecessary personal information within these source conditions: Covered public services, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"avoid\" for collecting unnecessary personal information while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves collecting unnecessary personal information. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: avoid collecting unnecessary personal information.","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"avoid\" for collecting unnecessary personal information within these source conditions: Covered public services, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"avoid\" for collecting unnecessary personal information while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-99485B54FC","version":2,"title":"Carefully review AI responses in security-sensitive situations.","text":"Users must review responses.","topic":"Privacy","intent":"review responses","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"brookline-genai","control":"Use, security-review bullet","sourceVersion":"1.7 — August 2025","url":"https://www.brooklinema.gov/3975/Generative-AI-Use","actor":"users","modality":"must","action":"review","object":"responses","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"Brookline, Massachusetts, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"users performs the required action \"review\" for responses within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"users omits the required action \"review\" for responses while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves responses. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: review responses.","examples":{"meetsRule":"users performs the required action \"review\" for responses within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"users omits the required action \"review\" for responses while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-E89D3740A1","version":2,"title":"Categorize sensitive attributes through biometrics","text":"AI operators must not categorize sensitive attributes through biometrics.","topic":"Privacy","intent":"categorize sensitive attributes through biometrics","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 5(1)(g)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"AI operators","modality":"must not","action":"categorize","object":"sensitive attributes through biometrics","condition":"Covered biometric categorization","exception":"Specified dataset labeling and law-enforcement exceptions","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI operators does not perform the prohibited action \"categorize\" for sensitive attributes through biometrics while these conditions apply: Covered biometric categorization.","doesNotMeetRule":"AI operators performs the prohibited action \"categorize\" for sensitive attributes through biometrics while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves sensitive attributes through biometrics. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: categorize sensitive attributes through biometrics.","examples":{"meetsRule":"AI operators does not perform the prohibited action \"categorize\" for sensitive attributes through biometrics while these conditions apply: Covered biometric categorization.","doesNotMeetRule":"AI operators performs the prohibited action \"categorize\" for sensitive attributes through biometrics while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-471437DC20","version":2,"title":"Correct inaccurate personal data","text":"Data controllers must correct inaccurate personal data.","topic":"Privacy","intent":"correct inaccurate personal data","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-gdpr","control":"Article 16","sourceVersion":"Regulation 2016/679","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","actor":"Data controllers","modality":"must","action":"correct","object":"inaccurate personal data","condition":"On applicable data-subject request","exception":"See article-specific exceptions and safeguards","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Data controllers performs the required action \"correct\" for inaccurate personal data within these source conditions: On applicable data-subject request, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"correct\" for inaccurate personal data while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves inaccurate personal data. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: correct inaccurate personal data.","examples":{"meetsRule":"Data controllers performs the required action \"correct\" for inaccurate personal data within these source conditions: On applicable data-subject request, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"correct\" for inaccurate personal data while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-04A480E942","version":2,"title":"Erase personal data when required","text":"Data controllers must erase personal data when required.","topic":"Privacy","intent":"erase personal data when required","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-gdpr","control":"Article 17(1)","sourceVersion":"Regulation 2016/679","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","actor":"Data controllers","modality":"must","action":"erase","object":"personal data when required","condition":"Subject to statutory exceptions","exception":"See article-specific exceptions and safeguards","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Data controllers performs the required action \"erase\" for personal data when required within these source conditions: Subject to statutory exceptions, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"erase\" for personal data when required while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves personal data when required. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: erase personal data when required.","examples":{"meetsRule":"Data controllers performs the required action \"erase\" for personal data when required within these source conditions: Subject to statutory exceptions, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"erase\" for personal data when required while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-231E86FCF1","version":2,"title":"Establish a lawful basis for training on personal information","text":"Covered GenAI service providers must establish a lawful basis for training on personal information.","topic":"Privacy","intent":"establish a lawful basis for training on personal information","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"cn-genai-interim","control":"Article 7(3)","sourceVersion":"Order 15; effective 2023-08-15","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","actor":"Covered GenAI service providers","modality":"must","action":"establish","object":"a lawful basis for training on personal information","condition":"Consent or another legal basis","exception":"Article 2 scope and cross-referenced Chinese laws apply","timing":null,"authority":"binding-within-scope","jurisdiction":"China","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"establish\" for a lawful basis for training on personal information within these source conditions: Consent or another legal basis, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"establish\" for a lawful basis for training on personal information while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves a lawful basis for training on personal information. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: establish a lawful basis for training on personal information.","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"establish\" for a lawful basis for training on personal information within these source conditions: Consent or another legal basis, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"establish\" for a lawful basis for training on personal information while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-C4036FF921","version":2,"title":"Examine AI privacy risks","text":"AI governance owners should examine AI privacy risks.","topic":"Privacy","intent":"examine ai privacy risks","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Measure 2.10","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"examine","object":"AI privacy risks","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"examine\" for AI privacy risks within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"examine\" for AI privacy risks. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves AI privacy risks. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: examine AI privacy risks.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"examine\" for AI privacy risks within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"examine\" for AI privacy risks. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-65595252CE","version":2,"title":"Keep sensitive information out of third-party tools unless MSU security explicitly approves.","text":"Users must-not enter sensitive information.","topic":"Privacy","intent":"enter sensitive information","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"msu-genai-guidelines","control":"Non-Permissible Uses, paragraph 3","sourceVersion":"Approved August 12, 2025; no revisions listed","url":"https://ai.msu.edu/guidelines","actor":"users","modality":"must-not","action":"enter","object":"sensitive information","condition":"non-MSU enterprise tools","exception":"explicit security approval","timing":null,"authority":"organization-specific","jurisdiction":"Michigan State University, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"users performs the required action \"enter\" for sensitive information within these source conditions: non-MSU enterprise tools, and retains evidence.","doesNotMeetRule":"users omits the required action \"enter\" for sensitive information while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves sensitive information. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: enter sensitive information.","examples":{"meetsRule":"users performs the required action \"enter\" for sensitive information within these source conditions: non-MSU enterprise tools, and retains evidence.","doesNotMeetRule":"users omits the required action \"enter\" for sensitive information while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-40C4A84CA0","version":2,"title":"Limit personal-data retention","text":"Data controllers must limit personal-data retention.","topic":"Privacy","intent":"limit personal data retention","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-gdpr","control":"Article 5(1)(e)","sourceVersion":"Regulation 2016/679","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","actor":"Data controllers","modality":"must","action":"limit","object":"personal-data retention","condition":"All covered processing","exception":"See article-specific exceptions and safeguards","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Data controllers performs the required action \"limit\" for personal-data retention within these source conditions: All covered processing, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"limit\" for personal-data retention while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves personal-data retention. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: limit personal-data retention.","examples":{"meetsRule":"Data controllers performs the required action \"limit\" for personal-data retention within these source conditions: All covered processing, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"limit\" for personal-data retention while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-5C638CD3DB","version":2,"title":"Maintain personal-data accuracy","text":"Data controllers must maintain personal-data accuracy.","topic":"Privacy","intent":"maintain personal data accuracy","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-gdpr","control":"Article 5(1)(d)","sourceVersion":"Regulation 2016/679","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","actor":"Data controllers","modality":"must","action":"maintain","object":"personal-data accuracy","condition":"All covered processing","exception":"See article-specific exceptions and safeguards","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Data controllers performs the required action \"maintain\" for personal-data accuracy within these source conditions: All covered processing, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"maintain\" for personal-data accuracy while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves personal-data accuracy. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: maintain personal-data accuracy.","examples":{"meetsRule":"Data controllers performs the required action \"maintain\" for personal-data accuracy within these source conditions: All covered processing, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"maintain\" for personal-data accuracy while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-5DE52C1C2C","version":2,"title":"Minimize personal data collected","text":"Data controllers must minimize personal data collected.","topic":"Privacy","intent":"minimize personal data collected","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-gdpr","control":"Article 5(1)(c)","sourceVersion":"Regulation 2016/679","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","actor":"Data controllers","modality":"must","action":"minimize","object":"personal data collected","condition":"All covered processing","exception":"See article-specific exceptions and safeguards","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Data controllers performs the required action \"minimize\" for personal data collected within these source conditions: All covered processing, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"minimize\" for personal data collected while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves personal data collected. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: minimize personal data collected.","examples":{"meetsRule":"Data controllers performs the required action \"minimize\" for personal data collected within these source conditions: All covered processing, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"minimize\" for personal data collected while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-FED6DB2BF6","version":2,"title":"Notify the authority of qualifying personal-data breaches","text":"Data controllers must notify the authority of qualifying personal-data breaches.","topic":"Privacy","intent":"notify the authority of qualifying personal data breaches","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-gdpr","control":"Article 33(1)","sourceVersion":"Regulation 2016/679","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","actor":"Data controllers","modality":"must","action":"notify","object":"the authority of qualifying personal-data breaches","condition":"Without undue delay and where feasible within 72 hours","exception":"See article-specific exceptions and safeguards","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Data controllers performs the required action \"notify\" for the authority of qualifying personal-data breaches within these source conditions: Without undue delay and where feasible within 72 hours, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"notify\" for the authority of qualifying personal-data breaches while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves the authority of qualifying personal-data breaches. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: notify the authority of qualifying personal-data breaches.","examples":{"meetsRule":"Data controllers performs the required action \"notify\" for the authority of qualifying personal-data breaches within these source conditions: Without undue delay and where feasible within 72 hours, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"notify\" for the authority of qualifying personal-data breaches while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-9752AE9F94","version":2,"title":"Obtain information-security/privacy risk assessment before vendor GenAI use.","text":"Users must obtain risk assessment.","topic":"Privacy","intent":"obtain risk assessment","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"harvard-genai-guidelines","control":"Use approved tools, bullet 3","sourceVersion":"Edition unspecified; prepared index checked 2026-09-28","url":"https://www.huit.harvard.edu/ai/guidelines","actor":"users","modality":"must","action":"obtain","object":"risk assessment","condition":"Harvard work","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"Harvard University, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"users performs the required action \"obtain\" for risk assessment within these source conditions: Harvard work, and retains evidence.","doesNotMeetRule":"users omits the required action \"obtain\" for risk assessment while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves risk assessment. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: obtain risk assessment.","examples":{"meetsRule":"users performs the required action \"obtain\" for risk assessment within these source conditions: Harvard work, and retains evidence.","doesNotMeetRule":"users omits the required action \"obtain\" for risk assessment while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-75F300981F","version":2,"title":"Organizations should determine their authority to process personal information.","text":"Organization should determine PII processing authority.","topic":"Privacy","intent":"determine pii processing authority","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-800-53-r5","control":"PT-2(a)","sourceVersion":"SP 800-53 Rev.5 / Dec-2020 updates","url":"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf#page=257","actor":"Organization","modality":"should","action":"determine","object":"PII processing authority","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"technical-controls-when-adopted","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Organization follows the recommendation to \"determine\" for PII processing authority within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"determine\" for PII processing authority. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves PII processing authority. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: determine PII processing authority.","examples":{"meetsRule":"Organization follows the recommendation to \"determine\" for PII processing authority within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"determine\" for PII processing authority. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-70303212C7","version":2,"title":"Organizations should document their authority to process personal information.","text":"Organization should document PII processing authority.","topic":"Privacy","intent":"document pii processing authority","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-800-53-r5","control":"PT-2(a)","sourceVersion":"SP 800-53 Rev.5 / Dec-2020 updates","url":"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf#page=257","actor":"Organization","modality":"should","action":"document","object":"PII processing authority","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"technical-controls-when-adopted","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Organization follows the recommendation to \"document\" for PII processing authority within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"document\" for PII processing authority. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves PII processing authority. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: document PII processing authority.","examples":{"meetsRule":"Organization follows the recommendation to \"document\" for PII processing authority within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"document\" for PII processing authority. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-6486E8DBA4","version":2,"title":"Organizations should protect the confidentiality, integrity and availability of transmitted data.","text":"Organization should protect transmitted data.","topic":"Privacy","intent":"protect transmitted data","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-csf-2","control":"PR.DS-02","sourceVersion":"CSWP 29 / 2.0","url":"https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf#page=25","actor":"Organization","modality":"should","action":"protect","object":"transmitted data","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Organization follows the recommendation to \"protect\" for transmitted data within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"protect\" for transmitted data. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves transmitted data. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: protect transmitted data.","examples":{"meetsRule":"Organization follows the recommendation to \"protect\" for transmitted data within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"protect\" for transmitted data. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-B39B348823","version":2,"title":"Organizations should restrict personal-information processing to authorized activities.","text":"Organization should restrict PII processing.","topic":"Privacy","intent":"restrict pii processing","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-800-53-r5","control":"PT-2(b)","sourceVersion":"SP 800-53 Rev.5 / Dec-2020 updates","url":"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf#page=257","actor":"Organization","modality":"should","action":"restrict","object":"PII processing","condition":"Authorized activities","exception":null,"timing":null,"authority":"technical-controls-when-adopted","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Organization follows the recommendation to \"restrict\" for PII processing within these conditions: Authorized activities.","doesNotMeetRule":"Organization omits the recommended action \"restrict\" for PII processing. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves PII processing. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: restrict PII processing.","examples":{"meetsRule":"Organization follows the recommendation to \"restrict\" for PII processing within these conditions: Authorized activities.","doesNotMeetRule":"Organization omits the recommended action \"restrict\" for PII processing. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-386B595FB5","version":2,"title":"Process personal data lawfully","text":"Data controllers must process personal data lawfully.","topic":"Privacy","intent":"process personal data lawfully","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-gdpr","control":"Article 5(1)(a)","sourceVersion":"Regulation 2016/679","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","actor":"Data controllers","modality":"must","action":"process","object":"personal data lawfully","condition":"All covered processing","exception":"See article-specific exceptions and safeguards","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Data controllers performs the required action \"process\" for personal data lawfully within these source conditions: All covered processing, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"process\" for personal data lawfully while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves personal data lawfully. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: process personal data lawfully.","examples":{"meetsRule":"Data controllers performs the required action \"process\" for personal data lawfully within these source conditions: All covered processing, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"process\" for personal data lawfully while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-685E3BDEA7","version":2,"title":"Process personal-information rights requests","text":"Covered GenAI service providers must process personal-information rights requests.","topic":"Privacy","intent":"process personal information rights requests","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"cn-genai-interim","control":"Article 11","sourceVersion":"Order 15; effective 2023-08-15","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","actor":"Covered GenAI service providers","modality":"must","action":"process","object":"personal-information rights requests","condition":"Lawful requests for access, correction or deletion","exception":"Article 2 scope and cross-referenced Chinese laws apply","timing":null,"authority":"binding-within-scope","jurisdiction":"China","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"process\" for personal-information rights requests within these source conditions: Lawful requests for access, correction or deletion, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"process\" for personal-information rights requests while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves personal-information rights requests. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: process personal-information rights requests.","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"process\" for personal-information rights requests within these source conditions: Lawful requests for access, correction or deletion, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"process\" for personal-information rights requests while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-CC0117ACB7","version":2,"title":"Protect personal-data integrity and confidentiality","text":"Data controllers must protect personal-data integrity and confidentiality.","topic":"Privacy","intent":"protect personal data integrity and confidentiality","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-gdpr","control":"Article 5(1)(f)","sourceVersion":"Regulation 2016/679","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","actor":"Data controllers","modality":"must","action":"protect","object":"personal-data integrity and confidentiality","condition":"All covered processing","exception":"See article-specific exceptions and safeguards","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Data controllers performs the required action \"protect\" for personal-data integrity and confidentiality within these source conditions: All covered processing, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"protect\" for personal-data integrity and confidentiality while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves personal-data integrity and confidentiality. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: protect personal-data integrity and confidentiality.","examples":{"meetsRule":"Data controllers performs the required action \"protect\" for personal-data integrity and confidentiality within these source conditions: All covered processing, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"protect\" for personal-data integrity and confidentiality while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-5D8AD7CDE4","version":2,"title":"Protect personal-information rights","text":"Covered GenAI service providers must protect personal-information rights.","topic":"Privacy","intent":"protect personal information rights","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"cn-genai-interim","control":"Article 4(4)","sourceVersion":"Order 15; effective 2023-08-15","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","actor":"Covered GenAI service providers","modality":"must","action":"protect","object":"personal-information rights","condition":"Covered service use and provision","exception":"Article 2 scope and cross-referenced Chinese laws apply","timing":null,"authority":"binding-within-scope","jurisdiction":"China","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"protect\" for personal-information rights within these source conditions: Covered service use and provision, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"protect\" for personal-information rights while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves personal-information rights. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: protect personal-information rights.","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"protect\" for personal-information rights within these source conditions: Covered service use and provision, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"protect\" for personal-information rights while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-8EDD597B2C","version":2,"title":"Provide clear privacy information","text":"Data controllers must provide clear privacy information.","topic":"Privacy","intent":"provide clear privacy information","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-gdpr","control":"Article 12(1)","sourceVersion":"Regulation 2016/679","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","actor":"Data controllers","modality":"must","action":"provide","object":"clear privacy information","condition":"Information to data subjects","exception":"See article-specific exceptions and safeguards","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Data controllers performs the required action \"provide\" for clear privacy information within these source conditions: Information to data subjects, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"provide\" for clear privacy information while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves clear privacy information. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: provide clear privacy information.","examples":{"meetsRule":"Data controllers performs the required action \"provide\" for clear privacy information within these source conditions: Information to data subjects, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"provide\" for clear privacy information while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-974125D9F2","version":2,"title":"Safeguard international personal-data transfers","text":"Data controllers must safeguard international personal-data transfers.","topic":"Privacy","intent":"safeguard international personal data transfers","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-gdpr","control":"Article 44","sourceVersion":"Regulation 2016/679","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","actor":"Data controllers","modality":"must","action":"safeguard","object":"international personal-data transfers","condition":"Covered transfers to third countries","exception":"See article-specific exceptions and safeguards","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Data controllers performs the required action \"safeguard\" for international personal-data transfers within these source conditions: Covered transfers to third countries, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"safeguard\" for international personal-data transfers while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves international personal-data transfers. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: safeguard international personal-data transfers.","examples":{"meetsRule":"Data controllers performs the required action \"safeguard\" for international personal-data transfers within these source conditions: Covered transfers to third countries, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"safeguard\" for international personal-data transfers while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-3A61647692","version":2,"title":"Assess third-party AI supply-chain risks","text":"AI governance owners should assess third-party AI supply-chain risks.","topic":"Procurement","intent":"assess third party ai supply chain risks","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Govern 6.1","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"assess","object":"third-party AI supply-chain risks","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"assess\" for third-party AI supply-chain risks within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"assess\" for third-party AI supply-chain risks. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves third-party AI supply-chain risks. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: assess third-party AI supply-chain risks.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"assess\" for third-party AI supply-chain risks within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"assess\" for third-party AI supply-chain risks. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-5EF003576B","version":2,"title":"Avoid meeting assistants except approved tools with contractual protections.","text":"Users should-not use meeting assistants.","topic":"Procurement","intent":"use meeting assistants","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"harvard-genai-guidelines","control":"Use approved tools, bullet 2","sourceVersion":"Edition unspecified; prepared index checked 2026-09-28","url":"https://www.huit.harvard.edu/ai/guidelines","actor":"users","modality":"should-not","action":"use","object":"meeting assistants","condition":"Harvard meetings","exception":"approved protected tools","timing":null,"authority":"organization-specific","jurisdiction":"Harvard University, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"users performs the required action \"use\" for meeting assistants within these source conditions: Harvard meetings, and retains evidence.","doesNotMeetRule":"users omits the required action \"use\" for meeting assistants while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves meeting assistants. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: use meeting assistants.","examples":{"meetsRule":"users performs the required action \"use\" for meeting assistants within these source conditions: Harvard meetings, and retains evidence.","doesNotMeetRule":"users omits the required action \"use\" for meeting assistants while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-E05F392822","version":2,"title":"Covered agencies must include contract terms enabling regular AI performance evaluation.","text":"Covered agency must include evaluation-enabling contract terms.","topic":"Procurement","intent":"include evaluation enabling contract terms","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"omb-m-25-22","control":"4(d)(ii)(E)","sourceVersion":"M-25-22","url":"https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-22-Driving-Efficient-Acquisition-of-Artificial-Intelligence-in-Government.pdf#page=10","actor":"Covered agency","modality":"must","action":"include","object":"evaluation-enabling contract terms","condition":"Applicable AI contracts under §2","exception":null,"timing":null,"authority":"binding-within-defined-federal-scope","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Covered agency performs the required action \"include\" for evaluation-enabling contract terms within these source conditions: Applicable AI contracts under §2, and retains evidence.","doesNotMeetRule":"Covered agency omits the required action \"include\" for evaluation-enabling contract terms while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves evaluation-enabling contract terms. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: include evaluation-enabling contract terms.","examples":{"meetsRule":"Covered agency performs the required action \"include\" for evaluation-enabling contract terms within these source conditions: Applicable AI contracts under §2, and retains evidence.","doesNotMeetRule":"Covered agency omits the required action \"include\" for evaluation-enabling contract terms while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-A80EF3B4B0","version":2,"title":"Covered agencies must request the vendor’s acceptable-use policy in LLM solicitations.","text":"Covered agency must request vendor acceptable-use policy.","topic":"Procurement","intent":"request vendor acceptable use policy","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"omb-m-26-04","control":"Appendix A.1(A)(i)","sourceVersion":"M-26-04","url":"https://www.whitehouse.gov/wp-content/uploads/2025/12/M-26-04-Increasing-Public-Trust-in-Artificial-Intelligence-Through-Unbiased-AI-Principles-1.pdf#page=5","actor":"Covered agency","modality":"must","action":"request","object":"vendor acceptable-use policy","condition":"Covered LLM solicitations","exception":null,"timing":null,"authority":"binding-within-defined-federal-scope","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Covered agency performs the required action \"request\" for vendor acceptable-use policy within these source conditions: Covered LLM solicitations, and retains evidence.","doesNotMeetRule":"Covered agency omits the required action \"request\" for vendor acceptable-use policy while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves vendor acceptable-use policy. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: request vendor acceptable-use policy.","examples":{"meetsRule":"Covered agency performs the required action \"request\" for vendor acceptable-use policy within these source conditions: Covered LLM solicitations, and retains evidence.","doesNotMeetRule":"Covered agency omits the required action \"request\" for vendor acceptable-use policy while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-21AFA15D02","version":2,"title":"Covered agencies must update procurement procedures to include the required LLM terms.","text":"Covered agency must update LLM procurement procedures.","topic":"Procurement","intent":"update llm procurement procedures","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"omb-m-26-04","control":"Agency Actions (c)","sourceVersion":"M-26-04","url":"https://www.whitehouse.gov/wp-content/uploads/2025/12/M-26-04-Increasing-Public-Trust-in-Artificial-Intelligence-Through-Unbiased-AI-Principles-1.pdf#page=3","actor":"Covered agency","modality":"must","action":"update","object":"LLM procurement procedures","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":"By 2026-03-11","authority":"binding-within-defined-federal-scope","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Covered agency performs the required action \"update\" for LLM procurement procedures within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"Covered agency omits the required action \"update\" for LLM procurement procedures while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves LLM procurement procedures. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: update LLM procurement procedures.","examples":{"meetsRule":"Covered agency performs the required action \"update\" for LLM procurement procedures within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"Covered agency omits the required action \"update\" for LLM procurement procedures while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-8312DD76DB","version":2,"title":"Establish contingency procedures for third-party failures","text":"AI governance owners should establish contingency procedures for third-party failures.","topic":"Procurement","intent":"establish contingency procedures for third party failures","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Govern 6.2","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"establish","object":"contingency procedures for third-party failures","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"establish\" for contingency procedures for third-party failures within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"establish\" for contingency procedures for third-party failures. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves contingency procedures for third-party failures. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: establish contingency procedures for third-party failures.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"establish\" for contingency procedures for third-party failures within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"establish\" for contingency procedures for third-party failures. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-746FA0104C","version":2,"title":"Monitor third-party AI risks","text":"AI governance owners should monitor third-party AI risks.","topic":"Procurement","intent":"monitor third party ai risks","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Manage 3.1","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"monitor","object":"third-party AI risks","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"monitor\" for third-party AI risks within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"monitor\" for third-party AI risks. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves third-party AI risks. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: monitor third-party AI risks.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"monitor\" for third-party AI risks within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"monitor\" for third-party AI risks. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-69B1D0BD8A","version":2,"title":"AI providers should maintain the ability to restore assets to a known-good state.","text":"AI provider should maintain known-good asset recovery.","topic":"Safety","intent":"maintain known good asset recovery","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"cisa-ncsc-secure-ai-development","control":"Secure development / assets","sourceVersion":"1.0","url":"https://www.ncsc.gov.uk/collection/guidelines-secure-ai-system-development/guidelines/secure-development","actor":"AI provider","modality":"should","action":"maintain","object":"known-good asset recovery","condition":"Compromise","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"AI provider follows the recommendation to \"maintain\" for known-good asset recovery within these conditions: Compromise.","doesNotMeetRule":"AI provider omits the recommended action \"maintain\" for known-good asset recovery. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves known-good asset recovery. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: maintain known-good asset recovery.","examples":{"meetsRule":"AI provider follows the recommendation to \"maintain\" for known-good asset recovery within these conditions: Compromise.","doesNotMeetRule":"AI provider omits the recommended action \"maintain\" for known-good asset recovery. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-4EB0C43D04","version":2,"title":"Communicate AI incidents to affected stakeholders","text":"AI governance owners should communicate AI incidents to affected stakeholders.","topic":"Safety","intent":"communicate ai incidents to affected stakeholders","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Manage 4.3","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"communicate","object":"AI incidents to affected stakeholders","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"communicate\" for AI incidents to affected stakeholders within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"communicate\" for AI incidents to affected stakeholders. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves AI incidents to affected stakeholders. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: communicate AI incidents to affected stakeholders.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"communicate\" for AI incidents to affected stakeholders within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"communicate\" for AI incidents to affected stakeholders. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-EB5574CE22","version":2,"title":"Document incidents involving third-party GAI systems","text":"AI governance owners should document incidents involving third-party GAI systems.","topic":"Safety","intent":"document incidents involving third party gai systems","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-genai-profile","control":"GV-6.2-002","sourceVersion":"AI 600-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf","actor":"AI governance owners","modality":"should","action":"document","object":"incidents involving third-party GAI systems","condition":"Generative AI lifecycle; voluntary suggested action","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"document\" for incidents involving third-party GAI systems within these conditions: Generative AI lifecycle; voluntary suggested action.","doesNotMeetRule":"AI governance owners omits the recommended action \"document\" for incidents involving third-party GAI systems. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves incidents involving third-party GAI systems. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: document incidents involving third-party GAI systems.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"document\" for incidents involving third-party GAI systems within these conditions: Generative AI lifecycle; voluntary suggested action.","doesNotMeetRule":"AI governance owners omits the recommended action \"document\" for incidents involving third-party GAI systems. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-E358CEFA41","version":2,"title":"Enable AI incident identification","text":"AI governance owners should enable AI incident identification.","topic":"Safety","intent":"enable ai incident identification","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Govern 4.3","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"enable","object":"AI incident identification","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"enable\" for AI incident identification within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"enable\" for AI incident identification. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves AI incident identification. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: enable AI incident identification.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"enable\" for AI incident identification within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"enable\" for AI incident identification. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-0E39923F61","version":2,"title":"Establish a safety-first AI development culture","text":"AI governance owners should establish a safety-first AI development culture.","topic":"Safety","intent":"establish a safety first ai development culture","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Govern 4.1","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"establish","object":"a safety-first AI development culture","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"establish\" for a safety-first AI development culture within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"establish\" for a safety-first AI development culture. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves a safety-first AI development culture. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: establish a safety-first AI development culture.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"establish\" for a safety-first AI development culture within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"establish\" for a safety-first AI development culture. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-347AC3B548","version":2,"title":"Establish mechanisms to deactivate unsafe AI systems","text":"AI governance owners should establish mechanisms to deactivate unsafe AI systems.","topic":"Safety","intent":"establish mechanisms to deactivate unsafe ai systems","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Manage 2.4","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"establish","object":"mechanisms to deactivate unsafe AI systems","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"establish\" for mechanisms to deactivate unsafe AI systems within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"establish\" for mechanisms to deactivate unsafe AI systems. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves mechanisms to deactivate unsafe AI systems. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: establish mechanisms to deactivate unsafe AI systems.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"establish\" for mechanisms to deactivate unsafe AI systems within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"establish\" for mechanisms to deactivate unsafe AI systems. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-FC4DFA8060","version":2,"title":"Evaluate AI safety risks","text":"AI governance owners should evaluate AI safety risks.","topic":"Safety","intent":"evaluate ai safety risks","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Measure 2.6","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"evaluate","object":"AI safety risks","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"evaluate\" for AI safety risks within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"evaluate\" for AI safety risks. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves AI safety risks. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: evaluate AI safety risks.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"evaluate\" for AI safety risks within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"evaluate\" for AI safety risks. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-EBC5423CFD","version":2,"title":"Follow incident protocols for suspected breaches or data-protection violations.","text":"Employees must follow incident protocols.","topic":"Safety","intent":"follow incident protocols","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nc-public-genai","control":"p.5, reporting, bullet 2","sourceVersion":"1.1 — April 14, 2026","url":"https://it.nc.gov/documents/use-publicly-available-generative-artificial-intelligence/download?attachment=","actor":"employees","modality":"must","action":"follow","object":"incident protocols","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"North Carolina, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"employees performs the required action \"follow\" for incident protocols within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"employees omits the required action \"follow\" for incident protocols while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves incident protocols. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: follow incident protocols.","examples":{"meetsRule":"employees performs the required action \"follow\" for incident protocols within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"employees omits the required action \"follow\" for incident protocols while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-F24F48122C","version":2,"title":"Plan a halt to unacceptable-risk GAI development","text":"AI governance owners should plan a halt to unacceptable-risk GAI development.","topic":"Safety","intent":"plan a halt to unacceptable risk gai development","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-genai-profile","control":"GV-1.3-007","sourceVersion":"AI 600-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf","actor":"AI governance owners","modality":"should","action":"plan","object":"a halt to unacceptable-risk GAI development","condition":"Generative AI lifecycle; voluntary suggested action","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"plan\" for a halt to unacceptable-risk GAI development within these conditions: Generative AI lifecycle; voluntary suggested action.","doesNotMeetRule":"AI governance owners omits the recommended action \"plan\" for a halt to unacceptable-risk GAI development. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves a halt to unacceptable-risk GAI development. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: plan a halt to unacceptable-risk GAI development.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"plan\" for a halt to unacceptable-risk GAI development within these conditions: Generative AI lifecycle; voluntary suggested action.","doesNotMeetRule":"AI governance owners omits the recommended action \"plan\" for a halt to unacceptable-risk GAI development. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-4EE1F0E0DF","version":2,"title":"Report serious incidents to authorities","text":"High-risk AI providers must report serious incidents to authorities.","topic":"Safety","intent":"report serious incidents to authorities","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 73(1)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI providers","modality":"must","action":"report","object":"serious incidents to authorities","condition":"Covered high-risk systems","exception":"Statutory incident category and deadline review required","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI providers performs the required action \"report\" for serious incidents to authorities within these source conditions: Covered high-risk systems, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"report\" for serious incidents to authorities while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves serious incidents to authorities. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: report serious incidents to authorities.","examples":{"meetsRule":"High-risk AI providers performs the required action \"report\" for serious incidents to authorities within these source conditions: Covered high-risk systems, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"report\" for serious incidents to authorities while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-D711D2E5E0","version":2,"title":"Report serious incidents to the AI Office","text":"Systemic-risk GPAI providers must report serious incidents to the AI Office.","topic":"Safety","intent":"report serious incidents to the ai office","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 55(1)(c)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"Systemic-risk GPAI providers","modality":"must","action":"report","object":"serious incidents to the AI Office","condition":"Covered systemic-risk models","exception":"Applicable statutory provisions","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Systemic-risk GPAI providers performs the required action \"report\" for serious incidents to the AI Office within these source conditions: Covered systemic-risk models, and retains evidence.","doesNotMeetRule":"Systemic-risk GPAI providers omits the required action \"report\" for serious incidents to the AI Office while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves serious incidents to the AI Office. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: report serious incidents to the AI Office.","examples":{"meetsRule":"Systemic-risk GPAI providers performs the required action \"report\" for serious incidents to the AI Office within these source conditions: Covered systemic-risk models, and retains evidence.","doesNotMeetRule":"Systemic-risk GPAI providers omits the required action \"report\" for serious incidents to the AI Office while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-D1FFF5F35C","version":2,"title":"Use harmfully manipulative AI techniques","text":"AI operators must not use harmfully manipulative AI techniques.","topic":"Safety","intent":"use harmfully manipulative ai techniques","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 5(1)(a)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"AI operators","modality":"must not","action":"use","object":"harmfully manipulative AI techniques","condition":"Material distortion of behavior causing or likely to cause significant harm","exception":"Statutory elements must all be assessed","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI operators does not perform the prohibited action \"use\" for harmfully manipulative AI techniques while these conditions apply: Material distortion of behavior causing or likely to cause significant harm.","doesNotMeetRule":"AI operators performs the prohibited action \"use\" for harmfully manipulative AI techniques while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves harmfully manipulative AI techniques. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: use harmfully manipulative AI techniques.","examples":{"meetsRule":"AI operators does not perform the prohibited action \"use\" for harmfully manipulative AI techniques while these conditions apply: Material distortion of behavior causing or likely to cause significant harm.","doesNotMeetRule":"AI operators performs the prohibited action \"use\" for harmfully manipulative AI techniques while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-BB06F70AC1","version":2,"title":"Ensure adequate cybersecurity for models","text":"Systemic-risk GPAI providers must ensure adequate cybersecurity for models.","topic":"Security","intent":"ensure adequate cybersecurity for models","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 55(1)(d)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"Systemic-risk GPAI providers","modality":"must","action":"ensure","object":"adequate cybersecurity for models","condition":"Covered systemic-risk models","exception":"Including physical infrastructure","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Systemic-risk GPAI providers performs the required action \"ensure\" for adequate cybersecurity for models within these source conditions: Covered systemic-risk models, and retains evidence.","doesNotMeetRule":"Systemic-risk GPAI providers omits the required action \"ensure\" for adequate cybersecurity for models while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves adequate cybersecurity for models. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: ensure adequate cybersecurity for models.","examples":{"meetsRule":"Systemic-risk GPAI providers performs the required action \"ensure\" for adequate cybersecurity for models within these source conditions: Covered systemic-risk models, and retains evidence.","doesNotMeetRule":"Systemic-risk GPAI providers omits the required action \"ensure\" for adequate cybersecurity for models while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-63476788C2","version":2,"title":"Ensure cybersecurity of high-risk AI","text":"High-risk AI providers must ensure cybersecurity of high-risk AI.","topic":"Security","intent":"ensure cybersecurity of high risk ai","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 15(5)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI providers","modality":"must","action":"ensure","object":"cybersecurity of high-risk AI","condition":"Against unauthorized third-party alteration","exception":"Applicable statutory provisions","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI providers performs the required action \"ensure\" for cybersecurity of high-risk AI within these source conditions: Against unauthorized third-party alteration, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"ensure\" for cybersecurity of high-risk AI while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves cybersecurity of high-risk AI. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: ensure cybersecurity of high-risk AI.","examples":{"meetsRule":"High-risk AI providers performs the required action \"ensure\" for cybersecurity of high-risk AI within these source conditions: Against unauthorized third-party alteration, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"ensure\" for cybersecurity of high-risk AI while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-B8B189C1E1","version":2,"title":"Evaluate AI security and resilience","text":"AI governance owners should evaluate AI security and resilience.","topic":"Security","intent":"evaluate ai security and resilience","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Measure 2.7","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"evaluate","object":"AI security and resilience","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"evaluate\" for AI security and resilience within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"evaluate\" for AI security and resilience. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves AI security and resilience. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: evaluate AI security and resilience.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"evaluate\" for AI security and resilience within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"evaluate\" for AI security and resilience. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-5D6EB58CC1","version":2,"title":"Exploit vulnerabilities through harmful AI manipulation","text":"AI operators must not exploit vulnerabilities through harmful AI manipulation.","topic":"Security","intent":"exploit vulnerabilities through harmful ai manipulation","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 5(1)(b)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"AI operators","modality":"must not","action":"exploit","object":"vulnerabilities through harmful AI manipulation","condition":"Age, disability or specific social or economic situation","exception":"Statutory harm threshold applies","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI operators does not perform the prohibited action \"exploit\" for vulnerabilities through harmful AI manipulation while these conditions apply: Age, disability or specific social or economic situation.","doesNotMeetRule":"AI operators performs the prohibited action \"exploit\" for vulnerabilities through harmful AI manipulation while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves vulnerabilities through harmful AI manipulation. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: exploit vulnerabilities through harmful AI manipulation.","examples":{"meetsRule":"AI operators does not perform the prohibited action \"exploit\" for vulnerabilities through harmful AI manipulation while these conditions apply: Age, disability or specific social or economic situation.","doesNotMeetRule":"AI operators performs the prohibited action \"exploit\" for vulnerabilities through harmful AI manipulation while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-80606F42F7","version":2,"title":"Implement appropriate data security measures","text":"Data controllers must implement appropriate data security measures.","topic":"Security","intent":"implement appropriate data security measures","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-gdpr","control":"Article 32(1)","sourceVersion":"Regulation 2016/679","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","actor":"Data controllers","modality":"must","action":"implement","object":"appropriate data security measures","condition":"Appropriate to processing risks","exception":"See article-specific exceptions and safeguards","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Data controllers performs the required action \"implement\" for appropriate data security measures within these source conditions: Appropriate to processing risks, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"implement\" for appropriate data security measures while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves appropriate data security measures. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: implement appropriate data security measures.","examples":{"meetsRule":"Data controllers performs the required action \"implement\" for appropriate data security measures within these source conditions: Appropriate to processing risks, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"implement\" for appropriate data security measures while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-49A6A9BEE4","version":2,"title":"Never enter passwords, API keys, or system-access secrets into GenAI.","text":"Users must-not enter access secrets.","topic":"Security","intent":"enter access secrets","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"brookline-genai","control":"Use, prohibited-data bullet","sourceVersion":"1.7 — August 2025","url":"https://www.brooklinema.gov/3975/Generative-AI-Use","actor":"users","modality":"must-not","action":"enter","object":"access secrets","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"Brookline, Massachusetts, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"users performs the required action \"enter\" for access secrets within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"users omits the required action \"enter\" for access secrets while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves access secrets. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: enter access secrets.","examples":{"meetsRule":"users performs the required action \"enter\" for access secrets within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"users omits the required action \"enter\" for access secrets while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-95F550699A","version":2,"title":"Notify supervisors and the agency security liaison about AI concerns.","text":"Employees must notify AI concerns.","topic":"Security","intent":"notify ai concerns","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nc-public-genai","control":"p.5, reporting, bullet 1","sourceVersion":"1.1 — April 14, 2026","url":"https://it.nc.gov/documents/use-publicly-available-generative-artificial-intelligence/download?attachment=","actor":"employees","modality":"must","action":"notify","object":"AI concerns","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"North Carolina, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"employees performs the required action \"notify\" for AI concerns within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"employees omits the required action \"notify\" for AI concerns while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves AI concerns. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: notify AI concerns.","examples":{"meetsRule":"employees performs the required action \"notify\" for AI concerns within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"employees omits the required action \"notify\" for AI concerns while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-8D76274A01","version":2,"title":"Obtain CIO and security-liaison approval before submitting existing state or proprietary code.","text":"Employees must obtain approval.","topic":"Security","intent":"obtain approval","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nc-public-genai","control":"p.5, data sharing, bullet 3","sourceVersion":"1.1 — April 14, 2026","url":"https://it.nc.gov/documents/use-publicly-available-generative-artificial-intelligence/download?attachment=","actor":"employees","modality":"must","action":"obtain","object":"approval","condition":"code submission","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"North Carolina, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"employees performs the required action \"obtain\" for approval within these source conditions: code submission, and retains evidence.","doesNotMeetRule":"employees omits the required action \"obtain\" for approval while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}},{"sourceId":"brookline-genai","control":"Use, bullet 1","sourceVersion":"1.7 — August 2025","url":"https://www.brooklinema.gov/3975/Generative-AI-Use","actor":"users","modality":"must","action":"obtain","object":"approval","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"Brookline, Massachusetts, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"users performs the required action \"obtain\" for approval within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"users omits the required action \"obtain\" for approval while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves approval. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: obtain approval.","examples":{"meetsRule":"employees performs the required action \"obtain\" for approval within these source conditions: code submission, and retains evidence.","doesNotMeetRule":"employees omits the required action \"obtain\" for approval while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-0029859136","version":2,"title":"Perform required security assessments","text":"Covered GenAI service providers must perform required security assessments.","topic":"Security","intent":"perform required security assessments","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"cn-genai-interim","control":"Article 17","sourceVersion":"Order 15; effective 2023-08-15","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","actor":"Covered GenAI service providers","modality":"must","action":"perform","object":"required security assessments","condition":"Services with public-opinion attributes or social mobilization capability","exception":"Article 2 scope and cross-referenced Chinese laws apply","timing":null,"authority":"binding-within-scope","jurisdiction":"China","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"perform\" for required security assessments within these source conditions: Services with public-opinion attributes or social mobilization capability, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"perform\" for required security assessments while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves required security assessments. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: perform required security assessments.","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"perform\" for required security assessments within these source conditions: Services with public-opinion attributes or social mobilization capability, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"perform\" for required security assessments while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-D67362ED3A","version":2,"title":"Protect trade secrets","text":"Covered GenAI service providers must protect trade secrets.","topic":"Security","intent":"protect trade secrets","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"cn-genai-interim","control":"Article 4(3)","sourceVersion":"Order 15; effective 2023-08-15","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","actor":"Covered GenAI service providers","modality":"must","action":"protect","object":"trade secrets","condition":"Covered service use and provision","exception":"Article 2 scope and cross-referenced Chinese laws apply","timing":null,"authority":"binding-within-scope","jurisdiction":"China","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"protect\" for trade secrets within these source conditions: Covered service use and provision, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"protect\" for trade secrets while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves trade secrets. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: protect trade secrets.","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"protect\" for trade secrets within these source conditions: Covered service use and provision, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"protect\" for trade secrets while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-50E6F7AEC2","version":2,"title":"Register proposed AI and obtain AITR/ISO, VITA/CIO, then Administration Secretary approval.","text":"Agencies must obtain sequential approval.","topic":"Security","intent":"obtain sequential approval","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"va-ai-ea400","control":"p.6, Approval Workflow / Exemptions","sourceVersion":"EA400 — June 2026","url":"https://www.vita.virginia.gov/media/vitavirginiagov/it-governance/ea/pdf/Artificial-Intelligence-(AI)-Utilization-Policy.pdf","actor":"agencies","modality":"must","action":"obtain","object":"sequential approval","condition":"before deployment","exception":"security defense; standard-software embedded AI; higher-education research/instruction","timing":null,"authority":"organization-specific","jurisdiction":"Virginia, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"agencies performs the required action \"obtain\" for sequential approval within these source conditions: before deployment, and retains evidence.","doesNotMeetRule":"agencies omits the required action \"obtain\" for sequential approval while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves sequential approval. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: obtain sequential approval.","examples":{"meetsRule":"agencies performs the required action \"obtain\" for sequential approval within these source conditions: before deployment, and retains evidence.","doesNotMeetRule":"agencies omits the required action \"obtain\" for sequential approval while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-59B6D94E34","version":2,"title":"Software producers should gather vulnerability reports from users, acquirers and public sources.","text":"Software producer should gather vulnerability reports.","topic":"Security","intent":"gather vulnerability reports","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ssdf-1-1","control":"RV.1.1","sourceVersion":"SP 800-218 / SSDF 1.1","url":"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-218.pdf#page=25","actor":"Software producer","modality":"should","action":"gather","object":"vulnerability reports","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Software producer follows the recommendation to \"gather\" for vulnerability reports within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Software producer omits the recommended action \"gather\" for vulnerability reports. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves vulnerability reports. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: gather vulnerability reports.","examples":{"meetsRule":"Software producer follows the recommendation to \"gather\" for vulnerability reports within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Software producer omits the recommended action \"gather\" for vulnerability reports. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-BC2EBDF815","version":2,"title":"Software producers should investigate credible vulnerability reports.","text":"Software producer should investigate credible vulnerability reports.","topic":"Security","intent":"investigate credible vulnerability reports","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ssdf-1-1","control":"RV.1.1","sourceVersion":"SP 800-218 / SSDF 1.1","url":"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-218.pdf#page=25","actor":"Software producer","modality":"should","action":"investigate","object":"credible vulnerability reports","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Software producer follows the recommendation to \"investigate\" for credible vulnerability reports within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Software producer omits the recommended action \"investigate\" for credible vulnerability reports. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves credible vulnerability reports. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: investigate credible vulnerability reports.","examples":{"meetsRule":"Software producer follows the recommendation to \"investigate\" for credible vulnerability reports within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Software producer omits the recommended action \"investigate\" for credible vulnerability reports. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-F52DD6D81F","version":2,"title":"Assign responsibility for content provenance reviews","text":"AI governance owners should assign responsibility for content provenance reviews.","topic":"Transparency","intent":"assign responsibility for content provenance reviews","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-genai-profile","control":"GV-1.5-001","sourceVersion":"AI 600-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf","actor":"AI governance owners","modality":"should","action":"assign","object":"responsibility for content provenance reviews","condition":"Generative AI lifecycle; voluntary suggested action","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"assign\" for responsibility for content provenance reviews within these conditions: Generative AI lifecycle; voluntary suggested action.","doesNotMeetRule":"AI governance owners omits the recommended action \"assign\" for responsibility for content provenance reviews. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves responsibility for content provenance reviews. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: assign responsibility for content provenance reviews.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"assign\" for responsibility for content provenance reviews within these conditions: Generative AI lifecycle; voluntary suggested action.","doesNotMeetRule":"AI governance owners omits the recommended action \"assign\" for responsibility for content provenance reviews. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-9B0903C354","version":2,"title":"Define operable data-labeling rules","text":"Covered GenAI service providers must define operable data-labeling rules.","topic":"Transparency","intent":"define operable data labeling rules","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"cn-genai-interim","control":"Article 8","sourceVersion":"Order 15; effective 2023-08-15","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","actor":"Covered GenAI service providers","modality":"must","action":"define","object":"operable data-labeling rules","condition":"Data annotation during development","exception":"Article 2 scope and cross-referenced Chinese laws apply","timing":null,"authority":"binding-within-scope","jurisdiction":"China","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"define\" for operable data-labeling rules within these source conditions: Data annotation during development, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"define\" for operable data-labeling rules while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves operable data-labeling rules. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: define operable data-labeling rules.","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"define\" for operable data-labeling rules within these source conditions: Data annotation during development, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"define\" for operable data-labeling rules while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-B8A087CCC2","version":2,"title":"Design sufficiently transparent operation","text":"High-risk AI providers must design sufficiently transparent operation.","topic":"Transparency","intent":"design sufficiently transparent operation","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 13(1)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI providers","modality":"must","action":"design","object":"sufficiently transparent operation","condition":"To enable deployer interpretation","exception":"Applicable statutory provisions","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI providers performs the required action \"design\" for sufficiently transparent operation within these source conditions: To enable deployer interpretation, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"design\" for sufficiently transparent operation while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves sufficiently transparent operation. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: design sufficiently transparent operation.","examples":{"meetsRule":"High-risk AI providers performs the required action \"design\" for sufficiently transparent operation within these source conditions: To enable deployer interpretation, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"design\" for sufficiently transparent operation while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-8530787112","version":2,"title":"Disclose deepfake generation or manipulation","text":"AI deployers must disclose deepfake generation or manipulation.","topic":"Transparency","intent":"disclose deepfake generation or manipulation","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 50(4)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"AI deployers","modality":"must","action":"disclose","object":"deepfake generation or manipulation","condition":"Covered synthetic media","exception":"Artistic and specified law-enforcement treatment applies","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI deployers performs the required action \"disclose\" for deepfake generation or manipulation within these source conditions: Covered synthetic media, and retains evidence.","doesNotMeetRule":"AI deployers omits the required action \"disclose\" for deepfake generation or manipulation while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves deepfake generation or manipulation. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: disclose deepfake generation or manipulation.","examples":{"meetsRule":"AI deployers performs the required action \"disclose\" for deepfake generation or manipulation within these source conditions: Covered synthetic media, and retains evidence.","doesNotMeetRule":"AI deployers omits the required action \"disclose\" for deepfake generation or manipulation while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-0A0DBE76B1","version":2,"title":"Establish transparent AI risk-management procedures","text":"AI governance owners should establish transparent AI risk-management procedures.","topic":"Transparency","intent":"establish transparent ai risk management procedures","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Govern 1.4","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"establish","object":"transparent AI risk-management procedures","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"establish\" for transparent AI risk-management procedures within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"establish\" for transparent AI risk-management procedures. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves transparent AI risk-management procedures. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: establish transparent AI risk-management procedures.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"establish\" for transparent AI risk-management procedures within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"establish\" for transparent AI risk-management procedures. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-2C63EF342D","version":2,"title":"Establish transparent GAI acceptable-use policies","text":"AI governance owners should establish transparent GAI acceptable-use policies.","topic":"Transparency","intent":"establish transparent gai acceptable use policies","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-genai-profile","control":"GV-1.4-002","sourceVersion":"AI 600-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf","actor":"AI governance owners","modality":"should","action":"establish","object":"transparent GAI acceptable-use policies","condition":"Generative AI lifecycle; voluntary suggested action","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"establish\" for transparent GAI acceptable-use policies within these conditions: Generative AI lifecycle; voluntary suggested action.","doesNotMeetRule":"AI governance owners omits the recommended action \"establish\" for transparent GAI acceptable-use policies. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves transparent GAI acceptable-use policies. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: establish transparent GAI acceptable-use policies.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"establish\" for transparent GAI acceptable-use policies within these conditions: Generative AI lifecycle; voluntary suggested action.","doesNotMeetRule":"AI governance owners omits the recommended action \"establish\" for transparent GAI acceptable-use policies. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-0CD56857BE","version":2,"title":"Evaluate data-labeling quality","text":"Covered GenAI service providers must evaluate data-labeling quality.","topic":"Transparency","intent":"evaluate data labeling quality","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"cn-genai-interim","control":"Article 8","sourceVersion":"Order 15; effective 2023-08-15","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","actor":"Covered GenAI service providers","modality":"must","action":"evaluate","object":"data-labeling quality","condition":"Data annotation during development","exception":"Article 2 scope and cross-referenced Chinese laws apply","timing":null,"authority":"binding-within-scope","jurisdiction":"China","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"evaluate\" for data-labeling quality within these source conditions: Data annotation during development, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"evaluate\" for data-labeling quality while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves data-labeling quality. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: evaluate data-labeling quality.","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"evaluate\" for data-labeling quality within these source conditions: Data annotation during development, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"evaluate\" for data-labeling quality while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-2D2E913625","version":2,"title":"Examine AI transparency risks","text":"AI governance owners should examine AI transparency risks.","topic":"Transparency","intent":"examine ai transparency risks","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Measure 2.8","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"examine","object":"AI transparency risks","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"examine\" for AI transparency risks within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"examine\" for AI transparency risks. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves AI transparency risks. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: examine AI transparency risks.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"examine\" for AI transparency risks within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"examine\" for AI transparency risks. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-BDE09E3088","version":2,"title":"Exclude unexplainable AI from decisions and approvals.","text":"Agencies must-not use unexplainable AI.","topic":"Transparency","intent":"use unexplainable ai","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"va-ai-ea400","control":"p.5, Ethical Use","sourceVersion":"EA400 — June 2026","url":"https://www.vita.virginia.gov/media/vitavirginiagov/it-governance/ea/pdf/Artificial-Intelligence-(AI)-Utilization-Policy.pdf","actor":"agencies","modality":"must-not","action":"use","object":"unexplainable AI","condition":"decision or approval","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"Virginia, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"agencies performs the required action \"use\" for unexplainable AI within these source conditions: decision or approval, and retains evidence.","doesNotMeetRule":"agencies omits the required action \"use\" for unexplainable AI while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves unexplainable AI. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: use unexplainable AI.","examples":{"meetsRule":"agencies performs the required action \"use\" for unexplainable AI within these source conditions: decision or approval, and retains evidence.","doesNotMeetRule":"agencies omits the required action \"use\" for unexplainable AI while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-87BEC56E72","version":2,"title":"Explain AI outputs in their use context","text":"AI governance owners should explain AI outputs in their use context.","topic":"Transparency","intent":"explain ai outputs in their use context","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Measure 2.9","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"explain","object":"AI outputs in their use context","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"explain\" for AI outputs in their use context within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"explain\" for AI outputs in their use context. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves AI outputs in their use context. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: explain AI outputs in their use context.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"explain\" for AI outputs in their use context within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"explain\" for AI outputs in their use context. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-5CE518437C","version":2,"title":"Improve transparency of GenAI services","text":"Covered GenAI service providers must improve transparency of GenAI services.","topic":"Transparency","intent":"improve transparency of genai services","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"cn-genai-interim","control":"Article 4(5)","sourceVersion":"Order 15; effective 2023-08-15","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","actor":"Covered GenAI service providers","modality":"must","action":"improve","object":"transparency of GenAI services","condition":"According to service characteristics","exception":"Article 2 scope and cross-referenced Chinese laws apply","timing":null,"authority":"binding-within-scope","jurisdiction":"China","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"improve\" for transparency of GenAI services within these source conditions: According to service characteristics, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"improve\" for transparency of GenAI services while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves transparency of GenAI services. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: improve transparency of GenAI services.","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"improve\" for transparency of GenAI services within these source conditions: According to service characteristics, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"improve\" for transparency of GenAI services while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-1DD5F7B4C4","version":2,"title":"Label generated images and videos","text":"Covered GenAI service providers must label generated images and videos.","topic":"Transparency","intent":"label generated images and videos","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"cn-genai-interim","control":"Article 12","sourceVersion":"Order 15; effective 2023-08-15","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","actor":"Covered GenAI service providers","modality":"must","action":"label","object":"generated images and videos","condition":"As required by deep-synthesis provisions","exception":"Article 2 scope and cross-referenced Chinese laws apply","timing":null,"authority":"binding-within-scope","jurisdiction":"China","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"label\" for generated images and videos within these source conditions: As required by deep-synthesis provisions, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"label\" for generated images and videos while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves generated images and videos. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: label generated images and videos.","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"label\" for generated images and videos within these source conditions: As required by deep-synthesis provisions, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"label\" for generated images and videos while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-66E5FC0789","version":2,"title":"Label town-used AI content conspicuously, describing review and editing.","text":"Users must label AI content.","topic":"Transparency","intent":"label ai content","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"brookline-genai","control":"Use, transparency bullet","sourceVersion":"1.7 — August 2025","url":"https://www.brooklinema.gov/3975/Generative-AI-Use","actor":"users","modality":"must","action":"label","object":"AI content","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"Brookline, Massachusetts, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"users performs the required action \"label\" for AI content within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"users omits the required action \"label\" for AI content while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves AI content. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: label AI content.","examples":{"meetsRule":"users performs the required action \"label\" for AI content within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"users omits the required action \"label\" for AI content while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-7F72121E8B","version":2,"title":"Present notices in plain language","text":"Responsible senior federal officials must present notices in plain language.","topic":"Transparency","intent":"present notices in plain language","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"ca-automated-decisions","control":"6.2.2","sourceVersion":"Modified 2025-06-24","url":"https://www.tbs-sct.canada.ca/pol/doc-eng.aspx?id=32592","actor":"Responsible senior federal officials","modality":"must","action":"present","object":"notices in plain language","condition":"Prominently in service channels","exception":"Directive scope and Appendix C apply","timing":null,"authority":"binding-within-federal-scope","jurisdiction":"Canada federal government","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Responsible senior federal officials performs the required action \"present\" for notices in plain language within these source conditions: Prominently in service channels, and retains evidence.","doesNotMeetRule":"Responsible senior federal officials omits the required action \"present\" for notices in plain language while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves notices in plain language. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: present notices in plain language.","examples":{"meetsRule":"Responsible senior federal officials performs the required action \"present\" for notices in plain language within these source conditions: Prominently in service channels, and retains evidence.","doesNotMeetRule":"Responsible senior federal officials omits the required action \"present\" for notices in plain language while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-E28075A396","version":2,"title":"Prominently disclose externally shared GenAI content, identifying system and version.","text":"Users must disclose GenAI content.","topic":"Transparency","intent":"disclose genai content","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"pa-ai-2026","control":"5.2.4, pp.6–7","sourceVersion":"Revision January 13, 2026","url":"https://www.pa.gov/content/dam/copapwp-pagov/en/oa/documents/policies/it-policies/artificial%20intelligence%20policy.pdf","actor":"users","modality":"must","action":"disclose","object":"GenAI content","condition":"including partial generation","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"Pennsylvania, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"users performs the required action \"disclose\" for GenAI content within these source conditions: including partial generation, and retains evidence.","doesNotMeetRule":"users omits the required action \"disclose\" for GenAI content while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves GenAI content. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: disclose GenAI content.","examples":{"meetsRule":"users performs the required action \"disclose\" for GenAI content within these source conditions: including partial generation, and retains evidence.","doesNotMeetRule":"users omits the required action \"disclose\" for GenAI content while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-9F12707A1E","version":2,"title":"Provide notice of automated decision-making","text":"Responsible senior federal officials must provide notice of automated decision-making.","topic":"Transparency","intent":"provide notice of automated decision making","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"ca-automated-decisions","control":"6.2.1","sourceVersion":"Modified 2025-06-24","url":"https://www.tbs-sct.canada.ca/pol/doc-eng.aspx?id=32592","actor":"Responsible senior federal officials","modality":"must","action":"provide","object":"notice of automated decision-making","condition":"Before decisions; impact-level requirements apply","exception":"Directive scope and Appendix C apply","timing":null,"authority":"binding-within-federal-scope","jurisdiction":"Canada federal government","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Responsible senior federal officials performs the required action \"provide\" for notice of automated decision-making within these source conditions: Before decisions; impact-level requirements apply, and retains evidence.","doesNotMeetRule":"Responsible senior federal officials omits the required action \"provide\" for notice of automated decision-making while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves notice of automated decision-making. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: provide notice of automated decision-making.","examples":{"meetsRule":"Responsible senior federal officials performs the required action \"provide\" for notice of automated decision-making within these source conditions: Before decisions; impact-level requirements apply, and retains evidence.","doesNotMeetRule":"Responsible senior federal officials omits the required action \"provide\" for notice of automated decision-making while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-634CB1FAE6","version":2,"title":"Train data-labeling personnel","text":"Covered GenAI service providers must train data-labeling personnel.","topic":"Transparency","intent":"train data labeling personnel","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"cn-genai-interim","control":"Article 8","sourceVersion":"Order 15; effective 2023-08-15","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","actor":"Covered GenAI service providers","modality":"must","action":"train","object":"data-labeling personnel","condition":"Data annotation during development","exception":"Article 2 scope and cross-referenced Chinese laws apply","timing":null,"authority":"binding-within-scope","jurisdiction":"China","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"train\" for data-labeling personnel within these source conditions: Data annotation during development, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"train\" for data-labeling personnel while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves data-labeling personnel. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: train data-labeling personnel.","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"train\" for data-labeling personnel within these source conditions: Data annotation during development, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"train\" for data-labeling personnel while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"}],"gaps":[{"title":"ISO/IEC 42001","jurisdiction":"International","url":"https://www.iso.org/standard/81230.html","reason":"Licensed standard; metadata only","status":"not-extracted"},{"title":"ISO/IEC 23894","jurisdiction":"International","url":"https://www.iso.org/standard/77304.html","reason":"Licensed standard; metadata only","status":"not-extracted"},{"title":"OECD AI Principles","jurisdiction":"International","url":"https://oecd.ai/en/ai-principles","reason":"Updated principles; clause extraction pending","status":"not-extracted"},{"title":"UNESCO Recommendation on AI Ethics","jurisdiction":"International","url":"https://www.unesco.org/en/artificial-intelligence/recommendation-ethics","reason":"Normative recommendations; extraction pending","status":"not-extracted"},{"title":"OWASP LLM Top 10","jurisdiction":"Global","url":"https://genai.owasp.org/llm-top-10/","reason":"Security recommendations; atomic extraction pending","status":"not-extracted"},{"title":"OWASP Agentic Security","jurisdiction":"Global","url":"https://genai.owasp.org/","reason":"Agent controls discovery pending","status":"not-extracted"},{"title":"Singapore AI Verify","jurisdiction":"Singapore","url":"https://aiverifyfoundation.sg/","reason":"Testing framework; extraction pending","status":"not-extracted"},{"title":"Singapore Model AI Governance Framework","jurisdiction":"Singapore","url":"https://www.pdpc.gov.sg/help-and-resources/2020/01/model-ai-governance-framework","reason":"Framework editions need reconciliation","status":"not-extracted"},{"title":"UK AI Cyber Security Code","jurisdiction":"United Kingdom","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice","reason":"Official code extraction pending","status":"not-extracted"},{"title":"Australia AI Safety Standard","jurisdiction":"Australia","url":"https://www.industry.gov.au/publications/voluntary-ai-safety-standard","reason":"Voluntary controls extraction pending","status":"not-extracted"},{"title":"Japan AI Guidelines for Business","jurisdiction":"Japan","url":"https://www.meti.go.jp/english/policy/mono_info_service/ai/index.html","reason":"Latest edition and translation need verification","status":"not-extracted"},{"title":"South Korea AI Basic Act","jurisdiction":"South Korea","url":"https://www.law.go.kr/","reason":"Authoritative Korean text and commencement need verification","status":"not-extracted"},{"title":"Brazil AI legislation","jurisdiction":"Brazil","url":"https://www.camara.leg.br/","reason":"Legislative status must be verified; no adopted-law claim","status":"not-extracted"},{"title":"Colorado AI Act","jurisdiction":"Colorado, US","url":"https://leg.colorado.gov/bills/SB24-205","reason":"Current 2026 amendments and consolidated law need review","status":"not-extracted"},{"title":"California frontier AI law","jurisdiction":"California, US","url":"https://leginfo.legislature.ca.gov/","reason":"Current SB 53 and related law extraction pending","status":"not-extracted"},{"title":"New York City Local Law 144","jurisdiction":"New York City, US","url":"https://www.nyc.gov/site/dca/about/automated-employment-decision-tools.page","reason":"Employment bias-audit controls pending","status":"not-extracted"},{"title":"Texas Responsible AI Governance Act","jurisdiction":"Texas, US","url":"https://capitol.texas.gov/","reason":"Current enacted text extraction pending","status":"not-extracted"},{"title":"EU GPAI Code of Practice","jurisdiction":"European Union","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","reason":"Separate voluntary compliance code extraction pending","status":"not-extracted"},{"title":"EU AI Omnibus","jurisdiction":"European Union","url":"https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai","reason":"Reconcile 2026 amendments with individual AI Act clauses","status":"not-extracted"},{"title":"China AI-generated content labeling","jurisdiction":"China","url":"https://www.cac.gov.cn/","reason":"2025 labeling measure and technical standard pending","status":"not-extracted"},{"title":"India AI governance","jurisdiction":"India","url":"https://www.meity.gov.in/","reason":"Advisories, data-protection law and sectoral scope need review","status":"not-extracted"},{"title":"Saudi AI ethics","jurisdiction":"Saudi Arabia","url":"https://sdaia.gov.sa/","reason":"Official principles and sectoral scope pending","status":"not-extracted"},{"title":"Dubai AI ethics","jurisdiction":"UAE","url":"https://www.digitaldubai.ae/","reason":"Official guidance extraction pending","status":"not-extracted"},{"title":"African Union AI Strategy","jurisdiction":"African Union","url":"https://au.int/","reason":"Strategy recommendations, not binding universal rules","status":"not-extracted"},{"title":"US FDA AI device guidance","jurisdiction":"United States","url":"https://www.fda.gov/medical-devices/","reason":"Medical-device controls and draft/final distinction pending","status":"not-extracted"},{"title":"US EEOC AI employment guidance","jurisdiction":"United States","url":"https://www.eeoc.gov/","reason":"Employment-law controls pending","status":"not-extracted"},{"title":"Financial-sector AI controls","jurisdiction":"Multiple","url":"https://www.bis.org/","reason":"Sector-specific scope and regulator mapping pending","status":"not-extracted"},{"title":"NIST AI RMF Playbook","jurisdiction":"United States","url":"https://airc.nist.gov/airmf-resources/playbook/","reason":"Tactical action extraction pending","status":"not-extracted"},{"title":"NIST GenAI complete profile","jurisdiction":"United States","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf","reason":"Complete action-by-action atomic extraction pending","status":"not-extracted"},{"title":"Original RDL 91-source manifest","jurisdiction":"Original app","url":"https://rdl-policy-playground.bsharve.chatgpt.site/","reason":"Owner source export not received; migration incomplete","status":"not-extracted"}],"liveUpdatedAt":null,"liveDiscovery":{"findings":[{"id":"finding-09c6c213bf7d4a66fdd5911929a14cf457ac5234e3899bf59dd1c5c4754428b8","kind":"rule-candidate","status":"pending","body":{"title":"Record unresolvable evaluation failures","sourceTitle":"Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence-Enabled Device Software Functions","sourceVersion":"Final guidance issued 18 August 2025; originally issued 4 December 2024; current FDA listing and PDF checked 18 October 2026","control":"VII.B(3), final submission-content paragraph, failure-recording limb; PDF page 31 (printed page 27)","actor":"Manufacturers of AI-enabled device software functions (AI-DSFs) seeking or using a PCCP","modality":"should","action":"record","object":"unresolvable PCCP performance-evaluation failures","condition":"Within this guidance's AI-DSF PCCP scope: device modifications planned over time, including eligible device constituents of device-led combination products; not general organizational AI use. The protocol should affirm failures will be recorded when a specific modification's performance evaluation has an unresolvable failure, such as unmet pre-defined criteria.","timing":"When an unresolvable evaluation failure occurs","exception":"Final guidance contains nonbinding recommendations; alternative approaches may satisfy applicable statutes and regulations. No exemption from required FDA authorization is inferred. Drug/biologic constituents are not covered by this guidance's device recommendations. If root-cause analysis shows the failure is unrelated to specific PCCP aspects, it is not considered unresolvable and testing may be repeated.","authority":"FDA final nonbinding guidance; recommendation only, distinct from any cited statutory duties or device-specific authorization conditions","jurisdiction":"United States; FDA-regulated AI-enabled medical devices","evidenceSummary":"Exact section and physical PDF page read from the FDA's 49-page final guidance on 18 October 2026; printed page is also identified. Original atomic candidate paraphrase, not a new October 2026 requirement. The January 2025 lifecycle-management document is still listed separately as draft/not for implementation. Legacy QSR cross-references in the 2025 text were not extracted as current standalone duties.","url":"https://www.fda.gov/media/166704/download#page=31","ruleId":"AIR-9D8B4C021B","intent":"record unresolvable pccp performance evaluation failures","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-18T13:06:08.468Z","reviewed_at":null},{"id":"finding-365c5ecdad2a8a76cff6c2f6f08a987049e7bb9c16f088fbe98cbd6ef0b5fb15","kind":"rule-candidate","status":"pending","body":{"title":"Specify expected device-update frequency","sourceTitle":"Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence-Enabled Device Software Functions","sourceVersion":"Final guidance issued 18 August 2025; originally issued 4 December 2024; current FDA listing and PDF checked 18 October 2026","control":"VI.B, update-frequency sentence; PDF page 25 (printed page 21)","actor":"Manufacturers of AI-enabled device software functions (AI-DSFs) seeking or using a PCCP","modality":"should","action":"specify","object":"expected PCCP device-update frequency","condition":"Within this guidance's AI-DSF PCCP scope: device modifications planned over time, including eligible device constituents of device-led combination products; not general organizational AI use. Describe the expected frequency of modifications, whether infrequent locked-model changes or continuous adaptation.","timing":"When describing planned modifications","exception":"Final guidance contains nonbinding recommendations; alternative approaches may satisfy applicable statutes and regulations. No exemption from required FDA authorization is inferred. Drug/biologic constituents are not covered by this guidance's device recommendations. ","authority":"FDA final nonbinding guidance; recommendation only, distinct from any cited statutory duties or device-specific authorization conditions","jurisdiction":"United States; FDA-regulated AI-enabled medical devices","evidenceSummary":"Exact section and physical PDF page read from the FDA's 49-page final guidance on 18 October 2026; printed page is also identified. Original atomic candidate paraphrase, not a new October 2026 requirement. The January 2025 lifecycle-management document is still listed separately as draft/not for implementation. Legacy QSR cross-references in the 2025 text were not extracted as current standalone duties.","url":"https://www.fda.gov/media/166704/download#page=25","ruleId":"AIR-D212B365EB","intent":"specify expected pccp device update frequency","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-18T13:06:08.468Z","reviewed_at":null},{"id":"finding-3bc7ec1bf2e8c76f9e24556ece3344a48ca99cf7a10317f38e12dc1b5d40dbb6","kind":"rule-candidate","status":"pending","body":{"title":"Summarize previously implemented PCCP changes","sourceTitle":"Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence-Enabled Device Software Functions","sourceVersion":"Final guidance issued 18 August 2025; originally issued 4 December 2024; current FDA listing and PDF checked 18 October 2026","control":"V.F, paragraph beginning 'Over time'; PDF page 24 (printed page 20)","actor":"Manufacturers of AI-enabled device software functions (AI-DSFs) seeking or using a PCCP","modality":"should","action":"summarize","object":"previously implemented authorized PCCP modifications","condition":"Within this guidance's AI-DSF PCCP scope: device modifications planned over time, including eligible device constituents of device-led combination products; not general organizational AI use. A later marketing submission is made for additional changes; include the modifications previously implemented consistently with the authorized PCCP so the current device is understandable.","timing":"In the later marketing submission","exception":"Final guidance contains nonbinding recommendations; alternative approaches may satisfy applicable statutes and regulations. No exemption from required FDA authorization is inferred. Drug/biologic constituents are not covered by this guidance's device recommendations. ","authority":"FDA final nonbinding guidance; recommendation only, distinct from any cited statutory duties or device-specific authorization conditions","jurisdiction":"United States; FDA-regulated AI-enabled medical devices","evidenceSummary":"Exact section and physical PDF page read from the FDA's 49-page final guidance on 18 October 2026; printed page is also identified. Original atomic candidate paraphrase, not a new October 2026 requirement. The January 2025 lifecycle-management document is still listed separately as draft/not for implementation. Legacy QSR cross-references in the 2025 text were not extracted as current standalone duties.","url":"https://www.fda.gov/media/166704/download#page=24","ruleId":"AIR-CA3B1AEBD0","intent":"summarize previously implemented authorized pccp modifications","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-18T13:06:08.468Z","reviewed_at":null},{"id":"finding-3e7e657af0690d41ac1241619133be68a20c533357fe24003342d4d814223cfb","kind":"rule-candidate","status":"pending","body":{"title":"Submit the revised PCCP clean copy","sourceTitle":"Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence-Enabled Device Software Functions","sourceVersion":"Final guidance issued 18 August 2025; originally issued 4 December 2024; current FDA listing and PDF checked 18 October 2026","control":"V.F, paragraph beginning 'As described in Section V.C.'; PDF page 23 (printed page 19)","actor":"Manufacturers of AI-enabled device software functions (AI-DSFs) seeking or using a PCCP","modality":"should","action":"submit","object":"a clean version-identified revised PCCP","condition":"Within this guidance's AI-DSF PCCP scope: device modifications planned over time, including eligible device constituents of device-led combination products; not general organizational AI use. The PCCP has been revised during FDA review; provide a clean final copy with title and current version number.","timing":"After review revisions and before PCCP authorization","exception":"Final guidance contains nonbinding recommendations; alternative approaches may satisfy applicable statutes and regulations. No exemption from required FDA authorization is inferred. Drug/biologic constituents are not covered by this guidance's device recommendations. ","authority":"FDA final nonbinding guidance; recommendation only, distinct from any cited statutory duties or device-specific authorization conditions","jurisdiction":"United States; FDA-regulated AI-enabled medical devices","evidenceSummary":"Exact section and physical PDF page read from the FDA's 49-page final guidance on 18 October 2026; printed page is also identified. Original atomic candidate paraphrase, not a new October 2026 requirement. The January 2025 lifecycle-management document is still listed separately as draft/not for implementation. Legacy QSR cross-references in the 2025 text were not extracted as current standalone duties.","url":"https://www.fda.gov/media/166704/download#page=23","ruleId":"AIR-32E06D4340","intent":"submit a clean version identified revised pccp","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-18T13:06:08.468Z","reviewed_at":null},{"id":"finding-4ccce89890c88d39bf0eb24fe40140bbdea0eb5ae82091b824704b0730c1eedb","kind":"rule-candidate","status":"pending","body":{"title":"Define modification acceptance criteria","sourceTitle":"Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence-Enabled Device Software Functions","sourceVersion":"Final guidance issued 18 August 2025; originally issued 4 December 2024; current FDA listing and PDF checked 18 October 2026","control":"VII.B(3), first paragraph; PDF page 31 (printed page 27)","actor":"Manufacturers of AI-enabled device software functions (AI-DSFs) seeking or using a PCCP","modality":"should","action":"define","object":"AI acceptance criteria","condition":"Within this guidance's AI-DSF PCCP scope: device modifications planned over time, including eligible device constituents of device-led combination products; not general organizational AI use. Predefine criteria for each planned device modification alongside appropriate metrics, study design and statistics. Same reusable intent as the existing acceptance-criteria rule; device/PCCP scope remains a distinct mapping.","timing":"Before evaluating planned modifications","exception":"Final guidance contains nonbinding recommendations; alternative approaches may satisfy applicable statutes and regulations. No exemption from required FDA authorization is inferred. Drug/biologic constituents are not covered by this guidance's device recommendations. ","authority":"FDA final nonbinding guidance; recommendation only, distinct from any cited statutory duties or device-specific authorization conditions","jurisdiction":"United States; FDA-regulated AI-enabled medical devices","evidenceSummary":"Exact section and physical PDF page read from the FDA's 49-page final guidance on 18 October 2026; printed page is also identified. Original atomic candidate paraphrase, not a new October 2026 requirement. The January 2025 lifecycle-management document is still listed separately as draft/not for implementation. Legacy QSR cross-references in the 2025 text were not extracted as current standalone duties.","url":"https://www.fda.gov/media/166704/download#page=31","ruleId":"AIR-07E86EC44F","intent":"define ai acceptance criteria","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-18T13:06:08.468Z","reviewed_at":null},{"id":"finding-5710e7dfd93ecba84f8907d4349e8913b86b45056a11e2d59a287fb3d1680c78","kind":"rule-candidate","status":"pending","body":{"title":"Enumerate proposed device changes","sourceTitle":"Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence-Enabled Device Software Functions","sourceVersion":"Final guidance issued 18 August 2025; originally issued 4 December 2024; current FDA listing and PDF checked 18 October 2026","control":"VI.B, opening paragraph; PDF page 25 (printed page 21)","actor":"Manufacturers of AI-enabled device software functions (AI-DSFs) seeking or using a PCCP","modality":"should","action":"enumerate","object":"individual proposed PCCP device modifications","condition":"Within this guidance's AI-DSF PCCP scope: device modifications planned over time, including eligible device constituents of device-led combination products; not general organizational AI use. In the Description of Modifications, list each planned modification. Rationale, testing and implementation methods remain separate source actions.","timing":"When preparing the proposed PCCP","exception":"Final guidance contains nonbinding recommendations; alternative approaches may satisfy applicable statutes and regulations. No exemption from required FDA authorization is inferred. Drug/biologic constituents are not covered by this guidance's device recommendations. ","authority":"FDA final nonbinding guidance; recommendation only, distinct from any cited statutory duties or device-specific authorization conditions","jurisdiction":"United States; FDA-regulated AI-enabled medical devices","evidenceSummary":"Exact section and physical PDF page read from the FDA's 49-page final guidance on 18 October 2026; printed page is also identified. Original atomic candidate paraphrase, not a new October 2026 requirement. The January 2025 lifecycle-management document is still listed separately as draft/not for implementation. Legacy QSR cross-references in the 2025 text were not extracted as current standalone duties.","url":"https://www.fda.gov/media/166704/download#page=25","ruleId":"AIR-263476C75F","intent":"enumerate individual proposed pccp device modifications","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-18T13:06:08.468Z","reviewed_at":null},{"id":"finding-65338599b0ac85b51dd21e5c43f58d9aa39c3ea120ce067273c63591be2917f8","kind":"rule-candidate","status":"pending","body":{"title":"Describe communications about device updates","sourceTitle":"Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence-Enabled Device Software Functions","sourceVersion":"Final guidance issued 18 August 2025; originally issued 4 December 2024; current FDA listing and PDF checked 18 October 2026","control":"VII.B(4), 'What manufacturers should include in a submission', item 4; PDF page 33 (printed page 29)","actor":"Manufacturers of AI-enabled device software functions (AI-DSFs) seeking or using a PCCP","modality":"should","action":"document","object":"PCCP device-update communications to users","condition":"Within this guidance's AI-DSF PCCP scope: device modifications planned over time, including eligible device constituents of device-led combination products; not general organizational AI use. Describe how modifications will be communicated, including performance/input differences and addressed known issues; performance-change communications are consistent with the protocol's evaluation.","timing":"In the update procedures before rollout","exception":"Final guidance contains nonbinding recommendations; alternative approaches may satisfy applicable statutes and regulations. No exemption from required FDA authorization is inferred. Drug/biologic constituents are not covered by this guidance's device recommendations. ","authority":"FDA final nonbinding guidance; recommendation only, distinct from any cited statutory duties or device-specific authorization conditions","jurisdiction":"United States; FDA-regulated AI-enabled medical devices","evidenceSummary":"Exact section and physical PDF page read from the FDA's 49-page final guidance on 18 October 2026; printed page is also identified. Original atomic candidate paraphrase, not a new October 2026 requirement. The January 2025 lifecycle-management document is still listed separately as draft/not for implementation. Legacy QSR cross-references in the 2025 text were not extracted as current standalone duties.","url":"https://www.fda.gov/media/166704/download#page=33","ruleId":"AIR-22FFBCB55A","intent":"document pccp device update communications to users","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-18T13:06:08.468Z","reviewed_at":null},{"id":"finding-6699a30d3f0258ac06aa50c2cf78d831d7dd176199b2b50cf92d7fdbdd952247","kind":"rule-candidate","status":"pending","body":{"title":"Describe test-data access restrictions","sourceTitle":"Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence-Enabled Device Software Functions","sourceVersion":"Final guidance issued 18 August 2025; originally issued 4 December 2024; current FDA listing and PDF checked 18 October 2026","control":"VII.B(1), final clause of submission-content paragraph; PDF page 30 (printed page 26)","actor":"Manufacturers of AI-enabled device software functions (AI-DSFs) seeking or using a PCCP","modality":"should","action":"document","object":"performance-test-data access restrictions","condition":"Within this guidance's AI-DSF PCCP scope: device modifications planned over time, including eligible device constituents of device-led combination products; not general organizational AI use. Describe protocols preventing access during training, tuning and testing to the data reserved for performance testing; preserve the source's specified purpose and scope.","timing":"In the Modification Protocol","exception":"Final guidance contains nonbinding recommendations; alternative approaches may satisfy applicable statutes and regulations. No exemption from required FDA authorization is inferred. Drug/biologic constituents are not covered by this guidance's device recommendations. ","authority":"FDA final nonbinding guidance; recommendation only, distinct from any cited statutory duties or device-specific authorization conditions","jurisdiction":"United States; FDA-regulated AI-enabled medical devices","evidenceSummary":"Exact section and physical PDF page read from the FDA's 49-page final guidance on 18 October 2026; printed page is also identified. Original atomic candidate paraphrase, not a new October 2026 requirement. The January 2025 lifecycle-management document is still listed separately as draft/not for implementation. Legacy QSR cross-references in the 2025 text were not extracted as current standalone duties.","url":"https://www.fda.gov/media/166704/download#page=30","ruleId":"AIR-F69D7851A2","intent":"document performance test data access restrictions","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-18T13:06:08.468Z","reviewed_at":null},{"id":"finding-86ac83f3e8921a3b5205196762b9953229d1d0ccc79b09147f8e405b090983f0","kind":"rule-candidate","status":"pending","body":{"title":"Assess combined modification effects","sourceTitle":"Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence-Enabled Device Software Functions","sourceVersion":"Final guidance issued 18 August 2025; originally issued 4 December 2024; current FDA listing and PDF checked 18 October 2026","control":"VIII, Impact Assessment item 5; PDF page 34 (printed page 30)","actor":"Manufacturers of AI-enabled device software functions (AI-DSFs) seeking or using a PCCP","modality":"should","action":"assess","object":"cumulative impact of all PCCP modifications","condition":"Within this guidance's AI-DSF PCCP scope: device modifications planned over time, including eligible device constituents of device-led combination products; not general organizational AI use. The Impact Assessment describes the combined effects of implementing all planned modifications, separately from each modification's individual risks.","timing":"During the PCCP impact assessment","exception":"Final guidance contains nonbinding recommendations; alternative approaches may satisfy applicable statutes and regulations. No exemption from required FDA authorization is inferred. Drug/biologic constituents are not covered by this guidance's device recommendations. ","authority":"FDA final nonbinding guidance; recommendation only, distinct from any cited statutory duties or device-specific authorization conditions","jurisdiction":"United States; FDA-regulated AI-enabled medical devices","evidenceSummary":"Exact section and physical PDF page read from the FDA's 49-page final guidance on 18 October 2026; printed page is also identified. Original atomic candidate paraphrase, not a new October 2026 requirement. The January 2025 lifecycle-management document is still listed separately as draft/not for implementation. Legacy QSR cross-references in the 2025 text were not extracted as current standalone duties.","url":"https://www.fda.gov/media/166704/download#page=34","ruleId":"AIR-0A2F580F9A","intent":"assess cumulative impact of all pccp modifications","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-18T13:06:08.468Z","reviewed_at":null},{"id":"finding-87907e8914af87adb80d90c1ed4dc779be776eb8edfac202097a2d446536ef2a","kind":"rule-candidate","status":"pending","body":{"title":"Withhold modifications that fail evaluation","sourceTitle":"Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence-Enabled Device Software Functions","sourceVersion":"Final guidance issued 18 August 2025; originally issued 4 December 2024; current FDA listing and PDF checked 18 October 2026","control":"VII.B(3), final submission-content paragraph, non-implementation limb; PDF page 31 (printed page 27)","actor":"Manufacturers of AI-enabled device software functions (AI-DSFs) seeking or using a PCCP","modality":"should","action":"withhold","object":"AI-device modifications with unresolvable evaluation failures","condition":"Within this guidance's AI-DSF PCCP scope: device modifications planned over time, including eligible device constituents of device-led combination products; not general organizational AI use. The protocol should affirm that the specific modification will not be implemented if its performance evaluation has an unresolvable failure. This is not a statement that all resolved or unrelated failures permanently prohibit updates.","timing":"Before implementation of a modification with unresolvable evaluation failure","exception":"Final guidance contains nonbinding recommendations; alternative approaches may satisfy applicable statutes and regulations. No exemption from required FDA authorization is inferred. Drug/biologic constituents are not covered by this guidance's device recommendations. A root-cause analysis showing failure unrelated to specific PCCP aspects permits repeat performance testing under the stated guidance.","authority":"FDA final nonbinding guidance; recommendation only, distinct from any cited statutory duties or device-specific authorization conditions","jurisdiction":"United States; FDA-regulated AI-enabled medical devices","evidenceSummary":"Exact section and physical PDF page read from the FDA's 49-page final guidance on 18 October 2026; printed page is also identified. Original atomic candidate paraphrase, not a new October 2026 requirement. The January 2025 lifecycle-management document is still listed separately as draft/not for implementation. Legacy QSR cross-references in the 2025 text were not extracted as current standalone duties.","url":"https://www.fda.gov/media/166704/download#page=31","ruleId":"AIR-B67DF35C10","intent":"withhold ai device modifications with unresolvable evaluation failures","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-18T13:06:08.468Z","reviewed_at":null},{"id":"finding-95cc50b36c1f1e9f84719dcb4c8c180454b6fad84c8db161698a02f22aebcb92","kind":"rule-candidate","status":"pending","body":{"title":"Describe local adaptation triggers","sourceTitle":"Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence-Enabled Device Software Functions","sourceVersion":"Final guidance issued 18 August 2025; originally issued 4 December 2024; current FDA listing and PDF checked 18 October 2026","control":"VI.B, paragraph beginning 'The Description of Modifications should also clearly specify'; PDF page 25 (printed page 21)","actor":"Manufacturers of AI-enabled device software functions (AI-DSFs) seeking or using a PCCP","modality":"should","action":"document","object":"local AI-device adaptation triggers","condition":"Within this guidance's AI-DSF PCCP scope: device modifications planned over time, including eligible device constituents of device-led combination products; not general organizational AI use. If the proposed PCCP includes local rather than uniform/global adaptations, describe factors or conditions warranting the local change.","timing":"In the proposed PCCP before local adaptations","exception":"Final guidance contains nonbinding recommendations; alternative approaches may satisfy applicable statutes and regulations. No exemption from required FDA authorization is inferred. Drug/biologic constituents are not covered by this guidance's device recommendations. ","authority":"FDA final nonbinding guidance; recommendation only, distinct from any cited statutory duties or device-specific authorization conditions","jurisdiction":"United States; FDA-regulated AI-enabled medical devices","evidenceSummary":"Exact section and physical PDF page read from the FDA's 49-page final guidance on 18 October 2026; printed page is also identified. Original atomic candidate paraphrase, not a new October 2026 requirement. The January 2025 lifecycle-management document is still listed separately as draft/not for implementation. Legacy QSR cross-references in the 2025 text were not extracted as current standalone duties.","url":"https://www.fda.gov/media/166704/download#page=25","ruleId":"AIR-5BEDB33F22","intent":"document local ai device adaptation triggers","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-18T13:06:08.468Z","reviewed_at":null},{"id":"finding-a88d487ed401b40d2a60b01dbd2cbed0575f361fd2a1a65e06779f32129a4984","kind":"rule-candidate","status":"pending","body":{"title":"Document train/tune/test separation","sourceTitle":"Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence-Enabled Device Software Functions","sourceVersion":"Final guidance issued 18 August 2025; originally issued 4 December 2024; current FDA listing and PDF checked 18 October 2026","control":"VII.B(1), 'What manufacturers should include in a submission'; PDF page 30 (printed page 26)","actor":"Manufacturers of AI-enabled device software functions (AI-DSFs) seeking or using a PCCP","modality":"should","action":"document","object":"training tuning and test-data separation strategies","condition":"Within this guidance's AI-DSF PCCP scope: device modifications planned over time, including eligible device constituents of device-led combination products; not general organizational AI use. Describe sequestration during collection for the modification's training, tuning and test sets; this candidate is for documentation, not proof of implemented separation.","timing":"In the Modification Protocol before modification testing","exception":"Final guidance contains nonbinding recommendations; alternative approaches may satisfy applicable statutes and regulations. No exemption from required FDA authorization is inferred. Drug/biologic constituents are not covered by this guidance's device recommendations. ","authority":"FDA final nonbinding guidance; recommendation only, distinct from any cited statutory duties or device-specific authorization conditions","jurisdiction":"United States; FDA-regulated AI-enabled medical devices","evidenceSummary":"Exact section and physical PDF page read from the FDA's 49-page final guidance on 18 October 2026; printed page is also identified. Original atomic candidate paraphrase, not a new October 2026 requirement. The January 2025 lifecycle-management document is still listed separately as draft/not for implementation. Legacy QSR cross-references in the 2025 text were not extracted as current standalone duties.","url":"https://www.fda.gov/media/166704/download#page=30","ruleId":"AIR-111A3152CD","intent":"document training tuning and test data separation strategies","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-18T13:06:08.468Z","reviewed_at":null},{"id":"finding-ce3e2c5f322ef4451839b6ff66a2a3644989e0cf03c789ef24059e15839bdb8e","kind":"rule-candidate","status":"pending","body":{"title":"Identify retraining triggers","sourceTitle":"Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence-Enabled Device Software Functions","sourceVersion":"Final guidance issued 18 August 2025; originally issued 4 December 2024; current FDA listing and PDF checked 18 October 2026","control":"VII.B(2), submission-content paragraph continued onto printed p.27; PDF page 31 (printed page 27)","actor":"Manufacturers of AI-enabled device software functions (AI-DSFs) seeking or using a PCCP","modality":"should","action":"identify","object":"AI-device retraining triggers","condition":"Within this guidance's AI-DSF PCCP scope: device modifications planned over time, including eligible device constituents of device-led combination products; not general organizational AI use. Triggers may include volume of new data or observed drift; these are examples rather than universally required trigger values.","timing":"When defining retraining practices","exception":"Final guidance contains nonbinding recommendations; alternative approaches may satisfy applicable statutes and regulations. No exemption from required FDA authorization is inferred. Drug/biologic constituents are not covered by this guidance's device recommendations. ","authority":"FDA final nonbinding guidance; recommendation only, distinct from any cited statutory duties or device-specific authorization conditions","jurisdiction":"United States; FDA-regulated AI-enabled medical devices","evidenceSummary":"Exact section and physical PDF page read from the FDA's 49-page final guidance on 18 October 2026; printed page is also identified. Original atomic candidate paraphrase, not a new October 2026 requirement. The January 2025 lifecycle-management document is still listed separately as draft/not for implementation. Legacy QSR cross-references in the 2025 text were not extracted as current standalone duties.","url":"https://www.fda.gov/media/166704/download#page=31","ruleId":"AIR-FB999AE28F","intent":"identify ai device retraining triggers","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-18T13:06:08.468Z","reviewed_at":null},{"id":"finding-d1f271f786194a8fe561cabdd84e67382b1d73e24480a80a8bf78adc9755b67d","kind":"rule-candidate","status":"pending","body":{"title":"Trace modifications to protocol methods","sourceTitle":"Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence-Enabled Device Software Functions","sourceVersion":"Final guidance issued 18 August 2025; originally issued 4 December 2024; current FDA listing and PDF checked 18 October 2026","control":"VII.C, opening paragraph; PDF page 33 (printed page 29)","actor":"Manufacturers of AI-enabled device software functions (AI-DSFs) seeking or using a PCCP","modality":"should","action":"map","object":"PCCP modifications to supporting protocol methods","condition":"Within this guidance's AI-DSF PCCP scope: device modifications planned over time, including eligible device constituents of device-led combination products; not general organizational AI use. Clearly identify which data-management, retraining, performance-evaluation and update-procedure methods apply to each described modification. A traceability table is an example, not the only permitted representation.","timing":"When assembling or revising a PCCP","exception":"Final guidance contains nonbinding recommendations; alternative approaches may satisfy applicable statutes and regulations. No exemption from required FDA authorization is inferred. Drug/biologic constituents are not covered by this guidance's device recommendations. ","authority":"FDA final nonbinding guidance; recommendation only, distinct from any cited statutory duties or device-specific authorization conditions","jurisdiction":"United States; FDA-regulated AI-enabled medical devices","evidenceSummary":"Exact section and physical PDF page read from the FDA's 49-page final guidance on 18 October 2026; printed page is also identified. Original atomic candidate paraphrase, not a new October 2026 requirement. The January 2025 lifecycle-management document is still listed separately as draft/not for implementation. Legacy QSR cross-references in the 2025 text were not extracted as current standalone duties.","url":"https://www.fda.gov/media/166704/download#page=33","ruleId":"AIR-7EA3DA63D9","intent":"map pccp modifications to supporting protocol methods","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-18T13:06:08.468Z","reviewed_at":null},{"id":"change-eu-ai-act-33400cad7f7b19a58e6d418f0d8539b8c1c41cbd9465061c5b36fd175a996e18","kind":"source-change","status":"pending","body":{"sourceId":"eu-ai-act","title":"EU Artificial Intelligence Act","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","status":"publisher-bytes-changed","checkedAt":"2026-10-18T13:03:10.096Z","fingerprint":"33400cad7f7b19a58e6d418f0d8539b8c1c41cbd9465061c5b36fd175a996e18","previousFingerprint":"3dd0cecff16f621ca02e49038f6f44f1754414c8ae8ea2c3f3f91fafcbe456d4","bytes":1535221,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-18T13:03:10.096Z","reviewed_at":null},{"id":"change-eu-gdpr-4f25679303fc908879f9a3c6eb190add841227bdf553c7dc991f3103e595ee2d","kind":"source-change","status":"pending","body":{"sourceId":"eu-gdpr","title":"General Data Protection Regulation","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","status":"publisher-bytes-changed","checkedAt":"2026-10-18T13:03:10.096Z","fingerprint":"4f25679303fc908879f9a3c6eb190add841227bdf553c7dc991f3103e595ee2d","previousFingerprint":"32a0b17e91313c79b22d5c41eecb1d2220a48bc45af860134c46c0136af5a2fb","bytes":1071070,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-18T13:03:10.096Z","reviewed_at":null},{"id":"finding-13c7fbd1b72599bea21d3ad6540c5dcafd7c68762ef1022516440558dcf4b87c","kind":"rule-candidate","status":"pending","body":{"title":"Analyze AI logs for anomalous behavior","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025; current official HTML and dateModified 2025-01-31 checked 17 October 2026","control":"Clause 12.2","actor":"System Operators","modality":"should","action":"analyze","object":"AI system logs","condition":"Within the voluntary Code's AI-system scope. Use logs to check continued desired output and detect anomalies, breaches or unexpected behavior, including drift or poisoning.","exception":"The Code is not designed for research-only academic systems that will not be deployed. Open-source applicability requires the implementation guide. ","timing":"Over time during operation","authority":"Voluntary UK government code; 'must' preserves source 'shall' as a requirement for following this voluntary Code, not a freestanding statutory duty; 'should' preserves its recommendation.","jurisdiction":"United Kingdom; role-based voluntary AI supply-chain code","evidenceSummary":"Exact numbered clause in official GOV.UK HTML read 17 October 2026. Original atomic paraphrase; pending owner review. This is an additional extraction from the 2025 edition, not a newly enacted or revised duty.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai#principle-12-monitor-your-systems-behaviour","ruleId":"AIR-E79CF56C27","intent":"analyze ai system logs","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-17T13:04:04.186Z","reviewed_at":null},{"id":"finding-14df702d3e9d2bcd82976f0a783fbe5a520d05fd6deea215c5cee6ca47782492","kind":"rule-candidate","status":"pending","body":{"title":"Assess poorly documented or unsecured AI components","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025; current official HTML and dateModified 2025-01-31 checked 17 October 2026","control":"Clause 7.2.1 — assessment limb","actor":"Developers and System Operators","modality":"must","action":"assess","object":"third-party AI supply-chain risks","condition":"Within the voluntary Code's AI-system scope. The clause 7.2 situation applies: a model or component used or adapted is not well documented or secured. Mitigating controls are a separate companion action.","exception":"The Code is not designed for research-only academic systems that will not be deployed. Open-source applicability requires the implementation guide. ","timing":"When choosing or adapting those components","authority":"Voluntary UK government code; 'must' preserves source 'shall' as a requirement for following this voluntary Code, not a freestanding statutory duty; 'should' preserves its recommendation.","jurisdiction":"United Kingdom; role-based voluntary AI supply-chain code","evidenceSummary":"Exact numbered clause in official GOV.UK HTML read 17 October 2026. Original atomic paraphrase; pending owner review. This is an additional extraction from the 2025 edition, not a newly enacted or revised duty. Shares the existing supply-chain risk-assessment intent; the poorly-documented/unsecured-component trigger, actors and force remain a distinct variant.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai#principle-7-secure-your-supply-chain","ruleId":"AIR-3A61647692","intent":"assess third party ai supply chain risks","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-17T13:04:04.186Z","reviewed_at":null},{"id":"finding-2079b6ff138eeb152a3d51e3bcaec46ade4705324e0392b9d60bba8e6e1f5dcd","kind":"rule-candidate","status":"pending","body":{"title":"Define deployment acceptance criteria","sourceTitle":"Guidance for AI Adoption: Implementation Guidance","sourceVersion":"October 2025 document edition; official HTML checked 17 October 2026. Current PDF download listing says published 5 May 2026; that listing date is not treated as a revised edition.","control":"5.1.2 — acceptance-criteria limb","actor":"Organizations developing or deploying AI systems","modality":"should","action":"define","object":"AI acceptance criteria","condition":"Voluntary implementation practices for Australian AI developers and deployers, tailored to context and risk. Reflect intended use, deployment context and risks identified under Essential Practice 3. Test methods, communicating criteria and conducting tests are separate actions.","exception":"No automatic adoption into another organization; independently applicable laws, contracts and stricter requirements remain separate. These recommendations do not certify compliance.","timing":"Before deployment","authority":"Australian government voluntary implementation guidance, not an independent statutory mandate","jurisdiction":"Australia","evidenceSummary":"Exact numbered control read 17 October 2026 through the official industry.gov.au publisher link, which now redirects to ai.gov.au/staying-safe-and-responsible/essential-ai-practices/guidance-ai-adoption-implementation-guidance. October 2025 PDF edition distinguished from its 5 May 2026 download-listing date. Original atomic paraphrase, pending review.","url":"https://www.industry.gov.au/publications/guidance-ai-adoption","ruleId":"AIR-07E86EC44F","intent":"define ai acceptance criteria","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-17T13:04:04.186Z","reviewed_at":null},{"id":"finding-209e03aba5f12531b29845ede7b959b05c9b4dc5a6e484e5a63db9c4d0b3c7eb","kind":"rule-candidate","status":"pending","body":{"title":"Monitor internal states when useful for security","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025; current official HTML and dateModified 2025-01-31 checked 17 October 2026","control":"Clause 12.3","actor":"System Operators and Developers","modality":"should","action":"monitor","object":"AI internal states","condition":"Within the voluntary Code's AI-system scope. Do so where it could improve handling of security threats or enable future security analytics; not an unconditional demand for all internal states.","exception":"The Code is not designed for research-only academic systems that will not be deployed. Open-source applicability requires the implementation guide. ","timing":"During operation where the security-benefit condition applies","authority":"Voluntary UK government code; 'must' preserves source 'shall' as a requirement for following this voluntary Code, not a freestanding statutory duty; 'should' preserves its recommendation.","jurisdiction":"United Kingdom; role-based voluntary AI supply-chain code","evidenceSummary":"Exact numbered clause in official GOV.UK HTML read 17 October 2026. Original atomic paraphrase; pending owner review. This is an additional extraction from the 2025 edition, not a newly enacted or revised duty.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai#principle-12-monitor-your-systems-behaviour","ruleId":"AIR-0B81A2B5B4","intent":"monitor ai internal states","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-17T13:04:04.186Z","reviewed_at":null},{"id":"finding-20df3e2b9d565a19bb13012628d180ef352c614b9f90e6e0946af10cf46aa48e","kind":"rule-candidate","status":"pending","body":{"title":"Share justification for risky component choices","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025; current official HTML and dateModified 2025-01-31 checked 17 October 2026","control":"Clause 7.2.2","actor":"System Operators","modality":"must","action":"share","object":"component risk-acceptance documentation with End-users","condition":"Within the voluntary Code's AI-system scope. The clause 7.2 choice has been made; share the documentation accessibly. This does not itself authorize the component choice.","exception":"The Code is not designed for research-only academic systems that will not be deployed. Open-source applicability requires the implementation guide. ","timing":"When using or adapting those components","authority":"Voluntary UK government code; 'must' preserves source 'shall' as a requirement for following this voluntary Code, not a freestanding statutory duty; 'should' preserves its recommendation.","jurisdiction":"United Kingdom; role-based voluntary AI supply-chain code","evidenceSummary":"Exact numbered clause in official GOV.UK HTML read 17 October 2026. Original atomic paraphrase; pending owner review. This is an additional extraction from the 2025 edition, not a newly enacted or revised duty.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai#principle-7-secure-your-supply-chain","ruleId":"AIR-2AEA7C34AC","intent":"share component risk acceptance documentation with end users","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-17T13:04:04.186Z","reviewed_at":null},{"id":"finding-22f9046eba62e7c0a861a8cfacb276c252965c88de8c190bfb48a4ed1bd51a86","kind":"rule-candidate","status":"pending","body":{"title":"Document each AI system's use context","sourceTitle":"Guidance for AI Adoption: Implementation Guidance","sourceVersion":"October 2025 document edition; official HTML checked 17 October 2026. Current PDF download listing says published 5 May 2026; that listing date is not treated as a revised edition.","control":"2.1.4","actor":"Organizations developing or deploying AI systems","modality":"should","action":"document","object":"intended AI use contexts","condition":"Voluntary implementation practices for Australian AI developers and deployers, tailored to context and risk. For each AI system, scope documentation includes intended uses, foreseeable misuse, capabilities, limitations and expected context.","exception":"No automatic adoption into another organization; independently applicable laws, contracts and stricter requirements remain separate. These recommendations do not certify compliance.","timing":"For each AI system","authority":"Australian government voluntary implementation guidance, not an independent statutory mandate","jurisdiction":"Australia","evidenceSummary":"Exact numbered control read 17 October 2026 through the official industry.gov.au publisher link, which now redirects to ai.gov.au/staying-safe-and-responsible/essential-ai-practices/guidance-ai-adoption-implementation-guidance. October 2025 PDF edition distinguished from its 5 May 2026 download-listing date. Original atomic paraphrase, pending review.","url":"https://www.industry.gov.au/publications/guidance-ai-adoption","ruleId":"AIR-F61F6AC2CB","intent":"document intended ai use contexts","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-17T13:04:04.186Z","reviewed_at":null},{"id":"finding-49d53ffb158fe19c9e2bb47350b3f58319f5c87ce39191e7b6585b98cfad764f","kind":"rule-candidate","status":"pending","body":{"title":"Triage high-risk AI systems","sourceTitle":"Guidance for AI Adoption: Implementation Guidance","sourceVersion":"October 2025 document edition; official HTML checked 17 October 2026. Current PDF download listing says published 5 May 2026; that listing date is not treated as a revised edition.","control":"3.2.1","actor":"Organizations developing or deploying AI systems","modality":"should","action":"establish","object":"AI system risk triage","condition":"Voluntary implementation practices for Australian AI developers and deployers, tailored to context and risk. Determine which systems may present enhanced or unacceptable risks using the organization's context and risk tolerance.","exception":"No automatic adoption into another organization; independently applicable laws, contracts and stricter requirements remain separate. These recommendations do not certify compliance.","timing":"During AI system risk assessment","authority":"Australian government voluntary implementation guidance, not an independent statutory mandate","jurisdiction":"Australia","evidenceSummary":"Exact numbered control read 17 October 2026 through the official industry.gov.au publisher link, which now redirects to ai.gov.au/staying-safe-and-responsible/essential-ai-practices/guidance-ai-adoption-implementation-guidance. October 2025 PDF edition distinguished from its 5 May 2026 download-listing date. Original atomic paraphrase, pending review.","url":"https://www.industry.gov.au/publications/guidance-ai-adoption","ruleId":"AIR-C2B1B0D97A","intent":"establish ai system risk triage","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-17T13:04:04.186Z","reviewed_at":null},{"id":"finding-52b71fea73580a43cb5383458e0679e9bfe66a610af3217f2ef37cff06e1e34e","kind":"rule-candidate","status":"pending","body":{"title":"Record public training data provenance","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025; current official HTML and dateModified 2025-01-31 checked 17 October 2026","control":"Clause 8.2","actor":"Developers","modality":"must","action":"document","object":"public training data provenance","condition":"Within the voluntary Code's AI-system scope. Training data comes from publicly available sources; documentation covers acquisition method, origin and use in the model.","exception":"The Code is not designed for research-only academic systems that will not be deployed. Open-source applicability requires the implementation guide. ","timing":"When publicly sourced training data is used","authority":"Voluntary UK government code; 'must' preserves source 'shall' as a requirement for following this voluntary Code, not a freestanding statutory duty; 'should' preserves its recommendation.","jurisdiction":"United Kingdom; role-based voluntary AI supply-chain code","evidenceSummary":"Exact numbered clause in official GOV.UK HTML read 17 October 2026. Original atomic paraphrase; pending owner review. This is an additional extraction from the 2025 edition, not a newly enacted or revised duty.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai#principle-8-document-your-data-models-and-prompts","ruleId":"AIR-2B88FB47B2","intent":"document public training data provenance","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-17T13:04:04.186Z","reviewed_at":null},{"id":"finding-693d7fa9626a40c6af18969d510255d48b283c1dd6c229a8884f03f405bf2a2a","kind":"rule-candidate","status":"pending","body":{"title":"Assess AI supply-chain risk","sourceTitle":"Guidance for AI Adoption: Implementation Guidance","sourceVersion":"October 2025 document edition; official HTML checked 17 October 2026. Current PDF download listing says published 5 May 2026; that listing date is not treated as a revised edition.","control":"3.1.2 — assessment limb","actor":"Organizations developing or deploying AI systems","modality":"should","action":"assess","object":"third-party AI supply-chain risks","condition":"Voluntary implementation practices for Australian AI developers and deployers, tailored to context and risk. Risk processes cover other developers and deployers; both providers and consumers consider open-source model, system and component risks.","exception":"No automatic adoption into another organization; independently applicable laws, contracts and stricter requirements remain separate. These recommendations do not certify compliance.","timing":"Across AI supply-chain risk management","authority":"Australian government voluntary implementation guidance, not an independent statutory mandate","jurisdiction":"Australia","evidenceSummary":"Exact numbered control read 17 October 2026 through the official industry.gov.au publisher link, which now redirects to ai.gov.au/staying-safe-and-responsible/essential-ai-practices/guidance-ai-adoption-implementation-guidance. October 2025 PDF edition distinguished from its 5 May 2026 download-listing date. Original atomic paraphrase, pending review.","url":"https://www.industry.gov.au/publications/guidance-ai-adoption","ruleId":"AIR-3A61647692","intent":"assess third party ai supply chain risks","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-17T13:04:04.186Z","reviewed_at":null},{"id":"finding-7da53506c96698c0b198732950e17422c3040f415517eaa26da59d22f5d782f8","kind":"rule-candidate","status":"pending","body":{"title":"Evaluate outputs for reverse-engineering exposure","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025; current official HTML and dateModified 2025-01-31 checked 17 October 2026","control":"Clause 9.4","actor":"Developers","modality":"should","action":"evaluate","object":"outputs for non-public model or training-data disclosure","condition":"Within the voluntary Code's AI-system scope. Assess whether outputs let System Operators or End-users reverse engineer non-public model aspects or training data.","exception":"The Code is not designed for research-only academic systems that will not be deployed. Open-source applicability requires the implementation guide. ","timing":"During output security evaluation","authority":"Voluntary UK government code; 'must' preserves source 'shall' as a requirement for following this voluntary Code, not a freestanding statutory duty; 'should' preserves its recommendation.","jurisdiction":"United Kingdom; role-based voluntary AI supply-chain code","evidenceSummary":"Exact numbered clause in official GOV.UK HTML read 17 October 2026. Original atomic paraphrase; pending owner review. This is an additional extraction from the 2025 edition, not a newly enacted or revised duty.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai#principle-9-conduct-appropriate-testing-and-evaluation","ruleId":"AIR-84C8BD3E44","intent":"evaluate outputs for non public model or training data disclosure","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-17T13:04:04.186Z","reviewed_at":null},{"id":"finding-7e6142af874768d30aa5d2f8edde0624228e626e368e400e320d11712f93c568","kind":"rule-candidate","status":"pending","body":{"title":"Record organizational AI risk tolerance","sourceTitle":"Guidance for AI Adoption: Implementation Guidance","sourceVersion":"October 2025 document edition; official HTML checked 17 October 2026. Current PDF download listing says published 5 May 2026; that listing date is not treated as a revised edition.","control":"3.1.1 — risk-tolerance limb","actor":"Organizations developing or deploying AI systems","modality":"should","action":"document","object":"AI risk tolerance","condition":"Voluntary implementation practices for Australian AI developers and deployers, tailored to context and risk. Define organizational acceptable/unacceptable risk criteria with likelihood and significance of harms, aligned to AI policy and objectives.","exception":"No automatic adoption into another organization; independently applicable laws, contracts and stricter requirements remain separate. These recommendations do not certify compliance.","timing":"When establishing and revising AI risk management","authority":"Australian government voluntary implementation guidance, not an independent statutory mandate","jurisdiction":"Australia","evidenceSummary":"Exact numbered control read 17 October 2026 through the official industry.gov.au publisher link, which now redirects to ai.gov.au/staying-safe-and-responsible/essential-ai-practices/guidance-ai-adoption-implementation-guidance. October 2025 PDF edition distinguished from its 5 May 2026 download-listing date. Original atomic paraphrase, pending review.","url":"https://www.industry.gov.au/publications/guidance-ai-adoption","ruleId":"AIR-9EE4AB873B","intent":"document ai risk tolerance","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-17T13:04:04.186Z","reviewed_at":null},{"id":"finding-8a6e8e02d73762e294cb72f68ab4b4067d07f78f199f7861196ba8942758fc99","kind":"rule-candidate","status":"pending","body":{"title":"Plan mitigations when patching is unavailable","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025; current official HTML and dateModified 2025-01-31 checked 17 October 2026","control":"Clause 11.1.1","actor":"Developers","modality":"must","action":"maintain","object":"AI security contingency mechanisms","condition":"Within the voluntary Code's AI-system scope. Mitigate security risks, particularly when updates cannot be provided; mechanisms and contingency plans should cover this case.","exception":"The Code is not designed for research-only academic systems that will not be deployed. Open-source applicability requires the implementation guide. ","timing":"During maintenance, particularly where updates cannot be provided","authority":"Voluntary UK government code; 'must' preserves source 'shall' as a requirement for following this voluntary Code, not a freestanding statutory duty; 'should' preserves its recommendation.","jurisdiction":"United Kingdom; role-based voluntary AI supply-chain code","evidenceSummary":"Exact numbered clause in official GOV.UK HTML read 17 October 2026. Original atomic paraphrase; pending owner review. This is an additional extraction from the 2025 edition, not a newly enacted or revised duty.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai#principle-11-maintain-regular-security-updates-patches-and-mitigations","ruleId":"AIR-7D7800B6DD","intent":"maintain ai security contingency mechanisms","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-17T13:04:04.186Z","reviewed_at":null},{"id":"finding-90f547c0991e25c594bc26b8912747a74a3c1370b18adff48292e78f1aa0954b","kind":"rule-candidate","status":"pending","body":{"title":"Retest major AI updates","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025; current official HTML and dateModified 2025-01-31 checked 17 October 2026","control":"Clause 11.2","actor":"Developers","modality":"should","action":"security-test","object":"major AI system updates","condition":"Within the voluntary Code's AI-system scope. Treat a major update as a newly developed model version and undertake a fresh security testing/evaluation process.","exception":"The Code is not designed for research-only academic systems that will not be deployed. Open-source applicability requires the implementation guide. ","timing":"For major AI system updates","authority":"Voluntary UK government code; 'must' preserves source 'shall' as a requirement for following this voluntary Code, not a freestanding statutory duty; 'should' preserves its recommendation.","jurisdiction":"United Kingdom; role-based voluntary AI supply-chain code","evidenceSummary":"Exact numbered clause in official GOV.UK HTML read 17 October 2026. Original atomic paraphrase; pending owner review. This is an additional extraction from the 2025 edition, not a newly enacted or revised duty.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai#principle-11-maintain-regular-security-updates-patches-and-mitigations","ruleId":"AIR-4616E50FCE","intent":"security test major ai system updates","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-17T13:04:04.186Z","reviewed_at":null},{"id":"finding-bfb59a1748e25a9075180f5c6defb5027c7213ded1de2191d6d4623a69fa8070","kind":"rule-candidate","status":"pending","body":{"title":"Provide available AI security updates","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025; current official HTML and dateModified 2025-01-31 checked 17 October 2026","control":"Clause 11.1 — Developer patch limb","actor":"Developers","modality":"must","action":"provide","object":"AI security updates and patches","condition":"Within the voluntary Code's AI-system scope. Updates and patches can be provided. Notification to System Operators and delivery by System Operators remain separate source actions.","exception":"The Code is not designed for research-only academic systems that will not be deployed. Open-source applicability requires the implementation guide. The source expressly qualifies provision with 'where possible'; do not erase that limitation.","timing":"During secure maintenance, where possible","authority":"Voluntary UK government code; 'must' preserves source 'shall' as a requirement for following this voluntary Code, not a freestanding statutory duty; 'should' preserves its recommendation.","jurisdiction":"United Kingdom; role-based voluntary AI supply-chain code","evidenceSummary":"Exact numbered clause in official GOV.UK HTML read 17 October 2026. Original atomic paraphrase; pending owner review. This is an additional extraction from the 2025 edition, not a newly enacted or revised duty.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai#principle-11-maintain-regular-security-updates-patches-and-mitigations","ruleId":"AIR-3480DB4BB0","intent":"provide ai security updates and patches","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-17T13:04:04.186Z","reviewed_at":null},{"id":"finding-ce66a59ee02ca65590afe62b8a46c724460c7e25c7caae5c10c0dab6bf905343","kind":"rule-candidate","status":"pending","body":{"title":"Document AI training needs","sourceTitle":"Guidance for AI Adoption: Implementation Guidance","sourceVersion":"October 2025 document edition; official HTML checked 17 October 2026. Current PDF download listing says published 5 May 2026; that listing date is not treated as a revised edition.","control":"1.3.1 — training-needs documentation limb","actor":"Organizations developing or deploying AI systems","modality":"should","action":"document","object":"organizational AI training needs","condition":"Voluntary implementation practices for Australian AI developers and deployers, tailored to context and risk. Assess broad AI understanding and accountability culture; delivering training and checking skills are separate actions.","exception":"No automatic adoption into another organization; independently applicable laws, contracts and stricter requirements remain separate. These recommendations do not certify compliance.","timing":"As AI development and deployment evolves","authority":"Australian government voluntary implementation guidance, not an independent statutory mandate","jurisdiction":"Australia","evidenceSummary":"Exact numbered control read 17 October 2026 through the official industry.gov.au publisher link, which now redirects to ai.gov.au/staying-safe-and-responsible/essential-ai-practices/guidance-ai-adoption-implementation-guidance. October 2025 PDF edition distinguished from its 5 May 2026 download-listing date. Original atomic paraphrase, pending review.","url":"https://www.industry.gov.au/publications/guidance-ai-adoption","ruleId":"AIR-940E938C1F","intent":"document organizational ai training needs","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-17T13:04:04.186Z","reviewed_at":null},{"id":"finding-e59b0a77d894ac1f1f876a49c35436053d1d337d79ceba7e20fd5e595ce2c75d","kind":"rule-candidate","status":"pending","body":{"title":"Document AI data usage rights","sourceTitle":"Guidance for AI Adoption: Implementation Guidance","sourceVersion":"October 2025 document edition; official HTML checked 17 October 2026. Current PDF download listing says published 5 May 2026; that listing date is not treated as a revised edition.","control":"5.4.2 — data-usage-rights bullet","actor":"Organizations developing or deploying AI systems","modality":"should","action":"document","object":"AI data usage rights","condition":"Voluntary implementation practices for Australian AI developers and deployers, tailored to context and risk. For each use case, include intellectual property/copyright, Indigenous Data Sovereignty, privacy, confidentiality and contractual rights.","exception":"No automatic adoption into another organization; independently applicable laws, contracts and stricter requirements remain separate. These recommendations do not certify compliance.","timing":"For each AI use case","authority":"Australian government voluntary implementation guidance, not an independent statutory mandate","jurisdiction":"Australia","evidenceSummary":"Exact numbered control read 17 October 2026 through the official industry.gov.au publisher link, which now redirects to ai.gov.au/staying-safe-and-responsible/essential-ai-practices/guidance-ai-adoption-implementation-guidance. October 2025 PDF edition distinguished from its 5 May 2026 download-listing date. Original atomic paraphrase, pending review.","url":"https://www.industry.gov.au/publications/guidance-ai-adoption","ruleId":"AIR-DD6C2FB7A7","intent":"document ai data usage rights","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-17T13:04:04.186Z","reviewed_at":null},{"id":"finding-e5ddfeb448373433476dd867a5fc7519c95148994ff7521b623a1a3edace1c1f","kind":"rule-candidate","status":"pending","body":{"title":"Monitor sensitive-data leakage from AI","sourceTitle":"Guidance for AI Adoption: Implementation Guidance","sourceVersion":"October 2025 document edition; official HTML checked 17 October 2026. Current PDF download listing says published 5 May 2026; that listing date is not treated as a revised edition.","control":"5.4.2 — leakage-monitoring bullet","actor":"Organizations developing or deploying AI systems","modality":"should","action":"monitor","object":"personal and sensitive information leakage from AI models and systems","condition":"Voluntary implementation practices for Australian AI developers and deployers, tailored to context and risk. Monitor for leakage of personal and sensitive information; detection and incident handling need appropriate mechanisms and authority.","exception":"No automatic adoption into another organization; independently applicable laws, contracts and stricter requirements remain separate. These recommendations do not certify compliance.","timing":"During model and system use","authority":"Australian government voluntary implementation guidance, not an independent statutory mandate","jurisdiction":"Australia","evidenceSummary":"Exact numbered control read 17 October 2026 through the official industry.gov.au publisher link, which now redirects to ai.gov.au/staying-safe-and-responsible/essential-ai-practices/guidance-ai-adoption-implementation-guidance. October 2025 PDF edition distinguished from its 5 May 2026 download-listing date. Original atomic paraphrase, pending review.","url":"https://www.industry.gov.au/publications/guidance-ai-adoption","ruleId":"AIR-5FC6C99AD4","intent":"monitor personal and sensitive information leakage from ai models and systems","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-17T13:04:04.186Z","reviewed_at":null},{"id":"finding-ec3de3163d9f647b4e2753671d527e83855a169693482a946192f13fb53b373a","kind":"rule-candidate","status":"pending","body":{"title":"Delete applicable assets when decommissioning","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025; current official HTML and dateModified 2025-01-31 checked 17 October 2026","control":"Clause 13.2 — deletion limb","actor":"Developers or System Operators deciding to decommission a model or system","modality":"must","action":"delete","object":"decommissioned AI data and configuration","condition":"Within the voluntary Code's AI-system scope. Decommissioning is decided; securely delete applicable data and configuration details with Data Custodian involvement.","exception":"The Code is not designed for research-only academic systems that will not be deployed. Open-source applicability requires the implementation guide. Only applicable data and configuration are covered; this is not a blanket authorization to delete unrelated records.","timing":"On model or system decommissioning","authority":"Voluntary UK government code; 'must' preserves source 'shall' as a requirement for following this voluntary Code, not a freestanding statutory duty; 'should' preserves its recommendation.","jurisdiction":"United Kingdom; role-based voluntary AI supply-chain code","evidenceSummary":"Exact numbered clause in official GOV.UK HTML read 17 October 2026. Original atomic paraphrase; pending owner review. This is an additional extraction from the 2025 edition, not a newly enacted or revised duty.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai#principle-13-ensure-proper-data-and-model-disposal","ruleId":"AIR-2B0E2D9575","intent":"delete decommissioned ai data and configuration","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-17T13:04:04.186Z","reviewed_at":null},{"id":"finding-fcfa79b40f36f7174e894eb1ee55ad9af228c5ac8a32caca51cedfd66ad73a0b","kind":"rule-candidate","status":"pending","body":{"title":"Evaluate outputs for unintended system influence","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025; current official HTML and dateModified 2025-01-31 checked 17 October 2026","control":"Clause 9.4.1","actor":"Developers","modality":"should","action":"evaluate","object":"outputs for unintended system influence","condition":"Within the voluntary Code's AI-system scope. Assess whether model outputs give System Operators or End-users unintended influence over the system.","exception":"The Code is not designed for research-only academic systems that will not be deployed. Open-source applicability requires the implementation guide. ","timing":"During output security evaluation","authority":"Voluntary UK government code; 'must' preserves source 'shall' as a requirement for following this voluntary Code, not a freestanding statutory duty; 'should' preserves its recommendation.","jurisdiction":"United Kingdom; role-based voluntary AI supply-chain code","evidenceSummary":"Exact numbered clause in official GOV.UK HTML read 17 October 2026. Original atomic paraphrase; pending owner review. This is an additional extraction from the 2025 edition, not a newly enacted or revised duty.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai#principle-9-conduct-appropriate-testing-and-evaluation","ruleId":"AIR-E39D075503","intent":"evaluate outputs for unintended system influence","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-17T13:04:04.186Z","reviewed_at":null},{"id":"finding-ff40fabdc11ce238d4582eb151d3d133df08d45b929a5b649198bbf502455222","kind":"rule-candidate","status":"pending","body":{"title":"Mitigate attacks through externally offered AI APIs","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025; current official HTML and dateModified 2025-01-31 checked 17 October 2026","control":"Clause 6.2","actor":"Developers offering an AI API to external customers or collaborators","modality":"must","action":"apply","object":"AI API attack mitigations","condition":"Within the voluntary Code's AI-system scope. An API is offered externally; controls address attacks through that API. Rate limits are an example, not a universally mandated control.","exception":"The Code is not designed for research-only academic systems that will not be deployed. Open-source applicability requires the implementation guide. ","timing":"When offering the external API","authority":"Voluntary UK government code; 'must' preserves source 'shall' as a requirement for following this voluntary Code, not a freestanding statutory duty; 'should' preserves its recommendation.","jurisdiction":"United Kingdom; role-based voluntary AI supply-chain code","evidenceSummary":"Exact numbered clause in official GOV.UK HTML read 17 October 2026. Original atomic paraphrase; pending owner review. This is an additional extraction from the 2025 edition, not a newly enacted or revised duty.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai#principle-6-secure-your-infrastructure","ruleId":"AIR-5A9E810E50","intent":"apply ai api attack mitigations","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-17T13:04:04.186Z","reviewed_at":null},{"id":"change-eu-ai-act-3dd0cecff16f621ca02e49038f6f44f1754414c8ae8ea2c3f3f91fafcbe456d4","kind":"source-change","status":"pending","body":{"sourceId":"eu-ai-act","title":"EU Artificial Intelligence Act","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","status":"publisher-bytes-changed","checkedAt":"2026-10-17T13:00:32.672Z","fingerprint":"3dd0cecff16f621ca02e49038f6f44f1754414c8ae8ea2c3f3f91fafcbe456d4","previousFingerprint":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","bytes":1535183,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-17T13:00:32.672Z","reviewed_at":null},{"id":"change-eu-gdpr-32a0b17e91313c79b22d5c41eecb1d2220a48bc45af860134c46c0136af5a2fb","kind":"source-change","status":"pending","body":{"sourceId":"eu-gdpr","title":"General Data Protection Regulation","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","status":"publisher-bytes-changed","checkedAt":"2026-10-17T13:00:32.672Z","fingerprint":"32a0b17e91313c79b22d5c41eecb1d2220a48bc45af860134c46c0136af5a2fb","previousFingerprint":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","bytes":1071030,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-17T13:00:32.672Z","reviewed_at":null},{"id":"change-msu-genai-guidelines-db41f2bc66f43a9dd344d6b68fcb32480d564066b8518f8565af7a28220fb398","kind":"source-change","status":"pending","body":{"sourceId":"msu-genai-guidelines","title":"Guidelines for the Use of Generative Artificial Intelligence Tools","url":"https://ai.msu.edu/guidelines","status":"publisher-bytes-changed","checkedAt":"2026-10-17T13:00:32.672Z","fingerprint":"db41f2bc66f43a9dd344d6b68fcb32480d564066b8518f8565af7a28220fb398","previousFingerprint":"a52faac3cc4647c69c3dbf34092a05b07955111a8190153c82789f5c677e1efa","bytes":706968,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-17T13:00:32.672Z","reviewed_at":null},{"id":"change-cisa-ncsc-secure-ai-development-ce44a7cc4771a4d57db5c0b4d3f602fb42c1f51a2eb3af066b01e0b9467c852e","kind":"source-change","status":"pending","body":{"sourceId":"cisa-ncsc-secure-ai-development","title":"Guidelines for Secure AI System Development","url":"https://www.ncsc.gov.uk/collection/guidelines-secure-ai-system-development/guidelines/secure-development","status":"publisher-bytes-changed","checkedAt":"2026-10-17T13:00:27.359Z","fingerprint":"ce44a7cc4771a4d57db5c0b4d3f602fb42c1f51a2eb3af066b01e0b9467c852e","previousFingerprint":"67dbd2fc3af682ed557176113d621ce2ed770c11ed69ec3f8412de6ab94860e2","bytes":235216,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-17T13:00:27.359Z","reviewed_at":null},{"id":"finding-009c977ad2f8be2f84f2ff72bc526800e74109d919f6a0209e11a54fdac50b84","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Measures for Labeling AI-Generated and Synthetic Content (人工智能生成合成内容标识办法)","sourceVersion":"Guoxinban Tong Zi [2025] No.2; issued 7 March 2025, published 14 March 2025; effective 1 September 2025; Chinese publisher text checked 16 October 2026","modality":"must","authority":"Binding regulatory measure within Article 2 scope; original English candidate paraphrase of Chinese official text, pending owner/legal review","jurisdiction":"China; applicability is limited by Article 2 and cross-referenced network-information-service provisions","url":"https://www.cac.gov.cn/2025-03/14/c_1743654684782215.htm","timing":"From 1 September 2025 (Article 14), during the applicable labeling activity","exception":"Article 2 applicability must be established; Article 11 preserves other applicable rules and mandatory standards. No general exemption inferred. Article 9 permits requested supply without explicit labels only after agreement-based clarification of labeling obligations and use responsibilities and at least six months of relevant logs; it does not waive Article 5 metadata duties.","condition":"Network information service providers conducting labeling activities within Article 2; services fall within Deep Synthesis Provisions Article 17(1). Add a prominent cue at an appropriate image location.","evidenceSummary":"Official CAC final measure, rather than the September 2024 consultation draft; exact article below. Source text checked 16 October 2026; no newly enacted duty claimed.","title":"Label generated images conspicuously","control":"Article 4(3)","actor":"Covered generation/synthesis service providers","action":"label","object":"generated images","ruleId":"AIR-EDEC4DCB77","intent":"label generated images","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-16T13:08:55.724Z","reviewed_at":null},{"id":"finding-04c4307c79ba50ec7bd97abfdc4aa66aff141aa85fd92f139d3b1ff4a9ef3c0e","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Measures for Labeling AI-Generated and Synthetic Content (人工智能生成合成内容标识办法)","sourceVersion":"Guoxinban Tong Zi [2025] No.2; issued 7 March 2025, published 14 March 2025; effective 1 September 2025; Chinese publisher text checked 16 October 2026","modality":"must","authority":"Binding regulatory measure within Article 2 scope; original English candidate paraphrase of Chinese official text, pending owner/legal review","jurisdiction":"China; applicability is limited by Article 2 and cross-referenced network-information-service provisions","url":"https://www.cac.gov.cn/2025-03/14/c_1743654684782215.htm","timing":"From 1 September 2025 (Article 14), during the applicable labeling activity","exception":"Article 2 applicability must be established; Article 11 preserves other applicable rules and mandatory standards. No general exemption inferred. Article 9 permits requested supply without explicit labels only after agreement-based clarification of labeling obligations and use responsibilities and at least six months of relevant logs; it does not waive Article 5 metadata duties.","condition":"Network information service providers conducting labeling activities within Article 2; services fall within Deep Synthesis Provisions Article 17(1). Place text/symbol cues at suitable text positions or prominent cues in the interface or around the text.","evidenceSummary":"Official CAC final measure, rather than the September 2024 consultation draft; exact article below. Source text checked 16 October 2026; no newly enacted duty claimed.","title":"Label generated text visibly","control":"Article 4(1)","actor":"Covered generation/synthesis service providers","action":"label","object":"generated text visibly","ruleId":"AIR-23EE43CF93","intent":"label generated text visibly","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-16T13:08:55.724Z","reviewed_at":null},{"id":"finding-05241de6ca242fd9f8c606c9a2f451d88209e390ca5cec87d5287406f4eda5d7","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Measures for Labeling AI-Generated and Synthetic Content (人工智能生成合成内容标识办法)","sourceVersion":"Guoxinban Tong Zi [2025] No.2; issued 7 March 2025, published 14 March 2025; effective 1 September 2025; Chinese publisher text checked 16 October 2026","modality":"must","authority":"Binding regulatory measure within Article 2 scope; original English candidate paraphrase of Chinese official text, pending owner/legal review","jurisdiction":"China; applicability is limited by Article 2 and cross-referenced network-information-service provisions","url":"https://www.cac.gov.cn/2025-03/14/c_1743654684782215.htm","timing":"From 1 September 2025 (Article 14), during the applicable labeling activity","exception":"Article 2 applicability must be established; Article 11 preserves other applicable rules and mandatory standards. No general exemption inferred.","condition":"Network information service providers conducting labeling activities within Article 2; user service agreements must specify the labeling methods, styles and related specifications.","evidenceSummary":"Official CAC final measure, rather than the September 2024 consultation draft; exact article below. Source text checked 16 October 2026; no newly enacted duty claimed.","title":"Describe labeling in user agreements","control":"Article 8 first limb","actor":"Covered service providers","action":"describe","object":"generated-content labeling methods and styles in user agreements","ruleId":"AIR-6D3C8487ED","intent":"describe generated content labeling methods and styles in user agreements","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-16T13:08:55.724Z","reviewed_at":null},{"id":"finding-17a3bf1a8236a122c2b198b02161ed3b889c4084f0aa231eaf8cfd4dfa87bfd9","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Measures for Labeling AI-Generated and Synthetic Content (人工智能生成合成内容标识办法)","sourceVersion":"Guoxinban Tong Zi [2025] No.2; issued 7 March 2025, published 14 March 2025; effective 1 September 2025; Chinese publisher text checked 16 October 2026","modality":"must","authority":"Binding regulatory measure within Article 2 scope; original English candidate paraphrase of Chinese official text, pending owner/legal review","jurisdiction":"China; applicability is limited by Article 2 and cross-referenced network-information-service provisions","url":"https://www.cac.gov.cn/2025-03/14/c_1743654684782215.htm","timing":"From 1 September 2025 (Article 14), during the applicable labeling activity","exception":"Article 2 applicability must be established; Article 11 preserves other applicable rules and mandatory standards. No general exemption inferred. Article 9 permits requested supply without explicit labels only after agreement-based clarification of labeling obligations and use responsibilities and at least six months of relevant logs; it does not waive Article 5 metadata duties.","condition":"Network information service providers conducting labeling activities within Article 2; services fall within Deep Synthesis Provisions Article 17(1). Prominent cues are required in the starting frame and around playback; intermediate/end cues are optional.","evidenceSummary":"Official CAC final measure, rather than the September 2024 consultation draft; exact article below. Source text checked 16 October 2026; no newly enacted duty claimed.","title":"Label generated video at required locations","control":"Article 4(4)","actor":"Covered generation/synthesis service providers","action":"label","object":"generated video","ruleId":"AIR-2A37BD45F4","intent":"label generated video","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-16T13:08:55.724Z","reviewed_at":null},{"id":"finding-3d15ef331a6b57a435235351556d6ea2b20fcd787c59970fe629fd0488f10599","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Measures for Labeling AI-Generated and Synthetic Content (人工智能生成合成内容标识办法)","sourceVersion":"Guoxinban Tong Zi [2025] No.2; issued 7 March 2025, published 14 March 2025; effective 1 September 2025; Chinese publisher text checked 16 October 2026","modality":"must","authority":"Binding regulatory measure within Article 2 scope; original English candidate paraphrase of Chinese official text, pending owner/legal review","jurisdiction":"China; applicability is limited by Article 2 and cross-referenced network-information-service provisions","url":"https://www.cac.gov.cn/2025-03/14/c_1743654684782215.htm","timing":"From 1 September 2025 (Article 14), during the applicable labeling activity","exception":"Article 2 applicability must be established; Article 11 preserves other applicable rules and mandatory standards. No general exemption inferred.","condition":"Network information service providers conducting labeling activities within Article 2; app provider offers AI generation/synthesis services; during listing or launch review.","evidenceSummary":"Official CAC final measure, rather than the September 2024 consultation draft; exact article below. Source text checked 16 October 2026; no newly enacted duty claimed.","title":"Verify app labeling materials","control":"Article 7 sentence 2","actor":"Internet application distribution platforms","action":"verify","object":"app generated-content labeling materials","ruleId":"AIR-DA28C8B948","intent":"verify app generated content labeling materials","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-16T13:08:55.724Z","reviewed_at":null},{"id":"finding-414dd46daa7b507e72e8377382050c9b39a9f6ecd0b4e36f0af445c6f0a90a21","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"MSU Guidelines for the Use of Generative Artificial Intelligence Tools","sourceVersion":"Approved 12 August 2025; History says not revised to date; official page checked 16 October 2026","authority":"Organization-specific MSU institutional guidance; not a general statutory duty","jurisdiction":"Michigan State University, Michigan, US","url":"https://ai.msu.edu/guidelines","modality":"must not","exception":"Apply only within MSU's institutional scope; no automatic adoption into other organizations.","timing":"While the approved guidelines apply; approved 12 August 2025","evidenceSummary":"Official MSU page, History and exact subsection checked 16 October 2026. Today's byte-change signal does not establish a substantive revision.","title":"Do not use detector output as sole decision basis","control":"Permissible Uses / Teaching and Learning / detection-tools paragraph","actor":"MSU instructors using generative AI detection tools","action":"rely","object":"detector output","condition":"An instructor chooses a generative AI detector; its output is only a potential indicator of misuse. The prohibited reliance is using detector output as the sole basis for academic or grading decisions; this does not prohibit considering it as one potential indicator.","ruleId":"AIR-1A04293BCD","intent":"rely detector output","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-16T13:08:55.724Z","reviewed_at":null},{"id":"finding-46590490c44f39d59c1bf6b008ced466a346280603cbfde7b8181fb17271b325","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Measures for Labeling AI-Generated and Synthetic Content (人工智能生成合成内容标识办法)","sourceVersion":"Guoxinban Tong Zi [2025] No.2; issued 7 March 2025, published 14 March 2025; effective 1 September 2025; Chinese publisher text checked 16 October 2026","modality":"must","authority":"Binding regulatory measure within Article 2 scope; original English candidate paraphrase of Chinese official text, pending owner/legal review","jurisdiction":"China; applicability is limited by Article 2 and cross-referenced network-information-service provisions","url":"https://www.cac.gov.cn/2025-03/14/c_1743654684782215.htm","timing":"From 1 September 2025 (Article 14), during the applicable labeling activity","exception":"Article 2 applicability must be established; Article 11 preserves other applicable rules and mandatory standards. No general exemption inferred.","condition":"Network information service providers conducting labeling activities within Article 2; file metadata explicitly identifies generated/synthetic content. Add a prominent adjacent notice that the content is generated/synthetic.","evidenceSummary":"Official CAC final measure, rather than the September 2024 consultation draft; exact article below. Source text checked 16 October 2026; no newly enacted duty claimed.","title":"Identify metadata-confirmed generated content","control":"Article 6(1), second limb","actor":"Network information content dissemination service providers","action":"label","object":"metadata-confirmed generated content","ruleId":"AIR-9E039F1858","intent":"label metadata confirmed generated content","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-16T13:08:55.724Z","reviewed_at":null},{"id":"finding-46593e5c95df0c4965d70c2d75c74ab6580926cb48624be11aaa618237221aaf","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Measures for Labeling AI-Generated and Synthetic Content (人工智能生成合成内容标识办法)","sourceVersion":"Guoxinban Tong Zi [2025] No.2; issued 7 March 2025, published 14 March 2025; effective 1 September 2025; Chinese publisher text checked 16 October 2026","modality":"must","authority":"Binding regulatory measure within Article 2 scope; original English candidate paraphrase of Chinese official text, pending owner/legal review","jurisdiction":"China; applicability is limited by Article 2 and cross-referenced network-information-service provisions","url":"https://www.cac.gov.cn/2025-03/14/c_1743654684782215.htm","timing":"From 1 September 2025 (Article 14), during the applicable labeling activity","exception":"Article 2 applicability must be established; Article 11 preserves other applicable rules and mandatory standards. No general exemption inferred.","condition":"Network information service providers conducting labeling activities within Article 2; one of Article 6(1)-(3) applies. Include generation attributes, dissemination-platform name or code, and content identifier.","evidenceSummary":"Official CAC final measure, rather than the September 2024 consultation draft; exact article below. Source text checked 16 October 2026; no newly enacted duty claimed.","title":"Add dissemination provenance metadata","control":"Article 6 final paragraph","actor":"Network information content dissemination service providers","action":"add","object":"dissemination provenance metadata","ruleId":"AIR-3FF151277F","intent":"add dissemination provenance metadata","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-16T13:08:55.724Z","reviewed_at":null},{"id":"finding-513eb3973637d08950f6809fe882c2702eb6fd1dc74e06b0ca923709c0141f8d","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Measures for Labeling AI-Generated and Synthetic Content (人工智能生成合成内容标识办法)","sourceVersion":"Guoxinban Tong Zi [2025] No.2; issued 7 March 2025, published 14 March 2025; effective 1 September 2025; Chinese publisher text checked 16 October 2026","modality":"must","authority":"Binding regulatory measure within Article 2 scope; original English candidate paraphrase of Chinese official text, pending owner/legal review","jurisdiction":"China; applicability is limited by Article 2 and cross-referenced network-information-service provisions","url":"https://www.cac.gov.cn/2025-03/14/c_1743654684782215.htm","timing":"From 1 September 2025 (Article 14), during the applicable labeling activity","exception":"Article 2 applicability must be established; Article 11 preserves other applicable rules and mandatory standards. No general exemption inferred.","condition":"Network information service providers conducting labeling activities within Article 2; publishing generated/synthetic content through dissemination services; use the provider's labeling functions.","evidenceSummary":"Official CAC final measure, rather than the September 2024 consultation draft; exact article below. Source text checked 16 October 2026; no newly enacted duty claimed.","title":"Label generated content when publishing","control":"Article 10 paragraph 1, labeling limb","actor":"Users of network information content dissemination services","action":"label","object":"AI content","ruleId":"AIR-66E5FC0789","intent":"label ai content","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-16T13:08:55.724Z","reviewed_at":null},{"id":"finding-6da124847cdefa6ba7f3146402e4bfc5568a224b5e584cf8f65af221ce305a40","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Measures for Labeling AI-Generated and Synthetic Content (人工智能生成合成内容标识办法)","sourceVersion":"Guoxinban Tong Zi [2025] No.2; issued 7 March 2025, published 14 March 2025; effective 1 September 2025; Chinese publisher text checked 16 October 2026","modality":"must","authority":"Binding regulatory measure within Article 2 scope; original English candidate paraphrase of Chinese official text, pending owner/legal review","jurisdiction":"China; applicability is limited by Article 2 and cross-referenced network-information-service provisions","url":"https://www.cac.gov.cn/2025-03/14/c_1743654684782215.htm","timing":"From 1 September 2025 (Article 14), during the applicable labeling activity","exception":"Article 2 applicability must be established; Article 11 preserves other applicable rules and mandatory standards. No general exemption inferred.","condition":"Network information service providers conducting labeling activities within Article 2; no implicit label is verified but the user declares generated/synthetic content. Add a prominent adjacent possible-generation notice.","evidenceSummary":"Official CAC final measure, rather than the September 2024 consultation draft; exact article below. Source text checked 16 October 2026; no newly enacted duty claimed.","title":"Identify user-declared possible generated content","control":"Article 6(2)","actor":"Network information content dissemination service providers","action":"label","object":"user-declared possibly generated content","ruleId":"AIR-2A5EA1B6EE","intent":"label user declared possibly generated content","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-16T13:08:55.724Z","reviewed_at":null},{"id":"finding-78f4d8f16bfce462072aff539ba689b7da1bef47f48861d3c58f9b0a7803095f","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Measures for Labeling AI-Generated and Synthetic Content (人工智能生成合成内容标识办法)","sourceVersion":"Guoxinban Tong Zi [2025] No.2; issued 7 March 2025, published 14 March 2025; effective 1 September 2025; Chinese publisher text checked 16 October 2026","modality":"must","authority":"Binding regulatory measure within Article 2 scope; original English candidate paraphrase of Chinese official text, pending owner/legal review","jurisdiction":"China; applicability is limited by Article 2 and cross-referenced network-information-service provisions","url":"https://www.cac.gov.cn/2025-03/14/c_1743654684782215.htm","timing":"From 1 September 2025 (Article 14), during the applicable labeling activity","exception":"Article 2 applicability must be established; Article 11 preserves other applicable rules and mandatory standards. No general exemption inferred.","condition":"Network information service providers conducting labeling activities within Article 2; neither metadata verification nor user declaration identifies generation, but explicit marks or other generation traces are detected. Add a prominent adjacent suspicion notice.","evidenceSummary":"Official CAC final measure, rather than the September 2024 consultation draft; exact article below. Source text checked 16 October 2026; no newly enacted duty claimed.","title":"Identify suspected generated content","control":"Article 6(3)","actor":"Network information content dissemination service providers","action":"label","object":"suspected generated content","ruleId":"AIR-2BA8F53223","intent":"label suspected generated content","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-16T13:08:55.724Z","reviewed_at":null},{"id":"finding-a446d757e292fe8fba359309141d8ed6248e66640de5ecb7527ada6651a11c43","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Measures for Labeling AI-Generated and Synthetic Content (人工智能生成合成内容标识办法)","sourceVersion":"Guoxinban Tong Zi [2025] No.2; issued 7 March 2025, published 14 March 2025; effective 1 September 2025; Chinese publisher text checked 16 October 2026","modality":"must","authority":"Binding regulatory measure within Article 2 scope; original English candidate paraphrase of Chinese official text, pending owner/legal review","jurisdiction":"China; applicability is limited by Article 2 and cross-referenced network-information-service provisions","url":"https://www.cac.gov.cn/2025-03/14/c_1743654684782215.htm","timing":"From 1 September 2025 (Article 14), during the applicable labeling activity","exception":"Article 2 applicability must be established; Article 11 preserves other applicable rules and mandatory standards. No general exemption inferred.","condition":"Network information service providers conducting labeling activities within Article 2; reviewing app listing or launch. Require app providers to state whether their app offers AI generation/synthesis services.","evidenceSummary":"Official CAC final measure, rather than the September 2024 consultation draft; exact article below. Source text checked 16 October 2026; no newly enacted duty claimed.","title":"Request AI-service disclosure during app review","control":"Article 7 sentence 1","actor":"Internet application distribution platforms","action":"request","object":"AI generation service disclosure from app providers","ruleId":"AIR-D10223F924","intent":"request ai generation service disclosure from app providers","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-16T13:08:55.724Z","reviewed_at":null},{"id":"finding-a69a5db12dc405f6c47fcac33777f6d2ae6b9e4cc291d9e7bd2038e33d0dcfe6","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"MSU Guidelines for the Use of Generative Artificial Intelligence Tools","sourceVersion":"Approved 12 August 2025; History says not revised to date; official page checked 16 October 2026","authority":"Organization-specific MSU institutional guidance; not a general statutory duty","jurisdiction":"Michigan State University, Michigan, US","url":"https://ai.msu.edu/guidelines","modality":"must","exception":"Apply only within MSU's institutional scope; no automatic adoption into other organizations.","timing":"Before access, license procurement or sign-up","evidenceSummary":"Official MSU page, History and exact subsection checked 16 October 2026. Today's byte-change signal does not establish a substantive revision.","title":"Consult IT before registering AI tools with MSU credentials","control":"Procuring or Registering for Available Generative AI Tools / second paragraph","actor":"MSU individuals and units using MSU credentials","action":"consult","object":"IT Services","condition":"Intending to use MSU credentials to access, license or sign up for a generative AI-enabled product or service; includes free and open-source tools.","ruleId":"AIR-242001C9D0","intent":"consult it services","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-16T13:08:55.724Z","reviewed_at":null},{"id":"finding-c763851c853da877ec79a436534e430b02471cb34665f1e05da311a920d1db0b","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Measures for Labeling AI-Generated and Synthetic Content (人工智能生成合成内容标识办法)","sourceVersion":"Guoxinban Tong Zi [2025] No.2; issued 7 March 2025, published 14 March 2025; effective 1 September 2025; Chinese publisher text checked 16 October 2026","modality":"must","authority":"Binding regulatory measure within Article 2 scope; original English candidate paraphrase of Chinese official text, pending owner/legal review","jurisdiction":"China; applicability is limited by Article 2 and cross-referenced network-information-service provisions","url":"https://www.cac.gov.cn/2025-03/14/c_1743654684782215.htm","timing":"From 1 September 2025 (Article 14), during the applicable labeling activity","exception":"Article 2 applicability must be established; Article 11 preserves other applicable rules and mandatory standards. No general exemption inferred.","condition":"Network information service providers conducting labeling activities within Article 2; under Deep Synthesis Provisions Article 16. File metadata must identify generated/synthetic attributes, provider name or code, and content identifier.","evidenceSummary":"Official CAC final measure, rather than the September 2024 consultation draft; exact article below. Source text checked 16 October 2026; no newly enacted duty claimed.","title":"Mark generated content through file metadata","control":"Article 5 paragraph 1","actor":"Covered service providers","action":"mark","object":"generated content in machine-readable form","ruleId":"AIR-5C96C1D94B","intent":"mark generated content in machine readable form","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-16T13:08:55.724Z","reviewed_at":null},{"id":"finding-d616efe2294bca885821737bb8753ae3abfd33fc3687f3eb0650179016712b38","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Measures for Labeling AI-Generated and Synthetic Content (人工智能生成合成内容标识办法)","sourceVersion":"Guoxinban Tong Zi [2025] No.2; issued 7 March 2025, published 14 March 2025; effective 1 September 2025; Chinese publisher text checked 16 October 2026","modality":"must","authority":"Binding regulatory measure within Article 2 scope; original English candidate paraphrase of Chinese official text, pending owner/legal review","jurisdiction":"China; applicability is limited by Article 2 and cross-referenced network-information-service provisions","url":"https://www.cac.gov.cn/2025-03/14/c_1743654684782215.htm","timing":"From 1 September 2025 (Article 14), during the applicable labeling activity","exception":"Article 2 applicability must be established; Article 11 preserves other applicable rules and mandatory standards. No general exemption inferred. Article 9 permits requested supply without explicit labels only after agreement-based clarification of labeling obligations and use responsibilities and at least six months of relevant logs; it does not waive Article 5 metadata duties.","condition":"Network information service providers conducting labeling activities within Article 2; services fall within Deep Synthesis Provisions Article 17(1). Use speech/rhythm cues at suitable audio positions or a prominent interface cue.","evidenceSummary":"Official CAC final measure, rather than the September 2024 consultation draft; exact article below. Source text checked 16 October 2026; no newly enacted duty claimed.","title":"Label generated audio visibly or audibly","control":"Article 4(2)","actor":"Covered generation/synthesis service providers","action":"label","object":"generated audio","ruleId":"AIR-517579FC73","intent":"label generated audio","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-16T13:08:55.724Z","reviewed_at":null},{"id":"finding-eebccfebe03ae567afaa1d6fd3b5995d8edd96a44c19a4cb3ea603113e6033a3","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Measures for Labeling AI-Generated and Synthetic Content (人工智能生成合成内容标识办法)","sourceVersion":"Guoxinban Tong Zi [2025] No.2; issued 7 March 2025, published 14 March 2025; effective 1 September 2025; Chinese publisher text checked 16 October 2026","modality":"must","authority":"Binding regulatory measure within Article 2 scope; original English candidate paraphrase of Chinese official text, pending owner/legal review","jurisdiction":"China; applicability is limited by Article 2 and cross-referenced network-information-service provisions","url":"https://www.cac.gov.cn/2025-03/14/c_1743654684782215.htm","timing":"From 1 September 2025; retain relevant logs for at least six months","exception":"Article 2 applicability must be established; Article 11 preserves other applicable rules and mandatory standards. No general exemption inferred.","condition":"Network information service providers conducting labeling activities within Article 2; a user requests content without explicit labels and the provider supplies it after clarifying the user's labeling obligations and usage responsibilities through the user agreement.","evidenceSummary":"Official CAC final measure, rather than the September 2024 consultation draft; exact article below. Source text checked 16 October 2026; no newly enacted duty claimed.","title":"Retain logs for content without explicit labels","control":"Article 9","actor":"Covered service providers","action":"retain","object":"recipient information and related unlabeled-content logs","ruleId":"AIR-78F3C16946","intent":"retain recipient information and related unlabeled content logs","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-16T13:08:55.724Z","reviewed_at":null},{"id":"finding-ef2b7db9ee53d4022eafdcfc58b38052c8329bfdd568ec5f0da6b2e5ad4f67d5","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Measures for Labeling AI-Generated and Synthetic Content (人工智能生成合成内容标识办法)","sourceVersion":"Guoxinban Tong Zi [2025] No.2; issued 7 March 2025, published 14 March 2025; effective 1 September 2025; Chinese publisher text checked 16 October 2026","modality":"must","authority":"Binding regulatory measure within Article 2 scope; original English candidate paraphrase of Chinese official text, pending owner/legal review","jurisdiction":"China; applicability is limited by Article 2 and cross-referenced network-information-service provisions","url":"https://www.cac.gov.cn/2025-03/14/c_1743654684782215.htm","timing":"From 1 September 2025 (Article 14), during the applicable labeling activity","exception":"Article 2 applicability must be established; Article 11 preserves other applicable rules and mandatory standards. No general exemption inferred.","condition":"Network information service providers conducting labeling activities within Article 2; disseminating content; inspect file metadata for implicit labeling.","evidenceSummary":"Official CAC final measure, rather than the September 2024 consultation draft; exact article below. Source text checked 16 October 2026; no newly enacted duty claimed.","title":"Check file metadata for implicit labels","control":"Article 6(1), first limb","actor":"Network information content dissemination service providers","action":"verify","object":"implicit labels in content file metadata","ruleId":"AIR-D875748735","intent":"verify implicit labels in content file metadata","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-16T13:08:55.724Z","reviewed_at":null},{"id":"finding-f821c1692bea60f81be8cf9b4ec3dc7ab9d4ede90761724921e9bbc7e8e03194","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Measures for Labeling AI-Generated and Synthetic Content (人工智能生成合成内容标识办法)","sourceVersion":"Guoxinban Tong Zi [2025] No.2; issued 7 March 2025, published 14 March 2025; effective 1 September 2025; Chinese publisher text checked 16 October 2026","modality":"must","authority":"Binding regulatory measure within Article 2 scope; original English candidate paraphrase of Chinese official text, pending owner/legal review","jurisdiction":"China; applicability is limited by Article 2 and cross-referenced network-information-service provisions","url":"https://www.cac.gov.cn/2025-03/14/c_1743654684782215.htm","timing":"From 1 September 2025 (Article 14), during the applicable labeling activity","exception":"Article 2 applicability must be established; Article 11 preserves other applicable rules and mandatory standards. No general exemption inferred. Article 9 permits requested supply without explicit labels only after agreement-based clarification of labeling obligations and use responsibilities and at least six months of relevant logs; it does not waive Article 5 metadata duties.","condition":"Network information service providers conducting labeling activities within Article 2; download, copy or export functions are provided. Files must contain compliant explicit labels.","evidenceSummary":"Official CAC final measure, rather than the September 2024 consultation draft; exact article below. Source text checked 16 October 2026; no newly enacted duty claimed.","title":"Preserve explicit labels in exported files","control":"Article 4 final paragraph","actor":"Covered generation/synthesis service providers","action":"preserve","object":"explicit labels in downloaded copied or exported generated files","ruleId":"AIR-D0197E474F","intent":"preserve explicit labels in downloaded copied or exported generated files","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-16T13:08:55.724Z","reviewed_at":null},{"id":"change-msu-genai-guidelines-a52faac3cc4647c69c3dbf34092a05b07955111a8190153c82789f5c677e1efa","kind":"source-change","status":"pending","body":{"sourceId":"msu-genai-guidelines","title":"Guidelines for the Use of Generative Artificial Intelligence Tools","url":"https://ai.msu.edu/guidelines","status":"publisher-bytes-changed","checkedAt":"2026-10-16T13:07:03.884Z","fingerprint":"a52faac3cc4647c69c3dbf34092a05b07955111a8190153c82789f5c677e1efa","previousFingerprint":"a846fd3339fc751dfed295eaaa686ae188114b9b6504cac6cd03ffe131c339c6","bytes":706968,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-16T13:07:03.884Z","reviewed_at":null},{"id":"change-cisa-ncsc-secure-ai-development-67dbd2fc3af682ed557176113d621ce2ed770c11ed69ec3f8412de6ab94860e2","kind":"source-change","status":"pending","body":{"sourceId":"cisa-ncsc-secure-ai-development","title":"Guidelines for Secure AI System Development","url":"https://www.ncsc.gov.uk/collection/guidelines-secure-ai-system-development/guidelines/secure-development","status":"publisher-bytes-changed","checkedAt":"2026-10-16T13:07:00.291Z","fingerprint":"67dbd2fc3af682ed557176113d621ce2ed770c11ed69ec3f8412de6ab94860e2","previousFingerprint":"67293a0fe467a4278e31b98b0fac930419cc9fcfd1f5415d9b1661e88fb0cc75","bytes":235216,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-16T13:07:00.291Z","reviewed_at":null},{"id":"finding-06cddb029f18475f193edc616d373b81c3d49f890e148e11c63900f21fa6683a","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"NIST AI 600-1 — Generative Artificial Intelligence Profile","sourceVersion":"NIST AI 600-1, July 2024; publisher date 26 July 2024; verified 15 October 2026","modality":"should","authority":"Voluntary NIST suggested risk-management action; not a statutory requirement","jurisdiction":"United States; cross-sectoral voluntary use","title":"Collect content-authenticity feedback from users","actor":"AI actors performing AI Deployment, AI Impact Assessment, Domain Expert, Operation and Monitoring, or TEVV tasks","action":"collect","object":"feedback from affected stakeholders","control":"MS-2.7-003 · PDF page 37","condition":"For generative AI risk management within the July 2024 profile; applicability depends on risk, lifecycle stage, relevant actor task and organisational use. Survey GAI users about satisfaction and perceived content authenticity; examine provenance concerns and understanding of content labels","exception":"Not every suggested action applies to every AI actor or task (Section 3, PDF p.17); tailor to organisational requirements, risk tolerance and resources. This guidance does not itself impose a legal duty.","timing":"During user-feedback and security/resilience assessment","evidenceSummary":"User surveys collect satisfaction and authenticity perceptions and help identify provenance literacy concerns.","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf#page=37","ruleId":"AIR-E7F9A07274","intent":"collect feedback from affected stakeholders","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-15T13:08:40.276Z","reviewed_at":null},{"id":"finding-07948c887997db39ad12b9fb6c940689510a727899d83b3a6d3f50247a44a175","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"NIST AI 600-1 — Generative Artificial Intelligence Profile","sourceVersion":"NIST AI 600-1, July 2024; publisher date 26 July 2024; verified 15 October 2026","modality":"should","authority":"Voluntary NIST suggested risk-management action; not a statutory requirement","jurisdiction":"United States; cross-sectoral voluntary use","title":"Review guardrails in novel operating circumstances","actor":"AI actors performing Domain Expert and TEVV (testing, evaluation, validation and verification) tasks","action":"review","object":"GAI safety and security guardrails in novel operating circumstances","control":"MS-2.5-006 · PDF page 35","condition":"For generative AI risk management within the July 2024 profile; applicability depends on risk, lifecycle stage, relevant actor task and organisational use. Also revisit the rationale underlying the original safe-deployment assessment","exception":"Not every suggested action applies to every AI actor or task (Section 3, PDF p.17); tailor to organisational requirements, risk tolerance and resources. This guidance does not itself impose a legal duty.","timing":"Regularly, especially in novel circumstances","evidenceSummary":"Regular review includes guardrails and the reasons deployment was originally judged safe.","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf#page=35","ruleId":"AIR-21A69129AF","intent":"review gai safety and security guardrails in novel operating circumstances","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-15T13:08:40.276Z","reviewed_at":null},{"id":"finding-08e35c00358754a28f2f19a52a051e17e64c22291a568158f36b01e6c500ce28","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"NIST AI 600-1 — Generative Artificial Intelligence Profile","sourceVersion":"NIST AI 600-1, July 2024; publisher date 26 July 2024; verified 15 October 2026","modality":"should","authority":"Voluntary NIST suggested risk-management action; not a statutory requirement","jurisdiction":"United States; cross-sectoral voluntary use","title":"Assess incident-driven adaptation speed","actor":"AI actors performing AI Deployment, AI Impact Assessment, Domain Expert, Operation and Monitoring, or TEVV tasks","action":"assess","object":"speed of GAI adaptation after security incidents and feedback","control":"MS-2.7-006 · PDF page 37","condition":"For generative AI risk management within the July 2024 profile; applicability depends on risk, lifecycle stage, relevant actor task and organisational use. Based on security-incident lessons and feedback","exception":"Not every suggested action applies to every AI actor or task (Section 3, PDF p.17); tailor to organisational requirements, risk tolerance and resources. This guidance does not itself impose a legal duty.","timing":"Following security incidents or feedback","evidenceSummary":"Assess how quickly the system adapts and improves after relevant security evidence.","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf#page=37","ruleId":"AIR-11CDA6B848","intent":"assess speed of gai adaptation after security incidents and feedback","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-15T13:08:40.276Z","reviewed_at":null},{"id":"finding-110bd4a348545cfa65023dcbdff1035b12d9f53955676b99ff71018bcb0150e5","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"NIST AI 600-1 — Generative Artificial Intelligence Profile","sourceVersion":"NIST AI 600-1, July 2024; publisher date 26 July 2024; verified 15 October 2026","modality":"should","authority":"Voluntary NIST suggested risk-management action; not a statutory requirement","jurisdiction":"United States; cross-sectoral voluntary use","title":"Re-evaluate fine-tuned safety above risk tolerance","actor":"AI actors performing AI Deployment, AI Impact Assessment, Domain Expert, Operation and Monitoring, or TEVV tasks","action":"re evaluate","object":"fine tuned model safety when negative risk exceeds tolerance","control":"MS-2.6-003 · PDF page 36","condition":"For generative AI risk management within the July 2024 profile; applicability depends on risk, lifecycle stage, relevant actor task and organisational use. When negative risk exceeds the organisation's risk tolerance","exception":"Not every suggested action applies to every AI actor or task (Section 3, PDF p.17); tailor to organisational requirements, risk tolerance and resources. This guidance does not itself impose a legal duty.","timing":"On exceeding organisational risk tolerance","evidenceSummary":"Reassess the safety features of a fine-tuned model when its negative risk exceeds the organisation's tolerance.","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf#page=36","ruleId":"AIR-C37BCC7CB3","intent":"re evaluate fine tuned model safety when negative risk exceeds tolerance","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-15T13:08:40.276Z","reviewed_at":null},{"id":"finding-31db51fd03e114a48b423acd6058e2b50e822b8541ced6be43f62f27197fc29c","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"NIST AI 600-1 — Generative Artificial Intelligence Profile","sourceVersion":"NIST AI 600-1, July 2024; publisher date 26 July 2024; verified 15 October 2026","modality":"should","authority":"Voluntary NIST suggested risk-management action; not a statutory requirement","jurisdiction":"United States; cross-sectoral voluntary use","title":"Define security-effectiveness metrics","actor":"AI actors performing AI Deployment, AI Impact Assessment, Domain Expert, Operation and Monitoring, or TEVV tasks","action":"define","object":"metrics of GAI security measure effectiveness","control":"MS-2.7-004 · PDF page 37","condition":"For generative AI risk management within the July 2024 profile; applicability depends on risk, lifecycle stage, relevant actor task and organisational use. Examples include provenance verification and unauthorised access or extraction attempts","exception":"Not every suggested action applies to every AI actor or task (Section 3, PDF p.17); tailor to organisational requirements, risk tolerance and resources. This guidance does not itself impose a legal duty.","timing":"When designing security measurement","evidenceSummary":"Identify measures that reflect how effectively security controls operate.","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf#page=37","ruleId":"AIR-31E0F1A846","intent":"define metrics of gai security measure effectiveness","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-15T13:08:40.276Z","reviewed_at":null},{"id":"finding-32a2e557ca350d843a111a5e14ea20be66cc8d0904327282f8066c542e7112ec","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"NIST AI 600-1 — Generative Artificial Intelligence Profile","sourceVersion":"NIST AI 600-1, July 2024; publisher date 26 July 2024; verified 15 October 2026","modality":"should","authority":"Voluntary NIST suggested risk-management action; not a statutory requirement","jurisdiction":"United States; cross-sectoral voluntary use","title":"Verify generated-output validity and safety","actor":"AI actors performing AI Deployment, AI Impact Assessment, Domain Expert, Operation and Monitoring, or TEVV tasks","action":"verify","object":"outputs","control":"MS-2.6-004 · PDF page 36","condition":"For generative AI risk management within the July 2024 profile; applicability depends on risk, lifecycle stage, relevant actor task and organisational use. Review GAI outputs for validity and safety, including generated code and downstream decision risks","exception":"Not every suggested action applies to every AI actor or task (Section 3, PDF p.17); tailor to organisational requirements, risk tolerance and resources. This guidance does not itself impose a legal duty.","timing":"During output review","evidenceSummary":"Review outputs for validity and safety and assess generated-code risks to downstream decisions. This mapping preserves NIST's voluntary force.","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf#page=36","ruleId":"AIR-7899BD6734","intent":"verify outputs","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-15T13:08:40.276Z","reviewed_at":null},{"id":"finding-50e0390892b22be4aed943bd863cba161905096fec7c0106bdde3fa2722149e3","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"NIST AI 600-1 — Generative Artificial Intelligence Profile","sourceVersion":"NIST AI 600-1, July 2024; publisher date 26 July 2024; verified 15 October 2026","modality":"should","authority":"Voluntary NIST suggested risk-management action; not a statutory requirement","jurisdiction":"United States; cross-sectoral voluntary use","title":"Verify handling of misuse-enabling queries","actor":"AI actors performing AI Deployment, AI Impact Assessment, Domain Expert, Operation and Monitoring, or TEVV tasks","action":"verify","object":"handling of queries that enable malicious or illegal GAI use","control":"MS-2.6-006 · PDF page 36","condition":"For generative AI risk management within the July 2024 profile; applicability depends on risk, lifecycle stage, relevant actor task and organisational use. Examples include manipulation, extortion, impersonation, cyber-attacks and weapons-related misuse; this is defensive assurance","exception":"Not every suggested action applies to every AI actor or task (Section 3, PDF p.17); tailor to organisational requirements, risk tolerance and resources. This guidance does not itself impose a legal duty.","timing":"During misuse-risk assessment and testing","evidenceSummary":"Check that the system handles queries that may facilitate inappropriate, malicious or illegal usage.","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf#page=36","ruleId":"AIR-1AAD1432EB","intent":"verify handling of queries that enable malicious or illegal gai use","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-15T13:08:40.276Z","reviewed_at":null},{"id":"finding-5e14c5ffffbd310cd6a8c1138c669f7b3a4beb77c8358b4d0052795422b3a2fd","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"NIST AI 600-1 — Generative Artificial Intelligence Profile","sourceVersion":"NIST AI 600-1, July 2024; publisher date 26 July 2024; verified 15 October 2026","modality":"should","authority":"Voluntary NIST suggested risk-management action; not a statutory requirement","jurisdiction":"United States; cross-sectoral voluntary use","title":"Assess harmful-content exposure impacts on AI workers","actor":"AI actors performing AI Deployment, AI Impact Assessment, Domain Expert, Operation and Monitoring, or TEVV tasks","action":"assess","object":"health and wellbeing impacts of harmful content exposure on AI actors","control":"MS-2.6-001 · PDF page 36","condition":"For generative AI risk management within the July 2024 profile; applicability depends on risk, lifecycle stage, relevant actor task and organisational use. Value-chain or other AI actors exposed to sexually explicit, offensive or violent information in training or maintenance","exception":"Not every suggested action applies to every AI actor or task (Section 3, PDF p.17); tailor to organisational requirements, risk tolerance and resources. This guidance does not itself impose a legal duty.","timing":"During GAI training and maintenance risk assessment","evidenceSummary":"Assess adverse impacts on people exposed to harmful material as part of GAI work.","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf#page=36","ruleId":"AIR-2F2F1B55B0","intent":"assess health and wellbeing impacts of harmful content exposure on ai actors","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-15T13:08:40.276Z","reviewed_at":null},{"id":"finding-6221064e97819dcb57502c40a80c2b777a7c2712610c59536f07c9a559529e66","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"NIST AI 600-1 — Generative Artificial Intelligence Profile","sourceVersion":"NIST AI 600-1, July 2024; publisher date 26 July 2024; verified 15 October 2026","modality":"should","authority":"Voluntary NIST suggested risk-management action; not a statutory requirement","jurisdiction":"United States; cross-sectoral voluntary use","title":"Benchmark content-provenance security and resilience","actor":"AI actors performing AI Deployment, AI Impact Assessment, Domain Expert, Operation and Monitoring, or TEVV tasks","action":"benchmark","object":"GAI content provenance security and resilience","control":"MS-2.7-002 · PDF page 37","condition":"For generative AI risk management within the July 2024 profile; applicability depends on risk, lifecycle stage, relevant actor task and organisational use. Against industry standards, best practices and state-of-the-art provenance methods","exception":"Not every suggested action applies to every AI actor or task (Section 3, PDF p.17); tailor to organisational requirements, risk tolerance and resources. This guidance does not itself impose a legal duty.","timing":"During security and resilience evaluation","evidenceSummary":"Compare provenance-related security and resilience with relevant industry baselines.","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf#page=37","ruleId":"AIR-D7FE687D05","intent":"benchmark gai content provenance security and resilience","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-15T13:08:40.276Z","reviewed_at":null},{"id":"finding-79427325c4b51b3386cbec4eaa892ddd0973cbba6134270a7fdd572e5b2fe5c2","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"NIST AI 600-1 — Generative Artificial Intelligence Profile","sourceVersion":"NIST AI 600-1, July 2024; publisher date 26 July 2024; verified 15 October 2026","modality":"should","authority":"Voluntary NIST suggested risk-management action; not a statutory requirement","jurisdiction":"United States; cross-sectoral voluntary use","title":"Verify continuing security-control effectiveness","actor":"AI actors performing AI Deployment, AI Impact Assessment, Domain Expert, Operation and Monitoring, or TEVV tasks","action":"verify","object":"continuing effectiveness and integrity of GAI security measures","control":"MS-2.7-009 · PDF page 38","condition":"For generative AI risk management within the July 2024 profile; applicability depends on risk, lifecycle stage, relevant actor task and organisational use. Assess whether security measures remain effective and uncompromised","exception":"Not every suggested action applies to every AI actor or task (Section 3, PDF p.17); tailor to organisational requirements, risk tolerance and resources. This guidance does not itself impose a legal duty.","timing":"Regularly","evidenceSummary":"Check continuing effectiveness and absence of compromise rather than relying solely on an initial assessment.","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf#page=38","ruleId":"AIR-7D1FAC43F3","intent":"verify continuing effectiveness and integrity of gai security measures","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-15T13:08:40.276Z","reviewed_at":null},{"id":"finding-7be858bf38a0cd2716ee7f4a1dccd4d00484a4d0171a0762765198c855e414fc","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"NIST AI 600-1 — Generative Artificial Intelligence Profile","sourceVersion":"NIST AI 600-1, July 2024; publisher date 26 July 2024; verified 15 October 2026","modality":"should","authority":"Voluntary NIST suggested risk-management action; not a statutory requirement","jurisdiction":"United States; cross-sectoral voluntary use","title":"Document human-domain-knowledge contributions","actor":"AI actors performing Domain Expert and TEVV (testing, evaluation, validation and verification) tasks","action":"document","object":"human domain knowledge used to improve GAI performance","control":"MS-2.5-002 · PDF page 35","condition":"For generative AI risk management within the July 2024 profile; applicability depends on risk, lifecycle stage, relevant actor task and organisational use. Includes knowledge contributed through RLHF, fine-tuning, RAG, moderation and business rules","exception":"Not every suggested action applies to every AI actor or task (Section 3, PDF p.17); tailor to organisational requirements, risk tolerance and resources. This guidance does not itself impose a legal duty.","timing":"When documenting GAI performance improvements","evidenceSummary":"Record the extent of human domain knowledge used in improving system performance.","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf#page=35","ruleId":"AIR-BE0700F5CB","intent":"document human domain knowledge used to improve gai performance","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-15T13:08:40.276Z","reviewed_at":null},{"id":"finding-840eb4d6006799c36f3e4d22879ca85f3074e2642cee3338a808d31106daeb0a","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"NIST AI 600-1 — Generative Artificial Intelligence Profile","sourceVersion":"NIST AI 600-1, July 2024; publisher date 26 July 2024; verified 15 October 2026","modality":"should","authority":"Voluntary NIST suggested risk-management action; not a statutory requirement","jurisdiction":"United States; cross-sectoral voluntary use","title":"Verify fine-tuning preserves safety controls","actor":"AI actors performing AI Deployment, AI Impact Assessment, Domain Expert, Operation and Monitoring, or TEVV tasks","action":"verify","object":"fine tuning preservation of safety and security controls","control":"MS-2.7-008 · PDF page 37","condition":"For generative AI risk management within the July 2024 profile; applicability depends on risk, lifecycle stage, relevant actor task and organisational use. When a GAI model is fine-tuned","exception":"Not every suggested action applies to every AI actor or task (Section 3, PDF p.17); tailor to organisational requirements, risk tolerance and resources. This guidance does not itself impose a legal duty.","timing":"During fine-tuning assurance","evidenceSummary":"Verify that fine-tuning has not compromised safety or security controls.","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf#page=37","ruleId":"AIR-2B9003A861","intent":"verify fine tuning preservation of safety and security controls","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-15T13:08:40.276Z","reviewed_at":null},{"id":"finding-88f3af26511a49e7d6905728e6cc1b2f0cb42abc36e78e8b60b555e2745dae45","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"NIST AI 600-1 — Generative Artificial Intelligence Profile","sourceVersion":"NIST AI 600-1, July 2024; publisher date 26 July 2024; verified 15 October 2026","modality":"should","authority":"Voluntary NIST suggested risk-management action; not a statutory requirement","jurisdiction":"United States; cross-sectoral voluntary use","title":"Measure implementation of security recommendations","actor":"AI actors performing AI Deployment, AI Impact Assessment, Domain Expert, Operation and Monitoring, or TEVV tasks","action":"measure","object":"implementation rate of recommendations from security checks and incidents","control":"MS-2.7-006 · PDF page 37","condition":"For generative AI risk management within the July 2024 profile; applicability depends on risk, lifecycle stage, relevant actor task and organisational use. Recommendations generated by security checks or incidents","exception":"Not every suggested action applies to every AI actor or task (Section 3, PDF p.17); tailor to organisational requirements, risk tolerance and resources. This guidance does not itself impose a legal duty.","timing":"During security improvement assessment","evidenceSummary":"Measure the rate at which security recommendations are implemented; do not substitute an assertion that lessons were learned.","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf#page=37","ruleId":"AIR-CC045735D8","intent":"measure implementation rate of recommendations from security checks and incidents","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-15T13:08:40.276Z","reviewed_at":null},{"id":"finding-8d0dd08ba1f8e52ec89aa5d2b013e80e494f142dcbbbfee72b549196c1a3780a","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"NIST AI 600-1 — Generative Artificial Intelligence Profile","sourceVersion":"NIST AI 600-1, July 2024; publisher date 26 July 2024; verified 15 October 2026","modality":"should","authority":"Voluntary NIST suggested risk-management action; not a statutory requirement","jurisdiction":"United States; cross-sectoral voluntary use","title":"Measure content-authentication error rates","actor":"AI actors performing AI Deployment, AI Impact Assessment, Domain Expert, Operation and Monitoring, or TEVV tasks","action":"measure","object":"content authentication false positive and false negative rates","control":"MS-2.7-005 · PDF page 37","condition":"For generative AI risk management within the July 2024 profile; applicability depends on risk, lifecycle stage, relevant actor task and organisational use. For methods such as watermarks, signatures and fingerprints; evaluate true results as well","exception":"Not every suggested action applies to every AI actor or task (Section 3, PDF p.17); tailor to organisational requirements, risk tolerance and resources. This guidance does not itself impose a legal duty.","timing":"During content-provenance reliability assessment","evidenceSummary":"Assess reliability using false-positive and false-negative rates alongside true positives and negatives.","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf#page=37","ruleId":"AIR-F2E27A486E","intent":"measure content authentication false positive and false negative rates","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-15T13:08:40.276Z","reviewed_at":null},{"id":"finding-8fe4aed1bdf86542137c9e008e11128fa698a0d39b424fe6e2d49ed4dbdd4d4f","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"NIST AI 600-1 — Generative Artificial Intelligence Profile","sourceVersion":"NIST AI 600-1, July 2024; publisher date 26 July 2024; verified 15 October 2026","modality":"should","authority":"Voluntary NIST suggested risk-management action; not a statutory requirement","jurisdiction":"United States; cross-sectoral voluntary use","title":"Include independent AI evaluators","actor":"AI actors performing AI Design tasks","action":"involve","object":"independent assessors in AI evaluation","control":"GV-3.2-001 · PDF page 22","condition":"For generative AI risk management within the July 2024 profile; applicability depends on risk, lifecycle stage, relevant actor task and organisational use. Policies should support independent evaluations or assessments with type and robustness proportionate to identified risk","exception":"Not every suggested action applies to every AI actor or task (Section 3, PDF p.17); tailor to organisational requirements, risk tolerance and resources. This guidance does not itself impose a legal duty.","timing":"When establishing oversight and evaluation policy","evidenceSummary":"Independent evaluations bolster oversight; the evaluation design should match the risk.","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf#page=22","ruleId":"AIR-DFA60F69C7","intent":"involve independent assessors in ai evaluation","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-15T13:08:40.276Z","reviewed_at":null},{"id":"finding-c0ab778586de7738a1bd348f024341ac5137e7adc8cf9ef6abdefee2af45e4a5","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"NIST AI 600-1 — Generative Artificial Intelligence Profile","sourceVersion":"NIST AI 600-1, July 2024; publisher date 26 July 2024; verified 15 October 2026","modality":"should","authority":"Voluntary NIST suggested risk-management action; not a statutory requirement","jurisdiction":"United States; cross-sectoral voluntary use","title":"Document interface anthropomorphization","actor":"AI actors performing Domain Expert and TEVV (testing, evaluation, validation and verification) tasks","action":"document","object":"instances of anthropomorphization in GAI interfaces","control":"MS-2.5-004 · PDF page 35","condition":"For generative AI risk management within the July 2024 profile; applicability depends on risk, lifecycle stage, relevant actor task and organisational use. Examples include human imagery and mentions of human feelings; this is documentation, not a blanket ban","exception":"Not every suggested action applies to every AI actor or task (Section 3, PDF p.17); tailor to organisational requirements, risk tolerance and resources. This guidance does not itself impose a legal duty.","timing":"During interface assessment","evidenceSummary":"Track and document humanlike features in GAI interfaces.","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf#page=35","ruleId":"AIR-1CA9890252","intent":"document instances of anthropomorphization in gai interfaces","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-15T13:08:40.276Z","reviewed_at":null},{"id":"finding-c41cc914d628e54a8e15aa856e58e4d3398c827c660d3076968cc823417c3fcd","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"NIST AI 600-1 — Generative Artificial Intelligence Profile","sourceVersion":"NIST AI 600-1, July 2024; publisher date 26 July 2024; verified 15 October 2026","modality":"should","authority":"Voluntary NIST suggested risk-management action; not a statutory requirement","jurisdiction":"United States; cross-sectoral voluntary use","title":"Avoid anecdotal capability extrapolation","actor":"AI actors performing Domain Expert and TEVV (testing, evaluation, validation and verification) tasks","action":"avoid","object":"extrapolating GAI performance from narrow anecdotal assessments","control":"MS-2.5-001 · PDF page 35","condition":"For generative AI risk management within the July 2024 profile; applicability depends on risk, lifecycle stage, relevant actor task and organisational use. When assessing GAI performance or capabilities","exception":"Not every suggested action applies to every AI actor or task (Section 3, PDF p.17); tailor to organisational requirements, risk tolerance and resources. This guidance does not itself impose a legal duty.","timing":"During capability and performance assessment","evidenceSummary":"NIST advises against extending narrow, non-systematic or anecdotal results into broader performance claims.","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf#page=35","ruleId":"AIR-4F4595BF99","intent":"avoid extrapolating gai performance from narrow anecdotal assessments","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-15T13:08:40.276Z","reviewed_at":null},{"id":"finding-dfe573c1f133fffdeb5d5c40971477b9b39b929e82198ff638759c4882a1054c","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"NIST AI 600-1 — Generative Artificial Intelligence Profile","sourceVersion":"NIST AI 600-1, July 2024; publisher date 26 July 2024; verified 15 October 2026","modality":"should","authority":"Voluntary NIST suggested risk-management action; not a statutory requirement","jurisdiction":"United States; cross-sectoral voluntary use","title":"Verify grounding of fine-tuning and RAG data","actor":"AI actors performing Domain Expert and TEVV (testing, evaluation, validation and verification) tasks","action":"verify","object":"grounding of fine tuning and retrieval augmented generation data","control":"MS-2.5-005 · PDF page 35","condition":"For generative AI risk management within the July 2024 profile; applicability depends on risk, lifecycle stage, relevant actor task and organisational use. When those data are used by the GAI system","exception":"Not every suggested action applies to every AI actor or task (Section 3, PDF p.17); tailor to organisational requirements, risk tolerance and resources. This guidance does not itself impose a legal duty.","timing":"During verification of fine-tuning or RAG datasets","evidenceSummary":"The action separately calls for checking that fine-tuning or retrieval-augmentation data are grounded.","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf#page=35","ruleId":"AIR-051CDCD71D","intent":"verify grounding of fine tuning and retrieval augmented generation data","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-15T13:08:40.276Z","reviewed_at":null},{"id":"finding-eaadee02fdb7b9cd654aface06199398ecf52df674521ac1af53e01b11e8cd50","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"NIST AI 600-1 — Generative Artificial Intelligence Profile","sourceVersion":"NIST AI 600-1, July 2024; publisher date 26 July 2024; verified 15 October 2026","modality":"should","authority":"Voluntary NIST suggested risk-management action; not a statutory requirement","jurisdiction":"United States; cross-sectoral voluntary use","title":"Verify architectural error-recovery capability","actor":"AI actors performing AI Deployment, AI Impact Assessment, Domain Expert, Operation and Monitoring, or TEVV tasks","action":"verify","object":"GAI architecture capability to recover from detected security errors","control":"MS-2.6-005 · PDF page 36","condition":"For generative AI risk management within the July 2024 profile; applicability depends on risk, lifecycle stage, relevant actor task and organisational use. When security anomalies, threats or impacts are detected; related monitoring and repair capabilities remain part of the source context","exception":"Not every suggested action applies to every AI actor or task (Section 3, PDF p.17); tailor to organisational requirements, risk tolerance and resources. This guidance does not itself impose a legal duty.","timing":"During architecture assurance and relevant incident testing","evidenceSummary":"Verify that the system architecture supports handling and recovering from errors under detected security problems.","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf#page=36","ruleId":"AIR-F9A744D2EF","intent":"verify gai architecture capability to recover from detected security errors","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-15T13:08:40.276Z","reviewed_at":null},{"id":"finding-f6fcadd687afc7aa544ac14ffa67ecb0d9bc1fd8892e40ad9894ea82a5f87cc5","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"NIST AI 600-1 — Generative Artificial Intelligence Profile","sourceVersion":"NIST AI 600-1, July 2024; publisher date 26 July 2024; verified 15 October 2026","modality":"should","authority":"Voluntary NIST suggested risk-management action; not a statutory requirement","jurisdiction":"United States; cross-sectoral voluntary use","title":"Verify sources and citations in GAI outputs","actor":"AI actors performing Domain Expert and TEVV (testing, evaluation, validation and verification) tasks","action":"verify","object":"sources and citations in GAI outputs","control":"MS-2.5-003 · PDF page 35","condition":"For generative AI risk management within the July 2024 profile; applicability depends on risk, lifecycle stage, relevant actor task and organisational use. Within pre-deployment risk measurement and ongoing monitoring","exception":"Not every suggested action applies to every AI actor or task (Section 3, PDF p.17); tailor to organisational requirements, risk tolerance and resources. This guidance does not itself impose a legal duty.","timing":"Before deployment and during ongoing monitoring","evidenceSummary":"Check the sources and citations supplied in generated outputs rather than treating them as reliable by default.","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf#page=35","ruleId":"AIR-7C84EFA973","intent":"verify sources and citations in gai outputs","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-15T13:08:40.276Z","reviewed_at":null},{"id":"finding-f97632481694d3e8ae8721c0f34688429dad51e4556b380e63ec93711f1ca5ab","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"NIST AI 600-1 — Generative Artificial Intelligence Profile","sourceVersion":"NIST AI 600-1, July 2024; publisher date 26 July 2024; verified 15 October 2026","modality":"should","authority":"Voluntary NIST suggested risk-management action; not a statutory requirement","jurisdiction":"United States; cross-sectoral voluntary use","title":"Evaluate safety-measure circumvention vulnerabilities","actor":"AI actors performing AI Deployment, AI Impact Assessment, Domain Expert, Operation and Monitoring, or TEVV tasks","action":"evaluate","object":"GAI vulnerabilities to safety measure circumvention","control":"MS-2.6-007 · PDF page 36","condition":"For generative AI risk management within the July 2024 profile; applicability depends on risk, lifecycle stage, relevant actor task and organisational use. Within authorised defensive evaluation","exception":"Not every suggested action applies to every AI actor or task (Section 3, PDF p.17); tailor to organisational requirements, risk tolerance and resources. This guidance does not itself impose a legal duty.","timing":"Regularly","evidenceSummary":"Assess susceptibility to circumvention of safety measures.","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf#page=36","ruleId":"AIR-FD39ED404D","intent":"evaluate gai vulnerabilities to safety measure circumvention","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-15T13:08:40.276Z","reviewed_at":null},{"id":"finding-ff0379325bf586b22b4f04020cd8d8d3ef45466d8e11ad44ed3c236b7da68666","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"NIST AI 600-1 — Generative Artificial Intelligence Profile","sourceVersion":"NIST AI 600-1, July 2024; publisher date 26 July 2024; verified 15 October 2026","modality":"should","authority":"Voluntary NIST suggested risk-management action; not a statutory requirement","jurisdiction":"United States; cross-sectoral voluntary use","title":"Verify training and evaluation data provenance","actor":"AI actors performing Domain Expert and TEVV (testing, evaluation, validation and verification) tasks","action":"verify","object":"provenance of GAI training and evaluation data","control":"MS-2.5-005 · PDF page 35","condition":"For generative AI risk management within the July 2024 profile; applicability depends on risk, lifecycle stage, relevant actor task and organisational use. TEVV data includes testing, evaluation, validation and verification data","exception":"Not every suggested action applies to every AI actor or task (Section 3, PDF p.17); tailor to organisational requirements, risk tolerance and resources. This guidance does not itself impose a legal duty.","timing":"During data verification for risk measurement","evidenceSummary":"Verify provenance of training and TEVV datasets. This is distinct from a claim that all dataset risks are resolved.","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf#page=35","ruleId":"AIR-37F8B8D4E2","intent":"verify provenance of gai training and evaluation data","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-15T13:08:40.276Z","reviewed_at":null},{"id":"change-cisa-ncsc-secure-ai-development-67293a0fe467a4278e31b98b0fac930419cc9fcfd1f5415d9b1661e88fb0cc75","kind":"source-change","status":"pending","body":{"sourceId":"cisa-ncsc-secure-ai-development","title":"Guidelines for Secure AI System Development","url":"https://www.ncsc.gov.uk/collection/guidelines-secure-ai-system-development/guidelines/secure-development","status":"publisher-bytes-changed","checkedAt":"2026-10-15T13:05:22.316Z","fingerprint":"67293a0fe467a4278e31b98b0fac930419cc9fcfd1f5415d9b1661e88fb0cc75","previousFingerprint":"8ac1ad46eff429e29577ee47b3a85199e5ffa654bc5e52891f9e1ae5bf6d347f","bytes":235216,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-15T13:05:22.316Z","reviewed_at":null},{"id":"finding-13c2be5c6aea82b3834d25446c13de7ed1f583ead4cb145056f69cfc8920bd0b","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Singapore Model AI Governance Framework","sourceVersion":"Second Edition, released 21 January 2020; official 70-page PDF retrieved 14 October 2026","actor":"Organisations adopting or deploying AI solutions at scale","authority":"Voluntary PDPC/IMDA governance guidance; not a statutory duty","jurisdiction":"Singapore; sector-agnostic voluntary reference elsewhere","title":"Document rationale for departures from corporate values","control":"3.12, p.29","action":"document","object":"rationale for AI deployment deviations from corporate values","modality":"should","condition":"Within the second-edition framework, primarily machine-learning deployment at scale; apply relevant measures proportionately to context and risk. A rationale does not authorize unlawful deployment.","exception":"Not intended for merely updating commercial off-the-shelf packages that now include AI (2.2). Measures are adaptable and not all relevant (3.2); adoption does not replace applicable laws or sectoral requirements (2.12-2.13).","timing":"When deciding on an inconsistent deployment or model","evidenceSummary":"Inconsistencies between AI deployment and corporate values should be conscious decisions with a clear documented rationale.","url":"https://www.pdpc.gov.sg/-/media/Files/PDPC/PDF-Files/Resource-for-Organisation/AI/SGModelAIGovFramework2.pdf#page=29","ruleId":"AIR-6BD6A06201","intent":"document rationale for ai deployment deviations from corporate values","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-14T13:02:21.582Z","reviewed_at":null},{"id":"finding-15abbd714d6bd45b40f5e6184d45257029979e0dd7e09526ee3a7bf0040c8d9d","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Singapore Model AI Governance Framework","sourceVersion":"Second Edition, released 21 January 2020; official 70-page PDF retrieved 14 October 2026","actor":"Organisations adopting or deploying AI solutions at scale","authority":"Voluntary PDPC/IMDA governance guidance; not a statutory duty","jurisdiction":"Singapore; sector-agnostic voluntary reference elsewhere","title":"Test models against dynamic production conditions","control":"3.35, p.48","action":"test","object":"AI models under dynamic production conditions","modality":"should","condition":"Within the second-edition framework, primarily machine-learning deployment at scale; apply relevant measures proportionately to context and risk. Wherever possible; safety testing needs depend on context.","exception":"Not intended for merely updating commercial off-the-shelf packages that now include AI (2.2). Measures are adaptable and not all relevant (3.2); adoption does not replace applicable laws or sectoral requirements (2.12-2.13).","timing":"During testing before and around deployment","evidenceSummary":"Where possible, testing should reflect production variability to assess generalisation and graceful failure.","url":"https://www.pdpc.gov.sg/-/media/Files/PDPC/PDF-Files/Resource-for-Organisation/AI/SGModelAIGovFramework2.pdf#page=48","ruleId":"AIR-6CD9D072C7","intent":"test ai models under dynamic production conditions","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-14T13:02:21.582Z","reviewed_at":null},{"id":"finding-176dafe5a36f288d28100133f53ee6c8dd1a5847e6ba6c665320baf7b87ec327","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Singapore Model AI Governance Framework","sourceVersion":"Second Edition, released 21 January 2020; official 70-page PDF retrieved 14 October 2026","actor":"Organisations adopting or deploying AI solutions at scale","authority":"Voluntary PDPC/IMDA governance guidance; not a statutory duty","jurisdiction":"Singapore; sector-agnostic voluntary reference elsewhere","title":"Transfer AI-governance knowledge when personnel change","control":"3.7(2)(b)(iii), p.24","action":"transfer","object":"AI governance knowledge during key personnel changes","modality":"may","condition":"Within the second-edition framework, primarily machine-learning deployment at scale; apply relevant measures proportionately to context and risk.","exception":"Not intended for merely updating commercial off-the-shelf packages that now include AI (2.2). Measures are adaptable and not all relevant (3.2); adoption does not replace applicable laws or sectoral requirements (2.12-2.13).","timing":"Whenever key AI personnel change","evidenceSummary":"Proper knowledge transfer reduces gaps in AI governance caused by movement of key staff.","url":"https://www.pdpc.gov.sg/-/media/Files/PDPC/PDF-Files/Resource-for-Organisation/AI/SGModelAIGovFramework2.pdf#page=24","ruleId":"AIR-B744BB72AD","intent":"transfer ai governance knowledge during key personnel changes","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-14T13:02:21.582Z","reviewed_at":null},{"id":"finding-1c8e1f5fceb82c12933144277c11ca9deb10e692d4e043a7f0c4e46e126963cb","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Singapore Model AI Governance Framework","sourceVersion":"Second Edition, released 21 January 2020; official 70-page PDF retrieved 14 October 2026","actor":"Organisations adopting or deploying AI solutions at scale","authority":"Voluntary PDPC/IMDA governance guidance; not a statutory duty","jurisdiction":"Singapore; sector-agnostic voluntary reference elsewhere","title":"Tell users when responses will train AI","control":"3.55, p.57","action":"inform","object":"individuals when their responses will train AI systems","modality":"should","condition":"Within the second-edition framework, primarily machine-learning deployment at scale; apply relevant measures proportionately to context and risk. Applies when responses will be used for training; does not itself establish a legal basis to process them.","exception":"Not intended for merely updating commercial off-the-shelf packages that now include AI (2.2). Measures are adaptable and not all relevant (3.2); adoption does not replace applicable laws or sectoral requirements (2.12-2.13).","timing":"When collecting responses for AI training","evidenceSummary":"Where applicable, inform users that their responses will train the AI system.","url":"https://www.pdpc.gov.sg/-/media/Files/PDPC/PDF-Files/Resource-for-Organisation/AI/SGModelAIGovFramework2.pdf#page=57","ruleId":"AIR-6E85F08651","intent":"inform individuals when their responses will train ai systems","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-14T13:02:21.582Z","reviewed_at":null},{"id":"finding-2256abf579327c93428d21ca055f99a842abdacefbce5800868c090ef2e8bc95","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Singapore Model AI Governance Framework","sourceVersion":"Second Edition, released 21 January 2020; official 70-page PDF retrieved 14 October 2026","actor":"Organisations adopting or deploying AI solutions at scale","authority":"Voluntary PDPC/IMDA governance guidance; not a statutory duty","jurisdiction":"Singapore; sector-agnostic voluntary reference elsewhere","title":"Test AI user interfaces before deployment","control":"3.55, p.57","action":"test","object":"AI user interfaces for usability before deployment","modality":"should","condition":"Within the second-edition framework, primarily machine-learning deployment at scale; apply relevant measures proportionately to context and risk.","exception":"Not intended for merely updating commercial off-the-shelf packages that now include AI (2.2). Measures are adaptable and not all relevant (3.2); adoption does not replace applicable laws or sectoral requirements (2.12-2.13).","timing":"Before deployment","evidenceSummary":"Test the interface and resolve usability problems before deployment so it serves its intended purpose.","url":"https://www.pdpc.gov.sg/-/media/Files/PDPC/PDF-Files/Resource-for-Organisation/AI/SGModelAIGovFramework2.pdf#page=57","ruleId":"AIR-FBA2E9CEBB","intent":"test ai user interfaces for usability before deployment","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-14T13:02:21.582Z","reviewed_at":null},{"id":"finding-277fa9be029217d4d50ed78fc8684a3203227e0870ff4133a93702ac38176c47","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Singapore Model AI Governance Framework","sourceVersion":"Second Edition, released 21 January 2020; official 70-page PDF retrieved 14 October 2026","actor":"Organisations adopting or deploying AI solutions at scale","authority":"Voluntary PDPC/IMDA governance guidance; not a statutory duty","jurisdiction":"Singapore; sector-agnostic voluntary reference elsewhere","title":"Provide appeals for material AI decisions","control":"3.54(b), p.57","action":"establish","object":"mechanisms to appeal AI outcomes","modality":"may","condition":"Within the second-edition framework, primarily machine-learning deployment at scale; apply relevant measures proportionately to context and risk. This voluntary recommendation is additional to existing review obligations; not a universal appeal entitlement.","exception":"Not intended for merely updating commercial off-the-shelf packages that now include AI (2.2). Measures are adaptable and not all relevant (3.2); adoption does not replace applicable laws or sectoral requirements (2.12-2.13).","timing":"After material decisions affecting an individual","evidenceSummary":"Consider an avenue for affected people to request review of material AI decisions; human review is reasonable for materially consequential autonomous decisions.","url":"https://www.pdpc.gov.sg/-/media/Files/PDPC/PDF-Files/Resource-for-Organisation/AI/SGModelAIGovFramework2.pdf#page=57","ruleId":"AIR-6E499BCE84","intent":"establish mechanisms to appeal ai outcomes","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-14T13:02:21.582Z","reviewed_at":null},{"id":"finding-38b0f25ef5ac27b572cb854cb1fa4e08f85c3b088bd11ed6b69a0d53c9b47bec","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Singapore Model AI Governance Framework","sourceVersion":"Second Edition, released 21 January 2020; official 70-page PDF retrieved 14 October 2026","actor":"Organisations adopting or deploying AI solutions at scale","authority":"Voluntary PDPC/IMDA governance guidance; not a statutory duty","jurisdiction":"Singapore; sector-agnostic voluntary reference elsewhere","title":"Train personnel in AI-risk responsibilities","control":"3.7(1)(b), p.22","action":"train","object":"personnel in their AI risk responsibilities","modality":"should","condition":"Within the second-edition framework, primarily machine-learning deployment at scale; apply relevant measures proportionately to context and risk.","exception":"Not intended for merely updating commercial off-the-shelf packages that now include AI (2.2). Measures are adaptable and not all relevant (3.2); adoption does not replace applicable laws or sectoral requirements (2.12-2.13).","timing":"Before and while discharging AI governance duties","evidenceSummary":"Internal AI governance personnel should understand their roles and receive suitable training, guidance and resources.","url":"https://www.pdpc.gov.sg/-/media/Files/PDPC/PDF-Files/Resource-for-Organisation/AI/SGModelAIGovFramework2.pdf#page=22","ruleId":"AIR-E528E1DA42","intent":"train personnel in their ai risk responsibilities","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-14T13:02:21.582Z","reviewed_at":null},{"id":"finding-44f1d9251394512e5a2b757516e8a300059510c5fecaeb294de8da10c47c9b00","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Singapore Model AI Governance Framework","sourceVersion":"Second Edition, released 21 January 2020; official 70-page PDF retrieved 14 October 2026","actor":"Organisations adopting or deploying AI solutions at scale","authority":"Voluntary PDPC/IMDA governance guidance; not a statutory duty","jurisdiction":"Singapore; sector-agnostic voluntary reference elsewhere","title":"Ask AI suppliers about model reproducibility","control":"3.40(d), p.50","action":"ask","object":"AI solution providers whether procured model results are reproducible","modality":"may","condition":"Within the second-edition framework, primarily machine-learning deployment at scale; apply relevant measures proportionately to context and risk. Concerns procurement of AI systems; distinguish from merely updating software that happens to add AI features under 2.2.","exception":"Not intended for merely updating commercial off-the-shelf packages that now include AI (2.2). Measures are adaptable and not all relevant (3.2); adoption does not replace applicable laws or sectoral requirements (2.12-2.13).","timing":"During procurement or reproducibility assessment","evidenceSummary":"Organisations procuring off-the-shelf AI systems can check reproducibility of results with the original solution provider.","url":"https://www.pdpc.gov.sg/-/media/Files/PDPC/PDF-Files/Resource-for-Organisation/AI/SGModelAIGovFramework2.pdf#page=50","ruleId":"AIR-DF06DD0948","intent":"ask ai solution providers whether procured model results are reproducible","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-14T13:02:21.582Z","reviewed_at":null},{"id":"finding-4ff95725544f0f9ec22b943aaee4fc7d9483786b92a611ee3babd241a9031d58","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Singapore Model AI Governance Framework","sourceVersion":"Second Edition, released 21 January 2020; official 70-page PDF retrieved 14 October 2026","actor":"Organisations adopting or deploying AI solutions at scale","authority":"Voluntary PDPC/IMDA governance guidance; not a statutory duty","jurisdiction":"Singapore; sector-agnostic voluntary reference elsewhere","title":"Enable human oversight of safety-critical AI","control":"3.18, p.31","action":"enable","object":"effective human oversight","modality":"should","condition":"Within the second-edition framework, primarily machine-learning deployment at scale; apply relevant measures proportionately to context and risk. If human control is not possible, sufficient information should support safe shutdown.","exception":"Not intended for merely updating commercial off-the-shelf packages that now include AI (2.2). Measures are adaptable and not all relevant (3.2); adoption does not replace applicable laws or sectoral requirements (2.12-2.13).","timing":"When operating safety-critical systems","evidenceSummary":"For safety-critical systems, allow a person to assume control and provide enough information for meaningful decisions or safe shutdown.","url":"https://www.pdpc.gov.sg/-/media/Files/PDPC/PDF-Files/Resource-for-Organisation/AI/SGModelAIGovFramework2.pdf#page=31","ruleId":"AIR-9F0606F820","intent":"enable effective human oversight","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-14T13:02:21.582Z","reviewed_at":null},{"id":"finding-58993f9dc6d928549470cdba57b58a0bbc1e4152ca151755e34c4de5b93cd41a","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Singapore Model AI Governance Framework","sourceVersion":"Second Edition, released 21 January 2020; official 70-page PDF retrieved 14 October 2026","actor":"Organisations adopting or deploying AI solutions at scale","authority":"Voluntary PDPC/IMDA governance guidance; not a statutory duty","jurisdiction":"Singapore; sector-agnostic voluntary reference elsewhere","title":"Assess risks of data with uncertain provenance","control":"3.23(a), p.37","action":"assess","object":"risks of using data with uncertain provenance","modality":"should","condition":"Within the second-edition framework, primarily machine-learning deployment at scale; apply relevant measures proportionately to context and risk. Trusted third-party supply does not itself establish provenance.","exception":"Not intended for merely updating commercial off-the-shelf packages that now include AI (2.2). Measures are adaptable and not all relevant (3.2); adoption does not replace applicable laws or sectoral requirements (2.12-2.13).","timing":"Before and during use of data whose origin is uncertain","evidenceSummary":"Where origins are difficult to establish, including commingled third-party data, assess the risks of using the data.","url":"https://www.pdpc.gov.sg/-/media/Files/PDPC/PDF-Files/Resource-for-Organisation/AI/SGModelAIGovFramework2.pdf#page=37","ruleId":"AIR-53EC5139B9","intent":"assess risks of using data with uncertain provenance","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-14T13:02:21.582Z","reviewed_at":null},{"id":"finding-5af70fc5e8250fd18712c9b09e2c92f4708986acdc14a050595d3536c5634e08","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Singapore Model AI Governance Framework","sourceVersion":"Second Edition, released 21 January 2020; official 70-page PDF retrieved 14 October 2026","actor":"Organisations adopting or deploying AI solutions at scale","authority":"Voluntary PDPC/IMDA governance guidance; not a statutory duty","jurisdiction":"Singapore; sector-agnostic voluntary reference elsewhere","title":"Ensure AI-dataset traceability","control":"3.23(a), p.37","action":"ensure","object":"AI dataset traceability","modality":"may","condition":"Within the second-edition framework, primarily machine-learning deployment at scale; apply relevant measures proportionately to context and risk. Data origin may be difficult to establish; assess and manage the resulting risk rather than assert complete provenance.","exception":"Not intended for merely updating commercial off-the-shelf packages that now include AI (2.2). Measures are adaptable and not all relevant (3.2); adoption does not replace applicable laws or sectoral requirements (2.12-2.13).","timing":"During data management and model development","evidenceSummary":"Data accountability practices include understanding data origin, curation, transformation and movement; provenance records support tracing errors.","url":"https://www.pdpc.gov.sg/-/media/Files/PDPC/PDF-Files/Resource-for-Organisation/AI/SGModelAIGovFramework2.pdf#page=37","ruleId":"AIR-B560A4296B","intent":"ensure ai dataset traceability","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-14T13:02:21.582Z","reviewed_at":null},{"id":"finding-6671a1804218c64a1faf6fbfb0f4c149caf3b272a7e406759f12fae3ed5d388a","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Singapore Model AI Governance Framework","sourceVersion":"Second Edition, released 21 January 2020; official 70-page PDF retrieved 14 October 2026","actor":"Organisations adopting or deploying AI solutions at scale","authority":"Voluntary PDPC/IMDA governance guidance; not a statutory duty","jurisdiction":"Singapore; sector-agnostic voluntary reference elsewhere","title":"Assign AI-system accountability","control":"3.7(1)(a), p.22","action":"assign","object":"AI system accountability","modality":"should","condition":"Within the second-edition framework, primarily machine-learning deployment at scale; apply relevant measures proportionately to context and risk.","exception":"Not intended for merely updating commercial off-the-shelf packages that now include AI (2.2). Measures are adaptable and not all relevant (3.2); adoption does not replace applicable laws or sectoral requirements (2.12-2.13).","timing":"At allocation of AI deployment responsibilities","evidenceSummary":"Allocate oversight of deployment stages to appropriate personnel or departments; a coordinating body is conditional on need and feasibility.","url":"https://www.pdpc.gov.sg/-/media/Files/PDPC/PDF-Files/Resource-for-Organisation/AI/SGModelAIGovFramework2.pdf#page=22","ruleId":"AIR-A332E21BFB","intent":"assign ai system accountability","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-14T13:02:21.582Z","reviewed_at":null},{"id":"finding-6aad6db8d94b1a5e2a14fc945fa08a63f2a83ee7269c661fc3d328c2d51caf2a","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Singapore Model AI Governance Framework","sourceVersion":"Second Edition, released 21 January 2020; official 70-page PDF retrieved 14 October 2026","actor":"Organisations adopting or deploying AI solutions at scale","authority":"Voluntary PDPC/IMDA governance guidance; not a statutory duty","jurisdiction":"Singapore; sector-agnostic voluntary reference elsewhere","title":"Develop an AI-explanation policy","control":"3.48, p.53","action":"develop","object":"a policy defining AI explanations and their timing","modality":"should","condition":"Within the second-edition framework, primarily machine-learning deployment at scale; apply relevant measures proportionately to context and risk. Explanations may be general or specific on request; tailor to purpose and context.","exception":"Not intended for merely updating commercial off-the-shelf packages that now include AI (2.2). Measures are adaptable and not all relevant (3.2); adoption does not replace applicable laws or sectoral requirements (2.12-2.13).","timing":"Before and during stakeholder communication","evidenceSummary":"An explanation policy specifies what to explain, when and organisational responsibilities; equivalent human decisions guide disclosure standards.","url":"https://www.pdpc.gov.sg/-/media/Files/PDPC/PDF-Files/Resource-for-Organisation/AI/SGModelAIGovFramework2.pdf#page=53","ruleId":"AIR-E6D1E07495","intent":"develop a policy defining ai explanations and their timing","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-14T13:02:21.582Z","reviewed_at":null},{"id":"finding-8c60987f5f9dca22446cb1ecb9144662821796a76623243c37722d03f6709deb","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Singapore Model AI Governance Framework","sourceVersion":"Second Edition, released 21 January 2020; official 70-page PDF retrieved 14 October 2026","actor":"Organisations adopting or deploying AI solutions at scale","authority":"Voluntary PDPC/IMDA governance guidance; not a statutory duty","jurisdiction":"Singapore; sector-agnostic voluntary reference elsewhere","title":"Establish a regular model-tuning policy","control":"3.34, p.48","action":"establish","object":"a policy for regular AI model tuning","modality":"may","condition":"Within the second-edition framework, primarily machine-learning deployment at scale; apply relevant measures proportionately to context and risk. Tuning must remain appropriate to the deployed system and risk.","exception":"Not intended for merely updating commercial off-the-shelf packages that now include AI (2.2). Measures are adaptable and not all relevant (3.2); adoption does not replace applicable laws or sectoral requirements (2.12-2.13).","timing":"Regularly; also when objectives, risks or corporate values change","evidenceSummary":"An internal policy and process for regular tuning helps deployed models respond to changing customer behavior and updated data.","url":"https://www.pdpc.gov.sg/-/media/Files/PDPC/PDF-Files/Resource-for-Organisation/AI/SGModelAIGovFramework2.pdf#page=48","ruleId":"AIR-06075B5F24","intent":"establish a policy for regular ai model tuning","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-14T13:02:21.582Z","reviewed_at":null},{"id":"finding-8d9f08d38bafc1c0aff08078f36c53dbcaf5535a85ab39e615e6d3503423f728","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Singapore Model AI Governance Framework","sourceVersion":"Second Edition, released 21 January 2020; official 70-page PDF retrieved 14 October 2026","actor":"Organisations adopting or deploying AI solutions at scale","authority":"Voluntary PDPC/IMDA governance guidance; not a statutory duty","jurisdiction":"Singapore; sector-agnostic voluntary reference elsewhere","title":"Review AI governance after structural changes","control":"3.7(2)(b)(iv), p.24","action":"review","object":"AI governance structures after organisational or key personnel changes","modality":"may","condition":"Within the second-edition framework, primarily machine-learning deployment at scale; apply relevant measures proportionately to context and risk.","exception":"Not intended for merely updating commercial off-the-shelf packages that now include AI (2.2). Measures are adaptable and not all relevant (3.2); adoption does not replace applicable laws or sectoral requirements (2.12-2.13).","timing":"On significant organisational or key-personnel change","evidenceSummary":"Review internal governance structures and measures following significant organisational or key-personnel changes.","url":"https://www.pdpc.gov.sg/-/media/Files/PDPC/PDF-Files/Resource-for-Organisation/AI/SGModelAIGovFramework2.pdf#page=24","ruleId":"AIR-80D754CF92","intent":"review ai governance structures after organisational or key personnel changes","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-14T13:02:21.582Z","reviewed_at":null},{"id":"finding-9878a9f67108d8dd5c0530b65da745bedb1e46ebea5d485d66bb6fe46d803c37","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Singapore Model AI Governance Framework","sourceVersion":"Second Edition, released 21 January 2020; official 70-page PDF retrieved 14 October 2026","actor":"Organisations adopting or deploying AI solutions at scale","authority":"Voluntary PDPC/IMDA governance guidance; not a statutory duty","jurisdiction":"Singapore; sector-agnostic voluntary reference elsewhere","title":"Assess whether to offer an AI opt-out","control":"3.52, p.56","action":"assess","object":"whether to offer an AI opt out","modality":"may","condition":"Within the second-edition framework, primarily machine-learning deployment at scale; apply relevant measures proportionately to context and risk. No universal opt-out mandate; if none is provided, consider review or recourse under 3.53.","exception":"Not intended for merely updating commercial off-the-shelf packages that now include AI (2.2). Measures are adaptable and not all relevant (3.2); adoption does not replace applicable laws or sectoral requirements (2.12-2.13).","timing":"When deciding whether and how to offer opt-out","evidenceSummary":"Consider opt-out availability and default versus on-request delivery against harm, reversibility, alternatives, costs and feasibility.","url":"https://www.pdpc.gov.sg/-/media/Files/PDPC/PDF-Files/Resource-for-Organisation/AI/SGModelAIGovFramework2.pdf#page=56","ruleId":"AIR-50720EFBE6","intent":"assess whether to offer an ai opt out","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-14T13:02:21.582Z","reviewed_at":null},{"id":"finding-be3cac7f934fd48781d050445e3654ce97fc27995543a4cc5e76a1e9d3bd171d","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Singapore Model AI Governance Framework","sourceVersion":"Second Edition, released 21 January 2020; official 70-page PDF retrieved 14 October 2026","actor":"Organisations adopting or deploying AI solutions at scale","authority":"Voluntary PDPC/IMDA governance guidance; not a statutory duty","jurisdiction":"Singapore; sector-agnostic voluntary reference elsewhere","title":"Monitor deployed AI-model behavior","control":"3.7(1)(c)(ii), p.23; 3.7(2)(b)(ii), p.24","action":"monitor","object":"AI behavior in production","modality":"should","condition":"Within the second-edition framework, primarily machine-learning deployment at scale; apply relevant measures proportionately to context and risk. Monitoring design is proportionate; autonomous monitoring is optional where appropriate.","exception":"Not intended for merely updating commercial off-the-shelf packages that now include AI (2.2). Measures are adaptable and not all relevant (3.2); adoption does not replace applicable laws or sectoral requirements (2.12-2.13).","timing":"During deployment","evidenceSummary":"Governance roles cover deployed-model monitoring and review; management reporting should surface performance and other issues.","url":"https://www.pdpc.gov.sg/-/media/Files/PDPC/PDF-Files/Resource-for-Organisation/AI/SGModelAIGovFramework2.pdf#page=23","ruleId":"AIR-F6290E21EB","intent":"monitor ai behavior in production","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-14T13:02:21.582Z","reviewed_at":null},{"id":"finding-c34820308e4e1d4c45576be47765fd0f63ed12766a30b5e4a851fd76df8a83a6","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Singapore Model AI Governance Framework","sourceVersion":"Second Edition, released 21 January 2020; official 70-page PDF retrieved 14 October 2026","actor":"Organisations adopting or deploying AI solutions at scale","authority":"Voluntary PDPC/IMDA governance guidance; not a statutory duty","jurisdiction":"Singapore; sector-agnostic voluntary reference elsewhere","title":"Make model replication files available for testing","control":"3.40(c), p.50","action":"make available","object":"AI model replication files for reproducibility testing","modality":"may","condition":"Within the second-edition framework, primarily machine-learning deployment at scale; apply relevant measures proportionately to context and risk. External reproducibility testing can target a risk-selected subset of AI features (3.39); not a public release mandate.","exception":"Not intended for merely updating commercial off-the-shelf packages that now include AI (2.2). Measures are adaptable and not all relevant (3.2); adoption does not replace applicable laws or sectoral requirements (2.12-2.13).","timing":"When undertaking reproducibility testing","evidenceSummary":"Replication files that reconstruct development steps facilitate testing and reproduction of behavior.","url":"https://www.pdpc.gov.sg/-/media/Files/PDPC/PDF-Files/Resource-for-Organisation/AI/SGModelAIGovFramework2.pdf#page=50","ruleId":"AIR-0B7460B97C","intent":"make available ai model replication files for reproducibility testing","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-14T13:02:21.582Z","reviewed_at":null},{"id":"finding-e127e120e2fa2158fe9a4426a9a63553613ae1e75466a2babc24f0e737ee435a","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Singapore Model AI Governance Framework","sourceVersion":"Second Edition, released 21 January 2020; official 70-page PDF retrieved 14 October 2026","actor":"Organisations adopting or deploying AI solutions at scale","authority":"Voluntary PDPC/IMDA governance guidance; not a statutory duty","jurisdiction":"Singapore; sector-agnostic voluntary reference elsewhere","title":"Determine human involvement using harm probability and severity","control":"3.15-3.17, p.31","action":"determine","object":"human involvement using probability and severity of AI harm","modality":"may","condition":"Within the second-edition framework, primarily machine-learning deployment at scale; apply relevant measures proportionately to context and risk. These are not the only factors: nature and reversibility of harm, recourse and operational feasibility also matter (3.17 footnote 4).","exception":"Not intended for merely updating commercial off-the-shelf packages that now include AI (2.2). Measures are adaptable and not all relevant (3.2); adoption does not replace applicable laws or sectoral requirements (2.12-2.13).","timing":"When selecting or reassessing human involvement","evidenceSummary":"A proposed matrix helps select human involvement using likelihood and severity of harm.","url":"https://www.pdpc.gov.sg/-/media/Files/PDPC/PDF-Files/Resource-for-Organisation/AI/SGModelAIGovFramework2.pdf#page=31","ruleId":"AIR-842F4DF31B","intent":"determine human involvement using probability and severity of ai harm","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-14T13:02:21.582Z","reviewed_at":null},{"id":"finding-e8da1f2bbf50529ffd909f34da52b790da64589b31f38f68034be8abbcd093cb","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Singapore Model AI Governance Framework","sourceVersion":"Second Edition, released 21 January 2020; official 70-page PDF retrieved 14 October 2026","actor":"Organisations adopting or deploying AI solutions at scale","authority":"Voluntary PDPC/IMDA governance guidance; not a statutory duty","jurisdiction":"Singapore; sector-agnostic voluntary reference elsewhere","title":"Retain AI traceability records for relevant durations","control":"3.37(c), p.49","action":"retain","object":"AI traceability records for industry relevant durations","modality":"may","condition":"Within the second-edition framework, primarily machine-learning deployment at scale; apply relevant measures proportionately to context and risk. No fixed retention duration is prescribed; contextual selection under 3.38 remains necessary.","exception":"Not intended for merely updating commercial off-the-shelf packages that now include AI (2.2). Measures are adaptable and not all relevant (3.2); adoption does not replace applicable laws or sectoral requirements (2.12-2.13).","timing":"For industry-relevant retention durations","evidenceSummary":"Traceability data should be retained for durations relevant to the industry rather than a universal period.","url":"https://www.pdpc.gov.sg/-/media/Files/PDPC/PDF-Files/Resource-for-Organisation/AI/SGModelAIGovFramework2.pdf#page=49","ruleId":"AIR-1CA65C58B8","intent":"retain ai traceability records for industry relevant durations","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-14T13:02:21.582Z","reviewed_at":null},{"id":"finding-f34717a48cab02e427a0a2076b6739dc92e6f6a1a86c849741f4738c029d8f37","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Singapore Model AI Governance Framework","sourceVersion":"Second Edition, released 21 January 2020; official 70-page PDF retrieved 14 October 2026","actor":"Organisations adopting or deploying AI solutions at scale","authority":"Voluntary PDPC/IMDA governance guidance; not a statutory duty","jurisdiction":"Singapore; sector-agnostic voluntary reference elsewhere","title":"Maintain a response plan for failed AI-risk mitigations","control":"3.13, p.29","action":"maintain","object":"a response plan for failed AI risk mitigations","modality":"should","condition":"Within the second-edition framework, primarily machine-learning deployment at scale; apply relevant measures proportionately to context and risk. Semantically related to existing risk-response planning; owner review should assess overlap before adoption.","exception":"Not intended for merely updating commercial off-the-shelf packages that now include AI (2.2). Measures are adaptable and not all relevant (3.2); adoption does not replace applicable laws or sectoral requirements (2.12-2.13).","timing":"Throughout the iterative deployment-risk process","evidenceSummary":"The iterative risk-management process includes maintaining a plan for cases where mitigation fails.","url":"https://www.pdpc.gov.sg/-/media/Files/PDPC/PDF-Files/Resource-for-Organisation/AI/SGModelAIGovFramework2.pdf#page=29","ruleId":"AIR-0D19E4E892","intent":"maintain a response plan for failed ai risk mitigations","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-14T13:02:21.582Z","reviewed_at":null},{"id":"finding-fcc93b61a733458d5bc21f59cf492241557d88310912b47b2161bedc9a295bf1","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Singapore Model AI Governance Framework","sourceVersion":"Second Edition, released 21 January 2020; official 70-page PDF retrieved 14 October 2026","actor":"Organisations adopting or deploying AI solutions at scale","authority":"Voluntary PDPC/IMDA governance guidance; not a statutory duty","jurisdiction":"Singapore; sector-agnostic voluntary reference elsewhere","title":"Protect AI traceability records from alteration","control":"3.37(c), p.49","action":"protect","object":"AI traceability records from degradation or alteration","modality":"may","condition":"Within the second-edition framework, primarily machine-learning deployment at scale; apply relevant measures proportionately to context and risk. Select traceability measures and product features proportionately to harm, experience and regulatory needs (3.38).","exception":"Not intended for merely updating commercial off-the-shelf packages that now include AI (2.2). Measures are adaptable and not all relevant (3.2); adoption does not replace applicable laws or sectoral requirements (2.12-2.13).","timing":"During storage of traceability data","evidenceSummary":"Store traceability data appropriately so it does not degrade or change.","url":"https://www.pdpc.gov.sg/-/media/Files/PDPC/PDF-Files/Resource-for-Organisation/AI/SGModelAIGovFramework2.pdf#page=49","ruleId":"AIR-66817D6B0A","intent":"protect ai traceability records from degradation or alteration","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-14T13:02:21.582Z","reviewed_at":null},{"id":"change-msu-genai-guidelines-a846fd3339fc751dfed295eaaa686ae188114b9b6504cac6cd03ffe131c339c6","kind":"source-change","status":"pending","body":{"sourceId":"msu-genai-guidelines","title":"Guidelines for the Use of Generative Artificial Intelligence Tools","url":"https://ai.msu.edu/guidelines","status":"publisher-bytes-changed","checkedAt":"2026-10-14T12:58:12.923Z","fingerprint":"a846fd3339fc751dfed295eaaa686ae188114b9b6504cac6cd03ffe131c339c6","previousFingerprint":"d8483523ef2e20efe11bd41752c6cf80915acac37d3598592539445f84443056","bytes":706968,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-14T12:58:12.923Z","reviewed_at":null},{"id":"change-cisa-ncsc-secure-ai-development-8ac1ad46eff429e29577ee47b3a85199e5ffa654bc5e52891f9e1ae5bf6d347f","kind":"source-change","status":"pending","body":{"sourceId":"cisa-ncsc-secure-ai-development","title":"Guidelines for Secure AI System Development","url":"https://www.ncsc.gov.uk/collection/guidelines-secure-ai-system-development/guidelines/secure-development","status":"publisher-bytes-changed","checkedAt":"2026-10-14T12:58:10.210Z","fingerprint":"8ac1ad46eff429e29577ee47b3a85199e5ffa654bc5e52891f9e1ae5bf6d347f","previousFingerprint":"9e70446e08f90873fce594e89339839ed1c9123de6c0c060670bb752c3b47c05","bytes":235219,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-14T12:58:10.210Z","reviewed_at":null},{"id":"finding-03ec1911de65548efcf04c70b5cfb6f53d60817140aeb26a215319b8dfffdb83","kind":"rule-candidate","status":"pending","body":{"title":"Separate tasks by authorization context","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM08:2026 Prevention Strategy 3","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"separate","object":"tasks by authorization context","condition":"When LLM tasks require different access levels.","evidenceSummary":"The guidance separates tasks and grants each context only the privileges it needs.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"Authorization must be deterministic and auditable.","timing":"Before execution","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-CBC4109CB3","intent":"separate tasks by authorization context","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-07557cc3dbe6a572b39fc4325a6ecf4f34619bf21bda29249699fc31f76ede2b","kind":"rule-candidate","status":"pending","body":{"title":"Verify model provenance and integrity","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM04:2026 Prevention Strategy 5","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"verify","object":"model provenance and integrity","condition":"Before promoting a model from an external or shared source.","evidenceSummary":"The guidance combines verifiable sources, signatures, hashes, immutable references and release gates.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"A valid signature proves origin and integrity, not model safety.","timing":"Before deployment and continuously upstream","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-20E5C620DA","intent":"verify model provenance and integrity","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-07ab644d67a9314e6cd0ef4dd13b9f5d176b074636e7de7b3bce2e779909d9e0","kind":"rule-candidate","status":"pending","body":{"title":"Use parameterized queries for model-generated database operations","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM10:2026 Prevention Strategy 5","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"use","object":"parameterized queries for model-generated database operations","condition":"When LLM output influences a database query.","evidenceSummary":"The guidance requires parameterized queries or prepared statements.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"Parameterization does not authorize an otherwise prohibited operation.","timing":"Before database execution","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-BA72D5E60A","intent":"use parameterized queries for model generated database operations","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-11ecf381e1e891ef80a91037416d292f29063a2e0a8ca8d3d0b765cbcb7ebd97","kind":"rule-candidate","status":"pending","body":{"title":"Enforce behavior controls outside the model","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM08:2026 Prevention Strategy 2","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"enforce","object":"behavior controls outside the model","condition":"When a critical behavior or safety boundary must be reliable.","evidenceSummary":"The guidance uses deterministic external safeguards rather than hidden instructions as the primary control.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"Fine-tuning may reduce risk but provides no consistent guarantee.","timing":"At every relevant decision point","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-B25B8057B5","intent":"enforce behavior controls outside the model","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-18edebc8a1aa3f8a6c32463a56e9913412536fdd0a3a60f5edf327737c9e29ab","kind":"rule-candidate","status":"pending","body":{"title":"Detect recursive or resource-intensive agent actions","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM06:2026 Prevention Strategy 8","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"detect","object":"recursive or resource-intensive agent actions","condition":"When agent-tool interaction deviates from established normal consumption patterns.","evidenceSummary":"The guidance monitors sessions for loops and resource-heavy tool behavior without a clear end state.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"Baselines must be maintained as tools and workloads change.","timing":"Continuously during agent runs","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-49A72C4549","intent":"detect recursive or resource intensive agent actions","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-1bd1cfc43e31f544dcc00ca1d0a24b8c75df353c6711e5699fcd7ac40960ead8","kind":"rule-candidate","status":"pending","body":{"title":"Validate every model response in trusted code","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM01:2026 Prevention and Mitigation Strategy 2","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"validate","object":"every model response in trusted application code","condition":"Before any downstream system acts on an LLM response.","evidenceSummary":"The guidance calls for structural validation in trusted code rather than a second model call.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"Structural validation catches format violations but not necessarily semantic manipulation.","timing":"Before downstream use","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-4E0B5E4900","intent":"validate every model response in trusted application code","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-1d8ad63a4a84bd74baf84657ac3813695c213a7b27437bb6df341430ca4c5eff","kind":"rule-candidate","status":"pending","body":{"title":"Strip invisible Unicode at ingest and render boundaries","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM01:2026 Prevention and Mitigation Strategy 5","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"strip","object":"invisible Unicode at ingest and render boundaries","condition":"When ingesting or rendering content that may reach or leave an LLM context.","evidenceSummary":"The guidance identifies tag-block, variation-selector and zero-width characters as smuggling channels.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"This does not address visible-text payloads or future steganographic classes.","timing":"At every ingest and render boundary","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-23C6FB27BE","intent":"strip invisible unicode at ingest and render boundaries","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-2466cd6e96527ce36718aca579bd1c878e93c2d53030ad73176d144d426c7804","kind":"rule-candidate","status":"pending","body":{"title":"Enforce tenant scope inside vector queries","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM09:2026 Prevention Strategy 1","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"enforce","object":"tenant scope inside vector queries","condition":"When a shared retrieval system serves multiple tenants or trust zones.","evidenceSummary":"The guidance validates tenant scope server-side within the index query.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"High-sensitivity workloads may require physically separate indexes.","timing":"At query time","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-31CFFA6E61","intent":"enforce tenant scope inside vector queries","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-309f564c9feaac4005af882c8d83219a2a5ec70d15093c5957112b84dd2b048e","kind":"rule-candidate","status":"pending","body":{"title":"Enforce hard AI spending caps","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM06:2026 Prevention Strategy 2","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"enforce","object":"hard AI spending caps","condition":"For each API key, user, team and cloud account consuming paid inference.","evidenceSummary":"The guidance requires non-overridable ceilings that stop inference when exceeded.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"Caps should account for modality and tool-protocol cost differences.","timing":"Continuously during inference","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-0527253C36","intent":"enforce hard ai spending caps","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-346b80433436c35ad69331e132d7d636f2f5f4219737e7addbcaada12af070c1","kind":"rule-candidate","status":"pending","body":{"title":"Govern automated retraining loops","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM05:2026 Prevention Strategy 9","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"govern","object":"automated retraining and feedback loops","condition":"When preference signals or user feedback can change a model automatically.","evidenceSummary":"The guidance validates inputs, requires human oversight and rate-limits feedback-driven updates.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"Controls address gradual poisoning but do not eliminate all manipulation.","timing":"Before accepting feedback and before retraining","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-799E96112C","intent":"govern automated retraining and feedback loops","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-4206d8e88bd140ab04c2a22fc58cb8f910d6d611be83cf0b414e478495e50830","kind":"rule-candidate","status":"pending","body":{"title":"Version datasets for rollback","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM05:2026 Prevention Strategy 8","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"version","object":"datasets for rollback and forensic analysis","condition":"Across training, fine-tuning and embedding data pipelines.","evidenceSummary":"The guidance uses data version control to track changes and support rollback after poisoning.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"Versioning must be paired with access and integrity controls.","timing":"Continuously across dataset changes","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-9168F8CFD2","intent":"version datasets for rollback and forensic analysis","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-42cc8e5e2d605af8301fa8ad5eda676ee9bf94706f7046352fa1e4edb79594ec","kind":"rule-candidate","status":"pending","body":{"title":"Verify claims before execution","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM07:2026 Prevention Strategy 2","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"verify","object":"LLM-generated claims before execution","condition":"When generated claims would trigger a tool, workflow or external action.","evidenceSummary":"The guidance separates claim generation from execution and inserts verification.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"Verification should use independent evidence and current system state.","timing":"Before acting","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-E7BF5547F0","intent":"verify llm generated claims before execution","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-5bb606ab629ae76dbbcb641b1b57a74050bdd6ebab2cf79798bc16ccccf3feb2","kind":"rule-candidate","status":"pending","body":{"title":"Require human confirmation before privileged actions","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM01:2026 Prevention and Mitigation Strategy 7","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"require","object":"human confirmation before privileged actions","condition":"For privileged, irreversible or externally visible actions proposed by an LLM application.","evidenceSummary":"The guidance requires confirmation against the exact rendered action.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"Approval fatigue can degrade review quality.","timing":"Immediately before action execution","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-67CAE3665A","intent":"require human confirmation before privileged actions","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-620cc55d77c3c8b6e3bf33a3ef6f766cd89d135d47c7378bc1decc8696810193","kind":"rule-candidate","status":"pending","body":{"title":"Mediate downstream actions independently of the LLM","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM03:2026 Prevention Strategy 7","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"mediate","object":"downstream actions independently of the LLM","condition":"Whenever an LLM proposes an action against a downstream system.","evidenceSummary":"The guidance validates every request at a deterministic policy point or downstream system.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"Graduated policies may auto-approve low-consequence reversible actions.","timing":"Before each downstream action","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-0376A55328","intent":"mediate downstream actions independently of the llm","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-64484b5f3ae210bdb8ffe25d37567d495fb7faca16ba414d22b73f0c52084c23","kind":"rule-candidate","status":"pending","body":{"title":"Block automatic outbound requests from rendered model output","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM10:2026 Prevention Strategy 9","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"block","object":"automatic outbound requests from rendered model output","condition":"When chat, IDE, email or mobile clients render LLM-generated content.","evidenceSummary":"The guidance disables automatic images, previews, iframes and similar fetches by default.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"If fetching is required, use an origin allowlist or a server-side proxy that strips data-bearing parameters.","timing":"At render time","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-19242DD653","intent":"block automatic outbound requests from rendered model output","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-658efaa31aa02be1264281c5ad8484cf776364f01939d140d1f0db2eafd2adf3","kind":"rule-candidate","status":"pending","body":{"title":"Minimize context sent to external providers","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM02:2026 Tier 1 Strategy 2","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"minimize","object":"context sent to external model providers","condition":"When an application sends user or organizational data to an external model provider.","evidenceSummary":"The guidance limits provider context to task-required fields and requires justification for auto-context features.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"Additional context may be justified when documented and controlled.","timing":"Before each external model request","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-7D56E83B4D","intent":"minimize context sent to external model providers","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-67a01c9bf0d63ccf3059b48d5a2971e972f40ed312fba5ef6d93e19115f1873c","kind":"rule-candidate","status":"pending","body":{"title":"Validate model outputs before backend use","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM10:2026 Prevention Strategy 1","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"validate","object":"model outputs before backend use","condition":"When model output is passed to a backend function or downstream component.","evidenceSummary":"The guidance treats model output as untrusted user input.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"Validation must be appropriate to the receiving function.","timing":"Before backend processing","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-91F1E724D7","intent":"validate model outputs before backend use","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-6824ea4c6492ff59245d49dd8b0796cd7451d19687b2ff47dc6a62432aa9a1f8","kind":"rule-candidate","status":"pending","body":{"title":"Reject oversized inputs before inference","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM06:2026 Prevention Strategy 1","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"reject","object":"oversized inputs before inference","condition":"When an input exceeds the application's documented size or token limits.","evidenceSummary":"The guidance uses pre-flight token estimation and input-size validation.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"Limits should be risk- and workload-appropriate.","timing":"Before inference begins","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-B02AAFF7C0","intent":"reject oversized inputs before inference","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-6aba5353e0925ff7fc8f929bf8f3e9249709ff14952820ed7402e9e172b35c67","kind":"rule-candidate","status":"pending","body":{"title":"Avoid open-ended agent tools","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM03:2026 Prevention Strategy 3","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"avoid","object":"open-ended agent tools","condition":"When a specific narrow operation can replace shell, arbitrary URL or equivalent open-ended functionality.","evidenceSummary":"The guidance prefers granular tools with strict parameter schemas.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"Open-ended tools may remain only where no safer granular alternative meets the need.","timing":"During tool selection and design","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-8F98427AF2","intent":"avoid open ended agent tools","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-6d73b2176b5d849b51beaab60d524ddc3ff162a0acfbdff871fb84f4ca8ee0d5","kind":"rule-candidate","status":"pending","body":{"title":"Reassess suppliers after security or contract changes","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM04:2026 Prevention Strategy 1","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"reassess","object":"AI suppliers after security or contract changes","condition":"When a supplier's security posture, access model, terms or privacy policy changes.","evidenceSummary":"The guidance requires recurring supplier review and change-triggered reassessment.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"Only trusted suppliers should remain in use.","timing":"After relevant supplier changes","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-5BFA4011AC","intent":"reassess ai suppliers after security or contract changes","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-6e28d8550e6e3e21c03049e1b50801cf8c240e55b40c40c20ba5085e068d825f","kind":"rule-candidate","status":"pending","body":{"title":"Limit agent-tool functions","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM03:2026 Prevention Strategy 2","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"limit","object":"agent-tool functions to necessary operations","condition":"When designing or selecting tools for an LLM agent.","evidenceSummary":"The guidance limits each tool to the operations required by the use case.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"Separate narrowly scoped tools may replace multifunction tools.","timing":"During tool design and configuration","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-D3CFB869C0","intent":"limit agent tool functions to necessary operations","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-71d03c842f1ff18f65bbd03bb8856d507779b4cbc87ceed289b58498268bb982","kind":"rule-candidate","status":"pending","body":{"title":"Keep credentials outside the model","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM01:2026 Prevention and Mitigation Strategy 4","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"keep","object":"credentials and state-change capability outside the model","condition":"For any privileged or state-changing operation exposed to an LLM application.","evidenceSummary":"The guidance places credentials and state-change authority in deterministic application code.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"Broad downstream permissions or agent hops can reintroduce the risk.","timing":"During design and execution","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-E9A76989D8","intent":"keep credentials and state change capability outside the model","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-7f5cd4596f4af82470099c7b77908b71cc97a7f93a6f221df52e3e22bd18d2b4","kind":"rule-candidate","status":"pending","body":{"title":"Limit agent tools to the necessary set","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM03:2026 Prevention Strategy 1","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"limit","object":"agent tools to the necessary set","condition":"When configuring tools available to an LLM agent.","evidenceSummary":"The guidance removes tools that are unnecessary for the intended task.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"No broader tool set is justified by convenience alone.","timing":"Before deployment and when capabilities change","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-B8045D5BEB","intent":"limit agent tools to the necessary set","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-8766289bb7e4ee66d6d0b128cada1e14af85543ff24d4295906b4a3adeaf7e94","kind":"rule-candidate","status":"pending","body":{"title":"Verify MCP servers and third-party tool packages","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM01:2026 Prevention and Mitigation Strategy 10","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"verify","object":"MCP servers and third-party tool packages","condition":"Before connecting an MCP server or third-party tool package to an LLM application.","evidenceSummary":"The guidance calls for pinning, signing, verification and tool-description review.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"Verification establishes provenance and integrity, not safety by itself.","timing":"Before installation and continuously after changes","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-E91FEB58FC","intent":"verify mcp servers and third party tool packages","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-881e7e23d4fabe9144285414adf707b50cded3b5124a5d6946f395e2971be644","kind":"rule-candidate","status":"pending","body":{"title":"Probe models for backdoors after alignment","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM05:2026 Prevention Strategy 10","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"probe","object":"models for backdoors after alignment","condition":"After each model alignment cycle and before deployment.","evidenceSummary":"The guidance requires trigger-focused testing rather than assuming alignment removes backdoors.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"General red teaming does not replace dedicated trigger probing.","timing":"After every alignment cycle","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-727C1A6948","intent":"probe models for backdoors after alignment","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-9540ffa541181c12c90f84ae8ac51317cc546228718529eb979db85d19dd5513","kind":"rule-candidate","status":"pending","body":{"title":"Enforce agent execution limits","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM06:2026 Prevention Strategy 9","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"enforce","object":"agent step recursion time and cost limits","condition":"For every autonomous or semi-autonomous agent execution.","evidenceSummary":"The guidance sets bounded steps, recursion depth, duration and per-run cost.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"State hashing is recommended to detect recursive loops.","timing":"At the start and throughout each run","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-341F31DDFD","intent":"enforce agent step recursion time and cost limits","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-96ce9efa8cceaf50e6888fbe4f7fdf664611311b5b1f5854b7c734b77cae54da","kind":"rule-candidate","status":"pending","body":{"title":"Redact reasoning traces before observability ingestion","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM02:2026 Tier 2 Strategy 11","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"redact","object":"reasoning traces before observability ingestion","condition":"When reasoning traces are logged, exported or sent to observability systems.","evidenceSummary":"The guidance treats reasoning traces as first-class output and bars unrestricted raw-trace logging.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"Reasoning traces may be retained only within appropriately restricted handling paths.","timing":"Before logging or export","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-FA8BA326DF","intent":"redact reasoning traces before observability ingestion","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-981a7980af2a0d2ae9aac69b4aaaf1d271a106fcdb95fdde1d9e1cc8e7569203","kind":"rule-candidate","status":"pending","body":{"title":"Delete embeddings with deleted source documents","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM09:2026 Prevention Strategy 5","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"delete","object":"embeddings when source documents are deleted","condition":"When a source document is removed under retention, privacy or access policy.","evidenceSummary":"The guidance applies bounded deletion and reconciliation audits to derived embeddings.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"Backups retain the same sensitivity as the source data.","timing":"Within the defined deletion period","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-E7A8BF872F","intent":"delete embeddings when source documents are deleted","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-99e296d9ab99a723fc6e35c55bcc32f1defa49fec2af09aeb4d275bf8e01f3b2","kind":"rule-candidate","status":"pending","body":{"title":"Require structured outputs with mandatory fields","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM07:2026 Prevention Strategy 6","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"require","object":"structured outputs with mandatory fields","condition":"When omissions could cause unsafe or incomplete downstream decisions.","evidenceSummary":"The guidance uses mandatory output fields to detect omission failures.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"A complete structure may still contain incorrect content.","timing":"Before accepting the output","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-3BD5F7160D","intent":"require structured outputs with mandatory fields","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-a21462daa7d4fe702824129ddf6359e86166b90a3cd2f62a2ed93c653f7c30f8","kind":"rule-candidate","status":"pending","body":{"title":"Exclude sensitive data from hidden context","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM08:2026 Prevention Strategy 1","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"exclude","object":"sensitive data from hidden model context","condition":"When constructing system prompts or other hidden context.","evidenceSummary":"The guidance assumes hidden context may become visible to users and removes secrets and security-critical configuration.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"Sensitive operations should remain in systems the model cannot directly access.","timing":"Before model invocation","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-FAD77512B0","intent":"exclude sensitive data from hidden model context","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-a7a2ceb17b1a246f130bbf005f488e0bf6156ff8447a2ebd5725318259dde1a7","kind":"rule-candidate","status":"pending","body":{"title":"Encode model outputs for destination context","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM10:2026 Prevention Strategies 3–4","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"encode","object":"model outputs for the destination context","condition":"When rendering or passing model output to HTML, JavaScript or another interpreting context.","evidenceSummary":"The guidance applies context-aware output encoding to prevent code execution.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"Encoding depends on the exact destination context.","timing":"Before rendering or interpretation","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-C295975FAC","intent":"encode model outputs for the destination context","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-a828081330940b0de0ccc9142c330c314c8f23295ef069221301d7b3bbc2374b","kind":"rule-candidate","status":"pending","body":{"title":"Authorize retrieval inside index queries","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM02:2026 Tier 1 Strategy 3","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"enforce","object":"authorization inside retrieval queries","condition":"When an LLM application retrieves documents or chunks from an index.","evidenceSummary":"The guidance places document- and chunk-level authorization inside the query rather than after retrieval.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"High-sensitivity workloads may require per-tenant indexes.","timing":"At retrieval time","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-7D6FAD1C1A","intent":"enforce authorization inside retrieval queries","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-b0eeb815877caa53dd4f8419512f60958c08f2e6a041d677390929d7a2952ef0","kind":"rule-candidate","status":"pending","body":{"title":"Verify inference artifacts before deployment","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM05:2026 Prevention Strategy 12","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"verify","object":"inference artifacts before deployment","condition":"For chat templates, tokenizer configurations, adapters and quantization artifacts.","evidenceSummary":"The guidance treats inference artifacts as security-relevant code and requires signatures, hashes, diffs and static analysis.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"Verification must cover configuration artifacts as well as model weights.","timing":"Before deployment","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-BE76435EC8","intent":"verify inference artifacts before deployment","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-e527346d3933705bca5f6601fc18406dcf233600ab7eb93276ea0d6f19de3905","kind":"rule-candidate","status":"pending","body":{"title":"Log vector retrieval activity immutably","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM09:2026 Prevention Strategy 6","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"log","object":"vector retrieval activity immutably","condition":"For production retrieval requests involving vector or embedding stores.","evidenceSummary":"The guidance records tenant scope, query, returned identifiers and similarity scores for monitoring and response.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"Logs remain sensitive and require their own access controls.","timing":"Continuously during retrieval","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-75C206D795","intent":"log vector retrieval activity immutably","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-ee3982593e3859a5ac72590265c05532bb8dcaf9432b62b023510a67e7d5b421","kind":"rule-candidate","status":"pending","body":{"title":"Ground outputs in current authoritative sources","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM07:2026 Prevention Strategy 1","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"ground","object":"LLM outputs in current authoritative sources","condition":"Before an LLM output informs a material decision or action.","evidenceSummary":"The guidance requires authoritative and current evidence for generated claims.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"Grounding does not by itself prove the claim is correct.","timing":"Before action or decision","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-96D2CD94EC","intent":"ground llm outputs in current authoritative sources","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-ee68e130f796a03795603cee4dc0032b2d8bcc379d20d63509c49e0d5cb8f9e4","kind":"rule-candidate","status":"pending","body":{"title":"Preserve user authorization across chained calls","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM03:2026 Prevention Strategy 5","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"preserve","object":"user authorization across chained tool and agent calls","condition":"When an LLM system delegates work through tools or multiple agents on a user's behalf.","evidenceSummary":"The guidance carries the originating user's authorization scope through the chain.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"Service identities must not silently expand the user's scope.","timing":"Throughout delegated execution","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-EEED31C620","intent":"preserve user authorization across chained tool and agent calls","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-f080b60b8666f516ddeea1710ceec006a4dbd93bba20ecc8d1c68960dd594a42","kind":"rule-candidate","status":"pending","body":{"title":"Verify erasure across sensitive AI artifacts","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM02:2026 Tier 3 Strategy 16","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"verify","object":"erasure across raw data embeddings checkpoints and adapters","condition":"When sensitive or regulated data must be removed from an AI system.","evidenceSummary":"The guidance requires erasure across major artifact classes with post-removal extraction and membership probes.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"Verification must cover derived artifacts, not only the source record.","timing":"After deletion or unlearning","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-FE2D83FBFC","intent":"verify erasure across raw data embeddings checkpoints and adapters","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-f24a1c45fa60db88b20d1c8f26d102e6519438bdbd760388638222e6bbd3169e","kind":"rule-candidate","status":"pending","body":{"title":"Maintain a signed AI bill of materials","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM04:2026 Prevention Strategy 4","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"maintain","object":"a signed AI bill of materials","condition":"For models, adapters, datasets and software components used by an LLM application.","evidenceSummary":"The guidance extends component inventories to AI artifacts and their licenses.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"Inventory does not establish that components are safe.","timing":"Continuously; audit regularly","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-A87B8A4534","intent":"maintain a signed ai bill of materials","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-f5ec7266f080f7ee9e623ab024f594ec15839b78fdcc018e972928d0d69f27bf","kind":"rule-candidate","status":"pending","body":{"title":"Verify AI-suggested dependencies","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM04:2026 Prevention Strategy 2","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"verify","object":"AI-suggested software dependencies","condition":"Before adopting a package or component recommended by an AI system.","evidenceSummary":"The guidance checks that suggested dependencies exist and are the intended package.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"Verification supplements vulnerability management and patching.","timing":"Before installation or adoption","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-A4915FB892","intent":"verify ai suggested software dependencies","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-fe9b1f05309e05ab662b630385df68d6566d5809a1bff44bd89eb0a18ce2ee05","kind":"rule-candidate","status":"pending","body":{"title":"Segregate vector indexes by trust tier","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM09:2026 Prevention Strategy 3","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"segregate","object":"vector indexes by trust tier","condition":"When external, partner and confidential content have different trust levels.","evidenceSummary":"The guidance uses index-level isolation instead of classification tags on a shared index.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"Mixed-trust content should not share an index without hard isolation.","timing":"Before embedding and retrieval","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-4BD004C832","intent":"segregate vector indexes by trust tier","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"change-msu-genai-guidelines-d8483523ef2e20efe11bd41752c6cf80915acac37d3598592539445f84443056","kind":"source-change","status":"pending","body":{"sourceId":"msu-genai-guidelines","title":"Guidelines for the Use of Generative Artificial Intelligence Tools","url":"https://ai.msu.edu/guidelines","status":"publisher-bytes-changed","checkedAt":"2026-10-13T13:07:51.702Z","fingerprint":"d8483523ef2e20efe11bd41752c6cf80915acac37d3598592539445f84443056","previousFingerprint":"e8425ab97d884bb531c36eefb28b74372aabf460e0fa8cae48d732265f90a19d","bytes":708342,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-13T13:07:51.702Z","reviewed_at":null},{"id":"change-cisa-ncsc-secure-ai-development-9e70446e08f90873fce594e89339839ed1c9123de6c0c060670bb752c3b47c05","kind":"source-change","status":"pending","body":{"sourceId":"cisa-ncsc-secure-ai-development","title":"Guidelines for Secure AI System Development","url":"https://www.ncsc.gov.uk/collection/guidelines-secure-ai-system-development/guidelines/secure-development","status":"publisher-bytes-changed","checkedAt":"2026-10-13T13:07:43.620Z","fingerprint":"9e70446e08f90873fce594e89339839ed1c9123de6c0c060670bb752c3b47c05","previousFingerprint":"ff6b00a00ce1f1afb385710a026bff767bc2a854527a6d768830515c0eefa22f","bytes":235219,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-13T13:07:43.620Z","reviewed_at":null},{"id":"finding-031dbf13a624bfdb2439df957bfe272c741d7b5e2bfbc5a5d7dcc88ae3b02429","kind":"rule-candidate","status":"pending","body":{"title":"Retain prior model documentation","sourceTitle":"Code of Practice for General-Purpose AI Models — Transparency Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Transparency Commitment 1, Measure 1.1, PDF page 5","actor":"Signatory providers of general-purpose AI models","modality":"should","action":"retain","object":"prior versions of model documentation","condition":"After documenting a general-purpose AI model placed on the Union market.","evidenceSummary":"Measure 1.1 commits signatories to keep prior documentation versions for a ten-year period.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"The Article 53(2) open-source exception applies unless the model has systemic risk.","timing":"Until 10 years after the model is placed on the market","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 53 compliance","jurisdiction":"European Union","ruleId":"AIR-8DE80BBC1E","intent":"retain prior versions of model documentation","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-0337625108f2237b5d292425ed2a71c9ec66e7832627dd5a337cba4e2cd08979","kind":"rule-candidate","status":"pending","body":{"title":"Implement a copyright compliance policy","sourceTitle":"Code of Practice for General-Purpose AI Models — Copyright Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Copyright Commitment 1, Measure 1.1(1), PDF page 4","actor":"Signatory providers placing general-purpose AI models on the Union market","modality":"should","action":"implement","object":"a copyright compliance policy","condition":"For every general-purpose AI model the signatory places on the Union market.","evidenceSummary":"Measure 1.1 commits signatories to draw up, update and implement a single-document policy addressing Union copyright law.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"The measure demonstrates a policy obligation but does not itself establish compliance with Union copyright law.","timing":"Before and while placing covered models on the Union market","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 53(1)(c) compliance","jurisdiction":"European Union","ruleId":"AIR-9A5BD1A87A","intent":"implement a copyright compliance policy","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-05f7ce79729141ff09acd41a89d03bfd940aef99f792dddc47a0f35d9bbfedc6","kind":"rule-candidate","status":"pending","body":{"title":"Assess systemic risks","sourceTitle":"Code of Practice for General-Purpose AI Models — Safety and Security Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Safety and Security Commitment 1, Measure 1.2, PDF page 8","actor":"Signatory providers of general-purpose AI models with systemic risk","modality":"should","action":"assess","object":"systemic risks","condition":"Through a full identification, analysis, acceptance and mitigation cycle before market placement and on specified material-change triggers.","evidenceSummary":"Measure 1.2 requires a full systemic-risk assessment and mitigation process before the model enters the market and at later triggers.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"Still-appropriate portions of earlier assessments need not be duplicated.","timing":"At least before market placement and whenever Measure 7.6 trigger conditions are met","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 55 compliance","jurisdiction":"European Union","ruleId":"AIR-9E7F166E73","intent":"assess systemic risks","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-0dade33246b6b826d3aea9043e521b8fdfca633bf3b8bfab0428d04bc17f07fc","kind":"rule-candidate","status":"pending","body":{"title":"Provide requested model documentation to the AI Office","sourceTitle":"Code of Practice for General-Purpose AI Models — Transparency Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Transparency Commitment 1, Measure 1.2, PDF page 5","actor":"Signatory providers of general-purpose AI models","modality":"should","action":"provide","object":"requested model documentation to the AI Office","condition":"Upon an AI Office request under Articles 91 or 75(3) for information necessary to perform AI Act tasks.","evidenceSummary":"Measure 1.2 commits signatories to supply the requested information in its most current form.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"The request must identify a lawful purpose and concern information necessary for the relevant supervisory task.","timing":"Within the period specified in the AI Office request","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 53 compliance","jurisdiction":"European Union","ruleId":"AIR-422B3BFDBA","intent":"provide requested model documentation to the ai office","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-0fcfe4cd4ae526a8a831b4953915dd26502fae744d479eccb297a961d8ac6f3b","kind":"rule-candidate","status":"pending","body":{"title":"Develop scenarios for identified systemic risks","sourceTitle":"Code of Practice for General-Purpose AI Models — Safety and Security Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Safety and Security Commitment 2, Measure 2.2, PDF page 11","actor":"Signatory providers of general-purpose AI models with systemic risk","modality":"should","action":"develop","object":"scenarios for identified systemic risks","condition":"After identifying systemic risks stemming from the model.","evidenceSummary":"Measure 2.2 requires an appropriate number and level of detail of scenarios for each identified systemic risk.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"Scenario number and detail are proportionate to the risk.","timing":"During systemic-risk identification and before acceptance determination","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 55 compliance","jurisdiction":"European Union","ruleId":"AIR-634ED1EFE9","intent":"develop scenarios for identified systemic risks","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-17e0664153cd38998834437df950d83be74af79b4c88e4a650c756b7726962d0","kind":"rule-candidate","status":"pending","body":{"title":"Retain serious-incident documentation","sourceTitle":"Code of Practice for General-Purpose AI Models — Safety and Security Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Safety and Security Commitment 9, Measure 9.4, PDF page 27","actor":"Signatory providers of general-purpose AI models with systemic risk","modality":"should","action":"retain","object":"serious-incident documentation","condition":"For relevant information gathered under the Code's serious-incident commitment.","evidenceSummary":"Measure 9.4 establishes a minimum five-year retention period measured from the later of documentation or incident date.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"Other applicable Union law may impose additional constraints.","timing":"At least five years from documentation or incident date, whichever is later","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 55 compliance","jurisdiction":"European Union","ruleId":"AIR-F812056EAF","intent":"retain serious incident documentation","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-1f1824cbeac327f2ff929f276136c354b20a7f92cb28daa5e5c171ac5c200a0a","kind":"rule-candidate","status":"pending","body":{"title":"Answer necessary downstream information requests","sourceTitle":"Code of Practice for General-Purpose AI Models — Transparency Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Transparency Commitment 1, Measure 1.2, PDF page 6","actor":"Signatory providers of general-purpose AI models","modality":"should","action":"provide","object":"additional information necessary for downstream AI Act compliance","condition":"Upon a downstream provider request for information necessary to understand relevant model capabilities and limitations or comply with the AI Act.","evidenceSummary":"Measure 1.2 sets a reasonable-time response commitment capped at fourteen days absent exceptional circumstances.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"Exceptional circumstances may justify more than 14 days; intellectual-property and confidentiality protections remain applicable.","timing":"Within a reasonable timeframe and no later than 14 days after the request","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 53 compliance","jurisdiction":"European Union","ruleId":"AIR-8BA004AE3B","intent":"provide additional information necessary for downstream ai act compliance","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-23b28331c5952314fbcd27fa10d918f270e77215da5846182a8e7bc924d59b0b","kind":"rule-candidate","status":"pending","body":{"title":"Prevent infringing reproduction of training content","sourceTitle":"Code of Practice for General-Purpose AI Models — Copyright Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Copyright Commitment 1, Measure 1.4(1)(a), PDF page 6","actor":"Signatory providers of general-purpose AI models","modality":"should","action":"prevent","object":"copyright-infringing reproduction of training content","condition":"When downstream systems generate outputs from the signatory's model.","evidenceSummary":"Measure 1.4(a) commits signatories to appropriate, proportionate technical safeguards against infringing reproduction.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"Safeguards are proportionate; the measure applies whether the model is vertically integrated or supplied contractually.","timing":"Before deployment and during model operation","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 53(1)(c) compliance","jurisdiction":"European Union","ruleId":"AIR-3DE78E9151","intent":"prevent copyright infringing reproduction of training content","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-23d4a92b292fcd3aac6aca3df6b67c8e8a84ba8c02e386708ebeac4f3ec1ed16","kind":"rule-candidate","status":"pending","body":{"title":"Create a safety and security framework","sourceTitle":"Code of Practice for General-Purpose AI Models — Safety and Security Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Safety and Security Commitment 1, Measure 1.1, PDF pages 6–7","actor":"Signatory providers of general-purpose AI models with systemic risk","modality":"should","action":"create","object":"a safety and security framework","condition":"For covered models being developed, placed on the market or used by the signatory.","evidenceSummary":"Measure 1.1 requires a state-of-the-art framework describing systemic-risk assessment and mitigation processes.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"The chapter applies to providers of GPAI models with systemic risk; proportional simplifications may apply to SMEs and small mid-caps.","timing":"During development and before market placement","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 55 compliance","jurisdiction":"European Union","ruleId":"AIR-BD536D5F40","intent":"create a safety and security framework","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-2e4f3a17b975ab7c06562a349aa02a33ac9ef21e5c55def206db51ada46935be","kind":"rule-candidate","status":"pending","body":{"title":"Withhold models with unacceptable systemic risk","sourceTitle":"Code of Practice for General-Purpose AI Models — Safety and Security Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Safety and Security Commitment 4, Measure 4.2, PDF page 16","actor":"Signatory providers of general-purpose AI models with systemic risk","modality":"should","action":"withhold","object":"models with unacceptable systemic risk","condition":"The model's systemic risks are not acceptable or are reasonably foreseeable soon to become unacceptable.","evidenceSummary":"Measure 4.2 requires the provider not to proceed and, as necessary, not to market, restrict, withdraw or recall the model until risk is acceptable.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"Appropriate safety or security mitigations and reassessment may support later proceeding once risk is acceptable.","timing":"Before development continues, market placement or use","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 55 compliance","jurisdiction":"European Union","ruleId":"AIR-677FAA1CCA","intent":"withhold models with unacceptable systemic risk","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-36c6266fc7586914199f6492f8fe1ebbbcdb9178c788847ebe1ba6685cc0cceb","kind":"rule-candidate","status":"pending","body":{"title":"Define systemic-risk acceptance criteria","sourceTitle":"Code of Practice for General-Purpose AI Models — Safety and Security Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Safety and Security Commitment 4, Measure 4.1, PDF pages 15–16","actor":"Signatory providers of general-purpose AI models with systemic risk","modality":"should","action":"define","object":"systemic-risk acceptance criteria","condition":"For each identified systemic risk and the overall risk determination.","evidenceSummary":"Measure 4.1 requires measurable tiers or other appropriate criteria and a justified safety margin that accounts for uncertainty.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"Other criteria may replace tiers when tiers are unsuitable and the risk is not a specified Appendix 1.4 risk.","timing":"Before deciding whether to continue development, market placement or use","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 55 compliance","jurisdiction":"European Union","ruleId":"AIR-F1F56E4EAE","intent":"define systemic risk acceptance criteria","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-37ad0e370cf101fcd942b1dafb93dc100dcaa7d7a0e1b11bb7986134ad22d0ae","kind":"rule-candidate","status":"pending","body":{"title":"Assign copyright-policy responsibility","sourceTitle":"Code of Practice for General-Purpose AI Models — Copyright Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Copyright Commitment 1, Measure 1.1(1), PDF page 4","actor":"Signatory providers of general-purpose AI models","modality":"should","action":"assign","object":"responsibility for copyright-policy implementation and oversight","condition":"When establishing the signatory's Union copyright compliance policy.","evidenceSummary":"Measure 1.1 separately commits signatories to assign implementation and oversight responsibilities within the organisation.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"Organisational form is not prescribed.","timing":"When establishing and maintaining the policy","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 53(1)(c) compliance","jurisdiction":"European Union","ruleId":"AIR-012BD71EC6","intent":"assign responsibility for copyright policy implementation and oversight","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-3fa415c35257ea0760e0ab064a71cc60cf60bc210226e41a58f2c3633fdfe8db","kind":"rule-candidate","status":"pending","body":{"title":"Define systemic-risk management responsibilities","sourceTitle":"Code of Practice for General-Purpose AI Models — Safety and Security Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Safety and Security Commitment 8, Measure 8.1, PDF pages 23–24","actor":"Signatory providers of general-purpose AI models with systemic risk","modality":"should","action":"define","object":"systemic-risk management responsibilities","condition":"Across supervisory, executive, operational and assurance levels appropriate to the organisation.","evidenceSummary":"Measure 8.1 requires clear allocation of oversight, ownership, support, monitoring and assurance responsibilities.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"SMEs and small mid-caps may use simplified allocations suited to their governance structure.","timing":"Before and throughout covered model development and operation","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 55 compliance","jurisdiction":"European Union","ruleId":"AIR-4053E5A771","intent":"define systemic risk management responsibilities","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-4949bb67929de99fa9292a88792be595f18ca4933db6e37050c0b639707caeec","kind":"rule-candidate","status":"pending","body":{"title":"Exclude persistently infringing websites from AI crawling","sourceTitle":"Code of Practice for General-Purpose AI Models — Copyright Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Copyright Commitment 1, Measure 1.2(1)(b), PDF pages 4–5","actor":"Signatory providers using web crawlers directly or through another party","modality":"should","action":"exclude","object":"persistently infringing websites from AI web crawling","condition":"A court or public authority in the EU or EEA recognises the website as persistently and repeatedly infringing copyright commercially at crawl time.","evidenceSummary":"Measure 1.2(b) commits signatories to exclude listed commercial-scale infringing sites from training-data crawling.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"The recognition must come from the specified courts or public authorities and apply at the time of crawling.","timing":"At each applicable web crawl","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 53(1)(c) compliance","jurisdiction":"European Union and European Economic Area","ruleId":"AIR-68AE3CE50C","intent":"exclude persistently infringing websites from ai web crawling","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-498ef747aff7bee5c695423778ede85c010461cf40b2696714f5770e7d9b4cac","kind":"rule-candidate","status":"pending","body":{"title":"Notify rightsholders of crawler-information updates","sourceTitle":"Code of Practice for General-Purpose AI Models — Copyright Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Copyright Commitment 1, Measure 1.3(4), PDF page 6","actor":"Signatory providers using web crawlers","modality":"should","action":"notify","object":"affected rightsholders of crawler-information updates","condition":"When published information about crawler features or rights-reservation measures changes.","evidenceSummary":"Measure 1.3(4) calls for an automated notification means, such as a syndicated web feed.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"The mechanism may use a feed or another automatic method.","timing":"When the published crawler information is updated","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 53(1)(c) compliance","jurisdiction":"European Union","ruleId":"AIR-0586B4E6D4","intent":"notify affected rightsholders of crawler information updates","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-4ca6f1e19b48a392e422e6da72122bf4d74c8d81d067d7e209f9d5ea441d24f0","kind":"rule-candidate","status":"pending","body":{"title":"Do not circumvent access-control technologies when crawling","sourceTitle":"Code of Practice for General-Purpose AI Models — Copyright Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Copyright Commitment 1, Measure 1.2(1)(a), PDF page 4","actor":"Signatory providers using web crawlers directly or through another party","modality":"must not","action":"circumvent","object":"technological access controls on copyright-protected content","condition":"When web crawling for text and data mining and general-purpose AI model training.","evidenceSummary":"Measure 1.2(a) commits signatories not to bypass effective technological measures, including subscription and paywall restrictions.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"The measure is tied to effective technological measures under Article 6(3) of Directive 2001/29/EC.","timing":"At web-crawl access time","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 53(1)(c) compliance","jurisdiction":"European Union","ruleId":"AIR-4C41C35712","intent":"circumvent technological access controls on copyright protected content","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-534a784efed01ce0c3695778c9404d0d28d8165dc0241cc8c992333d47e72541","kind":"rule-candidate","status":"pending","body":{"title":"Follow robots.txt rights reservations","sourceTitle":"Code of Practice for General-Purpose AI Models — Copyright Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Copyright Commitment 1, Measure 1.3(1)(a), PDF page 5","actor":"Signatory providers using web crawlers directly or through another party","modality":"should","action":"follow","object":"robots.txt rights-reservation instructions","condition":"When crawling publicly available online content for text and data mining and model training.","evidenceSummary":"Measure 1.3(a) commits signatories to crawlers that read and follow RFC 9309 robots.txt instructions and feasible successor versions.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"Successor protocol versions apply when the IETF shows they are technically feasible and implementable for providers and rightsholders.","timing":"At crawl time","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 53(1)(c) compliance","jurisdiction":"European Union","ruleId":"AIR-C683FD122D","intent":"follow robots txt rights reservation instructions","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-5c36b53977e2287a08901caf313f160f9169e00c83240f626fe60a9ebdc07489","kind":"rule-candidate","status":"pending","body":{"title":"Designate a rightsholder contact","sourceTitle":"Code of Practice for General-Purpose AI Models — Copyright Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Copyright Commitment 1, Measure 1.5(1), PDF page 6","actor":"Signatory providers of general-purpose AI models","modality":"should","action":"designate","object":"an electronic rightsholder contact","condition":"For affected rightsholders to communicate with the provider.","evidenceSummary":"Measure 1.5(1) requires a designated electronic contact and easily accessible contact information.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"No clause-specific exception is stated.","timing":"While the covered model is available","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 53(1)(c) compliance","jurisdiction":"European Union","ruleId":"AIR-99CC893DDC","intent":"designate an electronic rightsholder contact","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-608005629e283a302bb42d8b4ca98604edec0241a5a49f3ed2a3c3e1544ee94d","kind":"rule-candidate","status":"pending","body":{"title":"Implement mitigations that meet the model-security goal","sourceTitle":"Code of Practice for General-Purpose AI Models — Safety and Security Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Safety and Security Commitment 6, Measure 6.2, PDF page 18","actor":"Signatory providers of general-purpose AI models with systemic risk","modality":"should","action":"implement","object":"mitigations that meet the model-security goal","condition":"While protected model parameters remain non-public and not securely deleted.","evidenceSummary":"Measure 6.2 requires appropriate Appendix 4 mitigations or alternatives that achieve the same objectives.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"Equivalent alternative mitigations may be used when listed measures do not fit the organisational or technical context.","timing":"Throughout the lifecycle until parameters are public or securely deleted","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 55 compliance","jurisdiction":"European Union","ruleId":"AIR-F1C44EBF07","intent":"implement mitigations that meet the model security goal","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-66465f258871c3f90476af387059ad1be905c4f8867e6ccca830bf0f427e6dcd","kind":"rule-candidate","status":"pending","body":{"title":"Publish AI web-crawler compliance information","sourceTitle":"Code of Practice for General-Purpose AI Models — Copyright Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Copyright Commitment 1, Measure 1.3(4), PDF page 6","actor":"Signatory providers using web crawlers","modality":"should","action":"publish","object":"AI web-crawler rights-reservation compliance information","condition":"For crawlers and measures used to identify and comply with Article 4(3) rights reservations.","evidenceSummary":"Measure 1.3(4) commits signatories to make crawler identities, robots.txt features and other reservation-compliance measures public.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"The measure is without prejudice to the information right under Directive 2004/48/EC Article 8.","timing":"While the crawler and measures are in use","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 53(1)(c) compliance","jurisdiction":"European Union","ruleId":"AIR-D511525F2C","intent":"publish ai web crawler rights reservation compliance information","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-670775fe4a2ff80ec0705b1327ac97faf4bd9baa0d74ca720ef7b9f31148f9c3","kind":"rule-candidate","status":"pending","body":{"title":"Provide current model documentation to downstream providers","sourceTitle":"Code of Practice for General-Purpose AI Models — Transparency Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Transparency Commitment 1, Measure 1.2, PDF page 6","actor":"Signatory providers of general-purpose AI models","modality":"should","action":"provide","object":"current model documentation to downstream providers","condition":"For information in the Model Documentation intended for downstream providers integrating the model.","evidenceSummary":"Measure 1.2 commits signatories to provide the most current downstream-facing documentation.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"Confidentiality safeguards and protection of intellectual property, confidential business information and trade secrets apply.","timing":"When supporting downstream integration and compliance","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 53 compliance","jurisdiction":"European Union","ruleId":"AIR-5C65C34756","intent":"provide current model documentation to downstream providers","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-6e7e7c3f07158a09a63b4538903d1cd4f4d94c92ba161a69aa74b1cb9fd35683","kind":"rule-candidate","status":"pending","body":{"title":"Comply with other machine-readable rights reservations","sourceTitle":"Code of Practice for General-Purpose AI Models — Copyright Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Copyright Commitment 1, Measure 1.3(1)(b), PDF page 5","actor":"Signatory providers using web crawlers directly or through another party","modality":"should","action":"comply","object":"machine-readable copyright rights reservations","condition":"When appropriate reservation protocols are standardised or are technically implementable, state of the art, widely adopted and generally agreed through an inclusive EU process.","evidenceSummary":"Measure 1.3(b) covers qualifying asset-based and location-based reservation protocols beyond robots.txt.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"The protocol must meet the measure's standardisation or state-of-the-art, implementability, adoption and consensus conditions.","timing":"At crawl time","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 53(1)(c) compliance","jurisdiction":"European Union","ruleId":"AIR-A82ECCFA13","intent":"comply machine readable copyright rights reservations","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-78033c7c8395da6f900eb353d96fd30f2febe34b67b9dd8aee2d16dab20d5b6f","kind":"rule-candidate","status":"pending","body":{"title":"Create a safety and security model report","sourceTitle":"Code of Practice for General-Purpose AI Models — Safety and Security Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Safety and Security Commitment 7, Measures 7.1–7.5, PDF pages 18–21","actor":"Signatory providers of general-purpose AI models with systemic risk","modality":"should","action":"create","object":"a safety and security model report","condition":"For a covered model and its systemic-risk assessment and mitigation evidence.","evidenceSummary":"Commitment 7 requires a Model Report describing the model, reasons to proceed, risk work, external reports and material changes.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"SMEs and small mid-caps may reduce detail to reflect size and capacity; cross-references and multi-model reports are permitted where appropriate.","timing":"Before placing the model on the market","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 55 compliance","jurisdiction":"European Union","ruleId":"AIR-AC0E8FFF57","intent":"create a safety and security model report","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-7e4f0a10a5cd01dde4d937b9040f941ca9980760e25accfddb76ed87b4341dc3","kind":"rule-candidate","status":"pending","body":{"title":"Perform model evaluations","sourceTitle":"Code of Practice for General-Purpose AI Models — Safety and Security Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Safety and Security Commitment 3, Measure 3.2, PDF pages 12–13","actor":"Signatory providers of general-purpose AI models with systemic risk","modality":"should","action":"perform","object":"model evaluations","condition":"For modalities relevant to each identified systemic risk, using methods appropriate to the model and risk.","evidenceSummary":"Measure 3.2 requires at least state-of-the-art evaluations, including open-ended testing to identify unexpected behaviour and capability boundaries.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"Evaluation design is risk- and model-specific and informed by model-independent information.","timing":"During systemic-risk analysis and at relevant lifecycle triggers","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 55 compliance","jurisdiction":"European Union","ruleId":"AIR-95915B3947","intent":"perform model evaluations","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-7f83426dfa8c901061dbb120ed761dfd304eb7da64d54ed723862c1b68e3df6a","kind":"rule-candidate","status":"pending","body":{"title":"Protect model documentation from unintended alteration","sourceTitle":"Code of Practice for General-Purpose AI Models — Transparency Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Transparency Commitment 1, Measure 1.3, PDF page 6","actor":"Signatory providers of general-purpose AI models","modality":"should","action":"protect","object":"model documentation from unintended alteration","condition":"While drawing up, updating, retaining and evidencing model documentation.","evidenceSummary":"Measure 1.3 requires quality and integrity controls and protection against unintended changes.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"No clause-specific exception is stated.","timing":"Throughout documentation creation, maintenance and retention","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 53 compliance","jurisdiction":"European Union","ruleId":"AIR-D6481064E5","intent":"protect model documentation from unintended alteration","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-877c97e8813ced1651cef819ad7b133c454fb834f9f3b667303d9793bd37bc71","kind":"rule-candidate","status":"pending","body":{"title":"Report serious incidents to the AI Office","sourceTitle":"Code of Practice for General-Purpose AI Models — Safety and Security Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Safety and Security Commitment 9, Measures 9.2–9.3, PDF pages 25–27","actor":"Signatory providers of general-purpose AI models with systemic risk","modality":"should","action":"report","object":"serious incidents to the AI Office","condition":"When the provider establishes or reasonably suspects the model directly or indirectly caused a qualifying serious incident.","evidenceSummary":"Measures 9.2 and 9.3 specify report content and risk-specific initial deadlines, followed by intermediate and final reports.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"Information may be redacted as necessary for other applicable Union law; exceptional circumstances may affect initial timing.","timing":"Initial report within 2, 5, 10 or 15 days by incident type; updates every four weeks; final report within 60 days after resolution","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 55 compliance","jurisdiction":"European Union","ruleId":"AIR-D711D2E5E0","intent":"report serious incidents to the ai office","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-8f98f1c52956a7e6cd654f31bb1a322424cd68f3f1c42e9af4de2c5373f75c61","kind":"rule-candidate","status":"pending","body":{"title":"Document general-purpose AI models","sourceTitle":"Code of Practice for General-Purpose AI Models — Transparency Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Transparency Commitment 1, Measure 1.1, PDF page 5","actor":"Signatory providers placing general-purpose AI models on the Union market","modality":"should","action":"document","object":"general-purpose AI models","condition":"When placing a general-purpose AI model on the Union market under the voluntary Code.","evidenceSummary":"Measure 1.1 commits signatories to document at least the information listed in the Model Documentation Form.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"The measure does not apply to qualifying free-and-open-source providers under Article 53(2), unless the model has systemic risk.","timing":"By the time the model is placed on the Union market","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 53 compliance; not an additional legal obligation","jurisdiction":"European Union","ruleId":"AIR-EE45A1F342","intent":"document general purpose ai models","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-91ce894c964c682d4d5e34eb887b2dd4fbf4ecdcd040a44474f40c3339ce231f","kind":"rule-candidate","status":"pending","body":{"title":"Confirm the systemic-risk framework before market placement","sourceTitle":"Code of Practice for General-Purpose AI Models — Safety and Security Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Safety and Security Commitment 1, Measure 1.1, PDF page 7","actor":"Signatory providers of general-purpose AI models with systemic risk","modality":"should","action":"confirm","object":"the systemic-risk framework before market placement","condition":"After notifying the Commission under AI Act Article 52(1) and before placing the model on the market.","evidenceSummary":"Measure 1.1 specifies both a post-notification and pre-market confirmation deadline.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"Both deadlines apply; the earlier practical deadline controls.","timing":"No later than four weeks after Article 52(1) notification and no later than two weeks before market placement","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 55 compliance","jurisdiction":"European Union","ruleId":"AIR-622DE8A4D9","intent":"confirm the systemic risk framework before market placement","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-a4b34c5d0152952a16f630d9e5ec6c402b3bc17d4bf7b9b0ac395a365a97b20d","kind":"rule-candidate","status":"pending","body":{"title":"Provide an electronic copyright-complaint mechanism","sourceTitle":"Code of Practice for General-Purpose AI Models — Copyright Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Copyright Commitment 1, Measure 1.5(2), PDF page 6","actor":"Signatory providers of general-purpose AI models","modality":"should","action":"provide","object":"an electronic copyright-complaint mechanism","condition":"For affected rightsholders and authorised representatives to submit precise, substantiated Code-compliance complaints.","evidenceSummary":"Measure 1.5(2) calls for electronic submission and easily accessible mechanism information.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"The mechanism does not replace statutory copyright remedies.","timing":"While the covered model is available","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 53(1)(c) compliance","jurisdiction":"European Union","ruleId":"AIR-401F58C1AD","intent":"provide an electronic copyright complaint mechanism","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-a59db682a24cda879025969026c3dc7d30b5630fc670b949c35a831798b6d9cb","kind":"rule-candidate","status":"pending","body":{"title":"Publish systemic-risk framework and model-report summaries","sourceTitle":"Code of Practice for General-Purpose AI Models — Safety and Security Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Safety and Security Commitment 10, Measure 10.2, PDF page 28","actor":"Signatory providers of general-purpose AI models with systemic risk","modality":"should","action":"publish","object":"systemic-risk framework and model-report summaries","condition":"Insofar as publication is necessary to assess or mitigate systemic risks.","evidenceSummary":"Measure 10.2 calls for public summaries and updates, including high-level risk results and mitigations, with safety and confidentiality removals.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"Publication may omit information to protect mitigation effectiveness and sensitive commercial information and is unnecessary for qualifying similarly-safe-or-safer models under Appendix 2.2.","timing":"When necessary to assess or mitigate systemic risk and when summaries are updated","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 55 compliance","jurisdiction":"European Union","ruleId":"AIR-766D44E977","intent":"publish systemic risk framework and model report summaries","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-b5fa4cafdff2b59090d9f521833a75538391c586e7e4fabe81e09542d5d5e92d","kind":"rule-candidate","status":"pending","body":{"title":"Implement adversarially robust safety mitigations","sourceTitle":"Code of Practice for General-Purpose AI Models — Safety and Security Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Safety and Security Commitment 5, Measure 5.1, PDF page 17","actor":"Signatory providers of general-purpose AI models with systemic risk","modality":"should","action":"implement","object":"adversarially robust safety mitigations","condition":"Throughout the lifecycle, taking account of the model's release and distribution strategy.","evidenceSummary":"Measure 5.1 requires appropriate safety mitigations that remain sufficiently robust to attacks such as jailbreaks and hostile fine-tuning.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"The selected mitigations are proportionate to the model and systemic risks.","timing":"Throughout the model lifecycle","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 55 compliance","jurisdiction":"European Union","ruleId":"AIR-2A16933CC6","intent":"implement adversarially robust safety mitigations","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-bf883d9aeb8be63d4e3523636984f7429cc2618743e1d67a629bcb7b24849308","kind":"rule-candidate","status":"pending","body":{"title":"Process substantiated copyright complaints diligently","sourceTitle":"Code of Practice for General-Purpose AI Models — Copyright Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Copyright Commitment 1, Measure 1.5(2), PDF page 6","actor":"Signatory providers of general-purpose AI models","modality":"should","action":"process","object":"substantiated copyright complaints diligently","condition":"After receiving a sufficiently precise and adequately substantiated complaint under the Code.","evidenceSummary":"Measure 1.5(2) requires diligent, non-arbitrary action within a reasonable time.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"The provider need not repeat a response to an identical complaint from the same rightsholder and may reject manifestly unfounded complaints.","timing":"Within a reasonable time after receipt","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 53(1)(c) compliance","jurisdiction":"European Union","ruleId":"AIR-54E3B89D3D","intent":"process substantiated copyright complaints diligently","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-c59b93f61445335c54cd51796ef0569863aeba9ebda60a6c2f1fc13c15cea1d2","kind":"rule-candidate","status":"pending","body":{"title":"Update the systemic-risk framework","sourceTitle":"Code of Practice for General-Purpose AI Models — Safety and Security Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Safety and Security Commitment 1, Measure 1.3, PDF pages 9–10","actor":"Signatory providers of general-purpose AI models with systemic risk","modality":"should","action":"update","object":"the systemic-risk framework","condition":"When a framework assessment finds an update appropriate or material adequacy or adherence concerns arise.","evidenceSummary":"Measure 1.3 requires updates, a versioned changelog and periodic or event-triggered framework assessments.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"No update is needed when the assessment supports the current framework, but the annual-or-sooner assessment cadence remains.","timing":"Without undue delay after an assessment; assess at least every 12 months or sooner on reasonable grounds","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 55 compliance","jurisdiction":"European Union","ruleId":"AIR-79B6F75D3C","intent":"update the systemic risk framework","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-cde3f484ee3d7e76dd5db89cf66c01e5b07a4226e838e0f544647ec3e495e55e","kind":"rule-candidate","status":"pending","body":{"title":"Publish documentation-request contact information","sourceTitle":"Code of Practice for General-Purpose AI Models — Transparency Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Transparency Commitment 1, Measure 1.2, PDF page 5","actor":"Signatory providers of general-purpose AI models","modality":"should","action":"publish","object":"contact information for model-documentation requests","condition":"When placing a general-purpose AI model on the Union market.","evidenceSummary":"Measure 1.2 calls for website or other appropriate contact information for AI Office and downstream-provider requests.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"A provider without a website may use another appropriate public means.","timing":"When placing the model on the market","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 53 compliance","jurisdiction":"European Union","ruleId":"AIR-22EC51C7C3","intent":"publish contact information for model documentation requests","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-d316516f6932ee70363a514e09c318fb11c40c537c0815a9297607f4ffb3e8df","kind":"rule-candidate","status":"pending","body":{"title":"Provide independent evaluators free model access","sourceTitle":"Code of Practice for General-Purpose AI Models — Safety and Security Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Safety and Security Commitment 3, Measure 3.5, PDF page 14","actor":"Signatory providers of general-purpose AI models with systemic risk","modality":"should","action":"provide","object":"independent evaluators free access to relevant model versions","condition":"To facilitate post-market monitoring of covered systemic risks.","evidenceSummary":"Measure 3.5 requires adequate free access for an adequate number of evaluators to capable and minimally mitigated versions and available chains of thought.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"The access commitment does not apply when the model qualifies as similarly safe or safer for the same systemic risk under Appendix 2.2.","timing":"During post-market monitoring","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 55 compliance","jurisdiction":"European Union","ruleId":"AIR-695F78887A","intent":"provide independent evaluators free access to relevant model versions","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-d507f17f6ce0abc1c129ebf2a5c2b52224cd18fdad6ea73e3465504b1b35f88e","kind":"rule-candidate","status":"pending","body":{"title":"Provide the systemic-risk framework to the AI Office","sourceTitle":"Code of Practice for General-Purpose AI Models — Safety and Security Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Safety and Security Commitment 1, Measure 1.4, PDF page 10","actor":"Signatory providers of general-purpose AI models with systemic risk","modality":"should","action":"provide","object":"the systemic-risk framework to the AI Office","condition":"After confirming the framework or an update.","evidenceSummary":"Measure 1.4 requires unredacted AI Office access to confirmed frameworks and updates.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"No clause-specific redaction exception is stated for this measure.","timing":"Within five business days after confirmation","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 55 compliance","jurisdiction":"European Union","ruleId":"AIR-A0C58383B9","intent":"provide the systemic risk framework to the ai office","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-d69059a0c621773f651fd07b8a5fe18fd653d1d07824dccc0fa49f2bab62b193","kind":"rule-candidate","status":"pending","body":{"title":"Establish a post-market monitoring system","sourceTitle":"Code of Practice for General-Purpose AI Models — Safety and Security Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Safety and Security Commitment 3, Measure 3.5, PDF pages 13–14","actor":"Signatory providers of general-purpose AI models with systemic risk","modality":"should","action":"establish","object":"a post-market monitoring system","condition":"After a covered model is placed on the market.","evidenceSummary":"Measure 3.5 requires monitoring information relevant to risk acceptability and Model Report updates.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"Monitoring methods are selected proportionately; signatory-deployed systems integrating the model are included.","timing":"Continuously after market placement","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 55 compliance","jurisdiction":"European Union","ruleId":"AIR-96F8E30D4E","intent":"establish a post market monitoring system","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-db669283bf4ba41594cade37583f29d7869a6c631fb5d9307c2dd9edf9d0ff1d","kind":"rule-candidate","status":"pending","body":{"title":"Prohibit copyright-infringing model uses","sourceTitle":"Code of Practice for General-Purpose AI Models — Copyright Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Copyright Commitment 1, Measure 1.4(1)(b), PDF page 6","actor":"Signatory providers of general-purpose AI models","modality":"should","action":"prohibit","object":"copyright-infringing model uses","condition":"In acceptable-use policies, terms or equivalent model-governance documents.","evidenceSummary":"Measure 1.4(b) commits signatories to prohibit infringing uses or warn users in documentation for free and open-source models.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"For free and open-source models, accompanying documentation may alert users to the prohibition without changing the licence's open-source nature.","timing":"Before making the model available and throughout availability","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 53(1)(c) compliance","jurisdiction":"European Union","ruleId":"AIR-34CAEED939","intent":"prohibit copyright infringing model uses","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-df33c21c150e62cc8765918b83ccae588eebeb02069d7c8d678cbfdd195ebb15","kind":"rule-candidate","status":"pending","body":{"title":"Define a model-security threat-actor goal","sourceTitle":"Code of Practice for General-Purpose AI Models — Safety and Security Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Safety and Security Commitment 6, Measure 6.1, PDF page 18","actor":"Signatory providers of general-purpose AI models with systemic risk","modality":"should","action":"define","object":"a model-security threat-actor goal","condition":"For models covered by the Code's systemic-risk security commitment.","evidenceSummary":"Measure 6.1 requires a security goal covering non-state external, insider and other expected threat actors in light of current and expected capabilities.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"The commitment does not apply where model capabilities are inferior to at least one model whose parameters are publicly downloadable.","timing":"Before selecting and implementing security mitigations","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 55 compliance","jurisdiction":"European Union","ruleId":"AIR-5E0C8818B2","intent":"define a model security threat actor goal","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-ff9d79c1a9f6e51c9d08ce547ba922854a7719142d30b0d6b0e5fea9104ec479","kind":"rule-candidate","status":"pending","body":{"title":"Allocate resources for systemic-risk management","sourceTitle":"Code of Practice for General-Purpose AI Models — Safety and Security Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Safety and Security Commitment 8, Measure 8.2, PDF page 24","actor":"Management bodies of signatory providers of systemic-risk GPAI models","modality":"should","action":"allocate","object":"resources for systemic-risk management","condition":"To people assigned responsibilities under Measure 8.1 and proportionate to the model's systemic risks.","evidenceSummary":"Measure 8.2 covers human, financial, information, knowledge and computational resources.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"Resource levels are proportionate to the systemic risks.","timing":"Throughout systemic-risk assessment and mitigation","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 55 compliance","jurisdiction":"European Union","ruleId":"AIR-DF3CA2B6CF","intent":"allocate resources for systemic risk management","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"change-msu-genai-guidelines-e8425ab97d884bb531c36eefb28b74372aabf460e0fa8cae48d732265f90a19d","kind":"source-change","status":"pending","body":{"sourceId":"msu-genai-guidelines","title":"Guidelines for the Use of Generative Artificial Intelligence Tools","url":"https://ai.msu.edu/guidelines","status":"publisher-bytes-changed","checkedAt":"2026-10-12T13:13:08.595Z","fingerprint":"e8425ab97d884bb531c36eefb28b74372aabf460e0fa8cae48d732265f90a19d","previousFingerprint":"6eea7382848332286deaadfa923a4fccb85184b52867f1097cbc63b19943863c","bytes":708342,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-12T13:13:08.595Z","reviewed_at":null},{"id":"change-cisa-ncsc-secure-ai-development-ff6b00a00ce1f1afb385710a026bff767bc2a854527a6d768830515c0eefa22f","kind":"source-change","status":"pending","body":{"sourceId":"cisa-ncsc-secure-ai-development","title":"Guidelines for Secure AI System Development","url":"https://www.ncsc.gov.uk/collection/guidelines-secure-ai-system-development/guidelines/secure-development","status":"publisher-bytes-changed","checkedAt":"2026-10-12T13:13:00.506Z","fingerprint":"ff6b00a00ce1f1afb385710a026bff767bc2a854527a6d768830515c0eefa22f","previousFingerprint":"503fc5dcc843e7fb433e1cda18709296ac7528b890bad601f188ba5a787d4cf3","bytes":235219,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-12T13:13:00.506Z","reviewed_at":null},{"id":"finding-0f24246ba7041e243ee57c2d6ed288d6e48f1454b9a472836f7a3b9e40713fc8","kind":"rule-candidate","status":"pending","body":{"title":"Allow refusal of human-mimicking AI and human intervention","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraph 127","actor":"UNESCO Member States and AI actors","modality":"should","action":"allow","object":"refusal of human mimicking AI and human intervention","condition":"When users interact with an AI system imitating human or animal characteristics.","evidenceSummary":"Paragraph 127 calls for users to be able to refuse the AI interaction and request human intervention effectively.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"The Recommendation does not state an exception.","timing":"Throughout the interaction","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-4D0E0234A5","intent":"allow refusal of human mimicking ai and human intervention","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"finding-106e578c98b205a949738c969493f76356cda6e5d0e88d6ecac87c7c8a66f1e6","kind":"rule-candidate","status":"pending","body":{"title":"Inform people that they are interacting with AI","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraph 127","actor":"UNESCO Member States and AI actors","modality":"should","action":"inform","object":"people they are interacting with AI","condition":"When an AI system imitates human or animal characteristics.","evidenceSummary":"Paragraph 127 calls for users to be able to identify easily whether they are interacting with a living being or an AI system.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"None stated for identification of the interaction.","timing":"At the start and during the interaction","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-86AF529571","intent":"inform people they are interacting with ai","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"finding-15abe5d56ce8bfa06daa4f08c2afa766abb6119185db06437629b04bed9a5012","kind":"rule-candidate","status":"pending","body":{"title":"Support workers displaced by AI","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraph 118","actor":"UNESCO Member States","modality":"should","action":"support","object":"workers displaced by AI","condition":"During AI-driven labour transitions affecting at-risk employees.","evidenceSummary":"Paragraph 118 calls for fair-transition measures including reskilling, retention, safety nets, social protection and sufficient public funding.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"Measures should be developed with companies, civil society, workers and unions and adapted to national conditions.","timing":"Before and during workforce transitions","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-C810ED9CC5","intent":"support workers displaced by ai","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"finding-19f6b1493553854bc8f23afdad207140d3874988866f86a2b41364feb8087bcd","kind":"rule-candidate","status":"pending","body":{"title":"Evaluate training-data quality continuously","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraph 71","actor":"UNESCO Member States","modality":"should","action":"evaluate","object":"training data quality continuously","condition":"Within AI data-governance strategies, including collection, selection, security, protection and feedback processes.","evidenceSummary":"Paragraph 71 calls for continual evaluation of training-data quality and the adequacy of collection and selection processes.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"Methods should match the dataset, sector and system context.","timing":"Continuously throughout the lifecycle","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-B9421D0247","intent":"evaluate training data quality continuously","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"finding-1b37ed980c194fc23a070da96b24508ec75fa3f4bcef24b2eb199185065e9227","kind":"rule-candidate","status":"pending","body":{"title":"Explain factors, processes and logic behind AI outputs","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraph 40","actor":"AI actors","modality":"should","action":"explain","object":"factors, processes and logic behind AI outputs","condition":"For non-temporary, difficult-to-reverse or more-than-low-risk decisions affecting end users.","evidenceSummary":"Paragraph 40 calls for explainable algorithms and a meaningful explanation accompanying higher-impact decisions.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"Explainability should be appropriate to context and balanced with privacy, safety and security.","timing":"With the consequential decision","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-F193592F11","intent":"explain factors processes and logic behind ai outputs","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"finding-1b7ea3899b5340c63aaf09a60c7fb1cd225c3737bb9424200052a7013db0dd3e","kind":"rule-candidate","status":"pending","body":{"title":"Minimize discriminatory or biased AI outcomes","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraph 29","actor":"AI actors","modality":"should","action":"minimize","object":"discriminatory or biased AI outcomes","condition":"Throughout the AI-system lifecycle.","evidenceSummary":"Paragraph 29 asks AI actors to make reasonable efforts to minimize and avoid reinforcing or perpetuating discriminatory or biased applications and outcomes.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"The Recommendation frames the duty as all reasonable efforts.","timing":"Throughout the lifecycle","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-89F2838F2B","intent":"minimize discriminatory or biased ai outcomes","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"finding-1e47541f8f814223ae14d0fe87214894af5a340026cfefc61819e25bf4cd84be","kind":"rule-candidate","status":"pending","body":{"title":"Require human final diagnosis and treatment decisions","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraph 123(e)","actor":"UNESCO Member States and health-care providers","modality":"should","action":"require","object":"human final diagnosis and treatment decisions","condition":"When AI assists health-care prediction, detection, diagnosis or treatment.","evidenceSummary":"Paragraph 123(e) calls for human care and final diagnosis and treatment decisions always to be taken by humans, while allowing AI assistance.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"AI systems may assist health professionals but do not replace the final human decision.","timing":"At diagnosis and treatment decision time","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-B40AC286CA","intent":"require human final diagnosis and treatment decisions","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"finding-202dc103681e14056b9948ee92199cba17d406cbea2977987f330e5f14d0a270","kind":"rule-candidate","status":"pending","body":{"title":"Justify the selected AI method","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraph 26(a)-(c)","actor":"AI actors and UNESCO Member States","modality":"should","action":"justify","object":"the selected AI method","condition":"When choosing whether and how to use an AI system.","evidenceSummary":"Paragraph 26 calls for an AI method to be appropriate and proportionate to a legitimate aim, consistent with the Recommendation's values and human rights, context-appropriate, and scientifically grounded.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"The method may vary by legitimate aim and context, but it must not violate or abuse human rights.","timing":"Before selecting or deploying an AI method","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-E052965EDE","intent":"justify the selected ai method","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"finding-2066c1c4ca6b2866f089c2c69b25e4ae46332539b878b7bdb0d9d9cad6aea2da","kind":"rule-candidate","status":"pending","body":{"title":"Test human-rights-risk AI before market release","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraph 51","actor":"AI actors","modality":"should","action":"test","object":"human-rights-risk AI before market release","condition":"When an AI system is identified as posing potential risks to human rights.","evidenceSummary":"Paragraph 51 calls for broad testing, including real-world testing when needed, as part of an ethical impact assessment before market release.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"Real-world conditions are used when needed and remain subject to applicable safeguards.","timing":"Before market release","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-5A829F7830","intent":"test human rights risk ai before market release","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"finding-24156d582554536870e3e2dacb15a905bcd0536c779dce853dc85d19f0ec7264","kind":"rule-candidate","status":"pending","body":{"title":"Obtain informed consent for health-data analysis","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraph 123(d)","actor":"UNESCO Member States and health-AI actors","modality":"should","action":"obtain","object":"informed consent for health data analysis","condition":"When personal data is analyzed by AI for prediction, detection or treatment in health care.","evidenceSummary":"Paragraph 123(d) calls for effective mechanisms so data subjects are aware of and consent to use and analysis of their personal data.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"Consent mechanisms should not prevent access to health care and remain subject to applicable law.","timing":"Before use or analysis of personal health data","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-69428D74D8","intent":"obtain informed consent for health data analysis","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"finding-2f63183763fe1be93fc6386b89edfeaab8a70c50f5f5b594dd547e0cba5a3928","kind":"rule-candidate","status":"pending","body":{"title":"Regulate health AI for safety and clinical evidence","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraph 122","actor":"UNESCO Member States","modality":"should","action":"regulate","object":"health AI for safety and clinical evidence","condition":"For development and deployment of AI systems related to physical or mental health, with attention to children and youth.","evidenceSummary":"Paragraph 122 calls for health AI to be safe, effective, efficient, scientifically and medically proven and supportive of evidence-based innovation.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"Regulation should remain consistent with evidence-based innovation and medical progress.","timing":"Before clinical deployment and during operation","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-0CEAB16BD8","intent":"regulate health ai for safety and clinical evidence","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"finding-31acfcdef222251837bc7099f4afcd60e4fb3fad041ebd29f99242dbf3d11d37","kind":"rule-candidate","status":"pending","body":{"title":"Redress harms caused by AI systems","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraph 55","actor":"UNESCO Member States and private- and public-sector companies","modality":"should","action":"redress","object":"harms caused by AI systems","condition":"When investigation establishes AI-related harm.","evidenceSummary":"Paragraph 55 calls for remedial actions and remediation mechanisms to redress AI harms and protect human rights and the rule of law.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"Remediation should follow applicable legal and institutional processes.","timing":"After harm is established","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-2683D90976","intent":"redress harms caused by ai systems","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"finding-4db0629c51fc8c13b884c25417d8d515cea88d76408b8b9a696ec11b0de88e6d","kind":"rule-candidate","status":"pending","body":{"title":"Monitor every AI-system lifecycle phase","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraph 52","actor":"UNESCO Member States and business enterprises","modality":"should","action":"monitor","object":"all AI system lifecycle phases","condition":"Including decision algorithms, data and involved AI actors, especially in public services and direct-user contexts.","evidenceSummary":"Paragraph 52 calls for measures to monitor all lifecycle phases as part of ethical impact assessment.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"Monitoring measures should reflect the system and use context.","timing":"Continuously throughout the lifecycle","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-1EEC637757","intent":"monitor all ai system lifecycle phases","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"finding-567d15be52cd2b910d6846d9838b06155f34e06638a2a0b3438904045518f389","kind":"rule-candidate","status":"pending","body":{"title":"Do not cede life-and-death decisions to AI","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraphs 26 and 36","actor":"AI actors and UNESCO Member States","modality":"must not","action":"cede","object":"life-and-death decisions to AI systems","condition":"Where a decision may be irreversible, difficult to reverse, or involve life and death.","evidenceSummary":"Paragraphs 26 and 36 reserve final determination for humans in irreversible or life-and-death contexts and state that such decisions should not be ceded to AI systems.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"AI may assist human decision-making, but ultimate responsibility remains human.","timing":"At decision time","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-FE48418DC7","intent":"cede life and death decisions to ai systems","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"finding-5e27b96aa2f4dd415e2a0f3e7a6824722432f3e899843377b0c98ef75b50a070","kind":"rule-candidate","status":"pending","body":{"title":"Introduce ethical-impact-assessment frameworks","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraph 50","actor":"UNESCO Member States","modality":"should","action":"introduce","object":"ethical impact assessment frameworks","condition":"For AI systems and their human-rights, labour, environmental, ethical and social impacts.","evidenceSummary":"Paragraph 50 calls for assessment frameworks that identify benefits, concerns and risks and define prevention, mitigation, monitoring and assurance measures.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"Frameworks should reflect national circumstances and facilitate citizen participation.","timing":"Before deployment and during monitoring","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-D235002FA2","intent":"introduce ethical impact assessment frameworks","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"finding-5e4ca39564a4f1ca2f6befc4d3275f68a76bc521249e39ef702c85e668799345","kind":"rule-candidate","status":"pending","body":{"title":"Self-assess existing and proposed public AI systems","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraph 57","actor":"UNESCO Member States and public authorities","modality":"should","action":"self-assess","object":"existing and proposed public AI systems","condition":"Before deciding whether adoption is appropriate and during review of existing systems.","evidenceSummary":"Paragraph 57 calls for transparent self-assessment of existing and proposed AI systems, including whether adoption and the selected method are appropriate.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"Assessment depth should reflect the system's context and potential human-rights impact.","timing":"Before adoption and during periodic review","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-F3DC6726AA","intent":"self assess existing and proposed public ai systems","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"finding-5e651364ad04542e190470187cab7fa30442fa6a6a36eee13825b040dcad7a69","kind":"rule-candidate","status":"pending","body":{"title":"Attribute AI responsibility to persons or legal entities","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraph 35","actor":"UNESCO Member States","modality":"should","action":"attribute","object":"AI ethical and legal responsibility to persons or legal entities","condition":"For every lifecycle stage and remedy involving an AI system.","evidenceSummary":"Paragraph 35 calls for ethical and legal responsibility to remain attributable to physical persons or existing legal entities.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"Oversight may be individual or inclusive public oversight as appropriate.","timing":"Throughout the lifecycle and during remedy","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-60A1D85D1C","intent":"attribute ai ethical and legal responsibility to persons or legal entities","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"finding-6116d662a6bfc18835123f7c1754b0ca25877e1a3322ddc19e97367eef815e5d","kind":"rule-candidate","status":"pending","body":{"title":"Do not apply prohibited social scoring","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraph 26","actor":"AI actors and UNESCO Member States","modality":"must not","action":"apply","object":"prohibited social scoring","condition":"When selecting or using AI methods.","evidenceSummary":"Paragraph 26 states that AI systems should not be used for social scoring purposes.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"None stated for social scoring in the Recommendation.","timing":"Throughout selection, deployment and use","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-342C0977BB","intent":"apply prohibited social scoring","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"finding-6934a1adfdc69e62923520b060bacfc58138a37b39d44d1856387ab0501a8d15","kind":"rule-candidate","status":"pending","body":{"title":"Evaluate AI sustainability impacts continuously","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraph 31","actor":"UNESCO Member States and AI actors","modality":"should","action":"evaluate","object":"AI sustainability impacts continuously","condition":"Across human, social, cultural, economic and environmental dimensions.","evidenceSummary":"Paragraph 31 calls for continuous assessment of AI's impacts on sustainability, informed by evolving objectives such as the UN Sustainable Development Goals.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"Assessment dimensions evolve with sustainability goals and system context.","timing":"Continuously throughout the lifecycle","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-CCA033749A","intent":"evaluate ai sustainability impacts continuously","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"finding-6ba575c4453c8a3a77c88b5fac0f90cf3f0cbb14e2ee283c458ad4acbc352685","kind":"rule-candidate","status":"pending","body":{"title":"Combat stereotypes in AI outputs","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraph 66","actor":"UNESCO Member States and AI actors","modality":"should","action":"combat","object":"stereotypes in AI outputs","condition":"Whether stereotypes arise by design or negligence, with particular attention to data-scarce regions.","evidenceSummary":"Paragraph 66 calls for mechanisms requiring AI actors to disclose and combat stereotyping in AI-system outcomes and data.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"Implementation should respect freedom of expression and access to information.","timing":"During development, evaluation and operation","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-38F34770A2","intent":"combat stereotypes in ai outputs","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"finding-6dd1ba79f9f79b759464fd40ff2a60a83649ed783319253354cfd5efe33ed78c","kind":"rule-candidate","status":"pending","body":{"title":"Prohibit AI use that violates human-rights obligations","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraph 57","actor":"UNESCO Member States and public authorities","modality":"must not","action":"use","object":"AI that violates human rights obligations","condition":"When a transparent self-assessment finds that adoption would cause violations or abuses of human-rights obligations.","evidenceSummary":"Paragraph 57 calls for public authorities to prohibit AI use when assessment shows that adoption would violate or abuse the State's human-rights obligations.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"The prohibition follows a documented assessment under the Member State's legal framework.","timing":"Before adoption or continued use","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-BE5C54B56C","intent":"use ai that violates human rights obligations","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"finding-7272e160b2c9766396f4f07b786db5773c76c54ec4db1746d900dd284e10949e","kind":"rule-candidate","status":"pending","body":{"title":"Implement data protection by design","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraph 34","actor":"AI actors","modality":"should","action":"implement","object":"data protection by design","condition":"When designing and implementing AI systems that process personal information.","evidenceSummary":"Paragraph 34 calls for an innovative privacy-by-design approach and accountability for protecting personal information throughout the AI lifecycle.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"Implementation should be proportionate to the system and processing context.","timing":"From design through end-of-use","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-6BBD510385","intent":"implement data protection by design","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"finding-72b54400f50bbfd45929486180740b9def20b15fa633aff6183e79a5a175379c","kind":"rule-candidate","status":"pending","body":{"title":"Establish public-sector ethical-impact-assessment procedures","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraph 53","actor":"Governments","modality":"should","action":"establish","object":"public sector ethical impact assessment procedures","condition":"Particularly for public authorities adopting or deploying AI systems.","evidenceSummary":"Paragraph 53 calls for a regulatory procedure for public authorities to predict consequences, mitigate risks, avoid harms, support participation and address societal challenges.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"Assessments may be public where appropriate and should be multidisciplinary, pluralistic and inclusive.","timing":"Before adoption and throughout monitoring","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-E33B4DC8D1","intent":"establish public sector ethical impact assessment procedures","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"finding-84965ff4df6029b27b4501be10428b00d6df52ce31ac0a0902ebdbc42da78840","kind":"rule-candidate","status":"pending","body":{"title":"Provide an effective remedy for algorithmic discrimination","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraph 29","actor":"UNESCO Member States and AI actors","modality":"should","action":"provide","object":"an effective remedy against algorithmic discrimination","condition":"When discrimination or biased algorithmic determination occurs.","evidenceSummary":"Paragraph 29 states that an effective remedy should be available against discrimination and biased algorithmic determination.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"Remedy mechanisms operate under applicable national and international law.","timing":"When affected persons challenge discriminatory outcomes","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-5987C9FFC0","intent":"provide an effective remedy against algorithmic discrimination","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"finding-86d8b5827f14decf03a304cf344aecc9fbc8829d2f4990105d18aded5b35e0c7","kind":"rule-candidate","status":"pending","body":{"title":"Appoint an independent AI Ethics Officer","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraph 58","actor":"Public entities, private-sector companies and civil-society organizations","modality":"may","action":"appoint","object":"an independent AI Ethics Officer","condition":"To oversee ethical impact assessment, auditing, continuous monitoring and ethical guidance.","evidenceSummary":"Paragraph 58 encourages organizations to consider an independent AI Ethics Officer or equivalent mechanism for oversight.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"An equivalent oversight mechanism may be used instead of a named officer.","timing":"Before and during AI governance activities","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-3C84D30D8C","intent":"appoint an independent ai ethics officer","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"finding-8828b5520fc1d7ed297a5735e859aef00a05d9e84ae7058d32c004c7a7cbf2bb","kind":"rule-candidate","status":"pending","body":{"title":"Investigate harms caused by AI systems","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraph 55","actor":"UNESCO Member States","modality":"should","action":"investigate","object":"harms caused by AI systems","condition":"When AI systems may have caused harm in digital or physical contexts.","evidenceSummary":"Paragraph 55 calls for AI harms to be investigated through strong enforcement mechanisms and institutional capacity.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"Investigation should comply with applicable law and due process.","timing":"After suspected or reported harm","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-CC0AFE2F97","intent":"investigate harms caused by ai systems","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"finding-8ee46d2d708661cda8c5610a686389cd6f4120c02afe347dba3c56bb3b426600","kind":"rule-candidate","status":"pending","body":{"title":"Assess lifecycle environmental impacts of AI","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraph 84","actor":"UNESCO Member States and business enterprises","modality":"should","action":"assess","object":"direct and indirect AI lifecycle environmental impacts","condition":"Including carbon footprint, energy use and raw-material extraction supporting AI technologies.","evidenceSummary":"Paragraph 84 calls for lifecycle assessment and reduction of AI-system and data-infrastructure environmental impacts.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"Assessment should reflect direct and indirect impacts and applicable environmental law.","timing":"Throughout the lifecycle","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-E2FCA42DFE","intent":"assess direct and indirect ai lifecycle environmental impacts","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"finding-9078a029da7c24c9df4e1f6bf145a94daefd377fde1256e7129d0e4e6f82134e","kind":"rule-candidate","status":"pending","body":{"title":"Perform a data-protection impact assessment","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraph 34","actor":"AI actors","modality":"should","action":"perform","object":"a data protection impact assessment","condition":"For algorithmic systems that process personal information.","evidenceSummary":"Paragraph 34 calls for adequate privacy impact assessments that include societal and ethical considerations.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"Scope should reflect the system's use and personal-data processing context.","timing":"Before deployment and when processing changes materially","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-54647B2218","intent":"perform a data protection impact assessment","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"finding-9692673835adb623c1fcd6775fb14d5ffcac5b0fcc96de116e8dd2955a3f3e2e","kind":"rule-candidate","status":"pending","body":{"title":"Disclose AI interaction","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraph 38","actor":"AI actors","modality":"should","action":"disclose","object":"AI interaction","condition":"When a product or service is provided directly by or with the assistance of AI.","evidenceSummary":"Paragraph 38 calls for users to be informed properly and promptly when AI directly provides or assists a product or service.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"Disclosure depth should reflect context and impact.","timing":"Properly and promptly during the interaction","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-C8E01637B6","intent":"disclose ai interaction","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"finding-a4dba778f45c56b2075db4e8f4ffac87a753c3848b2e259ca32e739175cfab7b","kind":"rule-candidate","status":"pending","body":{"title":"Inform people about AI-based decisions","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraph 38","actor":"Relevant AI actors and public-sector institutions","modality":"should","action":"inform","object":"people of decisions informed by AI","condition":"When a decision is informed by or based on AI, especially where safety or human rights are affected.","evidenceSummary":"Paragraph 38 says people should be fully informed when a decision is informed by or made on the basis of AI algorithms.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"The transparency level may be balanced against privacy, safety and security according to context and impact.","timing":"At or before communicating the decision","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-D1348F48FB","intent":"inform people of decisions informed by ai","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"finding-b3acf33e982f54a3059fb75da8bf84932bc907ba20284fc3f7f6990477ba8e83","kind":"rule-candidate","status":"pending","body":{"title":"Promote public AI-literacy education","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraph 44","actor":"Governments, intergovernmental organizations, civil society, academia, media, community leaders and the private sector","modality":"should","action":"promote","object":"public AI literacy education","condition":"For diverse technical and non-technical publics.","evidenceSummary":"Paragraph 44 calls for open and accessible education, civic engagement, digital skills, AI-ethics training and media and information literacy.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"Programs should account for linguistic, social and cultural diversity.","timing":"Ongoing","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-0E2968834F","intent":"promote public ai literacy education","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"finding-cab1670be9880a87a14700c71d4fd05a2a4ee4608072030f2bea94c7d0edd3ec","kind":"rule-candidate","status":"pending","body":{"title":"Secure sensitive personal data","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraph 74","actor":"UNESCO Member States","modality":"should","action":"secure","object":"sensitive personal data","condition":"Where disclosure may cause exceptional damage, injury or hardship.","evidenceSummary":"Paragraph 74 calls for data policies or equivalent frameworks that ensure full security for personal and sensitive data.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"Examples include offence, biometric, genetic, health and protected-characteristic data; applicable law controls classification.","timing":"Throughout collection, use, sharing, storage and deletion","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-71AB7A284C","intent":"secure sensitive personal data","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"finding-d20f4f57c7191ee40db2f304d9f1b55b865885b04e622506f7b0e8438e403a80","kind":"rule-candidate","status":"pending","body":{"title":"Ensure AI-process traceability","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraph 43","actor":"AI actors and UNESCO Member States","modality":"should","action":"ensure","object":"AI process traceability","condition":"To support accountability and identify conflicts with human-rights norms or environmental well-being.","evidenceSummary":"Paragraph 43 calls for technical and institutional designs that make AI systems auditable and traceable throughout their lifecycle.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"Designs should account for applicable privacy, security and legal limits.","timing":"Throughout the lifecycle","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-A26D278094","intent":"ensure ai process traceability","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"finding-d45ac8cfddbd64f61e22c945ce58ab5404be2c702bf46307bb24eee075136924","kind":"rule-candidate","status":"pending","body":{"title":"Develop AI human-rights due-diligence mechanisms","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraph 51","actor":"UNESCO Member States and private-sector companies","modality":"should","action":"develop","object":"AI human rights due diligence mechanisms","condition":"To identify, prevent, mitigate and account for AI impacts on human rights, the rule of law and inclusive societies.","evidenceSummary":"Paragraph 51 calls for due-diligence and oversight mechanisms covering identification, prevention, mitigation and accountability for AI impacts.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"Mechanisms should be tailored to the actor's role and system context.","timing":"Before release and throughout operation","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-FDFFEEE98F","intent":"develop ai human rights due diligence mechanisms","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"finding-d8af7557e83a9b59f6c17a937c4473e909e05a231a20e145aaeeaafa66ca33e1","kind":"rule-candidate","status":"pending","body":{"title":"Monitor acquired AI in human-rights-sensitive uses","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraph 62","actor":"UNESCO Member States acquiring AI systems","modality":"should","action":"monitor","object":"acquired AI in human rights sensitive use cases","condition":"For uses such as law enforcement, welfare, employment, media, health care and the judiciary.","evidenceSummary":"Paragraph 62 calls for appropriate oversight authorities to monitor the social and economic impact of acquired AI in human-rights-sensitive use cases.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"Oversight can be performed by data-protection, sectoral or other public oversight bodies.","timing":"During procurement, deployment and operation","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-BACFD21F80","intent":"monitor acquired ai in human rights sensitive use cases","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"finding-fbc675d433f2de53bdc548a3a1edf04e428cbe4984e666a135a022517f4a16af","kind":"rule-candidate","status":"pending","body":{"title":"Maintain AI-system robustness, security and safety","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraph 27","actor":"AI actors","modality":"should","action":"maintain","object":"AI system robustness, security and safety","condition":"Across the AI-system lifecycle.","evidenceSummary":"Paragraph 27 calls for safety harms and security vulnerabilities to be avoided, addressed, prevented and eliminated throughout the AI lifecycle.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"Measures should remain proportionate to the system and context.","timing":"Continuously throughout the lifecycle","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-F634CFE326","intent":"maintain ai system robustness security and safety","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"change-eu-ai-act-d32741d8f24e35430c54acdc6fef90be02cf2989bdc8cbbd516036caa3776117","kind":"source-change","status":"pending","body":{"sourceId":"eu-ai-act","title":"EU Artificial Intelligence Act","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","status":"publisher-bytes-changed","checkedAt":"2026-10-11T13:02:32.325Z","fingerprint":"d32741d8f24e35430c54acdc6fef90be02cf2989bdc8cbbd516036caa3776117","previousFingerprint":"131b49699f7f9f7d911d511e1ac6eeed9109576c33f1492aa5321ab07b92273b","bytes":1534741,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-11T13:02:32.325Z","reviewed_at":null},{"id":"change-eu-gdpr-c1db6de6e2eacd1b35a45fad77332fa761f2205912aa7e4f166a5ffd3e34f8bc","kind":"source-change","status":"pending","body":{"sourceId":"eu-gdpr","title":"General Data Protection Regulation","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","status":"publisher-bytes-changed","checkedAt":"2026-10-11T13:02:32.325Z","fingerprint":"c1db6de6e2eacd1b35a45fad77332fa761f2205912aa7e4f166a5ffd3e34f8bc","previousFingerprint":"f9f622ce4ac6b1148dd0935711ecb56f8fac6ff65d8e6d68a906942e93b6d114","bytes":1071098,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-11T13:02:32.325Z","reviewed_at":null},{"id":"change-msu-genai-guidelines-6eea7382848332286deaadfa923a4fccb85184b52867f1097cbc63b19943863c","kind":"source-change","status":"pending","body":{"sourceId":"msu-genai-guidelines","title":"Guidelines for the Use of Generative Artificial Intelligence Tools","url":"https://ai.msu.edu/guidelines","status":"publisher-bytes-changed","checkedAt":"2026-10-11T13:02:32.325Z","fingerprint":"6eea7382848332286deaadfa923a4fccb85184b52867f1097cbc63b19943863c","previousFingerprint":"93bb4040ed7ccd48aa107314ac0f0d630cf5141e3a6f980149e1b771d8f57c1c","bytes":708514,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-11T13:02:32.325Z","reviewed_at":null},{"id":"finding-01e224a495c23605319f42e0e1e5a0bee13ad5df854268f2aa43f6b38ed085c1","kind":"rule-candidate","status":"pending","body":{"title":"Support workers displaced by AI","sourceTitle":"OECD Recommendation of the Council on Artificial Intelligence","sourceVersion":"OECD/LEGAL/0449; adopted 2019-05-22; amended 2024-05-03","control":"Section 2, Recommendation 2.4(b)","actor":"Governments of OECD Recommendation adherents","modality":"should","action":"support","object":"workers displaced by AI","condition":"As AI is deployed and affects labour-market transitions.","evidenceSummary":"Recommendation 2.4(b) recommends support for people affected by displacement, including social protection and access to new opportunities.","url":"https://oecd.ai/en/ai-principles","exception":"Measures may include training, social protection and labour-market opportunities and should be shaped through social dialogue.","timing":"During AI-driven labour transitions","authority":"Voluntary intergovernmental OECD Recommendation","jurisdiction":"International","ruleId":"AIR-C810ED9CC5","intent":"support workers displaced by ai","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-10T13:13:39.270Z","reviewed_at":null},{"id":"finding-0d41db6d12f1f56327cb5deddf8f2bf2378a8009f156fa2269893ae3b4b40649","kind":"rule-candidate","status":"pending","body":{"title":"Establish mechanisms to appeal AI outcomes","sourceTitle":"OECD Recommendation of the Council on Artificial Intelligence","sourceVersion":"OECD/LEGAL/0449; adopted 2019-05-22; amended 2024-05-03","control":"Section 1, Principle 1.3(iv)","actor":"AI actors","modality":"should","action":"establish","object":"mechanisms to appeal AI outcomes","condition":"When a person is adversely affected by an AI system output.","evidenceSummary":"Principle 1.3(iv) recommends information that enables adversely affected people to challenge an AI output.","url":"https://oecd.ai/en/ai-principles","exception":"Mechanism and information should be appropriate to context and consistent with the state of the art.","timing":"After or in connection with an adverse AI output","authority":"Voluntary intergovernmental OECD Recommendation","jurisdiction":"International","ruleId":"AIR-6E499BCE84","intent":"establish mechanisms to appeal ai outcomes","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-10T13:13:39.270Z","reviewed_at":null},{"id":"finding-314a7b9c7515fdf90097a17855536fbf98bad5ca691957c7da0d6a596f551922","kind":"rule-candidate","status":"pending","body":{"title":"Disclose AI capabilities and limitations","sourceTitle":"OECD Recommendation of the Council on Artificial Intelligence","sourceVersion":"OECD/LEGAL/0449; adopted 2019-05-22; amended 2024-05-03","control":"Section 1, Principle 1.3(i)","actor":"AI actors","modality":"should","action":"disclose","object":"AI system capabilities and limitations","condition":"When meaningful information can foster general understanding of the AI system.","evidenceSummary":"Principle 1.3(i) calls for meaningful information that supports understanding of system capabilities and limitations.","url":"https://oecd.ai/en/ai-principles","exception":"Information should be appropriate to context and consistent with the state of the art.","timing":"When communicating about or making the AI system available","authority":"Voluntary intergovernmental OECD Recommendation","jurisdiction":"International","ruleId":"AIR-3A544071D1","intent":"disclose ai system capabilities and limitations","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-10T13:13:39.270Z","reviewed_at":null},{"id":"finding-373bc73aa3f3e1277d2b8e0fa92652fc4b87a15b69ed0a89fa600a29ff1839d0","kind":"rule-candidate","status":"pending","body":{"title":"Define safe AI decommissioning procedures","sourceTitle":"OECD Recommendation of the Council on Artificial Intelligence","sourceVersion":"OECD/LEGAL/0449; adopted 2019-05-22; amended 2024-05-03","control":"Section 1, Principle 1.4(b)","actor":"AI actors","modality":"should","action":"define","object":"safe AI decommissioning procedures","condition":"For AI systems that risk undue harm or exhibit undesired behavior.","evidenceSummary":"Principle 1.4(b) recommends mechanisms that allow AI systems to be decommissioned safely as needed.","url":"https://oecd.ai/en/ai-principles","exception":"As appropriate to the system and context.","timing":"Before deployment and available when decommissioning becomes necessary","authority":"Voluntary intergovernmental OECD Recommendation","jurisdiction":"International","ruleId":"AIR-B098FE0267","intent":"define safe ai decommissioning procedures","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-10T13:13:39.270Z","reviewed_at":null},{"id":"finding-428970aef084bfe451a8d1f878bf8ffb0511eaf3e3bce816e5ab719516ab3e17","kind":"rule-candidate","status":"pending","body":{"title":"Apply ongoing systematic AI risk management","sourceTitle":"OECD Recommendation of the Council on Artificial Intelligence","sourceVersion":"OECD/LEGAL/0449; adopted 2019-05-22; amended 2024-05-03","control":"Section 1, Principle 1.5(c)","actor":"AI actors","modality":"should","action":"apply","object":"ongoing systematic AI risk management","condition":"To each AI lifecycle phase, based on role, context and ability to act.","evidenceSummary":"Principle 1.5(c) recommends an ongoing systematic risk-management approach across the AI lifecycle.","url":"https://oecd.ai/en/ai-principles","exception":"Risk treatment is role-, context- and capability-dependent.","timing":"Ongoing across every lifecycle phase","authority":"Voluntary intergovernmental OECD Recommendation","jurisdiction":"International","ruleId":"AIR-175EC9774A","intent":"apply ongoing systematic ai risk management","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-10T13:13:39.270Z","reviewed_at":null},{"id":"finding-5da30aa402de13696a9ad4976db356468e31b15b5c346e5da2ec16454b30bf6b","kind":"rule-candidate","status":"pending","body":{"title":"Invest in representative privacy-respecting open datasets","sourceTitle":"OECD Recommendation of the Council on Artificial Intelligence","sourceVersion":"OECD/LEGAL/0449; adopted 2019-05-22; amended 2024-05-03","control":"Section 2, Recommendation 2.1(b)","actor":"Governments of OECD Recommendation adherents","modality":"should","action":"invest","object":"representative privacy-respecting open datasets","condition":"To support AI research and development that is free from harmful bias and improves interoperability and standards use.","evidenceSummary":"Recommendation 2.1(b) recommends public investment and encouragement of private investment in representative, privacy-respecting open datasets.","url":"https://oecd.ai/en/ai-principles","exception":"Governments are asked to consider public investment and encourage private investment; privacy and data-protection constraints remain.","timing":"As part of AI research and development policy","authority":"Voluntary intergovernmental OECD Recommendation","jurisdiction":"International","ruleId":"AIR-7E9156278D","intent":"invest representative privacy respecting open datasets","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-10T13:13:39.270Z","reviewed_at":null},{"id":"finding-721f3ec1f140b00b50d75ba8ad8ec03025afbaabbd2372a5c20124594919a1b0","kind":"rule-candidate","status":"pending","body":{"title":"Enable safe AI-system override","sourceTitle":"OECD Recommendation of the Council on Artificial Intelligence","sourceVersion":"OECD/LEGAL/0449; adopted 2019-05-22; amended 2024-05-03","control":"Section 1, Principle 1.4(b)","actor":"AI actors","modality":"should","action":"enable","object":"safe override of harmful AI behavior","condition":"When an AI system risks undue harm or exhibits undesired behavior.","evidenceSummary":"Principle 1.4(b) recommends mechanisms that permit safe override when AI risks undue harm or behaves undesirably.","url":"https://oecd.ai/en/ai-principles","exception":"As appropriate to the system and context.","timing":"Available during operation and incident response","authority":"Voluntary intergovernmental OECD Recommendation","jurisdiction":"International","ruleId":"AIR-818859099F","intent":"enable safe override of harmful ai behavior","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-10T13:13:39.270Z","reviewed_at":null},{"id":"finding-78e17c1cb390ada2172749fcf01222c6388b3ce6a8db653efbaaaafa12f2a99c","kind":"rule-candidate","status":"pending","body":{"title":"Develop global technical standards for trustworthy AI","sourceTitle":"OECD Recommendation of the Council on Artificial Intelligence","sourceVersion":"OECD/LEGAL/0449; adopted 2019-05-22; amended 2024-05-03","control":"Section 2, Recommendation 2.5(c)","actor":"Governments of OECD Recommendation adherents","modality":"should","action":"develop","object":"global technical standards for trustworthy AI","condition":"Through multi-stakeholder and consensus-driven processes.","evidenceSummary":"Recommendation 2.5(c) recommends promoting global technical standards for interoperable and trustworthy AI.","url":"https://oecd.ai/en/ai-principles","exception":"Standards should be multi-stakeholder, consensus-driven, interoperable and global.","timing":"Through ongoing international cooperation","authority":"Voluntary intergovernmental OECD Recommendation","jurisdiction":"International","ruleId":"AIR-FADE655905","intent":"develop global technical standards for trustworthy ai","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-10T13:13:39.270Z","reviewed_at":null},{"id":"finding-8051e6c48381365d7f52d81d8b100d494fba0596d45029dbd659a89314b47ade","kind":"rule-candidate","status":"pending","body":{"title":"Enable controlled environments for AI testing","sourceTitle":"OECD Recommendation of the Council on Artificial Intelligence","sourceVersion":"OECD/LEGAL/0449; adopted 2019-05-22; amended 2024-05-03","control":"Section 2, Recommendation 2.3(a)","actor":"Governments of OECD Recommendation adherents","modality":"should","action":"enable","object":"controlled environments for AI testing","condition":"When supporting trustworthy AI transition from research and development to deployment and operation.","evidenceSummary":"Recommendation 2.3(a) says governments should consider experimentation in controlled environments for testing and scaling trustworthy AI.","url":"https://oecd.ai/en/ai-principles","exception":"Use experimentation and scaling only as appropriate; prefer outcome-based and interoperable approaches.","timing":"Before or during transition to deployment","authority":"Voluntary intergovernmental OECD Recommendation","jurisdiction":"International","ruleId":"AIR-00C55B6E08","intent":"enable controlled environments for ai testing","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-10T13:13:39.270Z","reviewed_at":null},{"id":"finding-8164bd45e3f0b09cb5901178411547c84eea3f516381edeb8d10eb0259051534","kind":"rule-candidate","status":"pending","body":{"title":"Enable repair of harmful AI behavior","sourceTitle":"OECD Recommendation of the Council on Artificial Intelligence","sourceVersion":"OECD/LEGAL/0449; adopted 2019-05-22; amended 2024-05-03","control":"Section 1, Principle 1.4(b)","actor":"AI actors","modality":"should","action":"enable","object":"repair of harmful AI behavior","condition":"When an AI system risks undue harm or exhibits undesired behavior.","evidenceSummary":"Principle 1.4(b) recommends mechanisms that permit repair when AI risks undue harm or behaves undesirably.","url":"https://oecd.ai/en/ai-principles","exception":"As appropriate to the system and context.","timing":"Available during operation and incident response","authority":"Voluntary intergovernmental OECD Recommendation","jurisdiction":"International","ruleId":"AIR-6C4AF0912E","intent":"enable repair of harmful ai behavior","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-10T13:13:39.270Z","reviewed_at":null},{"id":"finding-8adcb8c7111044230241ba4804e36bddf9876e652a7d6b59090a13c125826500","kind":"rule-candidate","status":"pending","body":{"title":"Adapt policy frameworks for trustworthy AI","sourceTitle":"OECD Recommendation of the Council on Artificial Intelligence","sourceVersion":"OECD/LEGAL/0449; adopted 2019-05-22; amended 2024-05-03","control":"Section 2, Recommendation 2.3(b)","actor":"Governments of OECD Recommendation adherents","modality":"should","action":"adapt","object":"policy frameworks for trustworthy AI","condition":"After reviewing how existing policy and regulatory frameworks and assessment mechanisms apply to AI systems.","evidenceSummary":"Recommendation 2.3(b) recommends reviewing and adapting frameworks to encourage trustworthy-AI innovation and competition.","url":"https://oecd.ai/en/ai-principles","exception":"Adaptation is required only as appropriate after review.","timing":"Periodically as AI systems and evidence evolve","authority":"Voluntary intergovernmental OECD Recommendation","jurisdiction":"International","ruleId":"AIR-258BC7584E","intent":"adapt policy frameworks for trustworthy ai","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-10T13:13:39.270Z","reviewed_at":null},{"id":"finding-8bbdfd0dca5c4a80a6b5a9808cac48effb9572ca2f6fb5e7b99ebeba953eba88","kind":"rule-candidate","status":"pending","body":{"title":"Ensure AI-process traceability","sourceTitle":"OECD Recommendation of the Council on Artificial Intelligence","sourceVersion":"OECD/LEGAL/0449; adopted 2019-05-22; amended 2024-05-03","control":"Section 1, Principle 1.5(b)","actor":"AI actors","modality":"should","action":"ensure","object":"AI process traceability","condition":"Where traceability supports analysis of outputs and responses to inquiry.","evidenceSummary":"Principle 1.5(b) includes process traceability as an accountability mechanism.","url":"https://oecd.ai/en/ai-principles","exception":"Appropriate to context and consistent with the state of the art.","timing":"Throughout relevant lifecycle phases","authority":"Voluntary intergovernmental OECD Recommendation","jurisdiction":"International","ruleId":"AIR-A26D278094","intent":"ensure ai process traceability","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-10T13:13:39.270Z","reviewed_at":null},{"id":"finding-a0a14a297a5221de41b3488427339acc9b6c8b82190a65c4aadcd27b313172ba","kind":"rule-candidate","status":"pending","body":{"title":"Ensure AI-dataset traceability","sourceTitle":"OECD Recommendation of the Council on Artificial Intelligence","sourceVersion":"OECD/LEGAL/0449; adopted 2019-05-22; amended 2024-05-03","control":"Section 1, Principle 1.5(b)","actor":"AI actors","modality":"should","action":"ensure","object":"AI dataset traceability","condition":"Where traceability supports analysis of outputs and responses to inquiry.","evidenceSummary":"Principle 1.5(b) includes dataset traceability as an accountability mechanism.","url":"https://oecd.ai/en/ai-principles","exception":"Appropriate to context and consistent with the state of the art.","timing":"Throughout relevant lifecycle phases","authority":"Voluntary intergovernmental OECD Recommendation","jurisdiction":"International","ruleId":"AIR-B560A4296B","intent":"ensure ai dataset traceability","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-10T13:13:39.270Z","reviewed_at":null},{"id":"finding-ab42d124126c5912e00b348fbd90612083be2858d34731dc7b4a776583e76a52","kind":"rule-candidate","status":"pending","body":{"title":"Maintain AI robustness, security and safety","sourceTitle":"OECD Recommendation of the Council on Artificial Intelligence","sourceVersion":"OECD/LEGAL/0449; adopted 2019-05-22; amended 2024-05-03","control":"Section 1, Principle 1.4(a)","actor":"AI actors","modality":"should","action":"maintain","object":"AI system robustness security and safety","condition":"Under normal use, foreseeable use or misuse, and other adverse conditions.","evidenceSummary":"Principle 1.4(a) recommends lifecycle-wide robustness, security and safety so systems function appropriately without unreasonable risks.","url":"https://oecd.ai/en/ai-principles","exception":"The recommendation targets unreasonable safety or security risks and depends on actor role and context.","timing":"Throughout the AI system lifecycle","authority":"Voluntary intergovernmental OECD Recommendation","jurisdiction":"International","ruleId":"AIR-F634CFE326","intent":"maintain ai system robustness security and safety","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-10T13:13:39.270Z","reviewed_at":null},{"id":"finding-ac4f2ab102b94be62e0e8ad573803ab34da403214214332c5869b06a393d7ae8","kind":"rule-candidate","status":"pending","body":{"title":"Enable effective human oversight of AI systems","sourceTitle":"OECD Recommendation of the Council on Artificial Intelligence","sourceVersion":"OECD/LEGAL/0449; adopted 2019-05-22; amended 2024-05-03","control":"Section 1, Principle 1.2(b)","actor":"AI actors, according to their lifecycle roles","modality":"should","action":"enable","object":"effective human oversight","condition":"Where needed to address risks from intended use, use outside intended purpose, intentional misuse or unintentional misuse.","evidenceSummary":"Principle 1.2(b) recommends mechanisms and safeguards that preserve human agency and oversight.","url":"https://oecd.ai/en/ai-principles","exception":"Implementation should be appropriate to the context and consistent with the state of the art.","timing":"During relevant lifecycle phases","authority":"Voluntary intergovernmental OECD Recommendation","jurisdiction":"International","ruleId":"AIR-9F0606F820","intent":"enable effective human oversight","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-10T13:13:39.270Z","reviewed_at":null},{"id":"finding-ae71438687970045f20ebd365f7ca6e60089d9c04862a4865841268986dfd658","kind":"rule-candidate","status":"pending","body":{"title":"Ensure AI lifecycle-decision traceability","sourceTitle":"OECD Recommendation of the Council on Artificial Intelligence","sourceVersion":"OECD/LEGAL/0449; adopted 2019-05-22; amended 2024-05-03","control":"Section 1, Principle 1.5(b)","actor":"AI actors","modality":"should","action":"ensure","object":"AI lifecycle decision traceability","condition":"Where traceability supports analysis of outputs and responses to inquiry.","evidenceSummary":"Principle 1.5(b) includes traceability of decisions made during the AI lifecycle.","url":"https://oecd.ai/en/ai-principles","exception":"Appropriate to context and consistent with the state of the art.","timing":"Throughout relevant lifecycle phases","authority":"Voluntary intergovernmental OECD Recommendation","jurisdiction":"International","ruleId":"AIR-0E0C140628","intent":"ensure ai lifecycle decision traceability","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-10T13:13:39.270Z","reviewed_at":null},{"id":"finding-ae92d01631f036a088fab5d833f5e6b4ad257d21a434fafc0ff8d59a7b916a95","kind":"rule-candidate","status":"pending","body":{"title":"Respect human rights throughout the AI lifecycle","sourceTitle":"OECD Recommendation of the Council on Artificial Intelligence","sourceVersion":"OECD/LEGAL/0449; adopted 2019-05-22; amended 2024-05-03","control":"Section 1, Principle 1.2(a)","actor":"AI actors, according to their lifecycle roles","modality":"should","action":"respect","object":"human rights throughout the AI system lifecycle","condition":"Across planning, data processing, model building, testing, deployment, operation, monitoring and retirement, as applicable to the actor's role.","evidenceSummary":"Principle 1.2(a) recommends that AI actors respect human rights and human-centred democratic values throughout the AI lifecycle.","url":"https://oecd.ai/en/ai-principles","exception":"Role- and context-dependent; rights include non-discrimination, privacy, dignity, autonomy, fairness and internationally recognised labour rights.","timing":"Throughout the AI system lifecycle","authority":"Voluntary intergovernmental OECD Recommendation","jurisdiction":"International","ruleId":"AIR-F48890400A","intent":"respect human rights throughout the ai system lifecycle","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-10T13:13:39.270Z","reviewed_at":null},{"id":"finding-b8ee999a5f91f8bf5e1aa311e7df6c497d3a82ce471962d76350f317f7526d73","kind":"rule-candidate","status":"pending","body":{"title":"Develop comparable indicators of AI activity","sourceTitle":"OECD Recommendation of the Council on Artificial Intelligence","sourceVersion":"OECD/LEGAL/0449; adopted 2019-05-22; amended 2024-05-03","control":"Section 2, Recommendation 2.5(d)","actor":"Governments of OECD Recommendation adherents","modality":"should","action":"develop","object":"internationally comparable AI indicators","condition":"To measure AI research, development and deployment and assess implementation progress.","evidenceSummary":"Recommendation 2.5(d) recommends internationally comparable indicators and an evidence base for implementation progress.","url":"https://oecd.ai/en/ai-principles","exception":"Indicators should be internationally comparable and tied to research, development and deployment evidence.","timing":"Ongoing measurement and assessment","authority":"Voluntary intergovernmental OECD Recommendation","jurisdiction":"International","ruleId":"AIR-3D3C10AB41","intent":"develop internationally comparable ai indicators","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-10T13:13:39.270Z","reviewed_at":null},{"id":"finding-b9bf89024bef3a1454fb465d69d4964de40e6e7fb4d899aaaca9ca3cd9e87c81","kind":"rule-candidate","status":"pending","body":{"title":"Promote responsible AI use at work","sourceTitle":"OECD Recommendation of the Council on Artificial Intelligence","sourceVersion":"OECD/LEGAL/0449; adopted 2019-05-22; amended 2024-05-03","control":"Section 2, Recommendation 2.4(c)","actor":"Governments of OECD Recommendation adherents","modality":"should","action":"promote","object":"responsible AI use at work","condition":"Working closely with stakeholders to improve worker safety, job quality and public services.","evidenceSummary":"Recommendation 2.4(c) calls on governments to promote responsible workplace AI use and broadly shared benefits.","url":"https://oecd.ai/en/ai-principles","exception":"Implementation should enhance safety and job quality and account for stakeholder roles.","timing":"During workplace AI adoption and operation","authority":"Voluntary intergovernmental OECD Recommendation","jurisdiction":"International","ruleId":"AIR-59C3D0945B","intent":"promote responsible ai use at work","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-10T13:13:39.270Z","reviewed_at":null},{"id":"finding-c38b54abe73007a67fb8cf0a2cd0bd125ebd12795e044b3d6b46a85bfe28e33c","kind":"rule-candidate","status":"pending","body":{"title":"Explain sources of AI data and inputs","sourceTitle":"OECD Recommendation of the Council on Artificial Intelligence","sourceVersion":"OECD/LEGAL/0449; adopted 2019-05-22; amended 2024-05-03","control":"Section 1, Principle 1.3(iii)","actor":"AI actors","modality":"should","action":"explain","object":"sources of AI data and inputs","condition":"When explanation is feasible and useful for people affected by an AI output.","evidenceSummary":"Principle 1.3(iii) identifies plain information on data and input sources as part of contextual explanation.","url":"https://oecd.ai/en/ai-principles","exception":"Only where feasible and useful; detail should be context-appropriate and consistent with the state of the art.","timing":"When providing an explanation of an AI output","authority":"Voluntary intergovernmental OECD Recommendation","jurisdiction":"International","ruleId":"AIR-ADAE26B414","intent":"explain sources of ai data and inputs","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-10T13:13:39.270Z","reviewed_at":null},{"id":"finding-c3b6083512d27741aa65376373042988cb3b0946aed7a88cb9e4e2b2a099ce20","kind":"rule-candidate","status":"pending","body":{"title":"Equip people with skills to use AI effectively","sourceTitle":"OECD Recommendation of the Council on Artificial Intelligence","sourceVersion":"OECD/LEGAL/0449; adopted 2019-05-22; amended 2024-05-03","control":"Section 2, Recommendation 2.4(a)","actor":"Governments of OECD Recommendation adherents","modality":"should","action":"equip","object":"people with skills to use AI effectively","condition":"In preparation for transformation of work and society, working closely with stakeholders.","evidenceSummary":"Recommendation 2.4(a) calls for empowering people to use and interact with AI by equipping them with necessary skills.","url":"https://oecd.ai/en/ai-principles","exception":"Implementation should cover the breadth of AI applications and reflect stakeholder needs.","timing":"As part of workforce and societal transition planning","authority":"Voluntary intergovernmental OECD Recommendation","jurisdiction":"International","ruleId":"AIR-0CA4CB8FA7","intent":"equip people with skills to use ai effectively","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-10T13:13:39.270Z","reviewed_at":null},{"id":"finding-cd0ac74387b7e04be64b981b25c839f516e6961f587df992fb17780b616b1c2b","kind":"rule-candidate","status":"pending","body":{"title":"Bolster information integrity in AI systems","sourceTitle":"OECD Recommendation of the Council on Artificial Intelligence","sourceVersion":"OECD/LEGAL/0449; adopted 2019-05-22; amended 2024-05-03","control":"Section 1, Principle 1.4(c)","actor":"AI actors","modality":"should","action":"bolster","object":"information integrity in AI systems","condition":"When information-integrity mechanisms are technically feasible.","evidenceSummary":"Principle 1.4(c) recommends mechanisms that strengthen information integrity while protecting freedom of expression.","url":"https://oecd.ai/en/ai-principles","exception":"Only where technically feasible, and measures must respect freedom of expression.","timing":"Across relevant design and operation phases","authority":"Voluntary intergovernmental OECD Recommendation","jurisdiction":"International","ruleId":"AIR-768D94AE56","intent":"bolster information integrity in ai systems","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-10T13:13:39.270Z","reviewed_at":null},{"id":"finding-d07556a64e0b52b92c9c6648ac29648bbafef3a6e474820bc01e0d72941e09ab","kind":"rule-candidate","status":"pending","body":{"title":"Inform stakeholders when they interact with AI","sourceTitle":"OECD Recommendation of the Council on Artificial Intelligence","sourceVersion":"OECD/LEGAL/0449; adopted 2019-05-22; amended 2024-05-03","control":"Section 1, Principle 1.3(ii)","actor":"AI actors","modality":"should","action":"inform","object":"stakeholders of AI interactions","condition":"When stakeholders interact with an AI system, including in the workplace.","evidenceSummary":"Principle 1.3(ii) recommends making stakeholders aware of their interactions with AI systems.","url":"https://oecd.ai/en/ai-principles","exception":"Information should be appropriate to context and consistent with the state of the art.","timing":"At or before the interaction","authority":"Voluntary intergovernmental OECD Recommendation","jurisdiction":"International","ruleId":"AIR-E8F30C1AB6","intent":"inform stakeholders of ai interactions","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-10T13:13:39.270Z","reviewed_at":null},{"id":"finding-d4f704305a179dbe2264e44eb347372bcd61ae1d05b829a636a54a379867e015","kind":"rule-candidate","status":"pending","body":{"title":"Invest in AI research on social, legal and ethical impacts","sourceTitle":"OECD Recommendation of the Council on Artificial Intelligence","sourceVersion":"OECD/LEGAL/0449; adopted 2019-05-22; amended 2024-05-03","control":"Section 2, Recommendation 2.1(a)","actor":"Governments of OECD Recommendation adherents","modality":"should","action":"invest","object":"AI research on social legal and ethical impacts","condition":"As part of long-term public investment and encouragement of private investment in trustworthy AI research and open science.","evidenceSummary":"Recommendation 2.1(a) calls for interdisciplinary investment addressing AI-related social, legal, ethical and policy issues.","url":"https://oecd.ai/en/ai-principles","exception":"Governments are asked to consider public investment and encourage private investment rather than meet a fixed spending level.","timing":"Long-term","authority":"Voluntary intergovernmental OECD Recommendation","jurisdiction":"International","ruleId":"AIR-2D29284F7D","intent":"invest ai research on social legal and ethical impacts","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-10T13:13:39.270Z","reviewed_at":null},{"id":"finding-d8dd6a8a646053bf2a68cd03c74f4c34041d0e8fe30f9a5a6085bf4d28bdd3c7","kind":"rule-candidate","status":"pending","body":{"title":"Explain factors and logic behind AI outputs","sourceTitle":"OECD Recommendation of the Council on Artificial Intelligence","sourceVersion":"OECD/LEGAL/0449; adopted 2019-05-22; amended 2024-05-03","control":"Section 1, Principle 1.3(iii)","actor":"AI actors","modality":"should","action":"explain","object":"factors processes and logic behind AI outputs","condition":"When explanation is feasible and useful for affected people to understand a prediction, content, recommendation or decision.","evidenceSummary":"Principle 1.3(iii) recommends plain information on the factors, processes or logic leading to an AI output.","url":"https://oecd.ai/en/ai-principles","exception":"Only where feasible and useful; explanation should be context-appropriate and consistent with the state of the art.","timing":"When providing an explanation of an AI output","authority":"Voluntary intergovernmental OECD Recommendation","jurisdiction":"International","ruleId":"AIR-F193592F11","intent":"explain factors processes and logic behind ai outputs","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-10T13:13:39.270Z","reviewed_at":null},{"id":"change-eu-ai-act-131b49699f7f9f7d911d511e1ac6eeed9109576c33f1492aa5321ab07b92273b","kind":"source-change","status":"pending","body":{"sourceId":"eu-ai-act","title":"EU Artificial Intelligence Act","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","status":"publisher-bytes-changed","checkedAt":"2026-10-10T13:05:46.577Z","fingerprint":"131b49699f7f9f7d911d511e1ac6eeed9109576c33f1492aa5321ab07b92273b","previousFingerprint":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","bytes":1534744,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-10T13:05:46.577Z","reviewed_at":null},{"id":"change-eu-gdpr-f9f622ce4ac6b1148dd0935711ecb56f8fac6ff65d8e6d68a906942e93b6d114","kind":"source-change","status":"pending","body":{"sourceId":"eu-gdpr","title":"General Data Protection Regulation","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","status":"publisher-bytes-changed","checkedAt":"2026-10-10T13:05:46.577Z","fingerprint":"f9f622ce4ac6b1148dd0935711ecb56f8fac6ff65d8e6d68a906942e93b6d114","previousFingerprint":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","bytes":1071097,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-10T13:05:46.577Z","reviewed_at":null},{"id":"change-msu-genai-guidelines-93bb4040ed7ccd48aa107314ac0f0d630cf5141e3a6f980149e1b771d8f57c1c","kind":"source-change","status":"pending","body":{"sourceId":"msu-genai-guidelines","title":"Guidelines for the Use of Generative Artificial Intelligence Tools","url":"https://ai.msu.edu/guidelines","status":"publisher-bytes-changed","checkedAt":"2026-10-10T13:05:46.577Z","fingerprint":"93bb4040ed7ccd48aa107314ac0f0d630cf5141e3a6f980149e1b771d8f57c1c","previousFingerprint":"e401974ad10a50b26c705292f1284b59860797d908a3854bee6eea7c18018e46","bytes":708342,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-10T13:05:46.577Z","reviewed_at":null},{"id":"change-cisa-ncsc-secure-ai-development-503fc5dcc843e7fb433e1cda18709296ac7528b890bad601f188ba5a787d4cf3","kind":"source-change","status":"pending","body":{"sourceId":"cisa-ncsc-secure-ai-development","title":"Guidelines for Secure AI System Development","url":"https://www.ncsc.gov.uk/collection/guidelines-secure-ai-system-development/guidelines/secure-development","status":"publisher-bytes-changed","checkedAt":"2026-10-10T13:05:44.088Z","fingerprint":"503fc5dcc843e7fb433e1cda18709296ac7528b890bad601f188ba5a787d4cf3","previousFingerprint":"ff473b03393de39a1b19fa71fee25fdbe1ea6909d03a9f4f2eccb7dc000fd7d2","bytes":235219,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-10T13:05:44.088Z","reviewed_at":null},{"id":"finding-031d7a66d053c0ce362aa27d7700a9d7ee8f8decf5bc91969b8d42f8994e5d76","kind":"rule-candidate","status":"pending","body":{"title":"Do not facilitate unlawful sexually explicit deepfakes with AI","sourceTitle":"Texas Responsible Artificial Intelligence Governance Act","sourceVersion":"H.B. 149 enrolled; Acts 2025, 89th Leg., R.S., ch. 1174; effective January 1, 2026","control":"Business & Commerce Code § 552.057(1)(B)","actor":"Persons developing or distributing AI systems within the subtitle's Texas scope","modality":"must not","action":"facilitate","object":"unlawful sexually explicit deepfakes with AI","condition":"The AI system is developed or distributed with the sole intent of producing, assisting, aiding in producing, or distributing deepfake videos or images prohibited by Penal Code § 21.165.","evidenceSummary":"Section 552.057(1)(B) establishes a sole-intent prohibition tied to Penal Code § 21.165.","url":"https://capitol.texas.gov/tlodocs/89R/billtext/html/HB00149F.htm","exception":"The prohibition requires sole intent and incorporates the elements of Penal Code § 21.165.","timing":"At development or distribution; effective January 1, 2026","authority":"Binding enacted Texas statute within scope","jurisdiction":"Texas, United States","ruleId":"AIR-2FBC24A41B","intent":"facilitate unlawful sexually explicit deepfakes with ai","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-09T13:11:03.845Z","reviewed_at":null},{"id":"finding-06893cbe816a62069a8b065a1aa56d77571862547866d52f6794b9d684217fcd","kind":"rule-candidate","status":"pending","body":{"title":"Report sandbox AI risk-mitigation updates quarterly","sourceTitle":"Texas Responsible Artificial Intelligence Governance Act","sourceVersion":"H.B. 149 enrolled; Acts 2025, 89th Leg., R.S., ch. 1174; effective January 1, 2026","control":"Business & Commerce Code § 553.102(a), (b)(2)","actor":"Texas AI regulatory-sandbox participants","modality":"must","action":"report","object":"updates on AI operational risk mitigation","condition":"The participant is testing an AI system in the Texas regulatory sandbox.","evidenceSummary":"Section 553.102 requires quarterly participant reports and specifically includes updates on how the system mitigates operational risks.","url":"https://capitol.texas.gov/tlodocs/89R/billtext/html/HB00149F.htm","exception":"DIR must keep intellectual property, trade secrets, and other sensitive program information confidential.","timing":"Quarterly during sandbox participation; effective January 1, 2026","authority":"Binding enacted Texas statute within scope","jurisdiction":"Texas, United States","ruleId":"AIR-C4C05465F4","intent":"report updates on ai operational risk mitigation","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-09T13:11:03.845Z","reviewed_at":null},{"id":"finding-12782e48a31c14b3852ce83f93743c505c776954d3728552462c35540150d1bc","kind":"rule-candidate","status":"pending","body":{"title":"Do not identify people from public biometric media without consent","sourceTitle":"Texas Responsible Artificial Intelligence Governance Act","sourceVersion":"H.B. 149 enrolled; Acts 2025, 89th Leg., R.S., ch. 1174; effective January 1, 2026","control":"Business & Commerce Code § 552.054(b)","actor":"Texas governmental entities developing or deploying AI systems","modality":"must not","action":"identify","object":"individuals using biometric data gathered from public sources without consent","condition":"The governmental entity develops or deploys AI for unique identification using biometric data or images/media gathered from the Internet or another public source, without consent, and the gathering would infringe a protected right.","evidenceSummary":"Section 552.054(b) links the ban to unique identification, public-source gathering without consent, and infringement of constitutional or statutory rights.","url":"https://capitol.texas.gov/tlodocs/89R/billtext/html/HB00149F.htm","exception":"The statute excludes ordinary photos, video/audio recordings and their derived data, plus HIPAA treatment, payment, or operations information, from its biometric-data definition; all elements must be met.","timing":"At development or deployment; effective January 1, 2026","authority":"Binding enacted Texas statute within scope","jurisdiction":"Texas, United States","ruleId":"AIR-1F8D5A27D6","intent":"identify individuals using biometric data gathered from public sources without consent","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-09T13:11:03.845Z","reviewed_at":null},{"id":"finding-1334fbaa2f510ee8debba48783826f48aa99b27b056054eb7fbe7f4b3131954f","kind":"rule-candidate","status":"pending","body":{"title":"Do not enable AI to incite criminal activity","sourceTitle":"Texas Responsible Artificial Intelligence Governance Act","sourceVersion":"H.B. 149 enrolled; Acts 2025, 89th Leg., R.S., ch. 1174; effective January 1, 2026","control":"Business & Commerce Code § 552.052(3)","actor":"Persons developing or deploying AI systems within the subtitle's Texas scope","modality":"must not","action":"enable","object":"AI systems to incite criminal activity","condition":"The system is developed or deployed in a manner intentionally aimed at inciting or encouraging criminal activity.","evidenceSummary":"Section 552.052(3) prohibits intentional development or deployment aimed at inciting or encouraging criminal activity.","url":"https://capitol.texas.gov/tlodocs/89R/billtext/html/HB00149F.htm","exception":"The prohibition contains an intent element and applies only within Section 551.002's Texas nexus.","timing":"At development and deployment; effective January 1, 2026","authority":"Binding enacted Texas statute within scope","jurisdiction":"Texas, United States","ruleId":"AIR-BD074F57DB","intent":"enable ai systems to incite criminal activity","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-09T13:11:03.845Z","reviewed_at":null},{"id":"finding-3ef088fc0d5831548b0fca53182b99fa41a50d659e6e6ecd06e8608e26131a2c","kind":"rule-candidate","status":"pending","body":{"title":"Report sandbox AI performance metrics quarterly","sourceTitle":"Texas Responsible Artificial Intelligence Governance Act","sourceVersion":"H.B. 149 enrolled; Acts 2025, 89th Leg., R.S., ch. 1174; effective January 1, 2026","control":"Business & Commerce Code § 553.102(a), (b)(1)","actor":"Texas AI regulatory-sandbox participants","modality":"must","action":"report","object":"AI system performance metrics","condition":"The participant is testing an AI system in the Texas regulatory sandbox.","evidenceSummary":"Section 553.102 requires quarterly participant reports and specifically includes system performance metrics.","url":"https://capitol.texas.gov/tlodocs/89R/billtext/html/HB00149F.htm","exception":"DIR must keep intellectual property, trade secrets, and other sensitive program information confidential.","timing":"Quarterly during sandbox participation; effective January 1, 2026","authority":"Binding enacted Texas statute within scope","jurisdiction":"Texas, United States","ruleId":"AIR-CD45DCD123","intent":"report ai system performance metrics","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-09T13:11:03.845Z","reviewed_at":null},{"id":"finding-56c31e2c81fe928cb8115609bdbd78d1bfd77babe6fb4ac96ce8559215d14c4c","kind":"rule-candidate","status":"pending","body":{"title":"Obtain approval before Texas AI sandbox testing","sourceTitle":"Texas Responsible Artificial Intelligence Governance Act","sourceVersion":"H.B. 149 enrolled; Acts 2025, 89th Leg., R.S., ch. 1174; effective January 1, 2026","control":"Business & Commerce Code § 553.052(a)","actor":"Applicants to the Texas AI regulatory sandbox","modality":"must","action":"obtain","object":"approval for AI sandbox testing","condition":"The applicant seeks to test an AI system under the Texas regulatory sandbox.","evidenceSummary":"Section 553.052(a) requires approval from the Department of Information Resources and each applicable agency before testing.","url":"https://capitol.texas.gov/tlodocs/89R/billtext/html/HB00149F.htm","exception":"Sandbox participation can last no more than 36 months unless DIR finds good cause for extension; Chapter 552 Subchapter B duties cannot be waived.","timing":"Before testing; effective January 1, 2026","authority":"Binding enacted Texas statute within scope","jurisdiction":"Texas, United States","ruleId":"AIR-B07A3B1B97","intent":"obtain approval for ai sandbox testing","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-09T13:11:03.845Z","reviewed_at":null},{"id":"finding-64dbcbc5f00309ed8b61dd590a6ff937d88ffb8c7238e82eb26e2aeb95b72c04","kind":"rule-candidate","status":"pending","body":{"title":"Inventory state-agency AI systems in information-resource reviews","sourceTitle":"Texas Responsible Artificial Intelligence Governance Act","sourceVersion":"H.B. 149 enrolled; Acts 2025, 89th Leg., R.S., ch. 1174; effective January 1, 2026","control":"Government Code § 2054.0965(b)(2), as amended by H.B. 149 § 7","actor":"Texas state agencies performing required information-resource deployment reviews","modality":"must","action":"inventory","object":"agency AI systems","condition":"The agency performs the review required by Government Code § 2054.0965, unless DIR rules modify the review.","evidenceSummary":"H.B. 149 adds artificial intelligence systems to the databases and applications that must be inventoried in the state-agency review.","url":"https://capitol.texas.gov/tlodocs/89R/billtext/html/HB00149F.htm","exception":"DIR rules may modify the review, and mandatory state-agency implementation is conditioned on specific fiscal-year appropriation under H.B. 149 § 9; implementation may proceed with other available funding.","timing":"During the required information-resource deployment review; effective January 1, 2026","authority":"Binding enacted Texas statute within scope, subject to DIR rules and the funding proviso","jurisdiction":"Texas, United States","ruleId":"AIR-C315EAF7F0","intent":"inventory agency ai systems","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-09T13:11:03.845Z","reviewed_at":null},{"id":"finding-685ce5cea91ba836e247497bb5d25deab0f2020806f4312a101a72faec4d75e9","kind":"rule-candidate","status":"pending","body":{"title":"Disclose consumer interaction with government AI","sourceTitle":"Texas Responsible Artificial Intelligence Governance Act","sourceVersion":"H.B. 149 enrolled; Acts 2025, 89th Leg., R.S., ch. 1174; effective January 1, 2026","control":"Business & Commerce Code § 552.051(b)-(e)","actor":"Texas governmental agencies making consumer-facing AI available","modality":"must","action":"disclose","object":"AI interaction","condition":"The agency makes an AI system intended to interact with Texas consumers available; disclosure is required even when the interaction would be obvious.","evidenceSummary":"Section 552.051 requires notice before or at interaction and specifies clear, conspicuous, plain-language presentation without dark patterns.","url":"https://capitol.texas.gov/tlodocs/89R/billtext/html/HB00149F.htm","exception":"The governmental-entity definition excludes hospital districts and Texas institutions of higher education; a hyperlink may provide the disclosure.","timing":"Before or at the time of interaction; effective January 1, 2026","authority":"Binding enacted Texas statute within scope","jurisdiction":"Texas, United States","ruleId":"AIR-C8E01637B6","intent":"disclose ai interaction","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-09T13:11:03.845Z","reviewed_at":null},{"id":"finding-6a1cde9387714feeb00f6a6b46ee99ca4823460c3322d7759ad4f64c74d0545e","kind":"rule-candidate","status":"pending","body":{"title":"Prove federal AI-law compliance for sandbox admission","sourceTitle":"Texas Responsible Artificial Intelligence Governance Act","sourceVersion":"H.B. 149 enrolled; Acts 2025, 89th Leg., R.S., ch. 1174; effective January 1, 2026","control":"Business & Commerce Code § 553.052(b)(4)","actor":"Applicants to the Texas AI regulatory sandbox","modality":"must","action":"provide","object":"proof of compliance with applicable federal AI laws and regulations","condition":"The person applies to test an AI system in the regulatory sandbox.","evidenceSummary":"Section 553.052(b)(4) makes proof of applicable federal AI-law compliance part of the sandbox application.","url":"https://capitol.texas.gov/tlodocs/89R/billtext/html/HB00149F.htm","exception":"Only applicable federal AI laws and regulations are covered; other application and nonwaivable state protections remain separate.","timing":"With the sandbox application; effective January 1, 2026","authority":"Binding enacted Texas statute within scope","jurisdiction":"Texas, United States","ruleId":"AIR-E3F0C98DE0","intent":"provide proof of compliance with applicable federal ai laws and regulations","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-09T13:11:03.845Z","reviewed_at":null},{"id":"finding-6a65bf1ea3e8a6ae60e011762d307bbafa28b1589e453224d5bd36b62985e41c","kind":"rule-candidate","status":"pending","body":{"title":"Report sandbox user and stakeholder feedback quarterly","sourceTitle":"Texas Responsible Artificial Intelligence Governance Act","sourceVersion":"H.B. 149 enrolled; Acts 2025, 89th Leg., R.S., ch. 1174; effective January 1, 2026","control":"Business & Commerce Code § 553.102(a), (b)(3)","actor":"Texas AI regulatory-sandbox participants","modality":"must","action":"report","object":"feedback from consumers and affected stakeholders using sandbox AI","condition":"The participant is testing an AI system in the Texas regulatory sandbox.","evidenceSummary":"Section 553.102 requires quarterly participant reports and specifically includes feedback from consumers and affected stakeholders using the tested system.","url":"https://capitol.texas.gov/tlodocs/89R/billtext/html/HB00149F.htm","exception":"DIR must keep intellectual property, trade secrets, and other sensitive program information confidential.","timing":"Quarterly during sandbox participation; effective January 1, 2026","authority":"Binding enacted Texas statute within scope","jurisdiction":"Texas, United States","ruleId":"AIR-1C7320ACE2","intent":"report feedback from consumers and affected stakeholders using sandbox ai","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-09T13:11:03.845Z","reviewed_at":null},{"id":"finding-6d11790ce2db394d45f80458ebcc592920a26f7e3824073acc4ab4614ee0677f","kind":"rule-candidate","status":"pending","body":{"title":"Document a sandbox adverse-consequence mitigation plan","sourceTitle":"Texas Responsible Artificial Intelligence Governance Act","sourceVersion":"H.B. 149 enrolled; Acts 2025, 89th Leg., R.S., ch. 1174; effective January 1, 2026","control":"Business & Commerce Code § 553.052(b)(3)","actor":"Applicants to the Texas AI regulatory sandbox","modality":"must","action":"document","object":"a plan to mitigate adverse consequences during AI sandbox testing","condition":"The person applies to test an AI system in the regulatory sandbox.","evidenceSummary":"Section 553.052(b)(3) requires the applicant to describe its plan for mitigating adverse consequences that may occur during the test.","url":"https://capitol.texas.gov/tlodocs/89R/billtext/html/HB00149F.htm","exception":"The mitigation plan is an application requirement and does not waive Chapter 552 Subchapter B protections.","timing":"With the sandbox application; effective January 1, 2026","authority":"Binding enacted Texas statute within scope","jurisdiction":"Texas, United States","ruleId":"AIR-CA307F333F","intent":"document a plan to mitigate adverse consequences during ai sandbox testing","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-09T13:11:03.845Z","reviewed_at":null},{"id":"finding-70e1948a09941d1956abdea0955690adb262cd4eac76703e4c02ded3052bf343","kind":"rule-candidate","status":"pending","body":{"title":"Disclose AI use in health care services","sourceTitle":"Texas Responsible Artificial Intelligence Governance Act","sourceVersion":"H.B. 149 enrolled; Acts 2025, 89th Leg., R.S., ch. 1174; effective January 1, 2026","control":"Business & Commerce Code § 552.051(f)","actor":"Licensed, registered, or certified health care service providers using AI in service or treatment","modality":"must","action":"disclose","object":"AI interaction","condition":"An AI system is used in relation to human health services or diagnosis, prevention, or treatment.","evidenceSummary":"Section 552.051(f) applies the statutory AI-interaction disclosure to health care recipients or their personal representatives.","url":"https://capitol.texas.gov/tlodocs/89R/billtext/html/HB00149F.htm","exception":"In an emergency, disclosure may follow when reasonably possible.","timing":"No later than the date service or treatment is first provided; effective January 1, 2026","authority":"Binding enacted Texas statute within scope","jurisdiction":"Texas, United States","ruleId":"AIR-C8E01637B6","intent":"disclose ai interaction","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-09T13:11:03.845Z","reviewed_at":null},{"id":"finding-7cb8efb4c991326c567ec0ed796e8c800928f49c00842d9ad25ac8f8bd02f42b","kind":"rule-candidate","status":"pending","body":{"title":"Do not build AI solely to impair federal constitutional rights","sourceTitle":"Texas Responsible Artificial Intelligence Governance Act","sourceVersion":"H.B. 149 enrolled; Acts 2025, 89th Leg., R.S., ch. 1174; effective January 1, 2026","control":"Business & Commerce Code § 552.055(a)","actor":"Persons developing or deploying AI systems within the subtitle's Texas scope","modality":"must not","action":"build","object":"AI systems solely intended to impair federal constitutional rights","condition":"The person's sole intent is for the AI system to infringe, restrict, or otherwise impair an individual's rights guaranteed by the United States Constitution.","evidenceSummary":"Section 552.055(a) establishes a sole-intent prohibition tied specifically to federal constitutional rights.","url":"https://capitol.texas.gov/tlodocs/89R/billtext/html/HB00149F.htm","exception":"The section does not create or expand constitutional rights and requires proof of sole intent.","timing":"At development or deployment; effective January 1, 2026","authority":"Binding enacted Texas statute within scope","jurisdiction":"Texas, United States","ruleId":"AIR-B85A6FD731","intent":"build ai systems solely intended to impair federal constitutional rights","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-09T13:11:03.845Z","reviewed_at":null},{"id":"finding-831db0ab4ae99e85cf30e0410bedd891dd284232da9e9894de1f779518375fa9","kind":"rule-candidate","status":"pending","body":{"title":"Do not facilitate prohibited child sexual material with AI","sourceTitle":"Texas Responsible Artificial Intelligence Governance Act","sourceVersion":"H.B. 149 enrolled; Acts 2025, 89th Leg., R.S., ch. 1174; effective January 1, 2026","control":"Business & Commerce Code § 552.057(1)(A)","actor":"Persons developing or distributing AI systems within the subtitle's Texas scope","modality":"must not","action":"facilitate","object":"prohibited child sexual material with AI","condition":"The AI system is developed or distributed with the sole intent of producing, assisting, aiding in producing, or distributing material prohibited by Penal Code § 43.26.","evidenceSummary":"Section 552.057(1)(A) establishes a sole-intent prohibition tied to Penal Code § 43.26.","url":"https://capitol.texas.gov/tlodocs/89R/billtext/html/HB00149F.htm","exception":"The prohibition requires sole intent and incorporates the elements of Penal Code § 43.26.","timing":"At development or distribution; effective January 1, 2026","authority":"Binding enacted Texas statute within scope","jurisdiction":"Texas, United States","ruleId":"AIR-9A07928A58","intent":"facilitate prohibited child sexual material with ai","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-09T13:11:03.845Z","reviewed_at":null},{"id":"finding-838848bbd7c854bbfc3613a384c15d76c2044d7b9ae87bd3fbdadfd15ea5aae2","kind":"rule-candidate","status":"pending","body":{"title":"Do not make AI sexual conversations impersonate minors","sourceTitle":"Texas Responsible Artificial Intelligence Governance Act","sourceVersion":"H.B. 149 enrolled; Acts 2025, 89th Leg., R.S., ch. 1174; effective January 1, 2026","control":"Business & Commerce Code § 552.057(2)","actor":"Persons developing or distributing AI systems within the subtitle's Texas scope","modality":"must not","action":"enable","object":"AI sexual conversations that impersonate minors","condition":"The person intentionally develops or distributes an AI system that engages in text conversations simulating or describing Penal Code § 43.25 sexual conduct while impersonating or imitating a child younger than 18.","evidenceSummary":"Section 552.057(2) separately prohibits intentional AI text conversations that combine defined sexual conduct with impersonation or imitation of a minor.","url":"https://capitol.texas.gov/tlodocs/89R/billtext/html/HB00149F.htm","exception":"All statutory elements, including intentional development/distribution, text conversation, defined sexual conduct, and under-18 impersonation or imitation, must be met.","timing":"At development or distribution; effective January 1, 2026","authority":"Binding enacted Texas statute within scope","jurisdiction":"Texas, United States","ruleId":"AIR-61E981ADBC","intent":"enable ai sexual conversations that impersonate minors","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-09T13:11:03.845Z","reviewed_at":null},{"id":"finding-be6ee16945868245be7d68cc29ae361cc25c7b760d3de66c86ff98a70e66e2fe","kind":"rule-candidate","status":"pending","body":{"title":"Do not enable AI to incite harm to others","sourceTitle":"Texas Responsible Artificial Intelligence Governance Act","sourceVersion":"H.B. 149 enrolled; Acts 2025, 89th Leg., R.S., ch. 1174; effective January 1, 2026","control":"Business & Commerce Code § 552.052(2)","actor":"Persons developing or deploying AI systems within the subtitle's Texas scope","modality":"must not","action":"enable","object":"AI systems to incite harm to another person","condition":"The system is developed or deployed in a manner intentionally aimed at inciting or encouraging harm to another person.","evidenceSummary":"Section 552.052(2) prohibits intentional development or deployment aimed at inciting or encouraging harm to another person.","url":"https://capitol.texas.gov/tlodocs/89R/billtext/html/HB00149F.htm","exception":"The prohibition contains an intent element and applies only within Section 551.002's Texas nexus.","timing":"At development and deployment; effective January 1, 2026","authority":"Binding enacted Texas statute within scope","jurisdiction":"Texas, United States","ruleId":"AIR-85B79C5488","intent":"enable ai systems to incite harm to another person","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-09T13:11:03.845Z","reviewed_at":null},{"id":"finding-f1acf67d0dffcbc102b5f71fab0ee35aa2ecccc2af9d2880440a1e6fa76a522e","kind":"rule-candidate","status":"pending","body":{"title":"Do not intentionally discriminate against protected classes through AI","sourceTitle":"Texas Responsible Artificial Intelligence Governance Act","sourceVersion":"H.B. 149 enrolled; Acts 2025, 89th Leg., R.S., ch. 1174; effective January 1, 2026","control":"Business & Commerce Code § 552.056(b)-(e)","actor":"Persons developing or deploying AI systems within the subtitle's Texas scope","modality":"must not","action":"discriminate","object":"against protected classes through AI","condition":"The person intends to unlawfully discriminate against a class protected by state or federal civil-rights law.","evidenceSummary":"Section 552.056 prohibits intentional unlawful discrimination through AI and states that disparate impact alone does not prove intent.","url":"https://capitol.texas.gov/tlodocs/89R/billtext/html/HB00149F.htm","exception":"Insurance services governed by specified insurance discrimination laws are excluded; federally insured financial institutions comply by meeting applicable federal and state banking law; disparate impact alone is insufficient.","timing":"At development or deployment; effective January 1, 2026","authority":"Binding enacted Texas statute within scope","jurisdiction":"Texas, United States","ruleId":"AIR-F682447E01","intent":"discriminate against protected classes through ai","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-09T13:11:03.845Z","reviewed_at":null},{"id":"finding-f26e64ede6555d6431011a09dbbd1cbab285b6d494cfa604670fdf0bbce3641b","kind":"rule-candidate","status":"pending","body":{"title":"Do not enable AI to incite physical self-harm","sourceTitle":"Texas Responsible Artificial Intelligence Governance Act","sourceVersion":"H.B. 149 enrolled; Acts 2025, 89th Leg., R.S., ch. 1174; effective January 1, 2026","control":"Business & Commerce Code § 552.052(1)","actor":"Persons developing or deploying AI systems within the subtitle's Texas scope","modality":"must not","action":"enable","object":"AI systems to incite physical self-harm","condition":"The system is developed or deployed in a manner intentionally aimed at inciting or encouraging self-harm, including suicide.","evidenceSummary":"Section 552.052(1) prohibits intentional development or deployment aimed at inciting or encouraging physical self-harm.","url":"https://capitol.texas.gov/tlodocs/89R/billtext/html/HB00149F.htm","exception":"The prohibition contains an intent element and applies only within Section 551.002's Texas nexus.","timing":"At development and deployment; effective January 1, 2026","authority":"Binding enacted Texas statute within scope","jurisdiction":"Texas, United States","ruleId":"AIR-33461AFACA","intent":"enable ai systems to incite physical self harm","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-09T13:11:03.845Z","reviewed_at":null},{"id":"finding-f53e0f8b45f9f2bd50e596b8e4682a15830316e9620c7cb0abc28fed385b1891","kind":"rule-candidate","status":"pending","body":{"title":"Assess sandbox impacts on consumers, privacy, and safety","sourceTitle":"Texas Responsible Artificial Intelligence Governance Act","sourceVersion":"H.B. 149 enrolled; Acts 2025, 89th Leg., R.S., ch. 1174; effective January 1, 2026","control":"Business & Commerce Code § 553.052(b)(2)","actor":"Applicants to the Texas AI regulatory sandbox","modality":"must","action":"assess","object":"sandbox AI impacts on consumers, privacy, and public safety","condition":"The person applies to test an AI system in the regulatory sandbox.","evidenceSummary":"Section 553.052(b)(2) requires a benefit assessment addressing potential consumer, privacy, and public-safety impacts.","url":"https://capitol.texas.gov/tlodocs/89R/billtext/html/HB00149F.htm","exception":"The assessment is an application requirement and does not waive Chapter 552 Subchapter B protections.","timing":"With the sandbox application; effective January 1, 2026","authority":"Binding enacted Texas statute within scope","jurisdiction":"Texas, United States","ruleId":"AIR-56526F7063","intent":"assess sandbox ai impacts on consumers privacy and public safety","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-09T13:11:03.845Z","reviewed_at":null},{"id":"finding-f7858dcea97069749f5064bf367fe6dfa2383a37b6a87e6de520d6b4c5ddb064","kind":"rule-candidate","status":"pending","body":{"title":"Do not apply prohibited government social scoring","sourceTitle":"Texas Responsible Artificial Intelligence Governance Act","sourceVersion":"H.B. 149 enrolled; Acts 2025, 89th Leg., R.S., ch. 1174; effective January 1, 2026","control":"Business & Commerce Code § 552.053","actor":"Texas governmental entities using or deploying AI systems","modality":"must not","action":"apply","object":"prohibited social scoring","condition":"AI evaluates or classifies natural persons from social behavior or personal characteristics to assign a social score that may cause unrelated-context, unjustified, or disproportionate adverse treatment or infringe protected rights.","evidenceSummary":"Section 552.053 prohibits government social scoring when the specified scoring purpose and adverse-result elements are present.","url":"https://capitol.texas.gov/tlodocs/89R/billtext/html/HB00149F.htm","exception":"All statutory elements must be assessed; the governmental-entity definition excludes hospital districts and Texas institutions of higher education.","timing":"At use or deployment; effective January 1, 2026","authority":"Binding enacted Texas statute within scope","jurisdiction":"Texas, United States","ruleId":"AIR-342C0977BB","intent":"apply prohibited social scoring","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-09T13:11:03.845Z","reviewed_at":null},{"id":"finding-f829606994b0a18d70951db3c95eecf3dc22935e18aaf7ac165b3b11c010281b","kind":"rule-candidate","status":"pending","body":{"title":"Evaluate state-agency AI use and contemplated use","sourceTitle":"Texas Responsible Artificial Intelligence Governance Act","sourceVersion":"H.B. 149 enrolled; Acts 2025, 89th Leg., R.S., ch. 1174; effective January 1, 2026","control":"Government Code § 2054.068(b)(5), as amended by H.B. 149 § 6","actor":"Texas state agencies reporting information-technology infrastructure status to the Department of Information Resources","modality":"must","action":"evaluate","object":"agency use or contemplated use of AI systems","condition":"The Department of Information Resources collects the agency's required infrastructure-status information.","evidenceSummary":"H.B. 149 adds an evaluation of each state agency's current or considered AI use to the information DIR collects.","url":"https://capitol.texas.gov/tlodocs/89R/billtext/html/HB00149F.htm","exception":"A mandatory state-agency implementation duty is conditioned on specific fiscal-year appropriation under H.B. 149 § 9; implementation may proceed with other available funding.","timing":"As part of the statutory infrastructure-status collection; effective January 1, 2026","authority":"Binding enacted Texas statute within scope, subject to the funding proviso","jurisdiction":"Texas, United States","ruleId":"AIR-FAC09DC006","intent":"evaluate agency use or contemplated use of ai systems","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-09T13:11:03.845Z","reviewed_at":null},{"id":"finding-f83200b2b4327e031dd392f3f23e66b8ee9c928d14cb5be45b37f96c1c42b0a2","kind":"rule-candidate","status":"pending","body":{"title":"Format AI interaction disclosures without dark patterns","sourceTitle":"Texas Responsible Artificial Intelligence Governance Act","sourceVersion":"H.B. 149 enrolled; Acts 2025, 89th Leg., R.S., ch. 1174; effective January 1, 2026","control":"Business & Commerce Code § 552.051(d)","actor":"Persons required to provide the Section 552.051 AI-interaction disclosure","modality":"must","action":"format","object":"AI interaction disclosures clearly and conspicuously in plain language without dark patterns","condition":"A disclosure is required under Section 552.051(b).","evidenceSummary":"Subsection (d) defines three presentation requirements for the required disclosure: clarity and conspicuousness, plain language, and no dark patterns.","url":"https://capitol.texas.gov/tlodocs/89R/billtext/html/HB00149F.htm","exception":"A hyperlink to a separate web page is permitted under subsection (e).","timing":"Whenever the Section 552.051 disclosure is presented; effective January 1, 2026","authority":"Binding enacted Texas statute within scope","jurisdiction":"Texas, United States","ruleId":"AIR-C7BB07CC59","intent":"format ai interaction disclosures clearly and conspicuously in plain language without dark patterns","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-09T13:11:03.845Z","reviewed_at":null},{"id":"change-msu-genai-guidelines-e401974ad10a50b26c705292f1284b59860797d908a3854bee6eea7c18018e46","kind":"source-change","status":"pending","body":{"sourceId":"msu-genai-guidelines","title":"Guidelines for the Use of Generative Artificial Intelligence Tools","url":"https://ai.msu.edu/guidelines","status":"publisher-bytes-changed","checkedAt":"2026-10-09T13:06:23.666Z","fingerprint":"e401974ad10a50b26c705292f1284b59860797d908a3854bee6eea7c18018e46","previousFingerprint":"72750156679660d6dedd4f444c9b2f5c049b57f228b982757a4fd3c6c065f826","bytes":707970,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-09T13:06:23.666Z","reviewed_at":null},{"id":"change-cisa-ncsc-secure-ai-development-ff473b03393de39a1b19fa71fee25fdbe1ea6909d03a9f4f2eccb7dc000fd7d2","kind":"source-change","status":"pending","body":{"sourceId":"cisa-ncsc-secure-ai-development","title":"Guidelines for Secure AI System Development","url":"https://www.ncsc.gov.uk/collection/guidelines-secure-ai-system-development/guidelines/secure-development","status":"publisher-bytes-changed","checkedAt":"2026-10-09T13:06:21.064Z","fingerprint":"ff473b03393de39a1b19fa71fee25fdbe1ea6909d03a9f4f2eccb7dc000fd7d2","previousFingerprint":"6aee8985f80d193faf6144c99d157fa5d42c73cc0bd0397bfa32129f904a1eb8","bytes":235219,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-09T13:06:21.064Z","reviewed_at":null},{"id":"finding-0470c7718a6ad7c1f2e176e73814c6a59b672728bcb8bc0b1717707e371d0b88","kind":"rule-candidate","status":"pending","body":{"title":"Inventory AI assets and dependencies","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025","control":"Principle 5, clause 5.1","actor":"Developers, Data Custodians, and System Operators","modality":"must","action":"maintain","object":"an inventory of AI assets and dependencies","condition":"The organisation develops, deploys, or controls data for an AI system.","evidenceSummary":"Clause 5.1 calls for a comprehensive asset inventory that includes connectivity and interdependencies.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai","exception":"Research-only AI systems that will not be deployed are outside the code's scope.","timing":"Throughout the AI-system lifecycle","authority":"voluntary-code requirement; not legislation","jurisdiction":"United Kingdom; voluntary use elsewhere","ruleId":"AIR-FC1F24F621","intent":"maintain an inventory of ai assets and dependencies","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-08T13:03:07.203Z","reviewed_at":null},{"id":"finding-06da2a924cc611b002dca003c8b7aeb3c15cd69e37f649dc109e444110eefa81","kind":"rule-candidate","status":"pending","body":{"title":"Security-test AI systems before release","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025","control":"Principle 9, clause 9.1","actor":"Developers","modality":"must","action":"security-test","object":"AI models, applications, and systems before release","condition":"The model, application, or system will be released to System Operators or End-users.","evidenceSummary":"Clause 9.1 requires released AI artifacts to pass through a security-assessment process.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai","exception":"Research-only AI systems that will not be deployed are outside the code's scope.","timing":"Before release","authority":"voluntary-code requirement; not legislation","jurisdiction":"United Kingdom; voluntary use elsewhere","ruleId":"AIR-2D4B88FD46","intent":"security test ai models applications and systems before release","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-08T13:03:07.203Z","reviewed_at":null},{"id":"finding-12e4cc15733aa42e67036212c7d57779588fa81b0e1b54d51b82f219105b2021","kind":"rule-candidate","status":"pending","body":{"title":"Tailor AI security training to staff roles","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025","control":"Principle 1, clause 1.1.1","actor":"System Operators, Developers, and Data Custodians","modality":"must","action":"tailor","object":"AI security training to staff roles","condition":"Staff receive AI security training; this is a requirement within a voluntary code.","evidenceSummary":"Clause 1.1.1 makes role and responsibility relevant to the content of AI security training.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai","exception":"Research-only AI systems that will not be deployed are outside the code's scope.","timing":"When designing and refreshing staff training","authority":"voluntary-code requirement; not legislation","jurisdiction":"United Kingdom; voluntary use elsewhere","ruleId":"AIR-28C86060C1","intent":"tailor ai security training to staff roles","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-08T13:03:07.203Z","reviewed_at":null},{"id":"finding-192da38cb421d5f25f0f38facf666103deb50a847bea1902d015171e20e6dff8","kind":"rule-candidate","status":"pending","body":{"title":"Justify use of poorly documented AI components","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025","control":"Principle 7, clause 7.2","actor":"System Operators","modality":"must","action":"document","object":"the justification for using poorly documented or unsecured AI components","condition":"The operator chooses to use or adapt a model or component that is not well documented or secured.","evidenceSummary":"Clause 7.2 makes the decision record explicit when component assurance is weak, including cases where no alternative supplier exists.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai","exception":"The example recognizes that no alternative supplier may exist; it does not waive documentation.","timing":"Before or when approving the component for use","authority":"voluntary-code requirement; not legislation","jurisdiction":"United Kingdom; voluntary use elsewhere","ruleId":"AIR-40509CE90B","intent":"document the justification for using poorly documented or unsecured ai components","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-08T13:03:07.203Z","reviewed_at":null},{"id":"finding-1d08ecd8015e66e8da24c2113c086d8caff0997c91bbd90e763e9c3ff7f96fe7","kind":"rule-candidate","status":"pending","body":{"title":"Tailor disaster recovery to AI-specific attacks","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025","control":"Principle 5, clause 5.3","actor":"System Operators","modality":"must","action":"tailor","object":"disaster-recovery plans to AI-specific attacks","condition":"The organisation operates an AI system.","evidenceSummary":"Clause 5.3 requires ordinary recovery planning to account for attacks directed at AI systems.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai","exception":"No clause-specific exception stated.","timing":"During recovery planning and maintenance","authority":"voluntary-code requirement; not legislation","jurisdiction":"United Kingdom; voluntary use elsewhere","ruleId":"AIR-E35BC83D85","intent":"tailor disaster recovery plans to ai specific attacks","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-08T13:03:07.203Z","reviewed_at":null},{"id":"finding-4b8dbfc06e536b0d159217c9adc6f473bb6fcdcb844d09c2c1a77884c8e4288d","kind":"rule-candidate","status":"pending","body":{"title":"Repeat data sanitization after adaptive model revisions","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025","control":"Principle 5, clause 5.4.1","actor":"Developers, Data Custodians, and System Operators","modality":"must","action":"repeat","object":"data and input sanitization after model revisions","condition":"A model is revised in response to user feedback or continuous learning, subject to the actor's access to the relevant data and inputs.","evidenceSummary":"Clause 5.4.1 extends checks and sanitization beyond initial design to feedback-driven or continuously learned revisions.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai","exception":"Responsibility follows each actor's access to the data and inputs and where they are stored.","timing":"After revisions driven by feedback or continuous learning","authority":"voluntary-code requirement; not legislation","jurisdiction":"United Kingdom; voluntary use elsewhere","ruleId":"AIR-320C95E6DC","intent":"repeat data and input sanitization after model revisions","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-08T13:03:07.203Z","reviewed_at":null},{"id":"finding-4ce83d5b67a7912e924d92c564b4d85407a6cd4252e5413c6711db580e105a5f","kind":"rule-candidate","status":"pending","body":{"title":"Disclose AI data handling to end users","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025","control":"Principle 10, clause 10.1","actor":"System Operators","modality":"must","action":"disclose","object":"AI data use, access, and storage to End-users","condition":"An AI system is deployed for end users; external Developers must first provide the necessary information to operators.","evidenceSummary":"Clause 10.1 requires accessible disclosure of where and how user data is used, accessed, and stored, including retraining or human review.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai","exception":"No clause-specific exception stated.","timing":"Before or at deployment and when practices change","authority":"voluntary-code requirement; not legislation","jurisdiction":"United Kingdom; voluntary use elsewhere","ruleId":"AIR-4591031280","intent":"disclose ai data use access and storage to end users","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-08T13:03:07.203Z","reviewed_at":null},{"id":"finding-4d42e68e669f554d5c6090aea5051d2f28d483b37e3ddf38ff8e030429553157","kind":"rule-candidate","status":"pending","body":{"title":"Test AI incident-management plans","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025","control":"Principle 6, clause 6.5 — testing component","actor":"Developers and System Operators","modality":"must","action":"test","object":"AI incident-management plans","condition":"The organisation develops or operates an AI system.","evidenceSummary":"Clause 6.5 requires AI-specific incident planning to be exercised, not only documented.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai","exception":"No clause-specific exception stated.","timing":"Before deployment and periodically during operation","authority":"voluntary-code requirement; not legislation","jurisdiction":"United Kingdom; voluntary use elsewhere","ruleId":"AIR-D60E646B27","intent":"test ai incident management plans","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-08T13:03:07.203Z","reviewed_at":null},{"id":"finding-59acbdd6fd36b9d02880e3e69bb50a86c5cae3a0f1cdf96eb95b5d386227c1ef","kind":"rule-candidate","status":"pending","body":{"title":"Conduct operator testing before AI deployment","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025","control":"Principle 9, clause 9.2","actor":"System Operators","modality":"must","action":"test","object":"AI systems before deployment","condition":"An AI system is being prepared for deployment; Developers support the testing.","evidenceSummary":"Clause 9.2 assigns pre-deployment testing responsibility to the operator with developer support.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai","exception":"Research-only AI systems that will not be deployed are outside the code's scope.","timing":"Before deployment","authority":"voluntary-code requirement; not legislation","jurisdiction":"United Kingdom; voluntary use elsewhere","ruleId":"AIR-36AAFBCE03","intent":"test ai systems before deployment","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-08T13:03:07.203Z","reviewed_at":null},{"id":"finding-6a1f6f1b9352844a33d2247723af7cf9a938bebae0f96454636905bce98ea7be","kind":"rule-candidate","status":"pending","body":{"title":"Isolate AI development and tuning environments","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025","control":"Principle 6, clause 6.3","actor":"Developers","modality":"must","action":"isolate","object":"AI development and model-tuning environments","condition":"Development or tuning uses non-public training data; separation and least-privilege controls are required.","evidenceSummary":"Clause 6.3 requires dedicated environments backed by technical separation and least-privilege controls.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai","exception":"The clause specifically highlights training data that is not publicly available.","timing":"During development and model tuning","authority":"voluntary-code requirement; not legislation","jurisdiction":"United Kingdom; voluntary use elsewhere","ruleId":"AIR-517A77B73E","intent":"isolate ai development and model tuning environments","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-08T13:03:07.203Z","reviewed_at":null},{"id":"finding-6a22ba03376d26e7571041123ab9d916b4fef15c722c1e354065f22da0a9ddb9","kind":"rule-candidate","status":"pending","body":{"title":"Assess AI-specific risks in external components","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025","control":"Principle 2, clause 2.4","actor":"Developers and System Operators","modality":"must","action":"assess","object":"AI-specific risks in external components","condition":"An external component is used in an AI system; apply due diligence consistent with existing software-development processes.","evidenceSummary":"Clause 2.4 adds AI-specific risk assessment to component due diligence.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai","exception":"Research-only AI systems that will not be deployed are outside the code's scope.","timing":"Before accepting or integrating an external component","authority":"voluntary-code requirement; not legislation","jurisdiction":"United Kingdom; voluntary use elsewhere","ruleId":"AIR-ACEEBA73D0","intent":"assess ai specific risks in external components","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-08T13:03:07.203Z","reviewed_at":null},{"id":"finding-6d6a13916e11b9d077446cc623beeffd80bb4a0ef0a2598724a6b41fc574cbfb","kind":"rule-candidate","status":"pending","body":{"title":"Design AI systems to resist adversarial attacks","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025","control":"Principle 2, clause 2.2","actor":"System Operators and Developers","modality":"must","action":"design","object":"AI systems to withstand adversarial attacks","condition":"An AI system is being designed or implemented; this is a requirement within a voluntary code.","evidenceSummary":"Clause 2.2 requires resilience against adversarial AI attacks; unexpected inputs and system failure are separate aspects of the same provision.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai","exception":"Research-only AI systems that will not be deployed are outside the code's scope.","timing":"During system design and implementation","authority":"voluntary-code requirement; not legislation","jurisdiction":"United Kingdom; voluntary use elsewhere","ruleId":"AIR-6DA8E52373","intent":"design ai systems to withstand adversarial attacks","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-08T13:03:07.203Z","reviewed_at":null},{"id":"finding-8113e5fc68b5cb6e1f6ca95f6b5d0bd38d83e805490b1a919e0cc7a8f6b075ea","kind":"rule-candidate","status":"pending","body":{"title":"Use independent AI security testers","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025","control":"Principle 9, clause 9.2.1","actor":"System Operators and Developers","modality":"should","action":"use","object":"independent AI security testers","condition":"Security testing is performed; testers need technical skills relevant to the system.","evidenceSummary":"Clause 9.2.1 recommends independence and system-relevant technical competence for AI security testing.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai","exception":"The code does not define required credentials or organizational independence.","timing":"During AI security testing","authority":"voluntary-code recommendation; not legislation","jurisdiction":"United Kingdom; voluntary use elsewhere","ruleId":"AIR-675CEF85E0","intent":"use independent ai security testers","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-08T13:03:07.203Z","reviewed_at":null},{"id":"finding-88d32ee2f437cce7a003253ae275626689b5b71ec06c00bf6b6e57cd5cf4dc6c","kind":"rule-candidate","status":"pending","body":{"title":"Include AI security in cyber training","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025","control":"Principle 1, clause 1.1","actor":"System Operators, Developers, and Data Custodians","modality":"must","action":"include","object":"AI security content in cyber security training","condition":"The organisation operates, develops, or controls data for deployed AI systems; this is a requirement within a voluntary code.","evidenceSummary":"Clause 1.1 places AI-specific security material inside the organisation's cyber training programme and calls for continuing review.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai","exception":"Research-only AI systems that will not be deployed are outside the code's scope.","timing":"During the AI-system lifecycle; review when substantial new AI threats emerge","authority":"voluntary-code requirement; not legislation","jurisdiction":"United Kingdom; voluntary use elsewhere","ruleId":"AIR-E4A7FE4D30","intent":"include ai security content in cyber security training","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-08T13:03:07.203Z","reviewed_at":null},{"id":"finding-a3af0037f6a1d025dae3b4f4c7a4c743f2c632e700d6939ba645f9dba6f9d9fc","kind":"rule-candidate","status":"pending","body":{"title":"Maintain human-oversight capabilities","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025","control":"Principle 4, clause 4.1","actor":"Developers and System Operators","modality":"should","action":"maintain","object":"human-oversight capabilities for AI systems","condition":"An AI system is being designed or operated.","evidenceSummary":"Clause 4.1 recommends incorporating oversight at design time and maintaining that capability over time.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai","exception":"No clause-specific exception stated.","timing":"From system design through operation","authority":"voluntary-code recommendation; not legislation","jurisdiction":"United Kingdom; voluntary use elsewhere","ruleId":"AIR-4FACE99125","intent":"maintain human oversight capabilities for ai systems","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-08T13:03:07.203Z","reviewed_at":null},{"id":"finding-adeb6d44fe35b0c2d4c8a4ce1dd15a595eaa0244a8f114f8f50ac2cec8d0c092","kind":"rule-candidate","status":"pending","body":{"title":"Reassess AI risks after configuration changes","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025","control":"Principle 3, clause 3.1.1","actor":"Developers and System Operators","modality":"must","action":"reassess","object":"AI security risks after configuration changes","condition":"A new setting or configuration option is implemented or updated at any lifecycle stage.","evidenceSummary":"Clause 3.1.1 links configuration changes to another pass through threat modelling and risk management.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai","exception":"Research-only AI systems that will not be deployed are outside the code's scope.","timing":"Whenever a setting or configuration option is introduced or changed","authority":"voluntary-code requirement; not legislation","jurisdiction":"United Kingdom; voluntary use elsewhere","ruleId":"AIR-69CA8EABE2","intent":"reassess ai security risks after configuration changes","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-08T13:03:07.203Z","reviewed_at":null},{"id":"finding-c57ac100cd95ac317586672565180be9ff802d13271246f77cd47bbf6f087018","kind":"rule-candidate","status":"pending","body":{"title":"Train developers in AI-specific secure engineering","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025","control":"Principle 1, clause 1.2.2","actor":"System Operators, Developers, and Data Custodians","modality":"must","action":"provide","object":"AI-specific secure coding and system-design training","condition":"The organisation has developers working on deployed or deployable AI systems; this is a requirement within a voluntary code.","evidenceSummary":"Clause 1.2.2 requires developer training focused on preventing and mitigating vulnerabilities in AI models, algorithms, and related software.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai","exception":"Research-only AI systems that will not be deployed are outside the code's scope.","timing":"Before and during AI development responsibilities","authority":"voluntary-code requirement; not legislation","jurisdiction":"United Kingdom; voluntary use elsewhere","ruleId":"AIR-240B04378C","intent":"provide ai specific secure coding and system design training","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-08T13:03:07.203Z","reviewed_at":null},{"id":"finding-ccb329626ac39259e0c183af79f955a1328b0082d5e66497470971cd0bc2c958","kind":"rule-candidate","status":"pending","body":{"title":"Communicate unresolved AI threats downstream","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025","control":"Principle 3, clause 3.2","actor":"Developers","modality":"must","action":"communicate","object":"unresolved AI security threats to System Operators","condition":"Developers identify an AI security threat they cannot resolve.","evidenceSummary":"Clause 3.2 assigns the first downstream notification step to developers so operators can threat-model their deployments.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai","exception":"No clause-specific exception stated.","timing":"When an identified threat cannot be resolved by the Developer","authority":"voluntary-code requirement; not legislation","jurisdiction":"United Kingdom; voluntary use elsewhere","ruleId":"AIR-F97B3855F8","intent":"communicate unresolved ai security threats to system operators","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-08T13:03:07.203Z","reviewed_at":null},{"id":"finding-e65ef0126a13d435f7d9dbaa37e4d38cd0b0b4eec984e4a6fc3592f0240ea12e","kind":"rule-candidate","status":"pending","body":{"title":"Log AI system and user actions","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025","control":"Principle 12, clause 12.1","actor":"System Operators","modality":"must","action":"log","object":"AI system and user actions","condition":"Logs support security compliance, investigations, and vulnerability remediation.","evidenceSummary":"Clause 12.1 establishes an operational logging obligation for both system behavior and user activity.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai","exception":"No retention period or log content minimum is specified in the clause.","timing":"Continuously during operation","authority":"voluntary-code requirement; not legislation","jurisdiction":"United Kingdom; voluntary use elsewhere","ruleId":"AIR-463F6EF08F","intent":"log ai system and user actions","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-08T13:03:07.203Z","reviewed_at":null},{"id":"finding-e9761eb0778d23b744b62cd61bfe4d099c539cf36f3dfa70b1d6e042269ae2c9","kind":"rule-candidate","status":"pending","body":{"title":"Review AI threat models regularly","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025","control":"Principle 3, clause 3.1","actor":"Developers and System Operators","modality":"should","action":"review","object":"AI threat models regularly","condition":"Threat modelling addresses AI-specific attacks such as data poisoning, model inversion, and membership inference.","evidenceSummary":"Clause 3.1 recommends recurring threat-model review as part of security-risk management.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai","exception":"Review frequency is risk-based and not fixed by the code.","timing":"Regularly throughout the AI lifecycle","authority":"voluntary-code recommendation; not legislation","jurisdiction":"United Kingdom; voluntary use elsewhere","ruleId":"AIR-4BDA78DD85","intent":"review ai threat models regularly","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-08T13:03:07.203Z","reviewed_at":null},{"id":"finding-eb70a56c61bfa2c0b1486411061feb66e84a3e3c6cb64eb5d5a50cc82174c980","kind":"rule-candidate","status":"pending","body":{"title":"Notify end users before model updates","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025","control":"Principle 7, clause 7.4","actor":"System Operators","modality":"must","action":"notify","object":"End-users of planned model updates","condition":"The operator intends to update a model; communication must be accessible.","evidenceSummary":"Clause 7.4 requires advance notice of intended model updates to end users.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai","exception":"No clause-specific exception stated.","timing":"Before the model is updated","authority":"voluntary-code requirement; not legislation","jurisdiction":"United Kingdom; voluntary use elsewhere","ruleId":"AIR-B7785F80BE","intent":"notify end users of planned model updates","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-08T13:03:07.203Z","reviewed_at":null},{"id":"finding-eec8d1cceba6385a38fc53f9ed0cbb459ed39e2249fce80306606004ad0cb0ca","kind":"rule-candidate","status":"pending","body":{"title":"Document AI security risks before creating a system","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025","control":"Principle 2, clause 2.1","actor":"System Operators and Developers","modality":"must","action":"document","object":"AI security risks and mitigation strategies","condition":"The organisation is deciding whether to create an AI system; this is a requirement within a voluntary code.","evidenceSummary":"Clause 2.1 requires the creation decision to record the problem or business need together with associated AI security risks and planned mitigations.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai","exception":"Research-only AI systems that will not be deployed are outside the code's scope.","timing":"Before deciding to create the AI system","authority":"voluntary-code requirement; not legislation","jurisdiction":"United Kingdom; voluntary use elsewhere","ruleId":"AIR-F3A86B168B","intent":"document ai security risks and mitigation strategies","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-08T13:03:07.203Z","reviewed_at":null},{"id":"finding-f9717e2e0865dc35f4296280f8683e92328e335a7b146b39e5d0dc09d04d9895","kind":"rule-candidate","status":"pending","body":{"title":"Publish an AI vulnerability disclosure policy","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025","control":"Principle 6, clause 6.4","actor":"Developers and System Operators","modality":"must","action":"publish","object":"an accessible AI vulnerability disclosure policy","condition":"The organisation develops or operates a deployed AI system.","evidenceSummary":"Clause 6.4 requires both implementation and public accessibility of a vulnerability disclosure policy.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai","exception":"No clause-specific exception stated.","timing":"Before and during operation","authority":"voluntary-code requirement; not legislation","jurisdiction":"United Kingdom; voluntary use elsewhere","ruleId":"AIR-88274A0109","intent":"publish an accessible ai vulnerability disclosure policy","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-08T13:03:07.203Z","reviewed_at":null},{"id":"finding-fb9aaeb3be6a36010f0ca72b08d7f6ad2c6a0392e9f1fe14db75fe4c3f79d094","kind":"rule-candidate","status":"pending","body":{"title":"Re-evaluate released models before reuse","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025","control":"Principle 7, clause 7.3","actor":"Developers and System Operators","modality":"must","action":"re-evaluate","object":"released AI models before intended use","condition":"A released model is being considered for use or adaptation.","evidenceSummary":"Clause 7.3 requires evaluations to be run again on released models that an organisation intends to use.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai","exception":"No clause-specific exception stated.","timing":"Before using the released model","authority":"voluntary-code requirement; not legislation","jurisdiction":"United Kingdom; voluntary use elsewhere","ruleId":"AIR-1436898CB8","intent":"re evaluate released ai models before intended use","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-08T13:03:07.203Z","reviewed_at":null},{"id":"change-msu-genai-guidelines-72750156679660d6dedd4f444c9b2f5c049b57f228b982757a4fd3c6c065f826","kind":"source-change","status":"pending","body":{"sourceId":"msu-genai-guidelines","title":"Guidelines for the Use of Generative Artificial Intelligence Tools","url":"https://ai.msu.edu/guidelines","status":"publisher-bytes-changed","checkedAt":"2026-10-08T12:59:29.361Z","fingerprint":"72750156679660d6dedd4f444c9b2f5c049b57f228b982757a4fd3c6c065f826","previousFingerprint":"c39277654a4ed4cfcb8722dc4a59eaddb3567d86a9eb872b7c7d4f6bc2cda2bd","bytes":707590,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-08T12:59:29.361Z","reviewed_at":null},{"id":"change-brookline-genai-755e2c904ae7401070b7338e2a00a2f7a24c634d404a78b87e2f62581915f9c3","kind":"source-change","status":"pending","body":{"sourceId":"brookline-genai","title":"Generative Artificial Intelligence Use Policy","url":"https://www.brooklinema.gov/3975/Generative-AI-Use","status":"publisher-bytes-changed","checkedAt":"2026-10-08T12:59:26.100Z","fingerprint":"755e2c904ae7401070b7338e2a00a2f7a24c634d404a78b87e2f62581915f9c3","previousFingerprint":"3eb9d05b8739fa8021c873c2aae060aca74b30f3ef7f53fdc778d5b456cf48da","bytes":110630,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-08T12:59:26.100Z","reviewed_at":null},{"id":"change-cisa-ncsc-secure-ai-development-6aee8985f80d193faf6144c99d157fa5d42c73cc0bd0397bfa32129f904a1eb8","kind":"source-change","status":"pending","body":{"sourceId":"cisa-ncsc-secure-ai-development","title":"Guidelines for Secure AI System Development","url":"https://www.ncsc.gov.uk/collection/guidelines-secure-ai-system-development/guidelines/secure-development","status":"publisher-bytes-changed","checkedAt":"2026-10-08T12:59:26.100Z","fingerprint":"6aee8985f80d193faf6144c99d157fa5d42c73cc0bd0397bfa32129f904a1eb8","previousFingerprint":"8d2c8a497b9cd3d22136891a7c92638bdc2ad53c4060ad823a3f3bd2fe7e3887","bytes":136664,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-08T12:59:26.100Z","reviewed_at":null},{"id":"finding-a5887fc28cab7d9316dd704dba4618a50e3f2b28a90551be055db4cd6ecf3e80","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Colorado HB26-1139 — Use of Artificial Intelligence in Health Care","sourceVersion":"HB26-1139 Signed Act — June 3, 2026","authority":"enacted Colorado state law","jurisdiction":"Colorado, United States","title":"Do not reimburse AI-conducted psychotherapy","control":"C.R.S. 25.5-4-426(2), signed-act PDF p.5","actor":"Colorado Medicaid and Children's Basic Health Plan payers","modality":"must not","action":"reimburse","object":"AI-conducted psychotherapy services","condition":"Psychotherapy is delivered directly to a client and conducted by AI.","exception":"AI-assisted ambient transcription or documentation supporting licensed providers is not barred.","timing":"On and after January 1, 2027","evidenceSummary":"The same nonpayment rule applies to public medical-assistance and children's health-plan payers.","url":"https://leg.colorado.gov/bill_files/117025/download#page=5","ruleId":"AIR-CAD7DC63E5","intent":"reimburse ai conducted psychotherapy services","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-07T13:21:02.259Z","reviewed_at":null},{"id":"finding-96ed8e7d6ed225603464df1112aebee4dc7a71a518aa76dc78fe763f7884e28d","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Colorado HB26-1139 — Use of Artificial Intelligence in Health Care","sourceVersion":"HB26-1139 Signed Act — June 3, 2026","authority":"enacted Colorado state law","jurisdiction":"Colorado, United States","title":"Do not reimburse AI-conducted psychotherapy","control":"C.R.S. 10-16-148(2), signed-act PDF p.4","actor":"Health insurance carriers","modality":"must not","action":"reimburse","object":"AI-conducted psychotherapy services","condition":"Psychotherapy is delivered directly to an enrollee and conducted by AI.","exception":"AI-assisted ambient transcription or documentation supporting licensed providers is not barred.","timing":"On and after January 1, 2027","evidenceSummary":"The act prohibits carrier payment for psychotherapy conducted by AI while preserving provider-support tools.","url":"https://leg.colorado.gov/bill_files/117025/download#page=4","ruleId":"AIR-CAD7DC63E5","intent":"reimburse ai conducted psychotherapy services","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-07T13:20:35.193Z","reviewed_at":null},{"id":"finding-ff3491bdb39a3538729a016d9456938ece775761dad3084034492752187cbe46","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Colorado HB26-1139 — Use of Artificial Intelligence in Health Care","sourceVersion":"HB26-1139 Signed Act — June 3, 2026","authority":"enacted Colorado state law","jurisdiction":"Colorado, United States","title":"Require qualified human review before AI-influenced coverage denial","control":"C.R.S. 10-3-1104.8(5), signed-act PDF p.3","actor":"Carriers issuing medical-necessity coverage denials","modality":"must","action":"require","object":"qualified human review of AI-influenced medical-necessity denials","condition":"A denial is based in whole or part on medical necessity and AI contributed to utilization review.","exception":"Reviewer must be a licensed clinician, physician, or other competent regulated professional qualified for the issue and plan terms.","timing":"Before issuing the denial on and after January 1, 2027","evidenceSummary":"The act bars issuing the covered denial solely from AI output and without qualified human review.","url":"https://leg.colorado.gov/bill_files/117025/download#page=3","ruleId":"AIR-B6676761C1","intent":"require qualified human review of ai influenced medical necessity denials","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-07T13:20:03.271Z","reviewed_at":null},{"id":"finding-6ba6cba0cba33f2693021553ba205c9266fd43ae8a6a81937bcaf001decf1b44","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Colorado HB26-1139 — Use of Artificial Intelligence in Health Care","sourceVersion":"HB26-1139 Signed Act — June 3, 2026","authority":"enacted Colorado state law","jurisdiction":"Colorado, United States","title":"Limit AI use of health data to stated purposes","control":"C.R.S. 10-3-1104.8(3)(d)(II), signed-act PDF p.2","actor":"Entities using AI systems for health-care utilization review","modality":"must not","action":"use","object":"individual health data beyond its intended or stated purpose","condition":"An AI system is used in health-care utilization review.","exception":"No clause-specific exception stated.","timing":"Throughout covered use on and after January 1, 2027","evidenceSummary":"The act requires periodic review to ensure individual health data is not reused beyond its intended or stated purpose.","url":"https://leg.colorado.gov/bill_files/117025/download#page=2","ruleId":"AIR-FFD08A3AF3","intent":"use individual health data beyond its intended or stated purpose","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-07T13:19:22.273Z","reviewed_at":null},{"id":"finding-0592eae9b1f961491ca380abde534443eb7c73c2b1f5be8b47715b3615ee745e","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Colorado HB26-1139 — Use of Artificial Intelligence in Health Care","sourceVersion":"HB26-1139 Signed Act — June 3, 2026","authority":"enacted Colorado state law","jurisdiction":"Colorado, United States","title":"Review health-care AI outcomes for accuracy and reliability","control":"C.R.S. 10-3-1104.8(3)(d)(I), signed-act PDF p.2","actor":"Entities using AI systems for health-care utilization review","modality":"must","action":"review","object":"health-care AI outcomes for accuracy and reliability","condition":"An AI system is used to determine coverage.","exception":"No numeric interval is stated; review must be periodic.","timing":"Periodically on and after January 1, 2027","evidenceSummary":"The act creates a periodic review duty for outcome accuracy and reliability.","url":"https://leg.colorado.gov/bill_files/117025/download#page=2","ruleId":"AIR-03B91E9572","intent":"review health care ai outcomes for accuracy and reliability","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-07T13:18:51.335Z","reviewed_at":null},{"id":"finding-781418825111f6e0b6b701bd0b65fb15b826fb42c7335416b945dd71344ceee0","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Colorado HB26-1139 — Use of Artificial Intelligence in Health Care","sourceVersion":"HB26-1139 Signed Act — June 3, 2026","authority":"enacted Colorado state law","jurisdiction":"Colorado, United States","title":"Do not decide coverage solely from group data","control":"C.R.S. 10-3-1104.8(3)(b), signed-act PDF p.2","actor":"Entities using AI systems for health-care utilization review","modality":"must not","action":"base","object":"AI coverage determinations solely on group data","condition":"An AI system is used to determine coverage for health-care services.","exception":"Group data may inform the determination only with reference to the individual's history and circumstances.","timing":"On and after January 1, 2027","evidenceSummary":"The act prohibits sole reliance on group data without reference to the individual patient.","url":"https://leg.colorado.gov/bill_files/117025/download#page=2","ruleId":"AIR-A17EB8B00B","intent":"base ai coverage determinations solely on group data","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-07T13:18:21.671Z","reviewed_at":null},{"id":"finding-024db1688418a75a842337472c4efbe11c94f3216ff364ad2895f3559ef4cdc0","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Colorado HB26-1139 — Use of Artificial Intelligence in Health Care","sourceVersion":"HB26-1139 Signed Act — June 3, 2026","authority":"enacted Colorado state law","jurisdiction":"Colorado, United States","title":"Base AI utilization review on patient-specific clinical facts","control":"C.R.S. 10-3-1104.8(3)(a), signed-act PDF pp.1–2","actor":"Entities using AI systems for health-care utilization review","modality":"must","action":"base","object":"AI utilization-review determinations on patient-specific clinical facts","condition":"An AI system is used to determine coverage for health-care services.","exception":"Relevant factors include clinical history, individual circumstances, written criteria, and plan terms.","timing":"On and after January 1, 2027","evidenceSummary":"The act requires coverage determinations to use the patient's individual clinical record and other specified factors.","url":"https://leg.colorado.gov/bill_files/117025/download#page=2","ruleId":"AIR-CE3A16C0C0","intent":"base ai utilization review determinations on patient specific clinical facts","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-07T13:17:51.461Z","reviewed_at":null},{"id":"finding-b9361e306bf33136cc1681fdfa6487d3eff5dadfe2e24d9e104d2fe931b0a90d","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Colorado HB26-1263 — Conversational Artificial Intelligence Service Operator Requirements","sourceVersion":"HB26-1263 Signed Act — June 1, 2026","authority":"enacted Colorado state law","jurisdiction":"Colorado, United States","title":"Detect repeated chatbot self-harm statements","control":"C.R.S. 6-1-1704(1)(a), signed-act PDF p.6","actor":"Operators of publicly available conversational AI services","modality":"must","action":"detect","object":"repeated user statements of suicidal ideation or self-harm","condition":"A user repeatedly expresses suicidal ideation, intent to self-harm, or desire to harm others.","exception":"No clause-specific exception stated.","timing":"During covered interactions beginning January 1, 2027","evidenceSummary":"The self-harm protocol must detect repeated covered statements and inquiries.","url":"https://leg.colorado.gov/bill_files/116851/download#page=6","ruleId":"AIR-1D0300EE76","intent":"detect repeated user statements of suicidal ideation or self harm","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-07T13:17:06.653Z","reviewed_at":null},{"id":"finding-5e884e24641558ae48cf6e92d5d970a811403e821702e83093ef602081e1f54f","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Colorado HB26-1263 — Conversational Artificial Intelligence Service Operator Requirements","sourceVersion":"HB26-1263 Signed Act — June 1, 2026","authority":"enacted Colorado state law","jurisdiction":"Colorado, United States","title":"Block simulated emotional dependence for minors","control":"C.R.S. 6-1-1703(3)(b)(II), signed-act PDF p.5","actor":"Conversational AI operators that know an account holder or user is a minor","modality":"must","action":"prevent","object":"chatbot outputs that simulate emotional dependence for minors","condition":"The account holder or user is known to be under 18.","exception":"Measures are required to the extent technically feasible.","timing":"During covered minor use beginning January 1, 2027","evidenceSummary":"The act requires measures against statements that simulate mutual existential or emotional dependence between the AI and a minor.","url":"https://leg.colorado.gov/bill_files/116851/download#page=5","ruleId":"AIR-D40CD44A27","intent":"prevent chatbot outputs that simulate emotional dependence for minors","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-07T13:16:34.641Z","reviewed_at":null},{"id":"finding-282f17b213be35227570efa281756d03a784dcc8571e7b84cd8e0282f3ca8739","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Colorado HB26-1263 — Conversational Artificial Intelligence Service Operator Requirements","sourceVersion":"HB26-1263 Signed Act — June 1, 2026","authority":"enacted Colorado state law","jurisdiction":"Colorado, United States","title":"Block explicit sexual chatbot content for minors","control":"C.R.S. 6-1-1703(3)(b)(I), signed-act PDF p.5","actor":"Conversational AI operators that know an account holder or user is a minor","modality":"must","action":"prevent","object":"explicit sexual chatbot content for minors","condition":"The account holder or user is known to be under 18.","exception":"Measures are required to the extent technically feasible.","timing":"During covered minor use beginning January 1, 2027","evidenceSummary":"The act requires technically feasible measures against explicit sexual conduct and intimate digital depictions for known minors.","url":"https://leg.colorado.gov/bill_files/116851/download#page=5","ruleId":"AIR-5C61952BC1","intent":"prevent explicit sexual chatbot content for minors","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-07T13:16:02.670Z","reviewed_at":null},{"id":"finding-02f5aca4e49a27657e913000ca1104a925816b7dae443c6f6eefb84de206899e","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Colorado HB26-1263 — Conversational Artificial Intelligence Service Operator Requirements","sourceVersion":"HB26-1263 Signed Act — June 1, 2026","authority":"enacted Colorado state law","jurisdiction":"Colorado, United States","title":"Estimate conversational-AI user ages","control":"C.R.S. 6-1-1702(4)(a), signed-act PDF p.3","actor":"Operators of publicly available conversational AI services","modality":"must","action":"estimate","object":"ages of conversational-AI account holders and users","condition":"The operator opens or serves an account or profile.","exception":"Use commercially reasonable or generally accepted methods; statutory service-scope exclusions apply.","timing":"Beginning January 1, 2027","evidenceSummary":"Covered operators must estimate the age of account holders and other users.","url":"https://leg.colorado.gov/bill_files/116851/download#page=3","ruleId":"AIR-DB2A798EF7","intent":"estimate ages of conversational ai account holders and users","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-07T13:15:36.462Z","reviewed_at":null},{"id":"finding-3734a7133dac0aff0233f871bd204c9cb477a5e36698f18b72af834facd8d32e","kind":"rule-candidate","status":"pending","body":{"title":"Disclose conversational-AI identity","sourceTitle":"Colorado HB26-1263 — Conversational Artificial Intelligence Service Operator Requirements","sourceVersion":"HB26-1263 Signed Act — June 1, 2026","control":"C.R.S. 6-1-1703(1), signed-act PDF p.4","actor":"Operators of publicly available conversational AI services","modality":"must","action":"inform","object":"people they are interacting with AI","condition":"A user interacts with a covered conversational AI service.","exception":"General statutory scope and constitutional limits apply.","timing":"Before first interaction and at least every three hours during continuous interaction, beginning January 1, 2027","authority":"enacted Colorado state law","jurisdiction":"Colorado, United States","evidenceSummary":"The act requires a clear AI identity notice before first interaction and at least every three hours during continuous use.","url":"https://leg.colorado.gov/bill_files/116851/download#page=4","ruleId":"AIR-86AF529571","intent":"inform people they are interacting with ai","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-07T13:14:46.822Z","reviewed_at":null},{"id":"change-msu-genai-guidelines-c39277654a4ed4cfcb8722dc4a59eaddb3567d86a9eb872b7c7d4f6bc2cda2bd","kind":"source-change","status":"pending","body":{"sourceId":"msu-genai-guidelines","title":"Guidelines for the Use of Generative Artificial Intelligence Tools","url":"https://ai.msu.edu/guidelines","status":"publisher-bytes-changed","checkedAt":"2026-10-07T13:00:06.079Z","fingerprint":"c39277654a4ed4cfcb8722dc4a59eaddb3567d86a9eb872b7c7d4f6bc2cda2bd","previousFingerprint":"a78484c1ebeaee493ce7b1b3068258565739e7b7a2b3e721a38b2887d8709681","bytes":707590,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-07T13:00:06.079Z","reviewed_at":null},{"id":"change-cisa-ncsc-secure-ai-development-8d2c8a497b9cd3d22136891a7c92638bdc2ad53c4060ad823a3f3bd2fe7e3887","kind":"source-change","status":"pending","body":{"sourceId":"cisa-ncsc-secure-ai-development","title":"Guidelines for Secure AI System Development","url":"https://www.ncsc.gov.uk/collection/guidelines-secure-ai-system-development/guidelines/secure-development","status":"publisher-bytes-changed","checkedAt":"2026-10-07T13:00:02.724Z","fingerprint":"8d2c8a497b9cd3d22136891a7c92638bdc2ad53c4060ad823a3f3bd2fe7e3887","previousFingerprint":"1c70944dae1f01d9bf42f72d7230a112384f50e02d92b4bf9544c53b11f232d2","bytes":136664,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-07T13:00:02.724Z","reviewed_at":null},{"id":"finding-2d57e2dba45ef60e8308320619e8664f0a781842a085f503db533c0f9d83800d","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"MSU Guidelines for the Use of Generative Artificial Intelligence Tools","sourceVersion":"Approved August 12, 2025; no revisions listed","authority":"organization-specific","jurisdiction":"Michigan State University, United States","url":"https://ai.msu.edu/guidelines","title":"Disclose AI-detector use to students","control":"Permissible Uses → Teaching and Learning, detection-tools paragraph","actor":"MSU instructors choosing to use generative AI detection tools","modality":"must","action":"disclose","object":"intended use of generative AI detection tools to students","condition":"An instructor elects to use detection tools despite the guideline's general discouragement; explain rationale, interpretation and potential follow-up.","exception":"Not triggered if no detection tool is used; disclosure does not authorize treating detector output as conclusive evidence.","timing":"When choosing to use the detector, as part of informing students of intended use.","evidenceSummary":"The detection paragraph requires clear disclosure of intended use, including rationale, how results will be interpreted and possible actions.","ruleId":"AIR-D2002846E6","intent":"disclose intended use of generative ai detection tools to students","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-06T13:07:51.068Z","reviewed_at":null},{"id":"finding-38479119e5044fee600724951b129b181ec8a9d6abaa28f596de1bcae3393935","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"MSU Guidelines for the Use of Generative Artificial Intelligence Tools","sourceVersion":"Approved August 12, 2025; no revisions listed","authority":"organization-specific","jurisdiction":"Michigan State University, United States","url":"https://ai.msu.edu/guidelines","title":"Give students an opportunity to respond to alleged AI misuse","control":"Implementation, Procurement and Resources → Reporting Misuse, second paragraph","actor":"MSU personnel handling allegations of student generative AI misuse","modality":"should","action":"afford","object":"students an opportunity to respond to alleged AI misuse","condition":"A student is accused of generative AI misuse; existing Student Rights and Responsibilities procedures govern.","exception":"No exception stated; this is an institutional procedural expectation, not a universal legal rule.","timing":"During the university's misconduct process before its resolution.","evidenceSummary":"The reporting paragraph promises a fair, transparent process that lets accused students respond, present evidence and access support.","ruleId":"AIR-5DF0307196","intent":"afford students an opportunity to respond to alleged ai misuse","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-06T13:07:51.068Z","reviewed_at":null},{"id":"finding-46fce5a365618568fd385448dca0a4ab8958fd7e5ae7b2c4ef311fa973c21ce0","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Local Law 144 AEDT controls — DCWP official FAQ","sourceVersion":"FAQ dated June 29, 2023; Local Law 144 of 2021 and final implementing rules","actor":"Employers and employment agencies using an AEDT in New York City","authority":"binding-within-NYC-AEDT-scope; regulator FAQ explains law and rules","jurisdiction":"New York City, United States","title":"Publish the AEDT bias audit summary","control":"FAQ II.3, p.3; 6 RCNY §5-303(a)(1),(b)","modality":"must","action":"publish","object":"AEDT bias audit summary","condition":"An AEDT substantially assists or replaces discretionary screening of applicants for a specific job or employees for promotion in NYC; includes jobs linked to a NYC office. Resume-bank outreach alone is outside scope. Summary includes audit date, data source/explanation, unknown-category count, category applicant counts, rates and impact ratios.","exception":"An identified active hyperlink to the required summary may satisfy publication.","timing":"Before AEDT use.","evidenceSummary":"FAQ II.3 requires public results and lists summary contents; §5-303(a)(1),(b) establishes website publication or identified active link.","url":"https://www.nyc.gov/assets/dca/downloads/pdf/about/DCWP-AEDT-FAQ.pdf#page=3","ruleId":"AIR-D7781FB4C4","intent":"publish aedt bias audit summary","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-06T13:07:51.068Z","reviewed_at":null},{"id":"finding-5ca250b875be0fb50c2027491a8fee19cd58a387d65edec2c4bc9432784c2f3a","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"MSU Guidelines for the Use of Generative Artificial Intelligence Tools","sourceVersion":"Approved August 12, 2025; no revisions listed","authority":"organization-specific","jurisdiction":"Michigan State University, United States","url":"https://ai.msu.edu/guidelines","title":"Use MSU-approved tools for university work","control":"Introduction, paragraphs 5–6; At a Glance, university-work bullet","actor":"Members of the MSU community conducting work on behalf of MSU","modality":"should","action":"use","object":"approved tools","condition":"Conducting work on behalf of MSU; tool approval and permissible data handling are specific to university standards and role.","exception":"No general exception is stated for university work; supervisor consultation clarifies permissible applications. Other personal/public uses require separate scope assessment.","timing":"When selecting and using generative AI tools for university work.","evidenceSummary":"MSU expects university-work use of institutionally approved/supported tools, with compliance/security review and role-specific consultation.","ruleId":"AIR-32BF4E5A3E","intent":"use approved tools","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-06T13:07:51.068Z","reviewed_at":null},{"id":"finding-a40845f549cbbf473c7b73ef200be324a53bda4d63977311f917ec6d85061329","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Local Law 144 AEDT controls — DCWP official FAQ","sourceVersion":"FAQ dated June 29, 2023; Local Law 144 of 2021 and final implementing rules","actor":"Independent auditors conducting required NYC AEDT bias audits","authority":"binding-within-NYC-AEDT-scope; regulator FAQ explains law and rules","jurisdiction":"New York City, United States","title":"Calculate category impact ratios for AEDT bias audits","control":"FAQ II.1, p.2 and III.9, p.4; 6 RCNY §5-301(b)(2)–(3),(c)(3)–(4),(d)","modality":"must","action":"calculate","object":"AEDT category impact ratios","condition":"An AEDT substantially assists or replaces discretionary screening of applicants for a specific job or employees for promotion in NYC; includes jobs linked to a NYC office. Resume-bank outreach alone is outside scope. Assess sex, race/ethnicity and their intersections; compare category selection/scoring rates with the highest category rate.","exception":"Categories under 2% may be excluded from impact-ratio calculations if the summary supplies justification, applicant count and applicable rate; other categories remain required.","timing":"During each required bias audit.","evidenceSummary":"FAQ II.1 requires impact ratios across sex, race/ethnicity and intersections; III.9 describes the under-2% exception, elaborated in §5-301(d).","url":"https://www.nyc.gov/assets/dca/downloads/pdf/about/DCWP-AEDT-FAQ.pdf#page=2","ruleId":"AIR-FF118BBCC7","intent":"calculate aedt category impact ratios","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-06T13:07:51.068Z","reviewed_at":null},{"id":"finding-ada27771f834c849a2bbce25cc32f0037b2dcb42d35a5b73a3244ebb3e0d63eb","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"MSU Guidelines for the Use of Generative Artificial Intelligence Tools","sourceVersion":"Approved August 12, 2025; no revisions listed","authority":"organization-specific","jurisdiction":"Michigan State University, United States","url":"https://ai.msu.edu/guidelines","title":"Include generative AI guidance in each syllabus","control":"Permissible Uses → Teaching and Learning → Educators, first paragraph","actor":"MSU course instructors","modality":"should","action":"include","object":"generative AI guidance in every course syllabus","condition":"Teaching an MSU course; guidance states whether AI is allowed, applicable contexts and expected acknowledgment/citation.","exception":"Guidance is course-specific and may permit or restrict use; no blanket permission is created.","timing":"In each syllabus, with expectations communicated at the outset of term.","evidenceSummary":"The Educators paragraph expects every syllabus to contain a clear generative AI statement addressing permitted contexts and acknowledgment.","ruleId":"AIR-45C22D7E04","intent":"include generative ai guidance in every course syllabus","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-06T13:07:51.068Z","reviewed_at":null},{"id":"finding-c4bd557148509cda1c46d013f8de3ac20861aac52a09fbf81b5f36dd9dfed559","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Local Law 144 AEDT controls — DCWP official FAQ","sourceVersion":"FAQ dated June 29, 2023; Local Law 144 of 2021 and final implementing rules","actor":"Employers and employment agencies using an AEDT in New York City","authority":"binding-within-NYC-AEDT-scope; regulator FAQ explains law and rules","jurisdiction":"New York City, United States","title":"Use independent assessors for AEDT bias audits","control":"FAQ II.1, p.2 and IV.2, p.5; 6 RCNY §5-300 Independent Auditor","modality":"must","action":"involve","object":"independent assessors in AI evaluation","condition":"An AEDT substantially assists or replaces discretionary screening of applicants for a specific job or employees for promotion in NYC; includes jobs linked to a NYC office. Resume-bank outreach alone is outside scope. Bias auditor must exercise impartial judgment, have no prior involvement in using/developing/distributing the AEDT, and have no disqualifying employment or financial interest during the audit.","exception":"Auditors need not be approved by DCWP; a vendor may coordinate an independent audit, but the employer or agency remains responsible.","timing":"For each required bias audit before reliance on the AEDT.","evidenceSummary":"FAQ II.1 and IV.2 define impartial, independent bias auditing; IV.1 rejects a DCWP-approved-auditor requirement and V preserves employer responsibility.","url":"https://www.nyc.gov/assets/dca/downloads/pdf/about/DCWP-AEDT-FAQ.pdf#page=5","ruleId":"AIR-DFA60F69C7","intent":"involve independent assessors in ai evaluation","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-06T13:07:51.068Z","reviewed_at":null},{"id":"finding-ccee5d16830abc09aec6300fe248f3336f064b6bceb84bb5e91c1bfcdef75574","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Local Law 144 AEDT controls — DCWP official FAQ","sourceVersion":"FAQ dated June 29, 2023; Local Law 144 of 2021 and final implementing rules","actor":"Employers and employment agencies using an AEDT in New York City","authority":"binding-within-NYC-AEDT-scope; regulator FAQ explains law and rules","jurisdiction":"New York City, United States","title":"Publish the AEDT distribution date","control":"FAQ II.3, p.3; 6 RCNY §5-303(a)(2),(b)","modality":"must","action":"publish","object":"AEDT distribution date","condition":"An AEDT substantially assists or replaces discretionary screening of applicants for a specific job or employees for promotion in NYC; includes jobs linked to a NYC office. Resume-bank outreach alone is outside scope. Distribution date means when the employer or agency began using the specific AEDT.","exception":"An identified active hyperlink to a site containing the required information may satisfy publication.","timing":"Before AEDT use.","evidenceSummary":"FAQ II.3 separately requires the date use began, in addition to audit results; §5-303(a)(2),(b) specifies its publication.","url":"https://www.nyc.gov/assets/dca/downloads/pdf/about/DCWP-AEDT-FAQ.pdf#page=3","ruleId":"AIR-79DB50E701","intent":"publish aedt distribution date","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-06T13:07:51.068Z","reviewed_at":null},{"id":"finding-ddb93b13d70761cf84907ea7112d02e5e61ef56d988d3142bb559c3bf4a1f8bf","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Local Law 144 AEDT controls — DCWP official FAQ","sourceVersion":"FAQ dated June 29, 2023; Local Law 144 of 2021 and final implementing rules","actor":"Employers and employment agencies using an AEDT in New York City","authority":"binding-within-NYC-AEDT-scope; regulator FAQ explains law and rules","jurisdiction":"New York City, United States","title":"Notify NYC residents before AEDT assessment","control":"FAQ VI.1–2, p.5; NYC Code §20-871(b)(1),(2); 6 RCNY §5-304(a)–(c)","modality":"must","action":"provide","object":"notice of automated decision-making","condition":"An AEDT substantially assists or replaces discretionary screening of applicants for a specific job or employees for promotion in NYC; includes jobs linked to a NYC office. Resume-bank outreach alone is outside scope. Candidate or employee resides in NYC. Notice identifies AEDT use and qualifications/characteristics assessed, with reasonable-accommodation request instructions.","exception":"Permitted notice channels include job posting, mail or email; applicants may receive website notice and promotion candidates a provided written policy. This rule does not itself require an alternative selection process.","timing":"At least 10 business days before AEDT use.","evidenceSummary":"FAQ VI.1–2 explains notice content, channels and lead time; §5-304 distinguishes applicant and promotion-candidate channels.","url":"https://www.nyc.gov/assets/dca/downloads/pdf/about/DCWP-AEDT-FAQ.pdf#page=5","ruleId":"AIR-9F12707A1E","intent":"provide notice of automated decision making","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-06T13:07:51.068Z","reviewed_at":null},{"id":"finding-e215d96370c5c1e762df90f24855611b0132bcd3c98be973768e62219ceb9d57","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Local Law 144 AEDT controls — DCWP official FAQ","sourceVersion":"FAQ dated June 29, 2023; Local Law 144 of 2021 and final implementing rules","actor":"Employers and employment agencies using an AEDT in New York City","authority":"regulator-guidance-interpreting-NYC-AEDT-requirements","jurisdiction":"New York City, United States","title":"Exclude inferred demographics from AEDT bias audits","control":"FAQ III.6, p.4","modality":"must not","action":"use","object":"imputed or inferred demographic data in AEDT bias audits","condition":"An AEDT substantially assists or replaces discretionary screening of applicants for a specific job or employees for promotion in NYC; includes jobs linked to a NYC office. Resume-bank outreach alone is outside scope. Rule concerns audit demographics, rather than a universal prohibition on demographic inference.","exception":"FAQ identifies no allowance for imputed/inferred audit demographics; insufficient historical data may instead permit other historical data or test data.","timing":"When preparing and conducting the bias audit.","evidenceSummary":"FAQ III.6 expressly disallows imputed or algorithmically inferred demographics for the bias audit and identifies alternative data options.","url":"https://www.nyc.gov/assets/dca/downloads/pdf/about/DCWP-AEDT-FAQ.pdf#page=4","ruleId":"AIR-6190106E33","intent":"use imputed or inferred demographic data in aedt bias audits","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-06T13:07:51.068Z","reviewed_at":null},{"id":"finding-e803525e253ee797543d3a6777325a8c0dd4cff01458994453e22f4e8d9bf501","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Local Law 144 AEDT controls — DCWP official FAQ","sourceVersion":"FAQ dated June 29, 2023; Local Law 144 of 2021 and final implementing rules","actor":"Employers and employment agencies using an AEDT in New York City","authority":"binding-within-NYC-AEDT-scope; regulator FAQ explains law and rules","jurisdiction":"New York City, United States","title":"Explain bias-audit test-data provenance","control":"FAQ III.7–8, p.4; 6 RCNY §5-302(b)","modality":"must","action":"explain","object":"AEDT bias audit test-data provenance","condition":"An AEDT substantially assists or replaces discretionary screening of applicants for a specific job or employees for promotion in NYC; includes jobs linked to a NYC office. Resume-bank outreach alone is outside scope. Audit uses test data because historical data are insufficient for a statistically significant audit.","exception":"Not triggered when audit uses only adequate historical data.","timing":"In the public summary of the test-data audit.","evidenceSummary":"FAQ III.7–8 requires the summary to state why test data were used and explain their source/development; §5-302(b) requires reasons and generation/acquisition description.","url":"https://www.nyc.gov/assets/dca/downloads/pdf/about/DCWP-AEDT-FAQ.pdf#page=4","ruleId":"AIR-7B6A0342EC","intent":"explain aedt bias audit test data provenance","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-06T13:07:51.068Z","reviewed_at":null},{"id":"finding-ec81a3502aa372ff1fb4836980f39e248268a2545d5df549032424819190ca47","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Local Law 144 AEDT controls — DCWP official FAQ","sourceVersion":"FAQ dated June 29, 2023; Local Law 144 of 2021 and final implementing rules","actor":"Employers and employment agencies using an AEDT in New York City","authority":"binding-within-NYC-AEDT-scope; regulator FAQ explains law and rules","jurisdiction":"New York City, United States","title":"Use historical AEDT data for bias auditing","control":"FAQ III.1–2, p.3 and III.4–5, p.4; 6 RCNY §5-302(a),(b)","modality":"must","action":"use","object":"historical data for AEDT bias audits","condition":"An AEDT substantially assists or replaces discretionary screening of applicants for a specific job or employees for promotion in NYC; includes jobs linked to a NYC office. Resume-bank outreach alone is outside scope. Historical data are collected from use of the same AEDT to assess applicants or promotion candidates.","exception":"Test data may be used if historical data are insufficient for a statistically significant audit. Reliance on other employers' historical data requires supplying one's own historical data or never having used the AEDT.","timing":"When conducting each required bias audit.","evidenceSummary":"FAQ III describes historical-data default, shared-data reliance conditions and insufficient-data exception; §5-302 preserves those distinctions.","url":"https://www.nyc.gov/assets/dca/downloads/pdf/about/DCWP-AEDT-FAQ.pdf#page=3","ruleId":"AIR-58ABBD6E09","intent":"use historical data for aedt bias audits","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-06T13:07:51.068Z","reviewed_at":null},{"id":"finding-edaad0cc3a6cc7dc62be92d31d0dd6c8571c0709bd5fa3004ba14e8b6b66824f","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Local Law 144 AEDT controls — DCWP official FAQ","sourceVersion":"FAQ dated June 29, 2023; Local Law 144 of 2021 and final implementing rules","actor":"Employers and employment agencies using an AEDT in New York City","authority":"binding-within-NYC-AEDT-scope; regulator FAQ explains law and rules","jurisdiction":"New York City, United States","title":"Do not use an AEDT with an expired bias audit","control":"FAQ II.4, p.3; 6 RCNY §5-301(a)","modality":"must not","action":"use","object":"AEDTs without a current bias audit","condition":"An AEDT substantially assists or replaces discretionary screening of applicants for a specific job or employees for promotion in NYC; includes jobs linked to a NYC office. Resume-bank outreach alone is outside scope.","exception":"Tools outside the statutory AEDT definition and non-assessment outreach are out of scope.","timing":"Before use and throughout continued use; most recent audit must be within the preceding year. Law effective January 1, 2023; enforcement July 5, 2023.","evidenceSummary":"FAQ II.4 limits reliance on a bias audit to one year; §5-301(a) prohibits continued use after that interval.","url":"https://www.nyc.gov/assets/dca/downloads/pdf/about/DCWP-AEDT-FAQ.pdf#page=3","ruleId":"AIR-D1A2B1E180","intent":"use aedts without a current bias audit","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-06T13:07:51.068Z","reviewed_at":null},{"id":"change-msu-genai-guidelines-a78484c1ebeaee493ce7b1b3068258565739e7b7a2b3e721a38b2887d8709681","kind":"source-change","status":"pending","body":{"sourceId":"msu-genai-guidelines","title":"Guidelines for the Use of Generative Artificial Intelligence Tools","url":"https://ai.msu.edu/guidelines","status":"publisher-bytes-changed","checkedAt":"2026-10-06T13:02:31.921Z","fingerprint":"a78484c1ebeaee493ce7b1b3068258565739e7b7a2b3e721a38b2887d8709681","previousFingerprint":"f0db429e44f8e635475937b5156f09de92fcc9033cc5c11a6fb85c18ec66399d","bytes":708180,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-06T13:02:31.921Z","reviewed_at":null},{"id":"change-cisa-ncsc-secure-ai-development-1c70944dae1f01d9bf42f72d7230a112384f50e02d92b4bf9544c53b11f232d2","kind":"source-change","status":"pending","body":{"sourceId":"cisa-ncsc-secure-ai-development","title":"Guidelines for Secure AI System Development","url":"https://www.ncsc.gov.uk/collection/guidelines-secure-ai-system-development/guidelines/secure-development","status":"publisher-bytes-changed","checkedAt":"2026-10-06T13:02:29.706Z","fingerprint":"1c70944dae1f01d9bf42f72d7230a112384f50e02d92b4bf9544c53b11f232d2","previousFingerprint":"84295cc322ed732913ef3a8fbdeafc856d022d8bd183153ff78751219d0a39f8","bytes":136664,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-06T13:02:29.706Z","reviewed_at":null},{"id":"finding-1f6b2c4af5ca0343a3403f577f271db360b05081779054c32b2201a6ee7266a1","kind":"rule-candidate","status":"pending","body":{"title":"Monitor AI behavior in production","sourceTitle":"Guidance for AI Adoption: Implementation Guidance","sourceVersion":"Published 5 May 2026","control":"5.2.1 Production monitoring","actor":"Organizations operating AI systems","modality":"should","action":"monitor","object":"AI behavior in production","condition":"Monitoring must use system-specific performance metrics and indicators relevant to identified risks.","exception":"Monitoring scope and intensity may be proportionate to the system's documented risks and deployment context.","timing":"Continuously or at a frequency defined before deployment and reviewed over the lifecycle.","authority":"voluntary","jurisdiction":"Australia","evidenceSummary":"Control 5.2.1 requires monitoring systems for each AI system that track performance measures and indicators tied to identified risks.","url":"https://www.industry.gov.au/publications/guidance-ai-adoption","ruleId":"AIR-F6290E21EB","intent":"monitor ai behavior in production","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-05T13:33:57.433Z","reviewed_at":null},{"id":"finding-37c7264cba5abd2b5c1ac5f50bc133e900f48f6ef803e7ba56e585c80ff43682","kind":"rule-candidate","status":"pending","body":{"title":"Reassess AI risks after controls","sourceTitle":"Guidance for AI Adoption: Implementation Guidance","sourceVersion":"Published 5 May 2026","control":"3.3.1 AI risk treatment","actor":"Organizations developing or deploying AI systems","modality":"should","action":"reassess","object":"AI risks after controls","condition":"After implementing selected risk-treatment options and controls for identified AI-system risks.","exception":"Treatment options may include avoidance, transfer, acceptance, or reduction, subject to the organization's documented risk criteria.","timing":"After controls are implemented and before relying on them as effective.","authority":"voluntary","jurisdiction":"Australia","evidenceSummary":"Control 3.3.1 directs organizations to implement a documented treatment plan and reassess risk after controls to verify effectiveness.","url":"https://www.industry.gov.au/publications/guidance-ai-adoption","ruleId":"AIR-96428BE149","intent":"reassess ai risks after controls","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-05T13:33:57.433Z","reviewed_at":null},{"id":"finding-3848028ed10c35da99f070491661f0ba1d40d345aef2f2d6e2e28effeaf811cd","kind":"rule-candidate","status":"pending","body":{"title":"Inventory organizational AI systems","sourceTitle":"Guidance for AI Adoption: Implementation Guidance","sourceVersion":"Published 5 May 2026","control":"4.1.1 AI register","actor":"Organizations developing or deploying AI systems","modality":"should","action":"inventory","object":"organizational AI systems","condition":"The organization-wide inventory must contain enough detail to inform stakeholders and support future conformance assessments.","exception":"Inventory detail should be sufficient for governance and conformance needs while respecting applicable confidentiality and security constraints.","timing":"Create and keep the inventory up to date, including review dates.","authority":"voluntary","jurisdiction":"Australia","evidenceSummary":"Control 4.1.1 calls for a current organization-wide inventory of each AI model and system with ownership, purpose, provenance, tests, risks, controls, audits, and review dates.","url":"https://www.industry.gov.au/publications/guidance-ai-adoption","ruleId":"AIR-9365A6ADE2","intent":"inventory organizational ai systems","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-05T13:33:57.433Z","reviewed_at":null},{"id":"finding-8821d5683602803de6d7ec29ea8a312eb5105b805cf16de4b6ddbf980aa38922","kind":"rule-candidate","status":"pending","body":{"title":"Define safe AI decommissioning procedures","sourceTitle":"Guidance for AI Adoption: Implementation Guidance","sourceVersion":"Published 5 May 2026","control":"6.2.1 AI decommissioning","actor":"Organizations operating AI systems","modality":"should","action":"define","object":"safe AI decommissioning procedures","condition":"Procedures must address termination criteria, accountable roles, critical dependencies, shutdown impacts, timing, treatment, data extraction, asset return or deletion, and record retention.","exception":"Critical infrastructure and service-delivery dependencies require impact assessment and a disruption-minimization plan before shutdown.","timing":"Define before decommissioning and apply when termination criteria are met.","authority":"voluntary","jurisdiction":"Australia","evidenceSummary":"Control 6.2.1 specifies the decisions and safeguards organizations should define for intervening in and decommissioning AI systems.","url":"https://www.industry.gov.au/publications/guidance-ai-adoption","ruleId":"AIR-B098FE0267","intent":"define safe ai decommissioning procedures","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-05T13:33:57.433Z","reviewed_at":null},{"id":"finding-940811c9ce2e185738e88fdd544fce1ed3cad53dbfa27dd92d39b71c0256e4df","kind":"rule-candidate","status":"pending","body":{"title":"Maintain alternative pathways for critical functions","sourceTitle":"Guidance for AI Adoption: Implementation Guidance","sourceVersion":"Published 5 May 2026","control":"6.2.4 Operational continuity","actor":"Organizations relying on AI for critical functions","modality":"should","action":"maintain","object":"alternative pathways for critical functions","condition":"Where AI systems support functions that must continue through malfunction or shutdown.","exception":"Alternative pathways may be manual or non-AI systems if they preserve required service continuity.","timing":"Available before an AI malfunction or planned or unplanned shutdown.","authority":"voluntary","jurisdiction":"Australia","evidenceSummary":"Control 6.2.4 directs organizations to preserve alternate ways to perform critical functions when AI systems malfunction or are taken offline.","url":"https://www.industry.gov.au/publications/guidance-ai-adoption","ruleId":"AIR-B7C8569952","intent":"maintain alternative pathways for critical functions","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-05T13:33:57.433Z","reviewed_at":null},{"id":"finding-a72cb97e55f6cea0630130f3b5c857cf6c3f1e13234fb86a34ec5b3eabeebdd3","kind":"rule-candidate","status":"pending","body":{"title":"Obtain documented AI deployment authorization","sourceTitle":"Guidance for AI Adoption: Implementation Guidance","sourceVersion":"Published 5 May 2026","control":"5.1.5 Pre-deployment testing","actor":"Organizations deploying AI systems","modality":"should","action":"obtain","object":"documented AI deployment authorization","condition":"Authorization must come from the accountable person and be based on documented test results.","exception":"The authorization decision may withhold deployment when acceptance criteria are not met.","timing":"Before deployment.","authority":"voluntary","jurisdiction":"Australia","evidenceSummary":"Control 5.1.5 calls for documented deployment authorization and rationale from the accountable person based on test results.","url":"https://www.industry.gov.au/publications/guidance-ai-adoption","ruleId":"AIR-76A82C58C5","intent":"obtain documented ai deployment authorization","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-05T13:33:57.433Z","reviewed_at":null},{"id":"finding-bea3d432160d43ed6dc7ba95a14e2a2af535d604aa82f1bfc6537107dc3aef2d","kind":"rule-candidate","status":"pending","body":{"title":"Assign and communicate AI system accountability","sourceTitle":"Guidance for AI Adoption: Implementation Guidance","sourceVersion":"Published 5 May 2026","control":"1.1.1 Accountable people","actor":"Organizations building, customising, or using AI in complex or higher-risk ways","modality":"should","action":"assign","object":"AI system accountability","condition":"For operation of the AI management system, including policies, deployment, oversight, testing, redress, and continual improvement across employees, contractors, and third-party providers.","exception":"Accountable roles may be distributed, but responsibility must be documented and clearly communicated.","timing":"Before and throughout development, deployment, and operation.","authority":"voluntary","jurisdiction":"Australia","evidenceSummary":"Control 1.1.1 directs organizations to assign, document, and clearly communicate who is accountable across the organization for specified AI-management responsibilities.","url":"https://www.industry.gov.au/publications/guidance-ai-adoption","ruleId":"AIR-A332E21BFB","intent":"assign ai system accountability","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-05T13:33:57.433Z","reviewed_at":null},{"id":"finding-c9e61e406a54ee0edcdc24ab7464129a3aa276cdbfcee0be934fe4a188cdc396","kind":"rule-candidate","status":"pending","body":{"title":"Document shared AI supply-chain accountability","sourceTitle":"Guidance for AI Adoption: Implementation Guidance","sourceVersion":"Published 5 May 2026","control":"1.2.1 Supply chain accountabilities","actor":"AI supply-chain participants","modality":"should","action":"document","object":"shared AI supply chain accountability","condition":"Across model developers, system developers, and deployers for monitoring and evaluation, human oversight, issue escalation, incident response, resolution, and updates.","exception":"Responsibilities may be shared across parties; each allocation still needs to be identified and communicated.","timing":"Before integration or deployment and maintained throughout the lifecycle.","authority":"voluntary","jurisdiction":"Australia","evidenceSummary":"Control 1.2.1 calls for identifying, documenting, and communicating shared responsibility across the AI supply chain for performance, safety, oversight, incidents, and updates.","url":"https://www.industry.gov.au/publications/guidance-ai-adoption","ruleId":"AIR-7A6D7EDE8E","intent":"document shared ai supply chain accountability","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-05T13:33:57.433Z","reviewed_at":null},{"id":"finding-f29a20415821414e04c6d4a65d906450209ef8309a31f4fe2fc09969e3fae9b1","kind":"rule-candidate","status":"pending","body":{"title":"Establish mechanisms to appeal AI outcomes","sourceTitle":"Guidance for AI Adoption: Implementation Guidance","sourceVersion":"Published 5 May 2026","control":"2.2.2 Feedback and redress","actor":"Organizations deploying AI systems","modality":"should","action":"establish","object":"mechanisms to appeal AI outcomes","condition":"For AI use and decisions affecting stakeholders; mechanisms must be accessible, understandable, and available at the appropriate time.","exception":"The mechanism should be proportionate to affected stakeholder needs and applicable regulatory requirements.","timing":"Available during the affected person's interaction with the AI system.","authority":"voluntary","jurisdiction":"Australia","evidenceSummary":"Control 2.2.2 requires system-level contestability mechanisms enabling stakeholders to understand, challenge, and appeal AI use and decisions.","url":"https://www.industry.gov.au/publications/guidance-ai-adoption","ruleId":"AIR-6E499BCE84","intent":"establish mechanisms to appeal ai outcomes","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-05T13:33:57.433Z","reviewed_at":null},{"id":"finding-f600c471f6d60b51102a22e951629126b669d212dafd530f38971aec8aac0f05","kind":"rule-candidate","status":"pending","body":{"title":"Request upstream AI test methods and results","sourceTitle":"Guidance for AI Adoption: Implementation Guidance","sourceVersion":"Published 5 May 2026","control":"5.1.4 Pre-deployment testing","actor":"Organizations procuring or deploying third-party AI systems","modality":"should","action":"request","object":"upstream AI test methods and results","condition":"When an upstream provider performed model or system testing during development.","exception":"The receiving organization must still evaluate whether the provider's testing aligns with its own acceptance criteria.","timing":"Before deployment authorization.","authority":"voluntary","jurisdiction":"Australia","evidenceSummary":"Control 5.1.4 tells deployers to request upstream testing methods and results and check them against the deployer's acceptance criteria.","url":"https://www.industry.gov.au/publications/guidance-ai-adoption","ruleId":"AIR-23441717D0","intent":"request upstream ai test methods and results","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-05T13:33:57.433Z","reviewed_at":null},{"id":"change-eu-ai-act-e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","kind":"source-change","status":"pending","body":{"sourceId":"eu-ai-act","title":"EU Artificial Intelligence Act","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","status":"publisher-bytes-changed","checkedAt":"2026-10-05T13:06:46.084Z","fingerprint":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","previousFingerprint":"d0956a30a24ee076ab16aced7ce7030c58170b900f79f5d70653d9b02c49939c","bytes":0,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-05T13:06:46.084Z","reviewed_at":null},{"id":"change-eu-gdpr-e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","kind":"source-change","status":"pending","body":{"sourceId":"eu-gdpr","title":"General Data Protection Regulation","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","status":"publisher-bytes-changed","checkedAt":"2026-10-05T13:06:46.084Z","fingerprint":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","previousFingerprint":"83b5dc401f75b59ebed22bea83b410443ce36e008268ada5345a1ccb1a9d0df9","bytes":0,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-05T13:06:46.084Z","reviewed_at":null},{"id":"change-msu-genai-guidelines-f0db429e44f8e635475937b5156f09de92fcc9033cc5c11a6fb85c18ec66399d","kind":"source-change","status":"pending","body":{"sourceId":"msu-genai-guidelines","title":"Guidelines for the Use of Generative Artificial Intelligence Tools","url":"https://ai.msu.edu/guidelines","status":"publisher-bytes-changed","checkedAt":"2026-10-05T13:06:46.084Z","fingerprint":"f0db429e44f8e635475937b5156f09de92fcc9033cc5c11a6fb85c18ec66399d","previousFingerprint":"d681d7fcf48a367b8abf1b7ac97baa47b03b39aeed9a79082f8aadd5e1c5b096","bytes":707428,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-05T13:06:46.084Z","reviewed_at":null},{"id":"change-cisa-ncsc-secure-ai-development-84295cc322ed732913ef3a8fbdeafc856d022d8bd183153ff78751219d0a39f8","kind":"source-change","status":"pending","body":{"sourceId":"cisa-ncsc-secure-ai-development","title":"Guidelines for Secure AI System Development","url":"https://www.ncsc.gov.uk/collection/guidelines-secure-ai-system-development/guidelines/secure-development","status":"publisher-bytes-changed","checkedAt":"2026-10-05T13:06:42.736Z","fingerprint":"84295cc322ed732913ef3a8fbdeafc856d022d8bd183153ff78751219d0a39f8","previousFingerprint":"637ba1b2f5d0bc7ba678246a53d59048109c9bbcf0dae938324601144fb28e3b","bytes":136664,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-05T13:06:42.736Z","reviewed_at":null},{"id":"finding-09ca06eae6f1de4bb68d81e41fcc7059fd6cc35716c04fd384de1fd8475b43ce","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai","authority":"voluntary-code-requirement; not legislation","jurisdiction":"United Kingdom; voluntary use elsewhere","exception":"No clause-specific exception stated.","topic":"Security","title":"Release hashes for distributed model components","control":"Principle 8, clause 8.1.2","actor":"Developers","modality":"must","action":"release","object":"cryptographic hashes for distributed model components","condition":"Model components are made available to other stakeholders; requirement within a voluntary code.","timing":"With component distribution","evidenceSummary":"Clause 8.1.2 supports stakeholder authenticity verification through published component hashes.","ruleId":"AIR-017A3F57AD","intent":"release cryptographic hashes for distributed model components","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-04T13:05:57.998Z","reviewed_at":null},{"id":"finding-0de9da9f5d0a36e4af974e9ad063f5e39343d9d4e98cc7d5d1778bef45e082eb","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Generative AI Profile","sourceVersion":"AI 600-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf#page=18","authority":"voluntary","jurisdiction":"United States; voluntary use elsewhere","modality":"should","exception":"No clause-specific exception stated.","topic":"Safety","title":"Plan periodic offensive-cyber misuse evaluations","control":"GV-1.3-003 · PDF page 18 · offensive-cyber test-plan component","actor":"Developers of highly capable generative AI models","action":"establish","object":"a test plan for periodic offensive-cyber misuse evaluations","condition":"Before highly capable model development, following the voluntary suggested action.","timing":"Before development; evaluations periodically","evidenceSummary":"Completes the cyber-testing portion alongside the existing CBRN planning candidate. This is planning, not evidence of completed evaluations.","ruleId":"AIR-1DD98BB162","intent":"establish a test plan for periodic offensive cyber misuse evaluations","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-04T13:05:57.998Z","reviewed_at":null},{"id":"finding-2ee56b3ef46f145a2a2daf7c4939e810c52d664ab3c0501fb1f6d998298160b1","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai","authority":"voluntary-code-requirement; not legislation","jurisdiction":"United Kingdom; voluntary use elsewhere","exception":"No clause-specific exception stated.","topic":"Security","title":"Audit prompt and configuration changes","control":"Principle 8, clause 8.3 — audit-log recommendation","actor":"Developers","modality":"should","action":"maintain","object":"an audit log of system-prompt and model-configuration changes","condition":"Changes affect how the AI system operates.","timing":"As relevant configuration changes occur","evidenceSummary":"Clause 8.3 recommends a configuration-change audit trail; optional sharing is excluded from this candidate.","ruleId":"AIR-EC7664C68A","intent":"maintain an audit log of system prompt and model configuration changes","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-04T13:05:57.998Z","reviewed_at":null},{"id":"finding-31b1e0e9ffc935eceaafdf50f30dfa9cbe097d0cb75099f7dc09de9c9f8efef1","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Generative Artificial Intelligence Use Policy","sourceVersion":"1.7 — August 2025","url":"https://www.brooklinema.gov/3975/Generative-AI-Use","authority":"organizational-policy; applicable Town scope only","jurisdiction":"Town of Brookline, Massachusetts, United States","modality":"must","exception":"Case-by-case IT Security Team exception process; do not infer an exception has been granted. Conflicting applicable law prevails.","topic":"Governance","title":"Terminate unprotected contractor data access","control":"Policy / Use — contractor responsibilities, fourth sub-bullet","actor":"Employees accountable for contractor relationships","action":"terminate","object":"contractor access to data forbidden from entry into unconstrained GenAI tools","condition":"Contractor provides no policy, has none, or its policy is less restrictive than the Town policy.","timing":"When the stated deficient-policy condition applies; no numeric deadline stated","evidenceSummary":"This is scoped data-access termination, not termination of the contractor's agreement.","ruleId":"AIR-AB6F26A8FE","intent":"terminate contractor access to data forbidden from entry into unconstrained genai tools","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-04T13:05:57.998Z","reviewed_at":null},{"id":"finding-540830f0d6650546d4d62108156c20342ab7154379823e0d7d29f3e4728b0e2f","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai","authority":"voluntary-code-requirement; not legislation","jurisdiction":"United Kingdom; voluntary use elsewhere","exception":"No clause-specific exception stated.","topic":"Security","title":"Document model, dataset and prompt lifecycle — UK mapping","control":"Principle 2, clause 2.3 — lifecycle-audit-trail component","actor":"Developers","modality":"must","action":"document","object":"model, dataset and prompt lifecycle","condition":"Models, datasets or prompts are incorporated into an AI system; record operation and lifecycle management in an audit trail.","timing":"Throughout operation and lifecycle management","evidenceSummary":"Clause 2.3 adds a UK voluntary-code requirement to existing intent AIR-AB2476BBAB. It does not overwrite the NCSC guidance variant.","ruleId":"AIR-AB2476BBAB","intent":"document model dataset and prompt lifecycle","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-04T13:05:57.998Z","reviewed_at":null},{"id":"finding-7ded22be70b5b304316f3744ca92e4e0f1cf1623692a866b1ca664364f760351","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Generative AI Profile","sourceVersion":"AI 600-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf#page=20","authority":"voluntary","jurisdiction":"United States; voluntary use elsewhere","modality":"should","exception":"No clause-specific exception stated.","topic":"Governance","title":"Record model access modes in GAI inventories","control":"GV-1.6-003 · PDF page 20 · model-access-mode component","actor":"AI governance owners","action":"record","object":"model access modes in GAI inventories","condition":"Consider additional GAI inventory fields; voluntary recommendation interpreted for owner validation.","timing":"At inventory creation and access-mode changes","evidenceSummary":"Captures the separate access-mode field; semantic overlap with model inventory rules remains for owner review.","ruleId":"AIR-265655957B","intent":"record model access modes in gai inventories","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-04T13:05:57.998Z","reviewed_at":null},{"id":"finding-80ddb705075930fec0f060a33dd08e2bc1e3730a4c19e8f47d784586ac1ce1c0","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai","authority":"voluntary-code-requirement; not legislation","jurisdiction":"United Kingdom; voluntary use elsewhere","exception":"No clause-specific exception stated.","topic":"Security","title":"Risk-assess AI permissions on connected systems","control":"Principle 2, clause 2.6 — risk-assessment component","actor":"Developers and System Operators","modality":"must","action":"risk-assess","object":"AI permissions on connected systems","condition":"An AI system interacts with other systems or data sources; a requirement within a voluntary code.","timing":"When granting connected-system permissions","evidenceSummary":"Clause 2.6 separately requires assessing the risk of those permissions.","ruleId":"AIR-AD5A513030","intent":"risk assess ai permissions on connected systems","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-04T13:05:57.998Z","reviewed_at":null},{"id":"finding-87eacd6043dcbd989c3c31daa145fb6f65b9a8c59460f08aba025ac1a02216db","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Generative AI Profile","sourceVersion":"AI 600-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf#page=20","authority":"voluntary","jurisdiction":"United States; voluntary use elsewhere","modality":"should","exception":"No clause-specific exception stated.","topic":"Governance","title":"Record underlying model versions in GAI inventories","control":"GV-1.6-003 · PDF page 20 · underlying-model-version component","actor":"AI governance owners","action":"record","object":"underlying foundation-model versions in GAI inventories","condition":"Consider additional GAI inventory fields beyond general governance and risk information; recommendation interpreted for owner validation.","timing":"At inventory creation and model-version changes","evidenceSummary":"The version field is one atomic interpretation of the suggested inventory fields; other recommended fields remain separate.","ruleId":"AIR-12D64D5511","intent":"record underlying foundation model versions in gai inventories","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-04T13:05:57.998Z","reviewed_at":null},{"id":"finding-a3d0cbd2010162dce2272e3d366f74ed2d13b0d0b82f4b51f14d4debad33f74d","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Generative Artificial Intelligence Use Policy","sourceVersion":"1.7 — August 2025","url":"https://www.brooklinema.gov/3975/Generative-AI-Use","authority":"organizational-policy; applicable Town scope only","jurisdiction":"Town of Brookline, Massachusetts, United States","modality":"must","exception":"Case-by-case IT Security Team exception process; do not infer an exception has been granted. Conflicting applicable law prevails.","topic":"Governance","title":"Report unsolicited AI privilege escalation","control":"Policy / Use — reporting bullet, first sub-bullet (privilege-escalation component)","actor":"Users of Town Technology Resources","action":"report","object":"indications of unsolicited AI privilege escalation to the IT Cybersecurity Team","condition":"Town systems or data may be exposed to GenAI; escalation occurs without explicit prompting.","timing":"When indications are observed; no numeric deadline stated","evidenceSummary":"This reporting duty excludes the separate sensitive-data and physical-interaction components. The current displayed revision is still 1.7, so the byte-change alert is not proof of a new policy edition.","ruleId":"AIR-FB75F669C0","intent":"report indications of unsolicited ai privilege escalation to the it cybersecurity team","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-04T13:05:57.998Z","reviewed_at":null},{"id":"finding-b6ea03c14df435d03cedf14ffde730ac38284b5dd3270229f144edde6f0b8260","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Generative AI Profile","sourceVersion":"AI 600-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf#page=18","authority":"voluntary","jurisdiction":"United States; voluntary use elsewhere","modality":"should","exception":"No clause-specific exception stated.","topic":"Safety","title":"Plan responses to highly capable model misuse","control":"GV-1.3-003 · PDF page 18 · response-policy component","actor":"Developers of highly capable generative AI models","action":"establish","object":"a response policy for highly capable model misuse","condition":"Potential misuse of CBRN information or capabilities, or offensive cyber capabilities; voluntary suggested action.","timing":"Before model development","evidenceSummary":"The response-policy action is separated from periodic testing; both capability classes remain scope conditions.","ruleId":"AIR-3C106D9655","intent":"establish a response policy for highly capable model misuse","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-04T13:05:57.998Z","reviewed_at":null},{"id":"finding-cc123951957a5ecbedbcac5d686327b041a37417e7ddd3b6e4057d6a11c547bf","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Generative Artificial Intelligence Use Policy","sourceVersion":"1.7 — August 2025","url":"https://www.brooklinema.gov/3975/Generative-AI-Use","authority":"organizational-policy; applicable Town scope only","jurisdiction":"Town of Brookline, Massachusetts, United States","modality":"must","exception":"Case-by-case IT Security Team exception process; do not infer an exception has been granted. Conflicting applicable law prevails.","topic":"Governance","title":"Request a contractor's written GenAI policy","control":"Policy / Use — contractor responsibilities, second sub-bullet","actor":"Employees accountable for contractor relationships","action":"request","object":"a contractor's written unconstrained-GenAI policy or summary","condition":"The contractor can access information forbidden from entry into unconstrained GenAI tools.","timing":"Before signing any agreement","evidenceSummary":"Requires written policy evidence before agreement; comparative review and termination are distinct actions.","ruleId":"AIR-9D20F6040D","intent":"request a contractor s written unconstrained genai policy or summary","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-04T13:05:57.998Z","reviewed_at":null},{"id":"finding-d1a646587cf27e73a5db96577afa7b53ab887f1209fdebfd7d1e7c2797a9a4d4","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai","authority":"voluntary-code-requirement; not legislation","jurisdiction":"United Kingdom; voluntary use elsewhere","exception":"No clause-specific exception stated.","topic":"Security","title":"Limit AI permissions on connected systems","control":"Principle 2, clause 2.6 — permission-limitation component","actor":"Developers and System Operators","modality":"must","action":"limit","object":"AI permissions on connected systems to required functionality","condition":"An AI system interacts with internal or external systems or data sources. 'Shall' is a requirement within this voluntary code.","timing":"When granting connected-system permissions","evidenceSummary":"Clause 2.6 confines permissions to functional need. The risk-assessment component is staged separately; semantic overlap with least-privilege rules requires owner review.","ruleId":"AIR-1575D8EDBD","intent":"limit ai permissions on connected systems to required functionality","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-04T13:05:57.998Z","reviewed_at":null},{"id":"change-eu-ai-act-d0956a30a24ee076ab16aced7ce7030c58170b900f79f5d70653d9b02c49939c","kind":"source-change","status":"pending","body":{"sourceId":"eu-ai-act","title":"EU Artificial Intelligence Act","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","status":"publisher-bytes-changed","checkedAt":"2026-10-04T12:59:58.143Z","fingerprint":"d0956a30a24ee076ab16aced7ce7030c58170b900f79f5d70653d9b02c49939c","previousFingerprint":"f2992af811eaa9a490df6f9d437698086ff850986b14be5701e86e57c43ad16a","bytes":1535248,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-04T12:59:58.143Z","reviewed_at":null},{"id":"change-eu-gdpr-83b5dc401f75b59ebed22bea83b410443ce36e008268ada5345a1ccb1a9d0df9","kind":"source-change","status":"pending","body":{"sourceId":"eu-gdpr","title":"General Data Protection Regulation","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","status":"publisher-bytes-changed","checkedAt":"2026-10-04T12:59:58.143Z","fingerprint":"83b5dc401f75b59ebed22bea83b410443ce36e008268ada5345a1ccb1a9d0df9","previousFingerprint":"44a3f97ed40dc0fb9f7edf75ed1ae1fc1a00e0854d962b9b5774a36c8927ed67","bytes":1071098,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-04T12:59:58.143Z","reviewed_at":null},{"id":"change-brookline-genai-3eb9d05b8739fa8021c873c2aae060aca74b30f3ef7f53fdc778d5b456cf48da","kind":"source-change","status":"pending","body":{"sourceId":"brookline-genai","title":"Generative Artificial Intelligence Use Policy","url":"https://www.brooklinema.gov/3975/Generative-AI-Use","status":"publisher-bytes-changed","checkedAt":"2026-10-04T12:59:54.281Z","fingerprint":"3eb9d05b8739fa8021c873c2aae060aca74b30f3ef7f53fdc778d5b456cf48da","previousFingerprint":"1b9f66483321faf06e0f2f8c778da2405dae63e4e2858f64138d871c7c9aed9f","bytes":110652,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-04T12:59:54.281Z","reviewed_at":null},{"id":"finding-f183563e664459e9595d9adb996b353a0036f4407c08b7797042fc273d1a8185","kind":"rule-candidate","status":"pending","body":{"title":"Plan periodic CBRN misuse evaluations","sourceTitle":"Generative AI Profile","sourceVersion":"AI 600-1","control":"GV-1.3-003 · PDF page 18","actor":"Developers of highly capable generative AI models","modality":"should","action":"establish","object":"a test plan for periodic CBRN misuse evaluations","condition":"Before developing highly capable models; the CBRN evaluation-planning portion of the voluntary NIST GenAI risk profile. Organization applicability requires review.","evidenceSummary":"NIST recommends preparing evaluation planning before highly capable model development. This atomic candidate covers CBRN misuse testing; the same action also discusses a response policy and offensive cyber capability, which need separate candidates.","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf#page=18","exception":null,"timing":"Before model development; evaluate periodically","authority":"voluntary","jurisdiction":"United States; voluntary use elsewhere","topic":"Safety","ruleId":"AIR-171D954EEE","intent":"establish a test plan for periodic cbrn misuse evaluations","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-03T23:27:38.373Z","reviewed_at":null}],"reviews":[]},"exportedAt":"2026-10-28T00:41:04.171Z"}