{ "schemaVersion": 2, "notice": "Illustrative mapping from the AI Governance Engineer Body of Knowledge v0.5.0 (not a claim of conformity)", "version": "0.5.0", "asOf": "2026-09-24", "license": "CC BY 4.0", "source": "https://aigovernanceengineer.com/resources/crosswalk", "citation": { "title": "AI Governance Engineering: The Thesis & Body of Knowledge", "authors": [ "Jorge García Aibar" ], "parentDoi": "https://doi.org/10.5281/zenodo.22956197", "conceptDoi": "https://doi.org/10.5281/zenodo.22857084" }, "columns": [ { "id": "eu", "label": "EU AI Act", "group": "law", "defaultVisible": true, "frameworks": [ "eu-ai-act" ] }, { "id": "gpai", "label": "GPAI Code", "group": "codes", "defaultVisible": false, "frameworks": [ "gpai-code-of-practice" ] }, { "id": "gdpr", "label": "GDPR", "group": "law", "defaultVisible": false, "frameworks": [ "gdpr" ] }, { "id": "iso", "label": "ISO/IEC 42001", "group": "standards", "defaultVisible": true, "frameworks": [ "iso-42001" ] }, { "id": "iso-more", "label": "ISO/IEC 42005 · 23894 · 42006", "group": "standards", "defaultVisible": false, "frameworks": [ "iso-42005", "iso-23894", "iso-42006" ] }, { "id": "nist", "label": "NIST AI RMF", "group": "codes", "defaultVisible": true, "frameworks": [ "nist-ai-rmf" ] }, { "id": "csa", "label": "CSA AICM", "group": "standards", "defaultVisible": false, "frameworks": [ "csa-aicm" ] }, { "id": "owasp", "label": "OWASP GenAI", "group": "standards", "defaultVisible": false, "frameworks": [ "owasp-llm-top-10", "owasp-agentic-top-10" ] }, { "id": "kr", "label": "Korea AI Basic Act", "group": "law", "defaultVisible": false, "frameworks": [ "kr-ai-basic-act" ] }, { "id": "uk", "label": "United Kingdom", "group": "law", "defaultVisible": false, "frameworks": [ "uk-duaa", "uk-atrs" ] }, { "id": "sg", "label": "Singapore", "group": "codes", "defaultVisible": false, "frameworks": [ "sg-genai-framework", "sg-agentic-framework" ] }, { "id": "aiverify", "label": "AI Verify", "group": "codes", "defaultVisible": false, "frameworks": [ "sg-ai-verify" ] }, { "id": "intl", "label": "Treaty and soft law", "group": "codes", "defaultVisible": false, "frameworks": [ "coe-cets-225", "oecd-ai-principles", "g7-hiroshima-coc" ] }, { "id": "gao", "label": "GAO AI Accountability", "group": "codes", "defaultVisible": false, "frameworks": [ "us-gao-ai-accountability" ] }, { "id": "cen", "label": "CEN-CENELEC", "group": "standards", "defaultVisible": false, "frameworks": [ "en-18286", "pren-18228", "pren-18229-1" ] }, { "id": "cn", "label": "China", "group": "law", "defaultVisible": true, "frameworks": [ "cn-tc260-framework", "cn-genai-measures", "cn-deep-synthesis", "cn-algo-recommendation", "cn-content-labelling", "cn-gbt-45654" ] } ], "frameworks": [ { "id": "eu-ai-act", "name": "EU AI Act (post-Omnibus)", "short": "EU AI Act", "type": "law", "issuer": "European Union", "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng", "column": "eu", "chipPrefix": "" }, { "id": "gpai-code-of-practice", "name": "GPAI Code of Practice", "short": "GPAI Code", "type": "code", "issuer": "European Commission", "url": "https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai", "column": "gpai", "chipPrefix": "" }, { "id": "gdpr", "name": "General Data Protection Regulation (EU) 2016/679", "short": "GDPR", "type": "law", "issuer": "European Union", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng", "column": "gdpr", "chipPrefix": "" }, { "id": "iso-42001", "name": "ISO/IEC 42001", "short": "ISO 42001", "type": "standard", "issuer": "ISO/IEC", "url": null, "column": "iso", "chipPrefix": "" }, { "id": "iso-42005", "name": "ISO/IEC 42005", "short": "ISO 42005", "type": "standard", "issuer": "ISO/IEC", "url": "https://www.iso.org/standard/44545.html", "column": "iso-more", "chipPrefix": "42005" }, { "id": "iso-23894", "name": "ISO/IEC 23894:2023", "short": "ISO 23894", "type": "standard", "issuer": "ISO/IEC", "url": "https://www.iso.org/standard/77304.html", "column": "iso-more", "chipPrefix": "23894" }, { "id": "iso-42006", "name": "ISO/IEC 42006:2025", "short": "ISO 42006", "type": "standard", "issuer": "ISO/IEC", "url": "https://www.iso.org/standard/42006", "column": "iso-more", "chipPrefix": "" }, { "id": "nist-ai-rmf", "name": "NIST AI RMF", "short": "NIST AI RMF", "type": "framework", "issuer": "NIST", "url": "https://www.nist.gov/itl/ai-risk-management-framework", "column": "nist", "chipPrefix": "" }, { "id": "csa-aicm", "name": "CSA AI Controls Matrix (AICM) v1.1", "short": "CSA AICM", "type": "controls", "issuer": "Cloud Security Alliance", "url": "https://cloudsecurityalliance.org/artifacts/ai-controls-matrix-v1-1", "column": "csa", "chipPrefix": "" }, { "id": "owasp-llm-top-10", "name": "OWASP Top 10 for LLM Applications 2026", "short": "OWASP LLM", "type": "framework", "issuer": "OWASP GenAI Security Project", "url": "https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/", "column": "owasp", "chipPrefix": "" }, { "id": "owasp-agentic-top-10", "name": "OWASP Top 10 for Agentic Applications 2026", "short": "OWASP Agentic", "type": "framework", "issuer": "OWASP GenAI Security Project", "url": "https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/", "column": "owasp", "chipPrefix": "" }, { "id": "kr-ai-basic-act", "name": "South Korea AI Basic Act", "short": "Korea AI Act", "type": "law", "issuer": "Republic of Korea", "url": "https://www.law.go.kr/LSW/lsInfoP.do?lsiSeq=268543", "column": "kr", "chipPrefix": "" }, { "id": "uk-duaa", "name": "UK Data (Use and Access) Act 2025", "short": "UK DUAA", "type": "law", "issuer": "United Kingdom", "url": "https://www.legislation.gov.uk/ukpga/2025/18/section/80", "column": "uk", "chipPrefix": "UK GDPR" }, { "id": "uk-atrs", "name": "UK Algorithmic Transparency Recording Standard (ATRS) v4.0", "short": "UK ATRS", "type": "standard", "issuer": "UK Government Digital Service", "url": "https://www.gov.uk/government/collections/algorithmic-transparency-recording-standard-hub", "column": "uk", "chipPrefix": "ATRS" }, { "id": "sg-genai-framework", "name": "Singapore Model AI Governance Framework for Generative AI", "short": "Singapore GenAI", "type": "framework", "issuer": "IMDA / AI Verify Foundation", "url": "https://aiverifyfoundation.sg/wp-content/uploads/2024/05/Model-AI-Governance-Framework-for-Generative-AI-May-2024-1-1.pdf", "column": "sg", "chipPrefix": "GenAI" }, { "id": "sg-agentic-framework", "name": "Singapore Model AI Governance Framework for Agentic AI", "short": "Singapore Agentic", "type": "framework", "issuer": "IMDA", "url": "https://www.imda.gov.sg/-/media/imda/files/about/emerging-tech-and-research/artificial-intelligence/mgf-for-agentic-ai.pdf", "column": "sg", "chipPrefix": "Agentic" }, { "id": "sg-ai-verify", "name": "AI Verify Testing Framework (Singapore, IMDA / AI Verify Foundation)", "short": "AI Verify", "type": "framework", "issuer": "IMDA / AI Verify Foundation", "url": "https://aiverifyfoundation.sg/tools/ai-verify-testing-framework/", "column": "aiverify", "chipPrefix": "" }, { "id": "coe-cets-225", "name": "Council of Europe Framework Convention on AI (CETS No. 225)", "short": "CoE Convention", "type": "law", "issuer": "Council of Europe", "url": "https://rm.coe.int/1680afae3c", "column": "intl", "chipPrefix": "CoE" }, { "id": "oecd-ai-principles", "name": "OECD AI Principles (Recommendation on AI, OECD/LEGAL/0449)", "short": "OECD AI Principles", "type": "framework", "issuer": "OECD", "url": "https://legalinstruments.oecd.org/en/instruments/OECD-LEGAL-0449", "column": "intl", "chipPrefix": "OECD" }, { "id": "g7-hiroshima-coc", "name": "G7 Hiroshima Process International Code of Conduct for Advanced AI Systems", "short": "G7 Code", "type": "code", "issuer": "G7", "url": "https://digital-strategy.ec.europa.eu/en/library/hiroshima-process-international-code-conduct-advanced-ai-systems", "column": "intl", "chipPrefix": "G7" }, { "id": "us-gao-ai-accountability", "name": "GAO AI Accountability Framework (GAO-21-519SP)", "short": "GAO AI Accountability", "type": "framework", "issuer": "U.S. Government Accountability Office", "url": "https://www.gao.gov/products/gao-21-519sp", "column": "gao", "chipPrefix": "" }, { "id": "en-18286", "name": "EN 18286:2026", "short": "EN 18286", "type": "standard", "issuer": "CEN-CENELEC", "url": "https://www.cencenelec.eu/news-events/news/2026/en-in-the-spotlight/2026-07-30-ai-quality-management/", "column": "cen", "chipPrefix": "" }, { "id": "pren-18228", "name": "prEN 18228 AI risk management (draft)", "short": "prEN 18228", "type": "standard", "issuer": "CEN-CENELEC JTC 21", "url": "https://genorma.com/en/standards/pren-18228", "column": "cen", "chipPrefix": "" }, { "id": "pren-18229-1", "name": "prEN 18229-1 AI trustworthiness framework, Part 1: logging (draft)", "short": "prEN 18229-1", "type": "standard", "issuer": "CEN-CENELEC JTC 21", "url": "https://genorma.com/en/standards/pren-18229-1", "column": "cen", "chipPrefix": "" }, { "id": "cn-tc260-framework", "name": "TC260 AI Safety Governance Framework 3.0", "short": "TC260 Framework 3.0", "type": "framework", "issuer": "TC260 under CAC guidance (China)", "url": "https://www.cac.gov.cn/rootimages/uploadimg/1791137114683961/1791137114683961.pdf", "column": "cn", "chipPrefix": "TC260" }, { "id": "cn-genai-measures", "name": "China Interim Measures for Generative AI Services (2023)", "short": "China GenAI Measures", "type": "law", "issuer": "CAC and six other bodies (China)", "url": "https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm", "column": "cn", "chipPrefix": "GenAI" }, { "id": "cn-deep-synthesis", "name": "China Provisions on Deep Synthesis (2023)", "short": "China Deep Synthesis", "type": "law", "issuer": "CAC, MIIT and MPS (China)", "url": "https://www.cac.gov.cn/2022-12/11/c_1672221949354811.htm", "column": "cn", "chipPrefix": "DeepSyn" }, { "id": "cn-algo-recommendation", "name": "China Provisions on Algorithmic Recommendation (2022)", "short": "China Algo. Rec.", "type": "law", "issuer": "CAC, MIIT, MPS and SAMR (China)", "url": "https://www.cac.gov.cn/2022-01/04/c_1642894606364259.htm", "column": "cn", "chipPrefix": "AlgoRec" }, { "id": "cn-content-labelling", "name": "China Measures for Labelling AI-Generated Synthetic Content (2025)", "short": "China AI Labelling", "type": "law", "issuer": "CAC, MIIT, MPS and NRTA (China)", "url": "https://www.cac.gov.cn/2025-03/14/c_1743654684782215.htm", "column": "cn", "chipPrefix": "Label" }, { "id": "cn-gbt-45654", "name": "GB/T 45654-2025 Basic security requirements for generative AI services", "short": "GB/T 45654", "type": "standard", "issuer": "SAMR / SAC, drafted by TC260 (China)", "url": "https://openstd.samr.gov.cn/bzgk/std/newGbInfo?hcno=F67D3F376E0A0A0FF5317FB36B32A30A", "column": "cn", "chipPrefix": "GB/T 45654" } ], "topics": [ { "id": "risk-management", "name": "Risk management", "summary": "Identifying, analysing and treating AI risks across the lifecycle, and keeping the treatment current as the system and its context change.", "layers": [ 1, 3 ], "read": [ { "label": "13. Where risk management sits", "url": "https://aigovernanceengineer.com/bok/risk-management" } ] }, { "id": "governance-accountability", "name": "Governance and accountability", "summary": "The policies, roles and accountability structures that put a named owner behind every AI decision and control.", "layers": [ 1 ], "read": [ { "label": "12. Running the AI governance program", "url": "https://aigovernanceengineer.com/bok/governance-program" } ] }, { "id": "impact-assessment", "name": "Impact assessment", "summary": "Assessing an AI system's impact on fundamental rights, individuals and society before and during deployment.", "layers": [ 1, 2 ], "read": [ { "label": "18. The EU AI Act in one pass: fundamental rights impact assessment", "url": "https://aigovernanceengineer.com/bok/eu-ai-act#fundamental-rights-impact-assessment-article-27" } ] }, { "id": "data-governance", "name": "Data governance", "summary": "Governing the data an AI system trains on and processes: lawful sourcing, quality, lineage and protection of personal and input data.", "layers": [ 2, 3 ], "read": [ { "label": "14. Governing AI development", "url": "https://aigovernanceengineer.com/bok/governing-development" } ] }, { "id": "documentation-transparency", "name": "Documentation and transparency", "summary": "Technical documentation, disclosures and content labelling that make an AI system legible to regulators, deployers and users.", "layers": [ 2 ], "read": [] }, { "id": "inventory-registration", "name": "Inventory and registration", "summary": "Keeping an inventory of AI systems and agents and, where required, registering or filing them with the authorities.", "layers": [ 2 ], "read": [ { "label": "11. AI, defined for governance", "url": "https://aigovernanceengineer.com/bok/ai-defined" } ] }, { "id": "logging-traceability", "name": "Logging and traceability", "summary": "Automatic, tamper-evident logs and records that make an AI system's behaviour reconstructable after the fact.", "layers": [ 4 ], "read": [] }, { "id": "human-oversight", "name": "Human oversight", "summary": "Human-in-the-loop checkpoints, approval gates and the ability to intervene in or stop an AI system.", "layers": [ 4 ], "read": [] }, { "id": "runtime-guardrails", "name": "Runtime guardrails", "summary": "Controls that constrain an AI system while it runs: input/output filtering, tool-invocation limits, isolation and memory management.", "layers": [ 4 ], "read": [] }, { "id": "robustness-security-evals", "name": "Robustness, security and evaluations", "summary": "Testing an AI system for accuracy, robustness, security and adversarial failure, including red-teaming and sandbox validation.", "layers": [ 3, 4 ], "read": [] }, { "id": "incident-monitoring", "name": "Incident response and monitoring", "summary": "Post-market monitoring, incident detection and reporting, and the complaint channels that surface real-world failures.", "layers": [ 5 ], "read": [ { "label": "17. Incidents, issues and root causes", "url": "https://aigovernanceengineer.com/bok/incidents" } ] }, { "id": "supply-chain", "name": "Supply chain and third parties", "summary": "Allocating responsibility along the AI value chain and managing risks from third-party models, data, tools and technical supporters.", "layers": [ 2, 5 ], "read": [ { "label": "18. The EU AI Act in one pass: who you are in the value chain", "url": "https://aigovernanceengineer.com/bok/eu-ai-act#who-you-are-in-the-value-chain" } ] }, { "id": "prohibited-practices", "name": "Prohibited practices", "summary": "Uses of AI that a jurisdiction bans outright or a framework treats as unacceptable, and the intake controls that keep them out of the portfolio.", "layers": [ 1 ], "read": [ { "label": "18. The EU AI Act in one pass: prohibited practices", "url": "https://aigovernanceengineer.com/bok/eu-ai-act#prohibited-practices-article-5" } ] }, { "id": "fairness-non-discrimination", "name": "Fairness and non-discrimination", "summary": "Detecting and correcting bias in data, models and outcomes, and the lawful handling of the sensitive data that bias testing needs.", "layers": [ 2, 3 ], "read": [ { "label": "16. Fairness and explainability for practitioners", "url": "https://aigovernanceengineer.com/bok/fairness-and-explainability" } ] }, { "id": "privacy-data-protection", "name": "Privacy and data protection", "summary": "Lawful basis, minimisation, privacy by design and the privacy attacks specific to models, wherever an AI system touches personal data.", "layers": [ 1, 2, 4 ], "read": [ { "label": "19. Privacy and data protection law applied to AI", "url": "https://aigovernanceengineer.com/bok/privacy-and-ai" } ] }, { "id": "explainability", "name": "Explainability and right to explanation", "summary": "Explaining a model and an individual output to the people who use it or are affected by it, and the legal rights to an explanation and to contest.", "layers": [ 2, 4 ], "read": [ { "label": "18. The EU AI Act in one pass: explanation and notice to affected people", "url": "https://aigovernanceengineer.com/bok/eu-ai-act#explanation-and-notice-to-affected-people" } ] }, { "id": "ai-literacy", "name": "AI literacy and competence", "summary": "Making sure the people who build, operate, oversee and use an AI system have the knowledge their role needs, with a record that shows it.", "layers": [ 1 ], "read": [ { "label": "18. The EU AI Act in one pass: AI literacy and bias-detection data", "url": "https://aigovernanceengineer.com/bok/eu-ai-act#ai-literacy-and-bias-detection-data" } ] }, { "id": "conformity-assessment", "name": "Conformity assessment and certification", "summary": "Demonstrating conformity before market entry, independent audit and certification, and the standards that carry a presumption of conformity.", "layers": [ 5 ], "read": [ { "label": "18. The EU AI Act in one pass: conformity assessment, declaration, marking and registration", "url": "https://aigovernanceengineer.com/bok/eu-ai-act#conformity-assessment-declaration-marking-and-registration" } ] }, { "id": "gpai-foundation-models", "name": "GPAI and foundation models", "summary": "Duties that attach to general-purpose and foundation models themselves: documentation for downstream providers, evaluation, and systemic-risk management.", "layers": [ 2, 3 ], "read": [ { "label": "18. The EU AI Act in one pass: general-purpose AI models", "url": "https://aigovernanceengineer.com/bok/eu-ai-act#general-purpose-ai-models" } ] }, { "id": "ip-copyright", "name": "IP and copyright", "summary": "Lawful access to training content, honouring rights reservations, and keeping outputs from reproducing protected works.", "layers": [ 2 ], "read": [ { "label": "20. Other law that already applies to AI", "url": "https://aigovernanceengineer.com/bok/existing-law" } ] }, { "id": "agent-identity-autonomy", "name": "Agent identity and autonomy", "summary": "Giving each agent its own identity and scoped permissions, bounding what it may do on its own, and keeping a human able to stop it.", "layers": [ 2, 4 ], "read": [ { "label": "05. Patterns: Agent Identity & Scoped Credentials", "url": "https://aigovernanceengineer.com/bok/patterns#pattern-agent-identity--scoped-credentials" } ] }, { "id": "content-provenance", "name": "Content provenance and deepfakes", "summary": "Marking synthetic content so it can be detected, labelling deepfakes for the people who see them, and verifying where content came from.", "layers": [ 2, 4 ], "read": [ { "label": "18. The EU AI Act in one pass: transparency cases", "url": "https://aigovernanceengineer.com/bok/eu-ai-act#transparency-cases-article-50" } ] }, { "id": "sandboxes-real-world-testing", "name": "Sandboxes and real-world testing", "summary": "Supervised regulatory sandboxes and testing in real-world conditions, with the plans, consent records and reversal paths they require.", "layers": [ 3 ], "read": [ { "label": "18. The EU AI Act in one pass: sandboxes and real-world testing", "url": "https://aigovernanceengineer.com/bok/eu-ai-act#sandboxes-and-real-world-testing" } ] }, { "id": "environmental-impact", "name": "Environmental impact", "summary": "Measuring and reporting the energy and resource use of training and running AI systems, and weighing it in design decisions.", "layers": [ 2, 5 ], "read": [ { "label": "22. Principles, soft law and standards: OECD AI Principles", "url": "https://aigovernanceengineer.com/bok/principles-and-standards#oecd-ai-principles" } ] }, { "id": "deployment-change-decommissioning", "name": "Deployment, change and decommissioning", "summary": "Putting a system into service, controlling changes that alter its risk, and withdrawing or retiring it safely when it no longer performs as intended.", "layers": [ 4, 5 ], "read": [ { "label": "15. Governing deployment and use", "url": "https://aigovernanceengineer.com/bok/governing-deployment" } ] } ], "references": [ { "topic": "risk-management", "framework": "eu-ai-act", "frameworkShort": "EU AI Act", "column": "eu", "reference": "Art. 9", "clauseId": "art-9", "label": "Art. 9", "title": "Risk management system", "strength": "core", "verified": true, "note": "Iterative, lifecycle risk management; the backbone of the risk register.", "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng#art_9", "obligation": "EU AI Act Art. 9 risk management system", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-eu-ai-act-art-9-risk-management-system", "obligationId": "AIGE-OBL-EUAIA-ART9", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-euaia-art9", "see": null }, { "topic": "risk-management", "framework": "iso-42001", "frameworkShort": "ISO 42001", "column": "iso", "reference": "6.1.2", "clauseId": "_6.1.2", "label": "6.1.2", "title": "AI risk assessment", "strength": "core", "verified": true, "note": "Planning-stage AI risk assessment.", "url": "https://www.iso.org/standard/42001", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "risk-management", "framework": "iso-42001", "frameworkShort": "ISO 42001", "column": "iso", "reference": "6.1.3", "clauseId": "_6.1.3", "label": "6.1.3", "title": "AI risk treatment", "strength": "core", "verified": true, "note": null, "url": "https://www.iso.org/standard/42001", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "risk-management", "framework": "iso-42001", "frameworkShort": "ISO 42001", "column": "iso", "reference": "8.2", "clauseId": "_8.2", "label": "8.2", "title": "AI risk assessment (operation)", "strength": "core", "verified": true, "note": null, "url": "https://www.iso.org/standard/42001", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "risk-management", "framework": "iso-42001", "frameworkShort": "ISO 42001", "column": "iso", "reference": "8.3", "clauseId": "_8.3", "label": "8.3", "title": "AI risk treatment (operation)", "strength": "core", "verified": true, "note": null, "url": "https://www.iso.org/standard/42001", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "risk-management", "framework": "iso-42001", "frameworkShort": "ISO 42001", "column": "iso", "reference": "A.6", "clauseId": "a.6", "label": "A.6", "title": "AI system life cycle", "strength": "related", "verified": true, "note": "Lifecycle controls operationalise the risk treatment.", "url": "https://www.iso.org/standard/42001", "obligation": "A.6 AI system life cycle", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-a6-ai-system-life-cycle", "obligationId": "AIGE-OBL-ISO42001-A6", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-iso42001-a6", "see": null }, { "topic": "risk-management", "framework": "nist-ai-rmf", "frameworkShort": "NIST AI RMF", "column": "nist", "reference": "MAP 1", "clauseId": "map-1", "label": "MAP 1", "title": "MAP 1: Context is established and understood", "strength": "core", "verified": true, "note": null, "url": "https://airc.nist.gov/airmf-resources/airmf/", "obligation": "MAP", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-map", "obligationId": "AIGE-OBL-NISTRMF-MAP", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-nistrmf-map", "see": null }, { "topic": "risk-management", "framework": "nist-ai-rmf", "frameworkShort": "NIST AI RMF", "column": "nist", "reference": "MAP 5", "clauseId": "map-5", "label": "MAP 5", "title": "MAP 5: Impacts to individuals, groups, communities, organizations, and society are characterized", "strength": "core", "verified": true, "note": null, "url": "https://airc.nist.gov/airmf-resources/airmf/", "obligation": "MAP", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-map", "obligationId": "AIGE-OBL-NISTRMF-MAP", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-nistrmf-map", "see": null }, { "topic": "risk-management", "framework": "nist-ai-rmf", "frameworkShort": "NIST AI RMF", "column": "nist", "reference": "MANAGE 1", "clauseId": "manage-1", "label": "MANAGE 1", "title": "MANAGE 1: AI risks based on assessments and other analytical output are prioritized, responded to, and managed", "strength": "core", "verified": true, "note": null, "url": "https://airc.nist.gov/airmf-resources/airmf/", "obligation": "MANAGE", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-manage", "obligationId": "AIGE-OBL-NISTRMF-MANAGE", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-nistrmf-manage", "see": null }, { "topic": "risk-management", "framework": "nist-ai-rmf", "frameworkShort": "NIST AI RMF", "column": "nist", "reference": "MEASURE 2", "clauseId": "measure-2", "label": "MEASURE 2", "title": "MEASURE 2: AI systems are evaluated for trustworthy characteristics", "strength": "related", "verified": true, "note": "Measurement feeds the risk picture.", "url": "https://airc.nist.gov/airmf-resources/airmf/", "obligation": "MEASURE", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-measure", "obligationId": "AIGE-OBL-NISTRMF-MEASURE", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-nistrmf-measure", "see": null }, { "topic": "risk-management", "framework": "cn-tc260-framework", "frameworkShort": "TC260 Framework 3.0", "column": "cn", "reference": "2", "clauseId": "_2", "label": "TC260 2", "title": "Classification of AI safety risks", "strength": "core", "verified": true, "note": "Three-way taxonomy: inherent / application / secondary (derivative) safety risks; printed p. 54.", "url": "https://www.cac.gov.cn/rootimages/uploadimg/1791137114683961/1791137114683961.pdf", "obligation": "TC260 AI Safety Governance Framework 3.0: operators' guidelines §5.3 (voluntary; 2026-09-14)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-tc260-ai-safety-governance-framework-30-operators-guidelines-53-voluntary-2026-09-14", "obligationId": "AIGE-OBL-CN-TC260-OPS", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-cn-tc260-ops", "see": null }, { "topic": "risk-management", "framework": "cn-tc260-framework", "frameworkShort": "TC260 Framework 3.0", "column": "cn", "reference": "Summary table", "clauseId": "summary-table", "label": "TC260 Summary table", "title": "Risks × technological × governance measures", "strength": "core", "verified": true, "note": "Maps each risk class to its countermeasures; printed pp. 107-108.", "url": "https://www.cac.gov.cn/rootimages/uploadimg/1791137114683961/1791137114683961.pdf", "obligation": "TC260 AI Safety Governance Framework 3.0: operators' guidelines §5.3 (voluntary; 2026-09-14)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-tc260-ai-safety-governance-framework-30-operators-guidelines-53-voluntary-2026-09-14", "obligationId": "AIGE-OBL-CN-TC260-OPS", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-cn-tc260-ops", "see": null }, { "topic": "risk-management", "framework": "cn-tc260-framework", "frameworkShort": "TC260 Framework 3.0", "column": "cn", "reference": "5.3.19", "clauseId": "_5.3.19", "label": "TC260 5.3.19", "title": "Re-assessment on material change", "strength": "related", "verified": true, "note": "Re-run the risk assessment when the system materially changes; printed p. 104.", "url": "https://www.cac.gov.cn/rootimages/uploadimg/1791137114683961/1791137114683961.pdf", "obligation": "TC260 AI Safety Governance Framework 3.0: operators' guidelines §5.3 (voluntary; 2026-09-14)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-tc260-ai-safety-governance-framework-30-operators-guidelines-53-voluntary-2026-09-14", "obligationId": "AIGE-OBL-CN-TC260-OPS", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-cn-tc260-ops", "see": null }, { "topic": "risk-management", "framework": "cn-genai-measures", "frameworkShort": "China GenAI Measures", "column": "cn", "reference": "Art. 17", "clauseId": "art-17", "label": "GenAI Art. 17", "title": "Security assessment and algorithm filing", "strength": "related", "verified": true, "note": "Security assessment for services with public-opinion attributes; CAC text.", "url": "https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm", "obligation": "Interim Measures for Generative AI Services (in force 2023-08-15)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-interim-measures-for-generative-ai-services-in-force-2023-08-15", "obligationId": "AIGE-OBL-CN-GENAI", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-cn-genai", "see": null }, { "topic": "risk-management", "framework": "cn-algo-recommendation", "frameworkShort": "China Algo. Rec.", "column": "cn", "reference": "Art. 27", "clauseId": "art-27", "label": "AlgoRec Art. 27", "title": "Security assessment", "strength": "related", "verified": true, "note": "Security assessment for recommendation services with public-opinion or social-mobilization capacity; CAC text.", "url": "https://www.cac.gov.cn/2022-01/04/c_1642894606364259.htm", "obligation": "Provisions on Algorithmic Recommendation (in force 2022-03-01)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-provisions-on-algorithmic-recommendation-in-force-2022-03-01", "obligationId": "AIGE-OBL-CN-ALGOREC", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-cn-algorec", "see": null }, { "topic": "governance-accountability", "framework": "eu-ai-act", "frameworkShort": "EU AI Act", "column": "eu", "reference": "Art. 17", "clauseId": "art-17", "label": "Art. 17", "title": "Quality management system", "strength": "core", "verified": true, "note": "The QMS that assigns and documents responsibilities.", "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng#art_17", "obligation": "EU AI Act Art. 17 quality management system", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-eu-ai-act-art-17-quality-management-system", "obligationId": "AIGE-OBL-EUAIA-ART17", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-euaia-art17", "see": null }, { "topic": "governance-accountability", "framework": "eu-ai-act", "frameworkShort": "EU AI Act", "column": "eu", "reference": "Art. 4", "clauseId": "art-4", "label": "Art. 4", "title": "AI literacy", "strength": "related", "verified": true, "note": "Staff competence underpins accountable operation.", "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng#art_4", "obligation": "EU AI Act Art. 4 AI literacy", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-eu-ai-act-art-4-ai-literacy", "obligationId": "AIGE-OBL-EUAIA-ART4", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-euaia-art4", "see": null }, { "topic": "governance-accountability", "framework": "iso-42001", "frameworkShort": "ISO 42001", "column": "iso", "reference": "5.1", "clauseId": "_5.1", "label": "5.1", "title": "Leadership and commitment", "strength": "core", "verified": true, "note": null, "url": "https://www.iso.org/standard/42001", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "governance-accountability", "framework": "iso-42001", "frameworkShort": "ISO 42001", "column": "iso", "reference": "5.2", "clauseId": "_5.2", "label": "5.2", "title": "AI policy", "strength": "core", "verified": true, "note": null, "url": "https://www.iso.org/standard/42001", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "governance-accountability", "framework": "iso-42001", "frameworkShort": "ISO 42001", "column": "iso", "reference": "5.3", "clauseId": "_5.3", "label": "5.3", "title": "Roles, responsibilities and authorities", "strength": "core", "verified": true, "note": null, "url": "https://www.iso.org/standard/42001", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "governance-accountability", "framework": "iso-42001", "frameworkShort": "ISO 42001", "column": "iso", "reference": "A.2", "clauseId": "a.2", "label": "A.2", "title": "Policies related to AI", "strength": "core", "verified": true, "note": null, "url": "https://www.iso.org/standard/42001", "obligation": "A.2 Policies related to AI", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-a2-policies-related-to-ai", "obligationId": "AIGE-OBL-ISO42001-A2", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-iso42001-a2", "see": null }, { "topic": "governance-accountability", "framework": "iso-42001", "frameworkShort": "ISO 42001", "column": "iso", "reference": "A.3", "clauseId": "a.3", "label": "A.3", "title": "Internal organization", "strength": "core", "verified": true, "note": null, "url": "https://www.iso.org/standard/42001", "obligation": "A.3 Internal organization", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-a3-internal-organization", "obligationId": "AIGE-OBL-ISO42001-A3", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-iso42001-a3", "see": null }, { "topic": "governance-accountability", "framework": "nist-ai-rmf", "frameworkShort": "NIST AI RMF", "column": "nist", "reference": "GOVERN 1", "clauseId": "govern-1", "label": "GOVERN 1", "title": "GOVERN 1: Policies, processes, procedures, and practices across the organization related to the mapping, measuring, and managing of AI risks are in place, transparent, and implemented effectively", "strength": "core", "verified": true, "note": null, "url": "https://airc.nist.gov/airmf-resources/airmf/", "obligation": "GOVERN", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-govern", "obligationId": "AIGE-OBL-NISTRMF-GOVERN", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-nistrmf-govern", "see": null }, { "topic": "governance-accountability", "framework": "nist-ai-rmf", "frameworkShort": "NIST AI RMF", "column": "nist", "reference": "GOVERN 2", "clauseId": "govern-2", "label": "GOVERN 2", "title": "GOVERN 2: Accountability structures are in place so that the appropriate teams and individuals are empowered, responsible, and trained", "strength": "core", "verified": true, "note": null, "url": "https://airc.nist.gov/airmf-resources/airmf/", "obligation": "GOVERN", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-govern", "obligationId": "AIGE-OBL-NISTRMF-GOVERN", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-nistrmf-govern", "see": null }, { "topic": "governance-accountability", "framework": "cn-tc260-framework", "frameworkShort": "TC260 Framework 3.0", "column": "cn", "reference": "4", "clauseId": "_4", "label": "TC260 4", "title": "Comprehensive governance measures", "strength": "core", "verified": true, "note": "Organisational and institutional governance measures; printed p. 85.", "url": "https://www.cac.gov.cn/rootimages/uploadimg/1791137114683961/1791137114683961.pdf", "obligation": "TC260 AI Safety Governance Framework 3.0: operators' guidelines §5.3 (voluntary; 2026-09-14)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-tc260-ai-safety-governance-framework-30-operators-guidelines-53-voluntary-2026-09-14", "obligationId": "AIGE-OBL-CN-TC260-OPS", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-cn-tc260-ops", "see": null }, { "topic": "governance-accountability", "framework": "cn-tc260-framework", "frameworkShort": "TC260 Framework 3.0", "column": "cn", "reference": "5.3.12", "clauseId": "_5.3.12", "label": "TC260 5.3.12", "title": "Traceable chain of responsibility", "strength": "core", "verified": true, "note": "A traceable responsibility chain across the lifecycle; printed p. 103.", "url": "https://www.cac.gov.cn/rootimages/uploadimg/1791137114683961/1791137114683961.pdf", "obligation": "TC260 AI Safety Governance Framework 3.0: operators' guidelines §5.3 (voluntary; 2026-09-14)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-tc260-ai-safety-governance-framework-30-operators-guidelines-53-voluntary-2026-09-14", "obligationId": "AIGE-OBL-CN-TC260-OPS", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-cn-tc260-ops", "see": null }, { "topic": "governance-accountability", "framework": "cn-genai-measures", "frameworkShort": "China GenAI Measures", "column": "cn", "reference": "Art. 9", "clauseId": "art-9", "label": "GenAI Art. 9", "title": "Provider responsibility as content producer", "strength": "core", "verified": true, "note": "Providers bear network-information content-producer responsibility; CAC text.", "url": "https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm", "obligation": "Interim Measures for Generative AI Services (in force 2023-08-15)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-interim-measures-for-generative-ai-services-in-force-2023-08-15", "obligationId": "AIGE-OBL-CN-GENAI", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-cn-genai", "see": null }, { "topic": "governance-accountability", "framework": "cn-algo-recommendation", "frameworkShort": "China Algo. Rec.", "column": "cn", "reference": "Art. 7", "clauseId": "art-7", "label": "AlgoRec Art. 7", "title": "Algorithm-security responsibility system", "strength": "core", "verified": true, "note": "Providers establish algorithm-security management systems; CAC text.", "url": "https://www.cac.gov.cn/2022-01/04/c_1642894606364259.htm", "obligation": "Provisions on Algorithmic Recommendation (in force 2022-03-01)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-provisions-on-algorithmic-recommendation-in-force-2022-03-01", "obligationId": "AIGE-OBL-CN-ALGOREC", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-cn-algorec", "see": null }, { "topic": "governance-accountability", "framework": "cn-deep-synthesis", "frameworkShort": "China Deep Synthesis", "column": "cn", "reference": "Art. 7", "clauseId": "art-7", "label": "DeepSyn Art. 7", "title": "Information-security responsibility system", "strength": "core", "verified": true, "note": "Providers establish management systems (registration, review, ethics, data and personal-information protection); CAC text.", "url": "https://www.cac.gov.cn/2022-12/11/c_1672221949354811.htm", "obligation": "Provisions on Deep Synthesis (in force 2023-01-10)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-provisions-on-deep-synthesis-in-force-2023-01-10", "obligationId": "AIGE-OBL-CN-DEEPSYN", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-cn-deepsyn", "see": null }, { "topic": "impact-assessment", "framework": "eu-ai-act", "frameworkShort": "EU AI Act", "column": "eu", "reference": "Art. 27", "clauseId": "art-27", "label": "Art. 27", "title": "Fundamental rights impact assessment for high-risk AI systems", "strength": "core", "verified": true, "note": "See pattern: /bok/patterns#pattern-fria-as-code", "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng#art_27", "obligation": "EU AI Act Art. 27 Fundamental Rights Impact Assessment (FRIA)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-eu-ai-act-art-27-fundamental-rights-impact-assessment-fria", "obligationId": "AIGE-OBL-EUAIA-ART27", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-euaia-art27", "see": null }, { "topic": "impact-assessment", "framework": "eu-ai-act", "frameworkShort": "EU AI Act", "column": "eu", "reference": "Art. 9", "clauseId": "art-9", "label": "Art. 9", "title": "Risk management system", "strength": "related", "verified": true, "note": "Risk management and the FRIA cross-reference each other.", "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng#art_9", "obligation": "EU AI Act Art. 9 risk management system", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-eu-ai-act-art-9-risk-management-system", "obligationId": "AIGE-OBL-EUAIA-ART9", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-euaia-art9", "see": null }, { "topic": "impact-assessment", "framework": "iso-42001", "frameworkShort": "ISO 42001", "column": "iso", "reference": "6.1.4", "clauseId": "_6.1.4", "label": "6.1.4", "title": "AI system impact assessment", "strength": "core", "verified": true, "note": null, "url": "https://www.iso.org/standard/42001", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "impact-assessment", "framework": "iso-42001", "frameworkShort": "ISO 42001", "column": "iso", "reference": "8.4", "clauseId": "_8.4", "label": "8.4", "title": "AI system impact assessment (operation)", "strength": "core", "verified": true, "note": null, "url": "https://www.iso.org/standard/42001", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "impact-assessment", "framework": "iso-42001", "frameworkShort": "ISO 42001", "column": "iso", "reference": "A.5", "clauseId": "a.5", "label": "A.5", "title": "Assessing impacts of AI systems", "strength": "core", "verified": true, "note": "See pattern: /bok/patterns#pattern-fria-as-code", "url": "https://www.iso.org/standard/42001", "obligation": "A.5 Assessing impacts of AI systems", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-a5-assessing-impacts-of-ai-systems", "obligationId": "AIGE-OBL-ISO42001-A5", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-iso42001-a5", "see": null }, { "topic": "impact-assessment", "framework": "nist-ai-rmf", "frameworkShort": "NIST AI RMF", "column": "nist", "reference": "MAP 3", "clauseId": "map-3", "label": "MAP 3", "title": "MAP 3: AI capabilities, targeted usage, goals, and expected benefits and costs are understood", "strength": "core", "verified": true, "note": null, "url": "https://airc.nist.gov/airmf-resources/airmf/", "obligation": "MAP", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-map", "obligationId": "AIGE-OBL-NISTRMF-MAP", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-nistrmf-map", "see": null }, { "topic": "impact-assessment", "framework": "nist-ai-rmf", "frameworkShort": "NIST AI RMF", "column": "nist", "reference": "MAP 5", "clauseId": "map-5", "label": "MAP 5", "title": "MAP 5: Impacts to individuals, groups, communities, organizations, and society are characterized", "strength": "core", "verified": true, "note": null, "url": "https://airc.nist.gov/airmf-resources/airmf/", "obligation": "MAP", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-map", "obligationId": "AIGE-OBL-NISTRMF-MAP", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-nistrmf-map", "see": null }, { "topic": "impact-assessment", "framework": "cn-tc260-framework", "frameworkShort": "TC260 Framework 3.0", "column": "cn", "reference": "Appendix 1", "clauseId": "appendix-1", "label": "TC260 Appendix 1", "title": "Grading principles", "strength": "core", "verified": true, "note": "Grading principles for classifying risk; printed pp. 109-112.", "url": "https://www.cac.gov.cn/rootimages/uploadimg/1791137114683961/1791137114683961.pdf", "obligation": "TC260 AI Safety Governance Framework 3.0: operators' guidelines §5.3 (voluntary; 2026-09-14)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-tc260-ai-safety-governance-framework-30-operators-guidelines-53-voluntary-2026-09-14", "obligationId": "AIGE-OBL-CN-TC260-OPS", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-cn-tc260-ops", "see": null }, { "topic": "impact-assessment", "framework": "cn-tc260-framework", "frameworkShort": "TC260 Framework 3.0", "column": "cn", "reference": "2.2", "clauseId": "_2.2", "label": "TC260 2.2", "title": "Safety risks in the application of AI", "strength": "related", "verified": true, "note": "Application-layer risks to assess (agentic, embodied, cybersecurity, content, personal information, real-world); printed p. 60.", "url": "https://www.cac.gov.cn/rootimages/uploadimg/1791137114683961/1791137114683961.pdf", "obligation": "TC260 AI Safety Governance Framework 3.0: operators' guidelines §5.3 (voluntary; 2026-09-14)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-tc260-ai-safety-governance-framework-30-operators-guidelines-53-voluntary-2026-09-14", "obligationId": "AIGE-OBL-CN-TC260-OPS", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-cn-tc260-ops", "see": null }, { "topic": "impact-assessment", "framework": "cn-genai-measures", "frameworkShort": "China GenAI Measures", "column": "cn", "reference": "Art. 17", "clauseId": "art-17", "label": "GenAI Art. 17", "title": "Security assessment", "strength": "core", "verified": true, "note": "Pre-deployment security assessment for public-opinion services; CAC text.", "url": "https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm", "obligation": "Interim Measures for Generative AI Services (in force 2023-08-15)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-interim-measures-for-generative-ai-services-in-force-2023-08-15", "obligationId": "AIGE-OBL-CN-GENAI", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-cn-genai", "see": null }, { "topic": "data-governance", "framework": "eu-ai-act", "frameworkShort": "EU AI Act", "column": "eu", "reference": "Art. 10", "clauseId": "art-10", "label": "Art. 10", "title": "Data and data governance", "strength": "core", "verified": true, "note": "Training, validation and test data quality and governance.", "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng#art_10", "obligation": "EU AI Act Art. 10 data and data governance", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-eu-ai-act-art-10-data-and-data-governance", "obligationId": "AIGE-OBL-EUAIA-ART10", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-euaia-art10", "see": null }, { "topic": "data-governance", "framework": "eu-ai-act", "frameworkShort": "EU AI Act", "column": "eu", "reference": "Art. 4a", "clauseId": "art-4a", "label": "Art. 4a", "title": "Special-category data for bias detection", "strength": "related", "verified": true, "note": "Post-Omnibus new article: a lawful basis to process special-category data to detect and correct bias.", "url": null, "obligation": "EU AI Act Art. 4a lawful basis for special-category data in bias detection", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-eu-ai-act-art-4a-lawful-basis-for-special-category-data-in-bias-detection", "obligationId": "AIGE-OBL-EUAIA-ART4A", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-euaia-art4a", "see": null }, { "topic": "data-governance", "framework": "iso-42001", "frameworkShort": "ISO 42001", "column": "iso", "reference": "A.7", "clauseId": "a.7", "label": "A.7", "title": "Data for AI systems", "strength": "core", "verified": true, "note": null, "url": "https://www.iso.org/standard/42001", "obligation": "A.7 Data for AI systems", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-a7-data-for-ai-systems", "obligationId": "AIGE-OBL-ISO42001-A7", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-iso42001-a7", "see": null }, { "topic": "data-governance", "framework": "iso-42001", "frameworkShort": "ISO 42001", "column": "iso", "reference": "A.4", "clauseId": "a.4", "label": "A.4", "title": "Resources for AI systems", "strength": "related", "verified": true, "note": "Data as a governed resource.", "url": "https://www.iso.org/standard/42001", "obligation": "A.4 Resources for AI systems", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-a4-resources-for-ai-systems", "obligationId": "AIGE-OBL-ISO42001-A4", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-iso42001-a4", "see": null }, { "topic": "data-governance", "framework": "nist-ai-rmf", "frameworkShort": "NIST AI RMF", "column": "nist", "reference": "MAP 2", "clauseId": "map-2", "label": "MAP 2", "title": "MAP 2: Categorization of the AI system is performed", "strength": "related", "verified": true, "note": "Data categorisation and provenance.", "url": "https://airc.nist.gov/airmf-resources/airmf/", "obligation": "MAP", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-map", "obligationId": "AIGE-OBL-NISTRMF-MAP", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-nistrmf-map", "see": null }, { "topic": "data-governance", "framework": "nist-ai-rmf", "frameworkShort": "NIST AI RMF", "column": "nist", "reference": "MEASURE 2.10", "clauseId": "measure-2.10", "label": "MEASURE 2.10", "title": "MEASURE 2.10: Privacy risk of the AI system is examined and documented", "strength": "related", "verified": true, "note": null, "url": "https://airc.nist.gov/airmf-resources/airmf/", "obligation": "MEASURE", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-measure", "obligationId": "AIGE-OBL-NISTRMF-MEASURE", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-nistrmf-measure", "see": null }, { "topic": "data-governance", "framework": "nist-ai-rmf", "frameworkShort": "NIST AI RMF", "column": "nist", "reference": "MEASURE 2.11", "clauseId": "measure-2.11", "label": "MEASURE 2.11", "title": "MEASURE 2.11: Fairness and bias are evaluated and results are documented", "strength": "related", "verified": true, "note": null, "url": "https://airc.nist.gov/airmf-resources/airmf/", "obligation": "MEASURE", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-measure", "obligationId": "AIGE-OBL-NISTRMF-MEASURE", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-nistrmf-measure", "see": null }, { "topic": "data-governance", "framework": "cn-tc260-framework", "frameworkShort": "TC260 Framework 3.0", "column": "cn", "reference": "2.1.3", "clauseId": "_2.1.3", "label": "TC260 2.1.3", "title": "Data safety risks", "strength": "core", "verified": true, "note": "Inherent data risks (quality, poisoning, leakage); printed p. 57.", "url": "https://www.cac.gov.cn/rootimages/uploadimg/1791137114683961/1791137114683961.pdf", "obligation": "TC260 AI Safety Governance Framework 3.0: operators' guidelines §5.3 (voluntary; 2026-09-14)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-tc260-ai-safety-governance-framework-30-operators-guidelines-53-voluntary-2026-09-14", "obligationId": "AIGE-OBL-CN-TC260-OPS", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-cn-tc260-ops", "see": null }, { "topic": "data-governance", "framework": "cn-tc260-framework", "frameworkShort": "TC260 Framework 3.0", "column": "cn", "reference": "5.1", "clauseId": "_5.1", "label": "TC260 5.1", "title": "Model R&D safety guidelines", "strength": "related", "verified": true, "note": "Training-data governance during model R&D; printed p. 95.", "url": "https://www.cac.gov.cn/rootimages/uploadimg/1791137114683961/1791137114683961.pdf", "obligation": "TC260 AI Safety Governance Framework 3.0: operators' guidelines §5.3 (voluntary; 2026-09-14)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-tc260-ai-safety-governance-framework-30-operators-guidelines-53-voluntary-2026-09-14", "obligationId": "AIGE-OBL-CN-TC260-OPS", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-cn-tc260-ops", "see": null }, { "topic": "data-governance", "framework": "cn-genai-measures", "frameworkShort": "China GenAI Measures", "column": "cn", "reference": "Art. 7", "clauseId": "art-7", "label": "GenAI Art. 7", "title": "Training-data lawful sourcing", "strength": "core", "verified": true, "note": "Lawful sources, IP and personal-information compliance for training data; CAC text.", "url": "https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm", "obligation": "Interim Measures for Generative AI Services (in force 2023-08-15)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-interim-measures-for-generative-ai-services-in-force-2023-08-15", "obligationId": "AIGE-OBL-CN-GENAI", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-cn-genai", "see": null }, { "topic": "data-governance", "framework": "cn-genai-measures", "frameworkShort": "China GenAI Measures", "column": "cn", "reference": "Art. 8", "clauseId": "art-8", "label": "GenAI Art. 8", "title": "Data-annotation standards", "strength": "core", "verified": true, "note": "Clear, specific annotation rules and quality checks; CAC text.", "url": "https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm", "obligation": "Interim Measures for Generative AI Services (in force 2023-08-15)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-interim-measures-for-generative-ai-services-in-force-2023-08-15", "obligationId": "AIGE-OBL-CN-GENAI", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-cn-genai", "see": null }, { "topic": "data-governance", "framework": "cn-genai-measures", "frameworkShort": "China GenAI Measures", "column": "cn", "reference": "Art. 11", "clauseId": "art-11", "label": "GenAI Art. 11", "title": "Protection of user input and records", "strength": "core", "verified": true, "note": "No unlawful retention of user input and usage records; CAC text.", "url": "https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm", "obligation": "Interim Measures for Generative AI Services (in force 2023-08-15)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-interim-measures-for-generative-ai-services-in-force-2023-08-15", "obligationId": "AIGE-OBL-CN-GENAI", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-cn-genai", "see": null }, { "topic": "data-governance", "framework": "cn-deep-synthesis", "frameworkShort": "China Deep Synthesis", "column": "cn", "reference": "Art. 14", "clauseId": "art-14", "label": "DeepSyn Art. 14", "title": "Training-data management", "strength": "core", "verified": true, "note": "Providers and technical supporters secure training data and personal information; CAC text.", "url": "https://www.cac.gov.cn/2022-12/11/c_1672221949354811.htm", "obligation": "Provisions on Deep Synthesis (in force 2023-01-10)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-provisions-on-deep-synthesis-in-force-2023-01-10", "obligationId": "AIGE-OBL-CN-DEEPSYN", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-cn-deepsyn", "see": null }, { "topic": "data-governance", "framework": "cn-gbt-45654", "frameworkShort": "GB/T 45654", "column": "cn", "reference": "Corpus security", "clauseId": "corpus-security", "label": "GB/T 45654 Corpus security", "title": "Training-corpus (data) security requirements", "strength": "core", "verified": false, "note": "GB/T 45654-2025 corpus-security requirements (TC260-003 predecessor §5). The official listing shows the standard as current (issued 2025-04-25, implemented 2025-11-01; checked 2026-09-24), but the full text is only offered there as an image preview, so the clause id is not verified against it.", "url": "https://openstd.samr.gov.cn/bzgk/std/newGbInfo?hcno=F67D3F376E0A0A0FF5317FB36B32A30A", "obligation": "GB/T 45654-2025 Basic security requirements for generative AI services (voluntary; implemented 2025-11-01)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-gbt-45654-2025-basic-security-requirements-for-generative-ai-services-voluntary-implemented-2025-11-01", "obligationId": "AIGE-OBL-CN-GBT45654", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-cn-gbt45654", "see": null }, { "topic": "documentation-transparency", "framework": "eu-ai-act", "frameworkShort": "EU AI Act", "column": "eu", "reference": "Art. 11", "clauseId": "art-11", "label": "Art. 11", "title": "Technical documentation", "strength": "core", "verified": true, "note": "Annex IV technical documentation.", "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng#art_11", "obligation": "EU AI Act Art. 11 technical documentation (Annex IV)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-eu-ai-act-art-11-technical-documentation-annex-iv", "obligationId": "AIGE-OBL-EUAIA-ART11", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-euaia-art11", "see": null }, { "topic": "documentation-transparency", "framework": "eu-ai-act", "frameworkShort": "EU AI Act", "column": "eu", "reference": "Art. 13", "clauseId": "art-13", "label": "Art. 13", "title": "Transparency and provision of information to deployers", "strength": "core", "verified": true, "note": null, "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng#art_13", "obligation": "EU AI Act Art. 13 transparency and information to deployers", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-eu-ai-act-art-13-transparency-and-information-to-deployers", "obligationId": "AIGE-OBL-EUAIA-ART13", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-euaia-art13", "see": null }, { "topic": "documentation-transparency", "framework": "eu-ai-act", "frameworkShort": "EU AI Act", "column": "eu", "reference": "Art. 53", "clauseId": "art-53", "label": "Art. 53", "title": "Obligations for providers of general-purpose AI models", "strength": "core", "verified": true, "note": "Model documentation and training-content summary for GPAI providers.", "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng#art_53", "obligation": "EU AI Act Art. 53 GPAI provider obligations", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-eu-ai-act-art-53-gpai-provider-obligations", "obligationId": "AIGE-OBL-EUAIA-ART53", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-euaia-art53", "see": null }, { "topic": "documentation-transparency", "framework": "eu-ai-act", "frameworkShort": "EU AI Act", "column": "eu", "reference": "Art. 50", "clauseId": "art-50", "label": "Art. 50", "title": "Transparency obligations for providers and deployers of certain AI systems", "strength": "related", "verified": true, "note": "User-facing disclosure and machine-readable content marking.", "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng#art_50", "obligation": "EU AI Act Art. 50 transparency for certain AI systems", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-eu-ai-act-art-50-transparency-for-certain-ai-systems", "obligationId": "AIGE-OBL-EUAIA-ART50", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-euaia-art50", "see": null }, { "topic": "documentation-transparency", "framework": "iso-42001", "frameworkShort": "ISO 42001", "column": "iso", "reference": "7.5", "clauseId": "_7.5", "label": "7.5", "title": "Documented information", "strength": "core", "verified": true, "note": null, "url": "https://www.iso.org/standard/42001", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "documentation-transparency", "framework": "iso-42001", "frameworkShort": "ISO 42001", "column": "iso", "reference": "A.6", "clauseId": "a.6", "label": "A.6", "title": "AI system life cycle", "strength": "core", "verified": true, "note": "Lifecycle documentation.", "url": "https://www.iso.org/standard/42001", "obligation": "A.6 AI system life cycle", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-a6-ai-system-life-cycle", "obligationId": "AIGE-OBL-ISO42001-A6", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-iso42001-a6", "see": null }, { "topic": "documentation-transparency", "framework": "iso-42001", "frameworkShort": "ISO 42001", "column": "iso", "reference": "A.8", "clauseId": "a.8", "label": "A.8", "title": "Information for interested parties", "strength": "core", "verified": true, "note": null, "url": "https://www.iso.org/standard/42001", "obligation": "A.8 Information for interested parties", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-a8-information-for-interested-parties", "obligationId": "AIGE-OBL-ISO42001-A8", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-iso42001-a8", "see": null }, { "topic": "documentation-transparency", "framework": "nist-ai-rmf", "frameworkShort": "NIST AI RMF", "column": "nist", "reference": "MAP 1", "clauseId": "map-1", "label": "MAP 1", "title": "MAP 1: Context is established and understood", "strength": "related", "verified": true, "note": "Documenting context and intended use.", "url": "https://airc.nist.gov/airmf-resources/airmf/", "obligation": "MAP", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-map", "obligationId": "AIGE-OBL-NISTRMF-MAP", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-nistrmf-map", "see": null }, { "topic": "documentation-transparency", "framework": "nist-ai-rmf", "frameworkShort": "NIST AI RMF", "column": "nist", "reference": "MEASURE 2.8", "clauseId": "measure-2.8", "label": "MEASURE 2.8", "title": "MEASURE 2.8: Risks associated with transparency and accountability are examined and documented", "strength": "related", "verified": true, "note": null, "url": "https://airc.nist.gov/airmf-resources/airmf/", "obligation": "MEASURE", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-measure", "obligationId": "AIGE-OBL-NISTRMF-MEASURE", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-nistrmf-measure", "see": null }, { "topic": "documentation-transparency", "framework": "cn-content-labelling", "frameworkShort": "China AI Labelling", "column": "cn", "reference": "Art. 4", "clauseId": "art-4", "label": "Label Art. 4", "title": "Explicit labels for generated content", "strength": "core", "verified": true, "note": "Visible labels on AI-generated and synthetic content; CAC text.", "url": "https://www.cac.gov.cn/2025-03/14/c_1743654684782215.htm", "obligation": "Measures for Labelling AI-Generated Synthetic Content with GB 45438-2025 (in force 2025-09-01)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-measures-for-labelling-ai-generated-synthetic-content-with-gb-45438-2025-in-force-2025-09-01", "obligationId": "AIGE-OBL-CN-LABEL", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-cn-label", "see": null }, { "topic": "documentation-transparency", "framework": "cn-content-labelling", "frameworkShort": "China AI Labelling", "column": "cn", "reference": "Art. 5", "clauseId": "art-5", "label": "Label Art. 5", "title": "Implicit (metadata) labels", "strength": "core", "verified": true, "note": "Implicit labels embedded in file metadata; CAC text.", "url": "https://www.cac.gov.cn/2025-03/14/c_1743654684782215.htm", "obligation": "Measures for Labelling AI-Generated Synthetic Content with GB 45438-2025 (in force 2025-09-01)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-measures-for-labelling-ai-generated-synthetic-content-with-gb-45438-2025-in-force-2025-09-01", "obligationId": "AIGE-OBL-CN-LABEL", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-cn-label", "see": null }, { "topic": "documentation-transparency", "framework": "cn-genai-measures", "frameworkShort": "China GenAI Measures", "column": "cn", "reference": "Art. 12", "clauseId": "art-12", "label": "GenAI Art. 12", "title": "Labelling of generated content", "strength": "core", "verified": true, "note": "Label generated images and video per the Deep Synthesis rules; CAC text.", "url": "https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm", "obligation": "Interim Measures for Generative AI Services (in force 2023-08-15)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-interim-measures-for-generative-ai-services-in-force-2023-08-15", "obligationId": "AIGE-OBL-CN-GENAI", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-cn-genai", "see": null }, { "topic": "documentation-transparency", "framework": "cn-genai-measures", "frameworkShort": "China GenAI Measures", "column": "cn", "reference": "Art. 19", "clauseId": "art-19", "label": "GenAI Art. 19", "title": "Disclosure to regulators", "strength": "related", "verified": true, "note": "Disclose training-data sources, scale and labelling mechanisms on request; CAC text.", "url": "https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm", "obligation": "Interim Measures for Generative AI Services (in force 2023-08-15)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-interim-measures-for-generative-ai-services-in-force-2023-08-15", "obligationId": "AIGE-OBL-CN-GENAI", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-cn-genai", "see": null }, { "topic": "documentation-transparency", "framework": "cn-deep-synthesis", "frameworkShort": "China Deep Synthesis", "column": "cn", "reference": "Art. 16", "clauseId": "art-16", "label": "DeepSyn Art. 16", "title": "Implicit technical labels", "strength": "core", "verified": true, "note": "Non-disruptive technical marks on synthetic content; CAC text.", "url": "https://www.cac.gov.cn/2022-12/11/c_1672221949354811.htm", "obligation": "Provisions on Deep Synthesis (in force 2023-01-10)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-provisions-on-deep-synthesis-in-force-2023-01-10", "obligationId": "AIGE-OBL-CN-DEEPSYN", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-cn-deepsyn", "see": null }, { "topic": "documentation-transparency", "framework": "cn-deep-synthesis", "frameworkShort": "China Deep Synthesis", "column": "cn", "reference": "Art. 17", "clauseId": "art-17", "label": "DeepSyn Art. 17", "title": "Conspicuous labels for confusable content", "strength": "core", "verified": true, "note": "Prominent labels where synthetic media could mislead; CAC text.", "url": "https://www.cac.gov.cn/2022-12/11/c_1672221949354811.htm", "obligation": "Provisions on Deep Synthesis (in force 2023-01-10)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-provisions-on-deep-synthesis-in-force-2023-01-10", "obligationId": "AIGE-OBL-CN-DEEPSYN", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-cn-deepsyn", "see": null }, { "topic": "documentation-transparency", "framework": "cn-algo-recommendation", "frameworkShort": "China Algo. Rec.", "column": "cn", "reference": "Art. 16", "clauseId": "art-16", "label": "AlgoRec Art. 16", "title": "Notice that recommendation is used", "strength": "related", "verified": true, "note": "Conspicuously inform users that algorithmic recommendation is in use; CAC text.", "url": "https://www.cac.gov.cn/2022-01/04/c_1642894606364259.htm", "obligation": "Provisions on Algorithmic Recommendation (in force 2022-03-01)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-provisions-on-algorithmic-recommendation-in-force-2022-03-01", "obligationId": "AIGE-OBL-CN-ALGOREC", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-cn-algorec", "see": null }, { "topic": "documentation-transparency", "framework": "cn-gbt-45654", "frameworkShort": "GB/T 45654", "column": "cn", "reference": "Content labelling", "clauseId": "content-labelling", "label": "GB/T 45654 Content labelling", "title": "Generated-content labelling requirements", "strength": "related", "verified": false, "note": "GB/T 45654-2025 content-labelling requirements (aligned with the 2025 Labelling Measures). The official listing shows the standard as current (issued 2025-04-25, implemented 2025-11-01; checked 2026-09-24), but the full text is only offered there as an image preview, so the clause id is not verified against it.", "url": "https://openstd.samr.gov.cn/bzgk/std/newGbInfo?hcno=F67D3F376E0A0A0FF5317FB36B32A30A", "obligation": "GB/T 45654-2025 Basic security requirements for generative AI services (voluntary; implemented 2025-11-01)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-gbt-45654-2025-basic-security-requirements-for-generative-ai-services-voluntary-implemented-2025-11-01", "obligationId": "AIGE-OBL-CN-GBT45654", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-cn-gbt45654", "see": null }, { "topic": "inventory-registration", "framework": "eu-ai-act", "frameworkShort": "EU AI Act", "column": "eu", "reference": "Art. 49", "clauseId": "art-49", "label": "Art. 49", "title": "Registration", "strength": "core", "verified": true, "note": "Registration of high-risk systems in the EU database.", "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng#art_49", "obligation": "EU AI Act Art. 49/71 registration of high-risk systems in the EU database", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-eu-ai-act-art-4971-registration-of-high-risk-systems-in-the-eu-database", "obligationId": "AIGE-OBL-EUAIA-ART49-71", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-euaia-art49-71", "see": null }, { "topic": "inventory-registration", "framework": "eu-ai-act", "frameworkShort": "EU AI Act", "column": "eu", "reference": "Art. 71", "clauseId": "art-71", "label": "Art. 71", "title": "EU database for high-risk AI systems", "strength": "core", "verified": true, "note": "The EU database that registration feeds.", "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng#art_71", "obligation": "EU AI Act Art. 49/71 registration of high-risk systems in the EU database", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-eu-ai-act-art-4971-registration-of-high-risk-systems-in-the-eu-database", "obligationId": "AIGE-OBL-EUAIA-ART49-71", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-euaia-art49-71", "see": null }, { "topic": "inventory-registration", "framework": "eu-ai-act", "frameworkShort": "EU AI Act", "column": "eu", "reference": "Art. 6", "clauseId": "art-6", "label": "Art. 6", "title": "Classification rules for high-risk AI systems", "strength": "related", "verified": true, "note": "Classification decides what must be registered.", "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng#art_6", "obligation": "EU AI Act Art. 6 classification of high-risk AI systems (incl. the Annex III route)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-eu-ai-act-art-6-classification-of-high-risk-ai-systems-incl-the-annex-iii-route", "obligationId": "AIGE-OBL-EUAIA-ART6", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-euaia-art6", "see": null }, { "topic": "inventory-registration", "framework": "iso-42001", "frameworkShort": "ISO 42001", "column": "iso", "reference": "A.4", "clauseId": "a.4", "label": "A.4", "title": "Resources for AI systems", "strength": "core", "verified": true, "note": "Resource and asset inventory of AI systems.", "url": "https://www.iso.org/standard/42001", "obligation": "A.4 Resources for AI systems", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-a4-resources-for-ai-systems", "obligationId": "AIGE-OBL-ISO42001-A4", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-iso42001-a4", "see": null }, { "topic": "inventory-registration", "framework": "nist-ai-rmf", "frameworkShort": "NIST AI RMF", "column": "nist", "reference": "GOVERN 1.6", "clauseId": "govern-1.6", "label": "GOVERN 1.6", "title": "GOVERN 1.6: Mechanisms are in place to inventory AI systems and are resourced according to organizational risk priorities", "strength": "core", "verified": true, "note": "See pattern: /bok/patterns#pattern-agent-registry", "url": "https://airc.nist.gov/airmf-resources/airmf/", "obligation": "GOVERN", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-govern", "obligationId": "AIGE-OBL-NISTRMF-GOVERN", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-nistrmf-govern", "see": null }, { "topic": "inventory-registration", "framework": "cn-algo-recommendation", "frameworkShort": "China Algo. Rec.", "column": "cn", "reference": "Art. 24", "clauseId": "art-24", "label": "AlgoRec Art. 24", "title": "Algorithm filing", "strength": "core", "verified": true, "note": "File within ten working days via the algorithm-filing system (public-opinion services); CAC text.", "url": "https://www.cac.gov.cn/2022-01/04/c_1642894606364259.htm", "obligation": "Provisions on Algorithmic Recommendation (in force 2022-03-01)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-provisions-on-algorithmic-recommendation-in-force-2022-03-01", "obligationId": "AIGE-OBL-CN-ALGOREC", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-cn-algorec", "see": null }, { "topic": "inventory-registration", "framework": "cn-deep-synthesis", "frameworkShort": "China Deep Synthesis", "column": "cn", "reference": "Art. 19", "clauseId": "art-19", "label": "DeepSyn Art. 19", "title": "Filing for public-opinion services", "strength": "core", "verified": true, "note": "Filing per the Algorithm Recommendation rules; CAC text.", "url": "https://www.cac.gov.cn/2022-12/11/c_1672221949354811.htm", "obligation": "Provisions on Deep Synthesis (in force 2023-01-10)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-provisions-on-deep-synthesis-in-force-2023-01-10", "obligationId": "AIGE-OBL-CN-DEEPSYN", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-cn-deepsyn", "see": null }, { "topic": "inventory-registration", "framework": "cn-genai-measures", "frameworkShort": "China GenAI Measures", "column": "cn", "reference": "Art. 17", "clauseId": "art-17", "label": "GenAI Art. 17", "title": "Algorithm filing", "strength": "core", "verified": true, "note": "Algorithm filing alongside the security assessment; CAC text.", "url": "https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm", "obligation": "Interim Measures for Generative AI Services (in force 2023-08-15)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-interim-measures-for-generative-ai-services-in-force-2023-08-15", "obligationId": "AIGE-OBL-CN-GENAI", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-cn-genai", "see": null }, { "topic": "inventory-registration", "framework": "cn-tc260-framework", "frameworkShort": "TC260 Framework 3.0", "column": "cn", "reference": "App. 2 II.2", "clauseId": "app-2-ii.2", "label": "TC260 App. 2 II.2", "title": "Identity and access management", "strength": "related", "verified": true, "note": "Identity and permissions per agent; printed pp. 120-121.", "url": "https://www.cac.gov.cn/rootimages/uploadimg/1791137114683961/1791137114683961.pdf", "obligation": "TC260 Framework 3.0 Appendix 2: agentic AI risk management (voluntary; 2026-09-14)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-tc260-framework-30-appendix-2-agentic-ai-risk-management-voluntary-2026-09-14", "obligationId": "AIGE-OBL-CN-TC260-AGENTS", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-cn-tc260-agents", "see": null }, { "topic": "inventory-registration", "framework": "cn-tc260-framework", "frameworkShort": "TC260 Framework 3.0", "column": "cn", "reference": "4.4.1", "clauseId": "_4.4.1", "label": "TC260 4.4.1", "title": "CII registration and filing", "strength": "related", "verified": true, "note": "Registration/filing for critical information infrastructure; printed p. 91.", "url": "https://www.cac.gov.cn/rootimages/uploadimg/1791137114683961/1791137114683961.pdf", "obligation": "TC260 AI Safety Governance Framework 3.0: operators' guidelines §5.3 (voluntary; 2026-09-14)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-tc260-ai-safety-governance-framework-30-operators-guidelines-53-voluntary-2026-09-14", "obligationId": "AIGE-OBL-CN-TC260-OPS", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-cn-tc260-ops", "see": null }, { "topic": "logging-traceability", "framework": "eu-ai-act", "frameworkShort": "EU AI Act", "column": "eu", "reference": "Art. 12", "clauseId": "art-12", "label": "Art. 12", "title": "Record-keeping", "strength": "core", "verified": true, "note": "Automatic logging over the system lifetime.", "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng#art_12", "obligation": "EU AI Act Art. 12 record-keeping and logging", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-eu-ai-act-art-12-record-keeping-and-logging", "obligationId": "AIGE-OBL-EUAIA-ART12", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-euaia-art12", "see": null }, { "topic": "logging-traceability", "framework": "eu-ai-act", "frameworkShort": "EU AI Act", "column": "eu", "reference": "Art. 26", "clauseId": "art-26", "label": "Art. 26", "title": "Obligations of deployers of high-risk AI systems", "strength": "related", "verified": true, "note": "Deployers keep the logs the system generates.", "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng#art_26", "obligation": "EU AI Act Art. 26 deployer obligations for high-risk systems", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-eu-ai-act-art-26-deployer-obligations-for-high-risk-systems", "obligationId": "AIGE-OBL-EUAIA-ART26", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-euaia-art26", "see": null }, { "topic": "logging-traceability", "framework": "iso-42001", "frameworkShort": "ISO 42001", "column": "iso", "reference": "A.6", "clauseId": "a.6", "label": "A.6", "title": "AI system life cycle", "strength": "core", "verified": true, "note": "Lifecycle event logs.", "url": "https://www.iso.org/standard/42001", "obligation": "A.6 AI system life cycle", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-a6-ai-system-life-cycle", "obligationId": "AIGE-OBL-ISO42001-A6", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-iso42001-a6", "see": null }, { "topic": "logging-traceability", "framework": "nist-ai-rmf", "frameworkShort": "NIST AI RMF", "column": "nist", "reference": "MANAGE 4", "clauseId": "manage-4", "label": "MANAGE 4", "title": "MANAGE 4: Risk treatments, including response and recovery, and communication plans for the identified and measured AI risks are documented and monitored", "strength": "related", "verified": true, "note": null, "url": "https://airc.nist.gov/airmf-resources/airmf/", "obligation": "MANAGE", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-manage", "obligationId": "AIGE-OBL-NISTRMF-MANAGE", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-nistrmf-manage", "see": null }, { "topic": "logging-traceability", "framework": "nist-ai-rmf", "frameworkShort": "NIST AI RMF", "column": "nist", "reference": "MEASURE 3", "clauseId": "measure-3", "label": "MEASURE 3", "title": "MEASURE 3: Mechanisms for tracking identified AI risks over time are in place", "strength": "related", "verified": true, "note": null, "url": "https://airc.nist.gov/airmf-resources/airmf/", "obligation": "MEASURE", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-measure", "obligationId": "AIGE-OBL-NISTRMF-MEASURE", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-nistrmf-measure", "see": null }, { "topic": "logging-traceability", "framework": "cn-tc260-framework", "frameworkShort": "TC260 Framework 3.0", "column": "cn", "reference": "App. 2 II.6", "clauseId": "app-2-ii.6", "label": "TC260 App. 2 II.6", "title": "Continuous monitoring and auditing", "strength": "core", "verified": true, "note": "Log management and auditing for agents; printed pp. 124-125.", "url": "https://www.cac.gov.cn/rootimages/uploadimg/1791137114683961/1791137114683961.pdf", "obligation": "TC260 Framework 3.0 Appendix 2: agentic AI risk management (voluntary; 2026-09-14)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-tc260-framework-30-appendix-2-agentic-ai-risk-management-voluntary-2026-09-14", "obligationId": "AIGE-OBL-CN-TC260-AGENTS", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-cn-tc260-agents", "see": null }, { "topic": "logging-traceability", "framework": "cn-tc260-framework", "frameworkShort": "TC260 Framework 3.0", "column": "cn", "reference": "5.3.6", "clauseId": "_5.3.6", "label": "TC260 5.3.6", "title": "Logs kept and audited", "strength": "core", "verified": true, "note": "Keep logs at least six months and audit them; printed p. 102.", "url": "https://www.cac.gov.cn/rootimages/uploadimg/1791137114683961/1791137114683961.pdf", "obligation": "TC260 AI Safety Governance Framework 3.0: operators' guidelines §5.3 (voluntary; 2026-09-14)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-tc260-ai-safety-governance-framework-30-operators-guidelines-53-voluntary-2026-09-14", "obligationId": "AIGE-OBL-CN-TC260-OPS", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-cn-tc260-ops", "see": null }, { "topic": "logging-traceability", "framework": "cn-content-labelling", "frameworkShort": "China AI Labelling", "column": "cn", "reference": "Art. 5", "clauseId": "art-5", "label": "Label Art. 5", "title": "Implicit metadata labels", "strength": "related", "verified": true, "note": "Metadata labels support content traceability; CAC text.", "url": "https://www.cac.gov.cn/2025-03/14/c_1743654684782215.htm", "obligation": "Measures for Labelling AI-Generated Synthetic Content with GB 45438-2025 (in force 2025-09-01)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-measures-for-labelling-ai-generated-synthetic-content-with-gb-45438-2025-in-force-2025-09-01", "obligationId": "AIGE-OBL-CN-LABEL", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-cn-label", "see": null }, { "topic": "human-oversight", "framework": "eu-ai-act", "frameworkShort": "EU AI Act", "column": "eu", "reference": "Art. 14", "clauseId": "art-14", "label": "Art. 14", "title": "Human oversight", "strength": "core", "verified": true, "note": "See pattern: /bok/patterns#pattern-human-in-the-loop-gate", "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng#art_14", "obligation": "EU AI Act Art. 14 human oversight", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-eu-ai-act-art-14-human-oversight", "obligationId": "AIGE-OBL-EUAIA-ART14", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-euaia-art14", "see": null }, { "topic": "human-oversight", "framework": "eu-ai-act", "frameworkShort": "EU AI Act", "column": "eu", "reference": "Art. 26", "clauseId": "art-26", "label": "Art. 26", "title": "Obligations of deployers of high-risk AI systems", "strength": "related", "verified": true, "note": "Deployers assign the humans who oversee the system.", "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng#art_26", "obligation": "EU AI Act Art. 26 deployer obligations for high-risk systems", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-eu-ai-act-art-26-deployer-obligations-for-high-risk-systems", "obligationId": "AIGE-OBL-EUAIA-ART26", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-euaia-art26", "see": null }, { "topic": "human-oversight", "framework": "iso-42001", "frameworkShort": "ISO 42001", "column": "iso", "reference": "A.9", "clauseId": "a.9", "label": "A.9", "title": "Use of AI systems", "strength": "core", "verified": true, "note": "Oversight of AI systems in use.", "url": "https://www.iso.org/standard/42001", "obligation": "A.9 Use of AI systems", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-a9-use-of-ai-systems", "obligationId": "AIGE-OBL-ISO42001-A9", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-iso42001-a9", "see": null }, { "topic": "human-oversight", "framework": "nist-ai-rmf", "frameworkShort": "NIST AI RMF", "column": "nist", "reference": "MANAGE 2.4", "clauseId": "manage-2.4", "label": "MANAGE 2.4", "title": "MANAGE 2.4: Mechanisms are in place and applied, and responsibilities are assigned and understood, to supersede, disengage, or deactivate AI systems that demonstrate performance or outcomes inconsistent with intended use", "strength": "core", "verified": true, "note": "See pattern: /bok/patterns#pattern-human-in-the-loop-gate", "url": "https://airc.nist.gov/airmf-resources/airmf/", "obligation": "MANAGE", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-manage", "obligationId": "AIGE-OBL-NISTRMF-MANAGE", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-nistrmf-manage", "see": null }, { "topic": "human-oversight", "framework": "nist-ai-rmf", "frameworkShort": "NIST AI RMF", "column": "nist", "reference": "GOVERN 3.2", "clauseId": "govern-3.2", "label": "GOVERN 3.2", "title": "GOVERN 3.2: Policies and procedures are in place to define and differentiate roles and responsibilities for human-AI configurations and oversight of AI systems", "strength": "related", "verified": true, "note": null, "url": "https://airc.nist.gov/airmf-resources/airmf/", "obligation": "GOVERN", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-govern", "obligationId": "AIGE-OBL-NISTRMF-GOVERN", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-nistrmf-govern", "see": null }, { "topic": "human-oversight", "framework": "cn-tc260-framework", "frameworkShort": "TC260 Framework 3.0", "column": "cn", "reference": "App. 2 II.3", "clauseId": "app-2-ii.3", "label": "TC260 App. 2 II.3", "title": "Strengthen human approval", "strength": "core", "verified": true, "note": "Human approval checkpoints, tamper-proof approval logs, deny-by-default; printed pp. 121-122.", "url": "https://www.cac.gov.cn/rootimages/uploadimg/1791137114683961/1791137114683961.pdf", "obligation": "TC260 Framework 3.0 Appendix 2: agentic AI risk management (voluntary; 2026-09-14)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-tc260-framework-30-appendix-2-agentic-ai-risk-management-voluntary-2026-09-14", "obligationId": "AIGE-OBL-CN-TC260-AGENTS", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-cn-tc260-agents", "see": null }, { "topic": "human-oversight", "framework": "cn-algo-recommendation", "frameworkShort": "China Algo. Rec.", "column": "cn", "reference": "Art. 17", "clauseId": "art-17", "label": "AlgoRec Art. 17", "title": "User option to switch off", "strength": "related", "verified": true, "note": "Users can opt out of algorithmic recommendation; CAC text.", "url": "https://www.cac.gov.cn/2022-01/04/c_1642894606364259.htm", "obligation": "Provisions on Algorithmic Recommendation (in force 2022-03-01)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-provisions-on-algorithmic-recommendation-in-force-2022-03-01", "obligationId": "AIGE-OBL-CN-ALGOREC", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-cn-algorec", "see": null }, { "topic": "human-oversight", "framework": "cn-genai-measures", "frameworkShort": "China GenAI Measures", "column": "cn", "reference": "Art. 10", "clauseId": "art-10", "label": "GenAI Art. 10", "title": "User guidance and protection", "strength": "related", "verified": true, "note": "Disclose scope of use and protect minors from over-reliance; CAC text.", "url": "https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm", "obligation": "Interim Measures for Generative AI Services (in force 2023-08-15)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-interim-measures-for-generative-ai-services-in-force-2023-08-15", "obligationId": "AIGE-OBL-CN-GENAI", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-cn-genai", "see": null }, { "topic": "runtime-guardrails", "framework": "eu-ai-act", "frameworkShort": "EU AI Act", "column": "eu", "reference": "Art. 5", "clauseId": "art-5", "label": "Art. 5", "title": "Prohibited AI practices", "strength": "related", "verified": true, "note": "Prohibitions enforced as input/output guardrails.", "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng#art_5", "obligation": "EU AI Act Art. 5 prohibited practices (incl. new NCII and CSAM bans)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-eu-ai-act-art-5-prohibited-practices-incl-new-ncii-and-csam-bans", "obligationId": "AIGE-OBL-EUAIA-ART5", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-euaia-art5", "see": null }, { "topic": "runtime-guardrails", "framework": "eu-ai-act", "frameworkShort": "EU AI Act", "column": "eu", "reference": "Art. 15", "clauseId": "art-15", "label": "Art. 15", "title": "Accuracy, robustness and cybersecurity", "strength": "related", "verified": true, "note": "Robustness and security controls that also act at runtime.", "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng#art_15", "obligation": "EU AI Act Art. 15 accuracy, robustness and cybersecurity", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-eu-ai-act-art-15-accuracy-robustness-and-cybersecurity", "obligationId": "AIGE-OBL-EUAIA-ART15", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-euaia-art15", "see": null }, { "topic": "runtime-guardrails", "framework": "iso-42001", "frameworkShort": "ISO 42001", "column": "iso", "reference": "A.9", "clauseId": "a.9", "label": "A.9", "title": "Use of AI systems", "strength": "core", "verified": true, "note": "See pattern: /bok/patterns#pattern-runtime-guardrail", "url": "https://www.iso.org/standard/42001", "obligation": "A.9 Use of AI systems", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-a9-use-of-ai-systems", "obligationId": "AIGE-OBL-ISO42001-A9", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-iso42001-a9", "see": null }, { "topic": "runtime-guardrails", "framework": "iso-42001", "frameworkShort": "ISO 42001", "column": "iso", "reference": "A.6", "clauseId": "a.6", "label": "A.6", "title": "AI system life cycle", "strength": "related", "verified": true, "note": "Operational controls in the run phase.", "url": "https://www.iso.org/standard/42001", "obligation": "A.6 AI system life cycle", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-a6-ai-system-life-cycle", "obligationId": "AIGE-OBL-ISO42001-A6", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-iso42001-a6", "see": null }, { "topic": "runtime-guardrails", "framework": "nist-ai-rmf", "frameworkShort": "NIST AI RMF", "column": "nist", "reference": "MANAGE 2", "clauseId": "manage-2", "label": "MANAGE 2", "title": "MANAGE 2: Strategies to maximize AI benefits and minimize negative impacts are planned, prepared, implemented, documented, and informed by relevant AI actors", "strength": "core", "verified": true, "note": "See pattern: /bok/patterns#pattern-runtime-guardrail", "url": "https://airc.nist.gov/airmf-resources/airmf/", "obligation": "MANAGE", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-manage", "obligationId": "AIGE-OBL-NISTRMF-MANAGE", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-nistrmf-manage", "see": null }, { "topic": "runtime-guardrails", "framework": "cn-tc260-framework", "frameworkShort": "TC260 Framework 3.0", "column": "cn", "reference": "App. 2 II.5", "clauseId": "app-2-ii.5", "label": "TC260 App. 2 II.5", "title": "Dynamic runtime management", "strength": "core", "verified": true, "note": "Runtime guardrails, memory isolation and sandbox isolation for agents; printed pp. 123-124.", "url": "https://www.cac.gov.cn/rootimages/uploadimg/1791137114683961/1791137114683961.pdf", "obligation": "TC260 Framework 3.0 Appendix 2: agentic AI risk management (voluntary; 2026-09-14)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-tc260-framework-30-appendix-2-agentic-ai-risk-management-voluntary-2026-09-14", "obligationId": "AIGE-OBL-CN-TC260-AGENTS", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-cn-tc260-agents", "see": null }, { "topic": "runtime-guardrails", "framework": "cn-tc260-framework", "frameworkShort": "TC260 Framework 3.0", "column": "cn", "reference": "3.2.1", "clauseId": "_3.2.1", "label": "TC260 3.2.1", "title": "Technological countermeasures for agentic AI", "strength": "core", "verified": true, "note": "Agentic-AI technical countermeasures; printed p. 77.", "url": "https://www.cac.gov.cn/rootimages/uploadimg/1791137114683961/1791137114683961.pdf", "obligation": "TC260 AI Safety Governance Framework 3.0: operators' guidelines §5.3 (voluntary; 2026-09-14)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-tc260-ai-safety-governance-framework-30-operators-guidelines-53-voluntary-2026-09-14", "obligationId": "AIGE-OBL-CN-TC260-OPS", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-cn-tc260-ops", "see": null }, { "topic": "runtime-guardrails", "framework": "cn-genai-measures", "frameworkShort": "China GenAI Measures", "column": "cn", "reference": "Art. 10", "clauseId": "art-10", "label": "GenAI Art. 10", "title": "Guided, bounded use", "strength": "core", "verified": true, "note": "Bound the service scope and guide reasonable use; CAC text.", "url": "https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm", "obligation": "Interim Measures for Generative AI Services (in force 2023-08-15)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-interim-measures-for-generative-ai-services-in-force-2023-08-15", "obligationId": "AIGE-OBL-CN-GENAI", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-cn-genai", "see": null }, { "topic": "runtime-guardrails", "framework": "cn-genai-measures", "frameworkShort": "China GenAI Measures", "column": "cn", "reference": "Art. 14", "clauseId": "art-14", "label": "GenAI Art. 14", "title": "Stop unlawful generation", "strength": "core", "verified": true, "note": "Stop generation and transmission of unlawful content; CAC text.", "url": "https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm", "obligation": "Interim Measures for Generative AI Services (in force 2023-08-15)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-interim-measures-for-generative-ai-services-in-force-2023-08-15", "obligationId": "AIGE-OBL-CN-GENAI", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-cn-genai", "see": null }, { "topic": "runtime-guardrails", "framework": "cn-deep-synthesis", "frameworkShort": "China Deep Synthesis", "column": "cn", "reference": "Art. 10", "clauseId": "art-10", "label": "DeepSyn Art. 10", "title": "Input and output review", "strength": "core", "verified": true, "note": "Technical or manual review of user inputs and synthetic outputs; CAC text.", "url": "https://www.cac.gov.cn/2022-12/11/c_1672221949354811.htm", "obligation": "Provisions on Deep Synthesis (in force 2023-01-10)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-provisions-on-deep-synthesis-in-force-2023-01-10", "obligationId": "AIGE-OBL-CN-DEEPSYN", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-cn-deepsyn", "see": null }, { "topic": "runtime-guardrails", "framework": "cn-algo-recommendation", "frameworkShort": "China Algo. Rec.", "column": "cn", "reference": "Art. 8", "clauseId": "art-8", "label": "AlgoRec Art. 8", "title": "Periodic algorithm review", "strength": "related", "verified": true, "note": "Regularly review the algorithm mechanisms, models and data; CAC text.", "url": "https://www.cac.gov.cn/2022-01/04/c_1642894606364259.htm", "obligation": "Provisions on Algorithmic Recommendation (in force 2022-03-01)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-provisions-on-algorithmic-recommendation-in-force-2022-03-01", "obligationId": "AIGE-OBL-CN-ALGOREC", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-cn-algorec", "see": null }, { "topic": "runtime-guardrails", "framework": "cn-algo-recommendation", "frameworkShort": "China Algo. Rec.", "column": "cn", "reference": "Art. 9", "clauseId": "art-9", "label": "AlgoRec Art. 9", "title": "Feature database for unlawful content", "strength": "related", "verified": true, "note": "Maintain a feature library to identify unlawful and harmful information; CAC text.", "url": "https://www.cac.gov.cn/2022-01/04/c_1642894606364259.htm", "obligation": "Provisions on Algorithmic Recommendation (in force 2022-03-01)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-provisions-on-algorithmic-recommendation-in-force-2022-03-01", "obligationId": "AIGE-OBL-CN-ALGOREC", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-cn-algorec", "see": null }, { "topic": "robustness-security-evals", "framework": "eu-ai-act", "frameworkShort": "EU AI Act", "column": "eu", "reference": "Art. 15", "clauseId": "art-15", "label": "Art. 15", "title": "Accuracy, robustness and cybersecurity", "strength": "core", "verified": true, "note": "See pattern: /bok/patterns#pattern-adversarial-red-team-suite", "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng#art_15", "obligation": "EU AI Act Art. 15 accuracy, robustness and cybersecurity", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-eu-ai-act-art-15-accuracy-robustness-and-cybersecurity", "obligationId": "AIGE-OBL-EUAIA-ART15", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-euaia-art15", "see": null }, { "topic": "robustness-security-evals", "framework": "eu-ai-act", "frameworkShort": "EU AI Act", "column": "eu", "reference": "Art. 55", "clauseId": "art-55", "label": "Art. 55", "title": "Obligations for providers of general-purpose AI models with systemic risk", "strength": "core", "verified": true, "note": "Model evaluations and adversarial testing for systemic-risk GPAI.", "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng#art_55", "obligation": "EU AI Act Art. 55 GPAI models with systemic risk", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-eu-ai-act-art-55-gpai-models-with-systemic-risk", "obligationId": "AIGE-OBL-EUAIA-ART55", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-euaia-art55", "see": null }, { "topic": "robustness-security-evals", "framework": "eu-ai-act", "frameworkShort": "EU AI Act", "column": "eu", "reference": "Art. 60", "clauseId": "art-60", "label": "Art. 60", "title": "Testing of high-risk AI systems in real-world conditions outside AI regulatory sandboxes", "strength": "related", "verified": true, "note": "Real-world testing plan and controls.", "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng#art_60", "obligation": "EU AI Act Art. 60 testing in real-world conditions outside sandboxes", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-eu-ai-act-art-60-testing-in-real-world-conditions-outside-sandboxes", "obligationId": "AIGE-OBL-EUAIA-ART60", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-euaia-art60", "see": null }, { "topic": "robustness-security-evals", "framework": "iso-42001", "frameworkShort": "ISO 42001", "column": "iso", "reference": "A.6", "clauseId": "a.6", "label": "A.6", "title": "AI system life cycle", "strength": "core", "verified": true, "note": "Verification and validation in the lifecycle; see pattern: /bok/patterns#pattern-eval-gate-in-ci", "url": "https://www.iso.org/standard/42001", "obligation": "A.6 AI system life cycle", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-a6-ai-system-life-cycle", "obligationId": "AIGE-OBL-ISO42001-A6", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-iso42001-a6", "see": null }, { "topic": "robustness-security-evals", "framework": "iso-42001", "frameworkShort": "ISO 42001", "column": "iso", "reference": "9.1", "clauseId": "_9.1", "label": "9.1", "title": "Monitoring, measurement, analysis and evaluation", "strength": "related", "verified": true, "note": null, "url": "https://www.iso.org/standard/42001", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "robustness-security-evals", "framework": "nist-ai-rmf", "frameworkShort": "NIST AI RMF", "column": "nist", "reference": "MEASURE 2", "clauseId": "measure-2", "label": "MEASURE 2", "title": "MEASURE 2: AI systems are evaluated for trustworthy characteristics", "strength": "core", "verified": true, "note": "See pattern: /bok/patterns#pattern-eval-gate-in-ci", "url": "https://airc.nist.gov/airmf-resources/airmf/", "obligation": "MEASURE", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-measure", "obligationId": "AIGE-OBL-NISTRMF-MEASURE", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-nistrmf-measure", "see": null }, { "topic": "robustness-security-evals", "framework": "cn-tc260-framework", "frameworkShort": "TC260 Framework 3.0", "column": "cn", "reference": "3", "clauseId": "_3", "label": "TC260 3", "title": "Technological countermeasures", "strength": "core", "verified": true, "note": "Technical measures across model, algorithm and data; printed p. 73.", "url": "https://www.cac.gov.cn/rootimages/uploadimg/1791137114683961/1791137114683961.pdf", "obligation": "TC260 AI Safety Governance Framework 3.0: operators' guidelines §5.3 (voluntary; 2026-09-14)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-tc260-ai-safety-governance-framework-30-operators-guidelines-53-voluntary-2026-09-14", "obligationId": "AIGE-OBL-CN-TC260-OPS", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-cn-tc260-ops", "see": null }, { "topic": "robustness-security-evals", "framework": "cn-tc260-framework", "frameworkShort": "TC260 Framework 3.0", "column": "cn", "reference": "App. 2 II.6", "clauseId": "app-2-ii.6", "label": "TC260 App. 2 II.6", "title": "Sandbox validation and red teaming", "strength": "core", "verified": true, "note": "Sandbox validation, red teaming and auditing for agents; printed pp. 124-125.", "url": "https://www.cac.gov.cn/rootimages/uploadimg/1791137114683961/1791137114683961.pdf", "obligation": "TC260 Framework 3.0 Appendix 2: agentic AI risk management (voluntary; 2026-09-14)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-tc260-framework-30-appendix-2-agentic-ai-risk-management-voluntary-2026-09-14", "obligationId": "AIGE-OBL-CN-TC260-AGENTS", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-cn-tc260-agents", "see": null }, { "topic": "robustness-security-evals", "framework": "cn-tc260-framework", "frameworkShort": "TC260 Framework 3.0", "column": "cn", "reference": "5.3.14", "clauseId": "_5.3.14", "label": "TC260 5.3.14", "title": "Resilience", "strength": "related", "verified": true, "note": "System resilience requirement; printed p. 103.", "url": "https://www.cac.gov.cn/rootimages/uploadimg/1791137114683961/1791137114683961.pdf", "obligation": "TC260 AI Safety Governance Framework 3.0: operators' guidelines §5.3 (voluntary; 2026-09-14)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-tc260-ai-safety-governance-framework-30-operators-guidelines-53-voluntary-2026-09-14", "obligationId": "AIGE-OBL-CN-TC260-OPS", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-cn-tc260-ops", "see": null }, { "topic": "robustness-security-evals", "framework": "cn-deep-synthesis", "frameworkShort": "China Deep Synthesis", "column": "cn", "reference": "Art. 15", "clauseId": "art-15", "label": "DeepSyn Art. 15", "title": "Technology management and algorithm verification", "strength": "core", "verified": true, "note": "Regular audit, assessment and verification of the synthesis-algorithm mechanisms; CAC text.", "url": "https://www.cac.gov.cn/2022-12/11/c_1672221949354811.htm", "obligation": "Provisions on Deep Synthesis (in force 2023-01-10)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-provisions-on-deep-synthesis-in-force-2023-01-10", "obligationId": "AIGE-OBL-CN-DEEPSYN", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-cn-deepsyn", "see": null }, { "topic": "robustness-security-evals", "framework": "cn-deep-synthesis", "frameworkShort": "China Deep Synthesis", "column": "cn", "reference": "Art. 20", "clauseId": "art-20", "label": "DeepSyn Art. 20", "title": "Security assessment of new products", "strength": "core", "verified": true, "note": "Security assessment before launching public-opinion products; CAC text.", "url": "https://www.cac.gov.cn/2022-12/11/c_1672221949354811.htm", "obligation": "Provisions on Deep Synthesis (in force 2023-01-10)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-provisions-on-deep-synthesis-in-force-2023-01-10", "obligationId": "AIGE-OBL-CN-DEEPSYN", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-cn-deepsyn", "see": null }, { "topic": "robustness-security-evals", "framework": "cn-genai-measures", "frameworkShort": "China GenAI Measures", "column": "cn", "reference": "Art. 17", "clauseId": "art-17", "label": "GenAI Art. 17", "title": "Security assessment", "strength": "related", "verified": true, "note": "Pre-deployment security assessment; CAC text.", "url": "https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm", "obligation": "Interim Measures for Generative AI Services (in force 2023-08-15)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-interim-measures-for-generative-ai-services-in-force-2023-08-15", "obligationId": "AIGE-OBL-CN-GENAI", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-cn-genai", "see": null }, { "topic": "robustness-security-evals", "framework": "cn-gbt-45654", "frameworkShort": "GB/T 45654", "column": "cn", "reference": "Security assessment", "clauseId": "security-assessment", "label": "GB/T 45654 Security assessment", "title": "Security-assessment requirements for generative AI services", "strength": "core", "verified": false, "note": "GB/T 45654-2025 security-assessment requirements (TC260-003 predecessor §8 and Annex A risk list). The official listing shows the standard as current (issued 2025-04-25, implemented 2025-11-01; checked 2026-09-24), but the full text is only offered there as an image preview, so the clause id is not verified against it.", "url": "https://openstd.samr.gov.cn/bzgk/std/newGbInfo?hcno=F67D3F376E0A0A0FF5317FB36B32A30A", "obligation": "GB/T 45654-2025 Basic security requirements for generative AI services (voluntary; implemented 2025-11-01)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-gbt-45654-2025-basic-security-requirements-for-generative-ai-services-voluntary-implemented-2025-11-01", "obligationId": "AIGE-OBL-CN-GBT45654", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-cn-gbt45654", "see": null }, { "topic": "incident-monitoring", "framework": "eu-ai-act", "frameworkShort": "EU AI Act", "column": "eu", "reference": "Art. 72", "clauseId": "art-72", "label": "Art. 72", "title": "Post-market monitoring by providers and post-market monitoring plan", "strength": "core", "verified": true, "note": "Continuous post-market monitoring.", "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng#art_72", "obligation": "EU AI Act Art. 72 post-market monitoring", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-eu-ai-act-art-72-post-market-monitoring", "obligationId": "AIGE-OBL-EUAIA-ART72", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-euaia-art72", "see": null }, { "topic": "incident-monitoring", "framework": "eu-ai-act", "frameworkShort": "EU AI Act", "column": "eu", "reference": "Art. 73", "clauseId": "art-73", "label": "Art. 73", "title": "Reporting of serious incidents", "strength": "core", "verified": true, "note": "See pattern: /bok/patterns#pattern-incident-pipeline", "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng#art_73", "obligation": "EU AI Act Art. 73 serious-incident reporting", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-eu-ai-act-art-73-serious-incident-reporting", "obligationId": "AIGE-OBL-EUAIA-ART73", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-euaia-art73", "see": null }, { "topic": "incident-monitoring", "framework": "eu-ai-act", "frameworkShort": "EU AI Act", "column": "eu", "reference": "Art. 55", "clauseId": "art-55", "label": "Art. 55", "title": "Obligations for providers of general-purpose AI models with systemic risk", "strength": "related", "verified": true, "note": "Systemic-risk incident tracking and reporting.", "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng#art_55", "obligation": "EU AI Act Art. 55 GPAI models with systemic risk", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-eu-ai-act-art-55-gpai-models-with-systemic-risk", "obligationId": "AIGE-OBL-EUAIA-ART55", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-euaia-art55", "see": null }, { "topic": "incident-monitoring", "framework": "iso-42001", "frameworkShort": "ISO 42001", "column": "iso", "reference": "A.8", "clauseId": "a.8", "label": "A.8", "title": "Information for interested parties", "strength": "core", "verified": true, "note": "Incident communication to interested parties.", "url": "https://www.iso.org/standard/42001", "obligation": "A.8 Information for interested parties", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-a8-information-for-interested-parties", "obligationId": "AIGE-OBL-ISO42001-A8", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-iso42001-a8", "see": null }, { "topic": "incident-monitoring", "framework": "iso-42001", "frameworkShort": "ISO 42001", "column": "iso", "reference": "10.2", "clauseId": "_10.2", "label": "10.2", "title": "Nonconformity and corrective action", "strength": "core", "verified": true, "note": null, "url": "https://www.iso.org/standard/42001", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "incident-monitoring", "framework": "nist-ai-rmf", "frameworkShort": "NIST AI RMF", "column": "nist", "reference": "MANAGE 4", "clauseId": "manage-4", "label": "MANAGE 4", "title": "MANAGE 4: Risk treatments, including response and recovery, and communication plans for the identified and measured AI risks are documented and monitored", "strength": "core", "verified": true, "note": "See pattern: /bok/patterns#pattern-continuous-assurance-telemetry", "url": "https://airc.nist.gov/airmf-resources/airmf/", "obligation": "MANAGE", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-manage", "obligationId": "AIGE-OBL-NISTRMF-MANAGE", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-nistrmf-manage", "see": null }, { "topic": "incident-monitoring", "framework": "cn-tc260-framework", "frameworkShort": "TC260 Framework 3.0", "column": "cn", "reference": "5.3.7", "clauseId": "_5.3.7", "label": "TC260 5.3.7", "title": "Real-time risk monitoring", "strength": "core", "verified": true, "note": "Real-time monitoring of AI risks in operation; printed p. 102.", "url": "https://www.cac.gov.cn/rootimages/uploadimg/1791137114683961/1791137114683961.pdf", "obligation": "TC260 AI Safety Governance Framework 3.0: operators' guidelines §5.3 (voluntary; 2026-09-14)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-tc260-ai-safety-governance-framework-30-operators-guidelines-53-voluntary-2026-09-14", "obligationId": "AIGE-OBL-CN-TC260-OPS", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-cn-tc260-ops", "see": null }, { "topic": "incident-monitoring", "framework": "cn-tc260-framework", "frameworkShort": "TC260 Framework 3.0", "column": "cn", "reference": "5.3.18", "clauseId": "_5.3.18", "label": "TC260 5.3.18", "title": "Incident reporting", "strength": "core", "verified": true, "note": "Report safety incidents; printed p. 104.", "url": "https://www.cac.gov.cn/rootimages/uploadimg/1791137114683961/1791137114683961.pdf", "obligation": "TC260 AI Safety Governance Framework 3.0: operators' guidelines §5.3 (voluntary; 2026-09-14)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-tc260-ai-safety-governance-framework-30-operators-guidelines-53-voluntary-2026-09-14", "obligationId": "AIGE-OBL-CN-TC260-OPS", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-cn-tc260-ops", "see": null }, { "topic": "incident-monitoring", "framework": "cn-tc260-framework", "frameworkShort": "TC260 Framework 3.0", "column": "cn", "reference": "App. 2 II.6", "clauseId": "app-2-ii.6", "label": "TC260 App. 2 II.6", "title": "Emergency plans", "strength": "related", "verified": true, "note": "Emergency plans within continuous monitoring for agents; printed pp. 124-125.", "url": "https://www.cac.gov.cn/rootimages/uploadimg/1791137114683961/1791137114683961.pdf", "obligation": "TC260 Framework 3.0 Appendix 2: agentic AI risk management (voluntary; 2026-09-14)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-tc260-framework-30-appendix-2-agentic-ai-risk-management-voluntary-2026-09-14", "obligationId": "AIGE-OBL-CN-TC260-AGENTS", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-cn-tc260-agents", "see": null }, { "topic": "incident-monitoring", "framework": "cn-genai-measures", "frameworkShort": "China GenAI Measures", "column": "cn", "reference": "Art. 14", "clauseId": "art-14", "label": "GenAI Art. 14", "title": "Handle and report unlawful content", "strength": "core", "verified": true, "note": "Stop, rectify and report unlawful content and optimise the model; CAC text.", "url": "https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm", "obligation": "Interim Measures for Generative AI Services (in force 2023-08-15)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-interim-measures-for-generative-ai-services-in-force-2023-08-15", "obligationId": "AIGE-OBL-CN-GENAI", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-cn-genai", "see": null }, { "topic": "incident-monitoring", "framework": "cn-genai-measures", "frameworkShort": "China GenAI Measures", "column": "cn", "reference": "Art. 15", "clauseId": "art-15", "label": "GenAI Art. 15", "title": "Complaint and reporting mechanism", "strength": "core", "verified": true, "note": "Accessible complaint and report channels with published timelines; CAC text.", "url": "https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm", "obligation": "Interim Measures for Generative AI Services (in force 2023-08-15)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-interim-measures-for-generative-ai-services-in-force-2023-08-15", "obligationId": "AIGE-OBL-CN-GENAI", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-cn-genai", "see": null }, { "topic": "incident-monitoring", "framework": "cn-algo-recommendation", "frameworkShort": "China Algo. Rec.", "column": "cn", "reference": "Art. 7", "clauseId": "art-7", "label": "AlgoRec Art. 7", "title": "Security management and emergency response", "strength": "related", "verified": true, "note": "Management systems include emergency response; CAC text.", "url": "https://www.cac.gov.cn/2022-01/04/c_1642894606364259.htm", "obligation": "Provisions on Algorithmic Recommendation (in force 2022-03-01)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-provisions-on-algorithmic-recommendation-in-force-2022-03-01", "obligationId": "AIGE-OBL-CN-ALGOREC", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-cn-algorec", "see": null }, { "topic": "supply-chain", "framework": "eu-ai-act", "frameworkShort": "EU AI Act", "column": "eu", "reference": "Art. 25", "clauseId": "art-25", "label": "Art. 25", "title": "Responsibilities along the AI value chain", "strength": "core", "verified": true, "note": "See pattern: /bok/patterns#pattern-vendor--model-due-diligence-gate", "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng#art_25", "obligation": "EU AI Act Art. 25 responsibilities along the AI value chain", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-eu-ai-act-art-25-responsibilities-along-the-ai-value-chain", "obligationId": "AIGE-OBL-EUAIA-ART25", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-euaia-art25", "see": null }, { "topic": "supply-chain", "framework": "eu-ai-act", "frameworkShort": "EU AI Act", "column": "eu", "reference": "Art. 26", "clauseId": "art-26", "label": "Art. 26", "title": "Obligations of deployers of high-risk AI systems", "strength": "related", "verified": true, "note": "Deployer duties toward upstream providers.", "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng#art_26", "obligation": "EU AI Act Art. 26 deployer obligations for high-risk systems", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-eu-ai-act-art-26-deployer-obligations-for-high-risk-systems", "obligationId": "AIGE-OBL-EUAIA-ART26", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-euaia-art26", "see": null }, { "topic": "supply-chain", "framework": "iso-42001", "frameworkShort": "ISO 42001", "column": "iso", "reference": "A.10", "clauseId": "a.10", "label": "A.10", "title": "Third-party and customer relationships", "strength": "core", "verified": true, "note": null, "url": "https://www.iso.org/standard/42001", "obligation": "A.10 Third-party and customer relationships", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-a10-third-party-and-customer-relationships", "obligationId": "AIGE-OBL-ISO42001-A10", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-iso42001-a10", "see": null }, { "topic": "supply-chain", "framework": "nist-ai-rmf", "frameworkShort": "NIST AI RMF", "column": "nist", "reference": "GOVERN 6", "clauseId": "govern-6", "label": "GOVERN 6", "title": "GOVERN 6: Policies and procedures are in place to address AI risks and benefits arising from third-party software and data and other supply chain issues", "strength": "core", "verified": true, "note": null, "url": "https://airc.nist.gov/airmf-resources/airmf/", "obligation": "GOVERN", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-govern", "obligationId": "AIGE-OBL-NISTRMF-GOVERN", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-nistrmf-govern", "see": null }, { "topic": "supply-chain", "framework": "nist-ai-rmf", "frameworkShort": "NIST AI RMF", "column": "nist", "reference": "MAP 4", "clauseId": "map-4", "label": "MAP 4", "title": "MAP 4: Risks and benefits are mapped for all AI system components including third-party software and data", "strength": "core", "verified": true, "note": null, "url": "https://airc.nist.gov/airmf-resources/airmf/", "obligation": "MAP", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-map", "obligationId": "AIGE-OBL-NISTRMF-MAP", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-nistrmf-map", "see": null }, { "topic": "supply-chain", "framework": "nist-ai-rmf", "frameworkShort": "NIST AI RMF", "column": "nist", "reference": "MANAGE 3", "clauseId": "manage-3", "label": "MANAGE 3", "title": "MANAGE 3: AI risks and benefits from third-party entities are managed", "strength": "core", "verified": true, "note": null, "url": "https://airc.nist.gov/airmf-resources/airmf/", "obligation": "MANAGE", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-manage", "obligationId": "AIGE-OBL-NISTRMF-MANAGE", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-nistrmf-manage", "see": null }, { "topic": "supply-chain", "framework": "cn-tc260-framework", "frameworkShort": "TC260 Framework 3.0", "column": "cn", "reference": "App. 2 II.4", "clauseId": "app-2-ii.4", "label": "TC260 App. 2 II.4", "title": "Supply chain and tool management", "strength": "core", "verified": true, "note": "Supply-chain and tool-invocation management for agents; printed pp. 122-123.", "url": "https://www.cac.gov.cn/rootimages/uploadimg/1791137114683961/1791137114683961.pdf", "obligation": "TC260 Framework 3.0 Appendix 2: agentic AI risk management (voluntary; 2026-09-14)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-tc260-framework-30-appendix-2-agentic-ai-risk-management-voluntary-2026-09-14", "obligationId": "AIGE-OBL-CN-TC260-AGENTS", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-cn-tc260-agents", "see": null }, { "topic": "supply-chain", "framework": "cn-tc260-framework", "frameworkShort": "TC260 Framework 3.0", "column": "cn", "reference": "4.4.4", "clauseId": "_4.4.4", "label": "TC260 4.4.4", "title": "Open-source ecosystem", "strength": "related", "verified": true, "note": "Governance of the open-source AI ecosystem; printed p. 92.", "url": "https://www.cac.gov.cn/rootimages/uploadimg/1791137114683961/1791137114683961.pdf", "obligation": "TC260 AI Safety Governance Framework 3.0: operators' guidelines §5.3 (voluntary; 2026-09-14)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-tc260-ai-safety-governance-framework-30-operators-guidelines-53-voluntary-2026-09-14", "obligationId": "AIGE-OBL-CN-TC260-OPS", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-cn-tc260-ops", "see": null }, { "topic": "supply-chain", "framework": "cn-genai-measures", "frameworkShort": "China GenAI Measures", "column": "cn", "reference": "Art. 7", "clauseId": "art-7", "label": "GenAI Art. 7", "title": "Lawful data and model sources", "strength": "related", "verified": true, "note": "Upstream training-data (and model) sourcing must be lawful; CAC text.", "url": "https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm", "obligation": "Interim Measures for Generative AI Services (in force 2023-08-15)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-interim-measures-for-generative-ai-services-in-force-2023-08-15", "obligationId": "AIGE-OBL-CN-GENAI", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-cn-genai", "see": null }, { "topic": "supply-chain", "framework": "cn-deep-synthesis", "frameworkShort": "China Deep Synthesis", "column": "cn", "reference": "Art. 14", "clauseId": "art-14", "label": "DeepSyn Art. 14", "title": "Providers and technical supporters", "strength": "related", "verified": true, "note": "Providers and their technical supporters share training-data duties (a value-chain relationship); CAC text. Draft mapped this to Art. 7, but Art. 14 is the article that names technical supporters.", "url": "https://www.cac.gov.cn/2022-12/11/c_1672221949354811.htm", "obligation": "Provisions on Deep Synthesis (in force 2023-01-10)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-provisions-on-deep-synthesis-in-force-2023-01-10", "obligationId": "AIGE-OBL-CN-DEEPSYN", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-cn-deepsyn", "see": null }, { "topic": "risk-management", "framework": "eu-ai-act", "frameworkShort": "EU AI Act", "column": "eu", "reference": "Art. 3", "clauseId": "art-3", "label": "Art. 3", "title": "Definitions", "strength": "related", "verified": true, "note": "Points (12) intended purpose, (13) reasonably foreseeable misuse and (23) substantial modification set the scope of the risk file.", "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng#art_3", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "risk-management", "framework": "iso-42001", "frameworkShort": "ISO 42001", "column": "iso", "reference": "6.1.4", "clauseId": "_6.1.4", "label": "6.1.4", "title": "AI system impact assessment", "strength": "related", "verified": true, "note": null, "url": "https://www.iso.org/standard/42001", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": "https://aigovernanceengineer.com/bok/risk-management#iso-31000-isoiec-23894-and-isoiec-42001" }, { "topic": "risk-management", "framework": "iso-23894", "frameworkShort": "ISO 23894", "column": "iso-more", "reference": "6.4", "clauseId": "_6.4", "label": "23894 6.4", "title": "Risk assessment", "strength": "core", "verified": false, "note": "Clause as listed in the INCITS/AI revised crosswalk between ISO/IEC 23894 and the AI RMF (2025-08-14, on NIST's AI Resource Center); the ISO text was not opened.", "url": "https://www.iso.org/standard/77304.html", "obligation": "ISO/IEC 23894:2023 guidance on AI risk management", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-isoiec-238942023-guidance-on-ai-risk-management", "obligationId": "AIGE-OBL-ISO23894-RISK", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-iso23894-risk", "see": null }, { "topic": "risk-management", "framework": "iso-23894", "frameworkShort": "ISO 23894", "column": "iso-more", "reference": "6.5", "clauseId": "_6.5", "label": "23894 6.5", "title": "Risk treatment", "strength": "core", "verified": false, "note": "Clause as listed in the INCITS/AI revised crosswalk between ISO/IEC 23894 and the AI RMF (2025-08-14, on NIST's AI Resource Center); the ISO text was not opened.", "url": "https://www.iso.org/standard/77304.html", "obligation": "ISO/IEC 23894:2023 guidance on AI risk management", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-isoiec-238942023-guidance-on-ai-risk-management", "obligationId": "AIGE-OBL-ISO23894-RISK", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-iso23894-risk", "see": null }, { "topic": "risk-management", "framework": "iso-23894", "frameworkShort": "ISO 23894", "column": "iso-more", "reference": "6.6", "clauseId": "_6.6", "label": "23894 6.6", "title": "Monitoring and review", "strength": "related", "verified": false, "note": "Clause as listed in the INCITS/AI revised crosswalk between ISO/IEC 23894 and the AI RMF (2025-08-14, on NIST's AI Resource Center); the ISO text was not opened.", "url": "https://www.iso.org/standard/77304.html", "obligation": "ISO/IEC 23894:2023 guidance on AI risk management", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-isoiec-238942023-guidance-on-ai-risk-management", "obligationId": "AIGE-OBL-ISO23894-RISK", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-iso23894-risk", "see": null }, { "topic": "risk-management", "framework": "nist-ai-rmf", "frameworkShort": "NIST AI RMF", "column": "nist", "reference": "GOVERN 1.3", "clauseId": "govern-1.3", "label": "GOVERN 1.3", "title": "GOVERN 1.3: Processes, procedures, and practices are in place to determine the needed level of risk management activities based on the organization's risk tolerance", "strength": "core", "verified": true, "note": null, "url": "https://airc.nist.gov/airmf-resources/airmf/", "obligation": "GOVERN", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-govern", "obligationId": "AIGE-OBL-NISTRMF-GOVERN", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-nistrmf-govern", "see": "https://aigovernanceengineer.com/bok/risk-management#proportionate-governance-tailoring-the-loop" }, { "topic": "risk-management", "framework": "nist-ai-rmf", "frameworkShort": "NIST AI RMF", "column": "nist", "reference": "MAP 1.5", "clauseId": "map-1.5", "label": "MAP 1.5", "title": "MAP 1.5: Organizational risk tolerances are determined and documented", "strength": "core", "verified": true, "note": null, "url": "https://airc.nist.gov/airmf-resources/airmf/", "obligation": "MAP", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-map", "obligationId": "AIGE-OBL-NISTRMF-MAP", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-nistrmf-map", "see": "https://aigovernanceengineer.com/bok/risk-management#risk-appetite-and-tolerance-compiled-into-gates" }, { "topic": "risk-management", "framework": "nist-ai-rmf", "frameworkShort": "NIST AI RMF", "column": "nist", "reference": "MANAGE 1.3", "clauseId": "manage-1.3", "label": "MANAGE 1.3", "title": "MANAGE 1.3: Responses to the AI risks deemed high priority, as identified by the MAP function, are developed, planned, and documented", "strength": "core", "verified": true, "note": null, "url": "https://airc.nist.gov/airmf-resources/airmf/", "obligation": "MANAGE", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-manage", "obligationId": "AIGE-OBL-NISTRMF-MANAGE", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-nistrmf-manage", "see": "https://aigovernanceengineer.com/bok/risk-management#treating-risk-the-mitigation-hierarchy" }, { "topic": "risk-management", "framework": "nist-ai-rmf", "frameworkShort": "NIST AI RMF", "column": "nist", "reference": "MANAGE 1.4", "clauseId": "manage-1.4", "label": "MANAGE 1.4", "title": "MANAGE 1.4: Negative residual risks to both downstream acquirers of AI systems and end users are documented", "strength": "core", "verified": true, "note": null, "url": "https://airc.nist.gov/airmf-resources/airmf/", "obligation": "MANAGE", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-manage", "obligationId": "AIGE-OBL-NISTRMF-MANAGE", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-nistrmf-manage", "see": "https://aigovernanceengineer.com/bok/risk-management#inherent-risk-residual-risk-and-who-accepts-it" }, { "topic": "risk-management", "framework": "nist-ai-rmf", "frameworkShort": "NIST AI RMF", "column": "nist", "reference": "MEASURE 3", "clauseId": "measure-3", "label": "MEASURE 3", "title": "MEASURE 3: Mechanisms for tracking identified AI risks over time are in place", "strength": "core", "verified": true, "note": null, "url": "https://airc.nist.gov/airmf-resources/airmf/", "obligation": "MEASURE", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-measure", "obligationId": "AIGE-OBL-NISTRMF-MEASURE", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-nistrmf-measure", "see": "https://aigovernanceengineer.com/bok/risk-management#operating-the-register" }, { "topic": "risk-management", "framework": "gpai-code-of-practice", "frameworkShort": "GPAI Code", "column": "gpai", "reference": "Safety C1", "clauseId": "safety-c1", "label": "Safety C1", "title": "Commitment 1: Safety and Security Framework", "strength": "related", "verified": true, "note": null, "url": "https://ec.europa.eu/newsroom/dae/redirection/document/118119", "obligation": "Safety and Security (systemic-risk models only)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-safety-and-security-systemic-risk-models-only", "obligationId": "AIGE-OBL-GPAICOP-SAFETY", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-gpaicop-safety", "see": null }, { "topic": "risk-management", "framework": "gpai-code-of-practice", "frameworkShort": "GPAI Code", "column": "gpai", "reference": "Safety C3", "clauseId": "safety-c3", "label": "Safety C3", "title": "Commitment 3: Systemic risk analysis", "strength": "related", "verified": true, "note": null, "url": "https://ec.europa.eu/newsroom/dae/redirection/document/118119", "obligation": "Safety and Security (systemic-risk models only)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-safety-and-security-systemic-risk-models-only", "obligationId": "AIGE-OBL-GPAICOP-SAFETY", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-gpaicop-safety", "see": null }, { "topic": "risk-management", "framework": "csa-aicm", "frameworkShort": "CSA AICM", "column": "csa", "reference": "GRC-02", "clauseId": "GRC-02", "label": "GRC-02", "title": "Risk Management Program", "strength": "core", "verified": true, "note": null, "url": "https://cloudsecurityalliance.org/artifacts/ai-controls-matrix-v1-1", "obligation": "AICM v1.1: 247 control objectives across 18 domains", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-aicm-v11-247-control-objectives-across-18-domains", "obligationId": "AIGE-OBL-CSA-AICM", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-csa-aicm", "see": null }, { "topic": "risk-management", "framework": "csa-aicm", "frameworkShort": "CSA AICM", "column": "csa", "reference": "MDS-12", "clauseId": "MDS-12", "label": "MDS-12", "title": "Open Model Risk Assessment", "strength": "related", "verified": true, "note": null, "url": "https://cloudsecurityalliance.org/artifacts/ai-controls-matrix-v1-1", "obligation": "AICM v1.1: 247 control objectives across 18 domains", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-aicm-v11-247-control-objectives-across-18-domains", "obligationId": "AIGE-OBL-CSA-AICM", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-csa-aicm", "see": null }, { "topic": "risk-management", "framework": "kr-ai-basic-act", "frameworkShort": "Korea AI Act", "column": "kr", "reference": "Art. 34(1)(1)", "clauseId": "art-34-1-1", "label": "Art. 34(1)(1)", "title": "Risk management plan for high-impact AI", "strength": "core", "verified": true, "note": null, "url": "https://www.law.go.kr/LSW/lsInfoP.do?lsiSeq=268543", "obligation": "South Korea AI Basic Act (in force 2026-01-22)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-south-korea-ai-basic-act-in-force-2026-01-22", "obligationId": "AIGE-OBL-KR-AIBASIC", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-kr-aibasic", "see": null }, { "topic": "risk-management", "framework": "uk-atrs", "frameworkShort": "UK ATRS", "column": "uk", "reference": "2.5.2", "clauseId": "_2.5.2", "label": "ATRS 2.5.2", "title": "Risks and mitigations", "strength": "core", "verified": true, "note": null, "url": "https://www.gov.uk/government/publications/algorithmic-transparency-template", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "risk-management", "framework": "sg-agentic-framework", "frameworkShort": "Singapore Agentic", "column": "sg", "reference": "2.1", "clauseId": "_2.1", "label": "Agentic 2.1", "title": "Assess and bound the risks upfront", "strength": "core", "verified": true, "note": null, "url": "https://www.imda.gov.sg/-/media/imda/files/about/emerging-tech-and-research/artificial-intelligence/mgf-for-agentic-ai.pdf", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "risk-management", "framework": "coe-cets-225", "frameworkShort": "CoE Convention", "column": "intl", "reference": "Art. 16", "clauseId": "art-16", "label": "CoE Art. 16", "title": "Risk and impact management framework", "strength": "core", "verified": true, "note": null, "url": "https://rm.coe.int/1680afae3c", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "risk-management", "framework": "oecd-ai-principles", "frameworkShort": "OECD AI Principles", "column": "intl", "reference": "1.5(c)", "clauseId": "_1.5-c", "label": "OECD 1.5(c)", "title": "Systematic risk management at each lifecycle phase", "strength": "related", "verified": true, "note": null, "url": "https://legalinstruments.oecd.org/en/instruments/OECD-LEGAL-0449", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "risk-management", "framework": "pren-18228", "frameworkShort": "prEN 18228", "column": "cen", "reference": "prEN 18228", "clauseId": "pren-18228", "label": "prEN 18228", "title": "AI risk management (draft; supports Art. 9)", "strength": "core", "verified": false, "note": "Draft European standard; stage as reported by Genorma on 2026-09-24 (secondary); the draft text is not public.", "url": "https://genorma.com/en/standards/pren-18228", "obligation": "prEN 18228 AI risk management (draft)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-pren-18228-ai-risk-management-draft", "obligationId": "AIGE-OBL-CEN-PREN18228", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-cen-pren18228", "see": null }, { "topic": "governance-accountability", "framework": "eu-ai-act", "frameworkShort": "EU AI Act", "column": "eu", "reference": "Art. 87", "clauseId": "art-87", "label": "Art. 87", "title": "Reporting of infringements and protection of reporting persons", "strength": "related", "verified": true, "note": null, "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng#art_87", "obligation": "EU AI Act Art. 87 reporting of infringements and protection of reporting persons", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-eu-ai-act-art-87-reporting-of-infringements-and-protection-of-reporting-persons", "obligationId": "AIGE-OBL-EUAIA-ART87", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-euaia-art87", "see": null }, { "topic": "governance-accountability", "framework": "gdpr", "frameworkShort": "GDPR", "column": "gdpr", "reference": "Art. 5(2)", "clauseId": "art-5-2", "label": "Art. 5(2)", "title": "Accountability", "strength": "core", "verified": true, "note": "The controller must demonstrate compliance, including any claim that a model is anonymous.", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng#art_5", "obligation": "GDPR Art. 5(2) accountability for a model anonymity claim", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-gdpr-art-52-accountability-for-a-model-anonymity-claim", "obligationId": "AIGE-OBL-GDPR-ART5-2", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-gdpr-art5-2", "see": null }, { "topic": "governance-accountability", "framework": "iso-42001", "frameworkShort": "ISO 42001", "column": "iso", "reference": "7.2", "clauseId": "_7.2", "label": "7.2", "title": "Competence", "strength": "related", "verified": false, "note": "Clause id and title as listed in the AI RMF to ISO/IEC FDIS 42001 crosswalk (contributed by Microsoft to NIST's AI Resource Center) and in CSA's AICM v1.1.1 mapping; the published ISO text was not opened.", "url": "https://www.iso.org/standard/42001", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "governance-accountability", "framework": "iso-42001", "frameworkShort": "ISO 42001", "column": "iso", "reference": "9.2", "clauseId": "_9.2", "label": "9.2", "title": "Internal audit", "strength": "related", "verified": false, "note": "Clause id and title as listed in the AI RMF to ISO/IEC FDIS 42001 crosswalk (contributed by Microsoft to NIST's AI Resource Center) and in CSA's AICM v1.1.1 mapping; the published ISO text was not opened.", "url": "https://www.iso.org/standard/42001", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "governance-accountability", "framework": "iso-42001", "frameworkShort": "ISO 42001", "column": "iso", "reference": "9.3", "clauseId": "_9.3", "label": "9.3", "title": "Management review", "strength": "core", "verified": false, "note": "Clause id and title as listed in the AI RMF to ISO/IEC FDIS 42001 crosswalk (contributed by Microsoft to NIST's AI Resource Center) and in CSA's AICM v1.1.1 mapping; the published ISO text was not opened.", "url": "https://www.iso.org/standard/42001", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "governance-accountability", "framework": "iso-42001", "frameworkShort": "ISO 42001", "column": "iso", "reference": "10.1", "clauseId": "_10.1", "label": "10.1", "title": "Continual improvement", "strength": "related", "verified": false, "note": "Clause id and title as listed in the AI RMF to ISO/IEC FDIS 42001 crosswalk (contributed by Microsoft to NIST's AI Resource Center) and in CSA's AICM v1.1.1 mapping; the published ISO text was not opened.", "url": "https://www.iso.org/standard/42001", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "governance-accountability", "framework": "nist-ai-rmf", "frameworkShort": "NIST AI RMF", "column": "nist", "reference": "GOVERN 4", "clauseId": "govern-4", "label": "GOVERN 4", "title": "GOVERN 4: Organizational teams are committed to a culture that considers and communicates AI risk", "strength": "related", "verified": true, "note": null, "url": "https://airc.nist.gov/airmf-resources/airmf/", "obligation": "GOVERN", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-govern", "obligationId": "AIGE-OBL-NISTRMF-GOVERN", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-nistrmf-govern", "see": null }, { "topic": "governance-accountability", "framework": "nist-ai-rmf", "frameworkShort": "NIST AI RMF", "column": "nist", "reference": "GOVERN 5", "clauseId": "govern-5", "label": "GOVERN 5", "title": "GOVERN 5: Processes are in place for robust engagement with relevant AI actors", "strength": "related", "verified": true, "note": null, "url": "https://airc.nist.gov/airmf-resources/airmf/", "obligation": "GOVERN", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-govern", "obligationId": "AIGE-OBL-NISTRMF-GOVERN", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-nistrmf-govern", "see": null }, { "topic": "governance-accountability", "framework": "gpai-code-of-practice", "frameworkShort": "GPAI Code", "column": "gpai", "reference": "Safety C8", "clauseId": "safety-c8", "label": "Safety C8", "title": "Commitment 8: Systemic risk responsibility allocation", "strength": "related", "verified": true, "note": null, "url": "https://ec.europa.eu/newsroom/dae/redirection/document/118119", "obligation": "Safety and Security (systemic-risk models only)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-safety-and-security-systemic-risk-models-only", "obligationId": "AIGE-OBL-GPAICOP-SAFETY", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-gpaicop-safety", "see": null }, { "topic": "governance-accountability", "framework": "csa-aicm", "frameworkShort": "CSA AICM", "column": "csa", "reference": "GRC-01", "clauseId": "GRC-01", "label": "GRC-01", "title": "Governance Program Policy and Procedures", "strength": "core", "verified": true, "note": null, "url": "https://cloudsecurityalliance.org/artifacts/ai-controls-matrix-v1-1", "obligation": "AICM v1.1: 247 control objectives across 18 domains", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-aicm-v11-247-control-objectives-across-18-domains", "obligationId": "AIGE-OBL-CSA-AICM", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-csa-aicm", "see": null }, { "topic": "governance-accountability", "framework": "csa-aicm", "frameworkShort": "CSA AICM", "column": "csa", "reference": "GRC-06", "clauseId": "GRC-06", "label": "GRC-06", "title": "Governance Responsibility Model", "strength": "core", "verified": true, "note": null, "url": "https://cloudsecurityalliance.org/artifacts/ai-controls-matrix-v1-1", "obligation": "AICM v1.1: 247 control objectives across 18 domains", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-aicm-v11-247-control-objectives-across-18-domains", "obligationId": "AIGE-OBL-CSA-AICM", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-csa-aicm", "see": null }, { "topic": "governance-accountability", "framework": "kr-ai-basic-act", "frameworkShort": "Korea AI Act", "column": "kr", "reference": "Art. 36", "clauseId": "art-36", "label": "Art. 36", "title": "Domestic representative", "strength": "related", "verified": true, "note": null, "url": "https://www.law.go.kr/LSW/lsInfoP.do?lsiSeq=268543", "obligation": "South Korea AI Basic Act (in force 2026-01-22)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-south-korea-ai-basic-act-in-force-2026-01-22", "obligationId": "AIGE-OBL-KR-AIBASIC", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-kr-aibasic", "see": null }, { "topic": "governance-accountability", "framework": "uk-atrs", "frameworkShort": "UK ATRS", "column": "uk", "reference": "2.1", "clauseId": "_2.1", "label": "ATRS 2.1", "title": "Owner and responsibility", "strength": "core", "verified": true, "note": null, "url": "https://www.gov.uk/government/publications/algorithmic-transparency-template", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "governance-accountability", "framework": "sg-genai-framework", "frameworkShort": "Singapore GenAI", "column": "sg", "reference": "1", "clauseId": "_1", "label": "GenAI 1", "title": "Accountability", "strength": "core", "verified": true, "note": null, "url": "https://aiverifyfoundation.sg/wp-content/uploads/2024/05/Model-AI-Governance-Framework-for-Generative-AI-May-2024-1-1.pdf", "obligation": "Singapore IMDA Model AI Governance Framework for Generative AI (voluntary)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-singapore-imda-model-ai-governance-framework-for-generative-ai-voluntary", "obligationId": "AIGE-OBL-SG-GENAI", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-sg-genai", "see": null }, { "topic": "governance-accountability", "framework": "sg-agentic-framework", "frameworkShort": "Singapore Agentic", "column": "sg", "reference": "2.2.1", "clauseId": "_2.2.1", "label": "Agentic 2.2.1", "title": "Clear allocation of responsibilities within and outside the organisation", "strength": "core", "verified": true, "note": null, "url": "https://www.imda.gov.sg/-/media/imda/files/about/emerging-tech-and-research/artificial-intelligence/mgf-for-agentic-ai.pdf", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "governance-accountability", "framework": "coe-cets-225", "frameworkShort": "CoE Convention", "column": "intl", "reference": "Art. 9", "clauseId": "art-9", "label": "CoE Art. 9", "title": "Accountability and responsibility", "strength": "related", "verified": true, "note": null, "url": "https://rm.coe.int/1680afae3c", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "governance-accountability", "framework": "oecd-ai-principles", "frameworkShort": "OECD AI Principles", "column": "intl", "reference": "1.5", "clauseId": "_1.5", "label": "OECD 1.5", "title": "Accountability", "strength": "core", "verified": true, "note": null, "url": "https://legalinstruments.oecd.org/en/instruments/OECD-LEGAL-0449", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "governance-accountability", "framework": "g7-hiroshima-coc", "frameworkShort": "G7 Code", "column": "intl", "reference": "Action 5", "clauseId": "action-5", "label": "G7 Action 5", "title": "Develop, implement and disclose AI governance and risk-management policies", "strength": "related", "verified": true, "note": null, "url": "https://digital-strategy.ec.europa.eu/en/library/hiroshima-process-international-code-conduct-advanced-ai-systems", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "governance-accountability", "framework": "en-18286", "frameworkShort": "EN 18286", "column": "cen", "reference": "EN 18286", "clauseId": "en-18286", "label": "EN 18286", "title": "Quality management system for EU AI Act regulatory purposes", "strength": "related", "verified": true, "note": "Published July 2026; supports Art. 17. No Official Journal citation, so no presumption of conformity, as of 2026-09-24.", "url": "https://www.cencenelec.eu/news-events/news/2026/en-in-the-spotlight/2026-07-30-ai-quality-management/", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "impact-assessment", "framework": "gdpr", "frameworkShort": "GDPR", "column": "gdpr", "reference": "Art. 35", "clauseId": "art-35", "label": "Art. 35", "title": "Data protection impact assessment", "strength": "core", "verified": true, "note": "The DPIA is the privacy twin of the FRIA; an AI DPIA adds training sources, memorisation and inference risks.", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng#art_35", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "impact-assessment", "framework": "gdpr", "frameworkShort": "GDPR", "column": "gdpr", "reference": "Art. 36", "clauseId": "art-36", "label": "Art. 36", "title": "Prior consultation", "strength": "related", "verified": true, "note": null, "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng#art_36", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "impact-assessment", "framework": "iso-42005", "frameworkShort": "ISO 42005", "column": "iso-more", "reference": "5.8", "clauseId": "_5.8", "label": "42005 5.8", "title": "Performing the AI system impact assessment", "strength": "core", "verified": false, "note": "Clause as listed in the INCITS/AI crosswalk against the DIS of ISO/IEC 42005 (2025-08-14, on NIST's AI Resource Center); numbering not checked against the published 2025 text.", "url": "https://www.iso.org/standard/44545.html", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "impact-assessment", "framework": "iso-42005", "frameworkShort": "ISO 42005", "column": "iso-more", "reference": "6.8", "clauseId": "_6.8", "label": "42005 6.8", "title": "Actual and reasonably foreseeable impacts", "strength": "core", "verified": false, "note": "Clause as listed in the INCITS/AI crosswalk against the DIS of ISO/IEC 42005 (2025-08-14, on NIST's AI Resource Center); numbering not checked against the published 2025 text.", "url": "https://www.iso.org/standard/44545.html", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "impact-assessment", "framework": "iso-42005", "frameworkShort": "ISO 42005", "column": "iso-more", "reference": "5.12", "clauseId": "_5.12", "label": "42005 5.12", "title": "Monitoring and review", "strength": "related", "verified": false, "note": "Clause as listed in the INCITS/AI crosswalk against the DIS of ISO/IEC 42005 (2025-08-14, on NIST's AI Resource Center); numbering not checked against the published 2025 text.", "url": "https://www.iso.org/standard/44545.html", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "impact-assessment", "framework": "csa-aicm", "frameworkShort": "CSA AICM", "column": "csa", "reference": "GRC-10", "clauseId": "GRC-10", "label": "GRC-10", "title": "AI Impact Assessment", "strength": "core", "verified": true, "note": null, "url": "https://cloudsecurityalliance.org/artifacts/ai-controls-matrix-v1-1", "obligation": "AICM v1.1: 247 control objectives across 18 domains", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-aicm-v11-247-control-objectives-across-18-domains", "obligationId": "AIGE-OBL-CSA-AICM", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-csa-aicm", "see": null }, { "topic": "impact-assessment", "framework": "csa-aicm", "frameworkShort": "CSA AICM", "column": "csa", "reference": "DSP-09", "clauseId": "DSP-09", "label": "DSP-09", "title": "Data Protection Impact Assessment", "strength": "related", "verified": true, "note": null, "url": "https://cloudsecurityalliance.org/artifacts/ai-controls-matrix-v1-1", "obligation": "AICM v1.1: 247 control objectives across 18 domains", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-aicm-v11-247-control-objectives-across-18-domains", "obligationId": "AIGE-OBL-CSA-AICM", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-csa-aicm", "see": null }, { "topic": "impact-assessment", "framework": "kr-ai-basic-act", "frameworkShort": "Korea AI Act", "column": "kr", "reference": "Art. 35", "clauseId": "art-35", "label": "Art. 35", "title": "Impact assessment (best-effort duty)", "strength": "core", "verified": true, "note": "Operators shall endeavour to assess the effect of high-impact AI on fundamental rights.", "url": "https://www.law.go.kr/LSW/lsInfoP.do?lsiSeq=268543", "obligation": "South Korea AI Basic Act (in force 2026-01-22)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-south-korea-ai-basic-act-in-force-2026-01-22", "obligationId": "AIGE-OBL-KR-AIBASIC", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-kr-aibasic", "see": null }, { "topic": "impact-assessment", "framework": "uk-atrs", "frameworkShort": "UK ATRS", "column": "uk", "reference": "2.5.1", "clauseId": "_2.5.1", "label": "ATRS 2.5.1", "title": "Impact assessments", "strength": "core", "verified": true, "note": null, "url": "https://www.gov.uk/government/publications/algorithmic-transparency-template", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "impact-assessment", "framework": "coe-cets-225", "frameworkShort": "CoE Convention", "column": "intl", "reference": "Art. 16", "clauseId": "art-16", "label": "CoE Art. 16", "title": "Risk and impact management framework", "strength": "related", "verified": true, "note": null, "url": "https://rm.coe.int/1680afae3c", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "data-governance", "framework": "eu-ai-act", "frameworkShort": "EU AI Act", "column": "eu", "reference": "Art. 10(2)(f)–(g)", "clauseId": "art-10-2-f-g", "label": "Art. 10(2)(f)–(g)", "title": "Examination for possible biases; measures to detect, prevent and mitigate them", "strength": "core", "verified": true, "note": null, "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng#art_10", "obligation": "EU AI Act Art. 10 data and data governance", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-eu-ai-act-art-10-data-and-data-governance", "obligationId": "AIGE-OBL-EUAIA-ART10", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-euaia-art10", "see": null }, { "topic": "data-governance", "framework": "eu-ai-act", "frameworkShort": "EU AI Act", "column": "eu", "reference": "Art. 53", "clauseId": "art-53", "label": "Art. 53", "title": "Obligations for providers of general-purpose AI models", "strength": "related", "verified": true, "note": "Art. 53(1)(d): public summary of the content used for training, on the AI Office template.", "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng#art_53", "obligation": "EU AI Act Art. 53 GPAI provider obligations", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-eu-ai-act-art-53-gpai-provider-obligations", "obligationId": "AIGE-OBL-EUAIA-ART53", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-euaia-art53", "see": null }, { "topic": "data-governance", "framework": "eu-ai-act", "frameworkShort": "EU AI Act", "column": "eu", "reference": "Art. 53(1)(c)", "clauseId": "art-53-1-c", "label": "Art. 53(1)(c)", "title": "Copyright policy, including rights reservations", "strength": "related", "verified": true, "note": null, "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng#art_53", "obligation": "EU AI Act Art. 53(1)(c) copyright policy honouring text-and-data-mining reservations", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-eu-ai-act-art-531c-copyright-policy-honouring-text-and-data-mining-reservations", "obligationId": "AIGE-OBL-EUAIA-ART53-1C", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-euaia-art53-1c", "see": null }, { "topic": "data-governance", "framework": "eu-ai-act", "frameworkShort": "EU AI Act", "column": "eu", "reference": "Art. 5(1)(e)", "clauseId": "art-5-1-e", "label": "Art. 5(1)(e)", "title": "Prohibited: untargeted scraping of facial images", "strength": "related", "verified": true, "note": "Facial-recognition databases built by untargeted scraping of the internet or CCTV are banned; a sourcing rule for data pipelines.", "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng#art_5", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "data-governance", "framework": "gpai-code-of-practice", "frameworkShort": "GPAI Code", "column": "gpai", "reference": "Copyright 1.1–1.5", "clauseId": "copyright-1.1-1.5", "label": "Copyright 1.1–1.5", "title": "Commitment 1: Copyright policy (Measures 1.1 to 1.5)", "strength": "related", "verified": true, "note": null, "url": "https://ec.europa.eu/newsroom/dae/redirection/document/118115", "obligation": "Copyright", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-copyright", "obligationId": "AIGE-OBL-GPAICOP-COPYRIGHT", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-gpaicop-copyright", "see": null }, { "topic": "data-governance", "framework": "gdpr", "frameworkShort": "GDPR", "column": "gdpr", "reference": "Art. 5(1)(c)", "clauseId": "art-5-1-c", "label": "Art. 5(1)(c)", "title": "Data minimisation", "strength": "core", "verified": true, "note": "Minimisation argued feature by feature for training, retrieval, logs and eval sets.", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng#art_5", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "data-governance", "framework": "gdpr", "frameworkShort": "GDPR", "column": "gdpr", "reference": "Art. 25", "clauseId": "art-25", "label": "Art. 25", "title": "Data protection by design and by default", "strength": "core", "verified": true, "note": null, "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng#art_25", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "data-governance", "framework": "gdpr", "frameworkShort": "GDPR", "column": "gdpr", "reference": "Art. 9", "clauseId": "art-9", "label": "Art. 9", "title": "Processing of special categories of personal data", "strength": "related", "verified": true, "note": "Sits beside AI Act Art. 4a on bias-detection processing; inferred sensitive data counts.", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng#art_9", "obligation": "GDPR Art. 9 special categories, incl. inferred sensitive data", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-gdpr-art-9-special-categories-incl-inferred-sensitive-data", "obligationId": "AIGE-OBL-GDPR-ART9", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-gdpr-art9", "see": null }, { "topic": "data-governance", "framework": "iso-42001", "frameworkShort": "ISO 42001", "column": "iso", "reference": "A.7.3", "clauseId": "a.7.3", "label": "A.7.3", "title": "Acquisition of data", "strength": "core", "verified": false, "note": "Clause id and title as listed in the AI RMF to ISO/IEC FDIS 42001 crosswalk (contributed by Microsoft to NIST's AI Resource Center) and in CSA's AICM v1.1.1 mapping; the published ISO text was not opened.", "url": "https://www.iso.org/standard/42001", "obligation": "A.7 Data for AI systems", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-a7-data-for-ai-systems", "obligationId": "AIGE-OBL-ISO42001-A7", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-iso42001-a7", "see": null }, { "topic": "data-governance", "framework": "csa-aicm", "frameworkShort": "CSA AICM", "column": "csa", "reference": "DSP-20", "clauseId": "DSP-20", "label": "DSP-20", "title": "Data Provenance and Transparency", "strength": "core", "verified": true, "note": null, "url": "https://cloudsecurityalliance.org/artifacts/ai-controls-matrix-v1-1", "obligation": "AICM v1.1: 247 control objectives across 18 domains", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-aicm-v11-247-control-objectives-across-18-domains", "obligationId": "AIGE-OBL-CSA-AICM", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-csa-aicm", "see": null }, { "topic": "data-governance", "framework": "csa-aicm", "frameworkShort": "CSA AICM", "column": "csa", "reference": "DSP-21", "clauseId": "DSP-21", "label": "DSP-21", "title": "Data Poisoning Prevention & Detection", "strength": "related", "verified": true, "note": null, "url": "https://cloudsecurityalliance.org/artifacts/ai-controls-matrix-v1-1", "obligation": "AICM v1.1: 247 control objectives across 18 domains", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-aicm-v11-247-control-objectives-across-18-domains", "obligationId": "AIGE-OBL-CSA-AICM", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-csa-aicm", "see": null }, { "topic": "data-governance", "framework": "owasp-llm-top-10", "frameworkShort": "OWASP LLM", "column": "owasp", "reference": "LLM05:2026", "clauseId": "llm05-2026", "label": "LLM05:2026", "title": "Data and Model Poisoning", "strength": "related", "verified": true, "note": null, "url": "https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/", "obligation": "Top 10 for LLM Applications 2026", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-top-10-for-llm-applications-2026", "obligationId": "AIGE-OBL-OWASP-LLM", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-owasp-llm", "see": null }, { "topic": "data-governance", "framework": "uk-atrs", "frameworkShort": "UK ATRS", "column": "uk", "reference": "2.4.3", "clauseId": "_2.4.3", "label": "ATRS 2.4.3", "title": "Development data specification", "strength": "core", "verified": true, "note": null, "url": "https://www.gov.uk/government/publications/algorithmic-transparency-template", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "data-governance", "framework": "sg-genai-framework", "frameworkShort": "Singapore GenAI", "column": "sg", "reference": "2", "clauseId": "_2", "label": "GenAI 2", "title": "Data", "strength": "core", "verified": true, "note": null, "url": "https://aiverifyfoundation.sg/wp-content/uploads/2024/05/Model-AI-Governance-Framework-for-Generative-AI-May-2024-1-1.pdf", "obligation": "Singapore IMDA Model AI Governance Framework for Generative AI (voluntary)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-singapore-imda-model-ai-governance-framework-for-generative-ai-voluntary", "obligationId": "AIGE-OBL-SG-GENAI", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-sg-genai", "see": null }, { "topic": "documentation-transparency", "framework": "eu-ai-act", "frameworkShort": "EU AI Act", "column": "eu", "reference": "Art. 86", "clauseId": "art-86", "label": "Art. 86", "title": "Right to explanation of individual decision-making", "strength": "related", "verified": true, "note": "Transparency that reaches the affected person: reason codes and an appeal route.", "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng#art_86", "obligation": "EU AI Act Art. 86 right to explanation of individual decision-making", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-eu-ai-act-art-86-right-to-explanation-of-individual-decision-making", "obligationId": "AIGE-OBL-EUAIA-ART86", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-euaia-art86", "see": null }, { "topic": "documentation-transparency", "framework": "eu-ai-act", "frameworkShort": "EU AI Act", "column": "eu", "reference": "Art. 18", "clauseId": "art-18", "label": "Art. 18", "title": "Documentation keeping", "strength": "related", "verified": true, "note": null, "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng#art_18", "obligation": "EU AI Act Art. 18 documentation keeping", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-eu-ai-act-art-18-documentation-keeping", "obligationId": "AIGE-OBL-EUAIA-ART18", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-euaia-art18", "see": null }, { "topic": "documentation-transparency", "framework": "eu-ai-act", "frameworkShort": "EU AI Act", "column": "eu", "reference": "Art. 43", "clauseId": "art-43", "label": "Art. 43", "title": "Conformity assessment", "strength": "related", "verified": true, "note": null, "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng#art_43", "obligation": "EU AI Act Art. 43 conformity assessment", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-eu-ai-act-art-43-conformity-assessment", "obligationId": "AIGE-OBL-EUAIA-ART43", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-euaia-art43", "see": null }, { "topic": "documentation-transparency", "framework": "eu-ai-act", "frameworkShort": "EU AI Act", "column": "eu", "reference": "Art. 53(1)(d)", "clauseId": "art-53-1-d", "label": "Art. 53(1)(d)", "title": "Public summary of the content used for training", "strength": "related", "verified": true, "note": null, "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng#art_53", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "documentation-transparency", "framework": "eu-ai-act", "frameworkShort": "EU AI Act", "column": "eu", "reference": "Art. 50(2), 50(4)", "clauseId": "art-50-2-50-4", "label": "Art. 50(2), 50(4)", "title": "Machine-readable marking of synthetic content; disclosure of deep fakes", "strength": "related", "verified": true, "note": null, "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng#art_50", "obligation": "EU AI Act Art. 50 transparency for certain AI systems", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-eu-ai-act-art-50-transparency-for-certain-ai-systems", "obligationId": "AIGE-OBL-EUAIA-ART50", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-euaia-art50", "see": null }, { "topic": "documentation-transparency", "framework": "gpai-code-of-practice", "frameworkShort": "GPAI Code", "column": "gpai", "reference": "Transparency 1.1", "clauseId": "transparency-1.1", "label": "Transparency 1.1", "title": "Drawing up and keeping up-to-date model documentation", "strength": "core", "verified": true, "note": null, "url": "https://ec.europa.eu/newsroom/dae/redirection/document/118120", "obligation": "Transparency", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-transparency", "obligationId": "AIGE-OBL-GPAICOP-TRANSPARENCY", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-gpaicop-transparency", "see": null }, { "topic": "documentation-transparency", "framework": "gpai-code-of-practice", "frameworkShort": "GPAI Code", "column": "gpai", "reference": "Transparency 1.2", "clauseId": "transparency-1.2", "label": "Transparency 1.2", "title": "Providing relevant information", "strength": "related", "verified": true, "note": null, "url": "https://ec.europa.eu/newsroom/dae/redirection/document/118120", "obligation": "Transparency", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-transparency", "obligationId": "AIGE-OBL-GPAICOP-TRANSPARENCY", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-gpaicop-transparency", "see": null }, { "topic": "documentation-transparency", "framework": "gdpr", "frameworkShort": "GDPR", "column": "gdpr", "reference": "Arts. 13–14", "clauseId": "arts-13-14", "label": "Arts. 13–14", "title": "Information to be provided to the data subject", "strength": "core", "verified": true, "note": "Notice versioned with the model card; Art. 14 covers scraped or licensed training data.", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng#art_13", "obligation": "GDPR Arts. 13–14 transparency to data subjects", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-gdpr-arts-1314-transparency-to-data-subjects", "obligationId": "AIGE-OBL-GDPR-ART13-14", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-gdpr-art13-14", "see": null }, { "topic": "documentation-transparency", "framework": "gdpr", "frameworkShort": "GDPR", "column": "gdpr", "reference": "Art. 30", "clauseId": "art-30", "label": "Art. 30", "title": "Records of processing activities", "strength": "related", "verified": true, "note": null, "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng#art_30", "obligation": "GDPR Art. 30 records of processing activities", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-gdpr-art-30-records-of-processing-activities", "obligationId": "AIGE-OBL-GDPR-ART30", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-gdpr-art30", "see": null }, { "topic": "documentation-transparency", "framework": "nist-ai-rmf", "frameworkShort": "NIST AI RMF", "column": "nist", "reference": "MAP 1.6", "clauseId": "map-1.6", "label": "MAP 1.6", "title": "MAP 1.6: System requirements are elicited from and understood by relevant AI actors. Design decisions take socio-technical implications into account to address AI risks", "strength": "related", "verified": true, "note": null, "url": "https://airc.nist.gov/airmf-resources/airmf/", "obligation": "MAP", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-map", "obligationId": "AIGE-OBL-NISTRMF-MAP", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-nistrmf-map", "see": null }, { "topic": "documentation-transparency", "framework": "nist-ai-rmf", "frameworkShort": "NIST AI RMF", "column": "nist", "reference": "MEASURE 2.9", "clauseId": "measure-2.9", "label": "MEASURE 2.9", "title": "MEASURE 2.9: The AI model is explained, validated, and documented, and AI system output is interpreted within its context as identified in the MAP function to inform responsible use and governance", "strength": "related", "verified": true, "note": null, "url": "https://airc.nist.gov/airmf-resources/airmf/", "obligation": "MEASURE", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-measure", "obligationId": "AIGE-OBL-NISTRMF-MEASURE", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-nistrmf-measure", "see": null }, { "topic": "documentation-transparency", "framework": "csa-aicm", "frameworkShort": "CSA AICM", "column": "csa", "reference": "MDS-03", "clauseId": "MDS-03", "label": "MDS-03", "title": "Model Documentation", "strength": "core", "verified": true, "note": null, "url": "https://cloudsecurityalliance.org/artifacts/ai-controls-matrix-v1-1", "obligation": "AICM v1.1: 247 control objectives across 18 domains", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-aicm-v11-247-control-objectives-across-18-domains", "obligationId": "AIGE-OBL-CSA-AICM", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-csa-aicm", "see": null }, { "topic": "documentation-transparency", "framework": "csa-aicm", "frameworkShort": "CSA AICM", "column": "csa", "reference": "MDS-04", "clauseId": "MDS-04", "label": "MDS-04", "title": "Model Documentation Requirements", "strength": "related", "verified": true, "note": null, "url": "https://cloudsecurityalliance.org/artifacts/ai-controls-matrix-v1-1", "obligation": "AICM v1.1: 247 control objectives across 18 domains", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-aicm-v11-247-control-objectives-across-18-domains", "obligationId": "AIGE-OBL-CSA-AICM", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-csa-aicm", "see": null }, { "topic": "documentation-transparency", "framework": "kr-ai-basic-act", "frameworkShort": "Korea AI Act", "column": "kr", "reference": "Art. 31", "clauseId": "art-31", "label": "Art. 31", "title": "Transparency: prior notice, output labelling, realistic synthetic content", "strength": "core", "verified": true, "note": null, "url": "https://www.law.go.kr/LSW/lsInfoP.do?lsiSeq=268543", "obligation": "South Korea AI Basic Act (in force 2026-01-22)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-south-korea-ai-basic-act-in-force-2026-01-22", "obligationId": "AIGE-OBL-KR-AIBASIC", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-kr-aibasic", "see": null }, { "topic": "documentation-transparency", "framework": "kr-ai-basic-act", "frameworkShort": "Korea AI Act", "column": "kr", "reference": "Art. 34(1)(2)", "clauseId": "art-34-1-2", "label": "Art. 34(1)(2)", "title": "Explanation plan: result, main criteria, training-data overview", "strength": "related", "verified": true, "note": null, "url": "https://www.law.go.kr/LSW/lsInfoP.do?lsiSeq=268543", "obligation": "South Korea AI Basic Act (in force 2026-01-22)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-south-korea-ai-basic-act-in-force-2026-01-22", "obligationId": "AIGE-OBL-KR-AIBASIC", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-kr-aibasic", "see": null }, { "topic": "documentation-transparency", "framework": "uk-atrs", "frameworkShort": "UK ATRS", "column": "uk", "reference": "Tier 1", "clauseId": "tier-1", "label": "ATRS Tier 1", "title": "Summary information", "strength": "core", "verified": true, "note": null, "url": "https://www.gov.uk/government/publications/algorithmic-transparency-template", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "documentation-transparency", "framework": "uk-atrs", "frameworkShort": "UK ATRS", "column": "uk", "reference": "2.2", "clauseId": "_2.2", "label": "ATRS 2.2", "title": "Description and rationale", "strength": "related", "verified": true, "note": null, "url": "https://www.gov.uk/government/publications/algorithmic-transparency-template", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "documentation-transparency", "framework": "sg-genai-framework", "frameworkShort": "Singapore GenAI", "column": "sg", "reference": "3", "clauseId": "_3", "label": "GenAI 3", "title": "Trusted Development and Deployment", "strength": "core", "verified": true, "note": null, "url": "https://aiverifyfoundation.sg/wp-content/uploads/2024/05/Model-AI-Governance-Framework-for-Generative-AI-May-2024-1-1.pdf", "obligation": "Singapore IMDA Model AI Governance Framework for Generative AI (voluntary)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-singapore-imda-model-ai-governance-framework-for-generative-ai-voluntary", "obligationId": "AIGE-OBL-SG-GENAI", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-sg-genai", "see": null }, { "topic": "documentation-transparency", "framework": "coe-cets-225", "frameworkShort": "CoE Convention", "column": "intl", "reference": "Art. 14(2)", "clauseId": "art-14-2", "label": "CoE Art. 14(2)", "title": "Documentation sufficient to contest decisions; complaint to authorities", "strength": "core", "verified": true, "note": null, "url": "https://rm.coe.int/1680afae3c", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "documentation-transparency", "framework": "coe-cets-225", "frameworkShort": "CoE Convention", "column": "intl", "reference": "Art. 15(2)", "clauseId": "art-15-2", "label": "CoE Art. 15(2)", "title": "Notification of interaction with an AI system", "strength": "related", "verified": true, "note": null, "url": "https://rm.coe.int/1680afae3c", "obligation": "Council of Europe Convention Art. 15(2) notice of interaction with an AI system", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-council-of-europe-convention-art-152-notice-of-interaction-with-an-ai-system", "obligationId": "AIGE-OBL-COE-ART15-2", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-coe-art15-2", "see": null }, { "topic": "documentation-transparency", "framework": "oecd-ai-principles", "frameworkShort": "OECD AI Principles", "column": "intl", "reference": "1.3", "clauseId": "_1.3", "label": "OECD 1.3", "title": "Transparency and explainability", "strength": "core", "verified": true, "note": null, "url": "https://legalinstruments.oecd.org/en/instruments/OECD-LEGAL-0449", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "documentation-transparency", "framework": "g7-hiroshima-coc", "frameworkShort": "G7 Code", "column": "intl", "reference": "Action 3", "clauseId": "action-3", "label": "G7 Action 3", "title": "Publicly report capabilities, limitations and domains of use", "strength": "core", "verified": true, "note": null, "url": "https://digital-strategy.ec.europa.eu/en/library/hiroshima-process-international-code-conduct-advanced-ai-systems", "obligation": "G7 Hiroshima Code action 3: public reporting of capabilities and limitations", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-g7-hiroshima-code-action-3-public-reporting-of-capabilities-and-limitations", "obligationId": "AIGE-OBL-G7-A3", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-g7-a3", "see": null }, { "topic": "inventory-registration", "framework": "eu-ai-act", "frameworkShort": "EU AI Act", "column": "eu", "reference": "Art. 3(1)", "clauseId": "art-3-1", "label": "Art. 3(1)", "title": "Definition of an AI system", "strength": "related", "verified": true, "note": "The definition decides which systems enter the inventory at all; the Commission guidelines list the excluded families.", "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng#art_3", "obligation": "EU AI Act Art. 3(1) AI system definition (scope of the Act)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-eu-ai-act-art-31-ai-system-definition-scope-of-the-act", "obligationId": "AIGE-OBL-EUAIA-ART3-1", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-euaia-art3-1", "see": null }, { "topic": "inventory-registration", "framework": "eu-ai-act", "frameworkShort": "EU AI Act", "column": "eu", "reference": "Art. 52", "clauseId": "art-52", "label": "Art. 52", "title": "Procedure", "strength": "related", "verified": true, "note": "Notification of GPAI models that meet the systemic-risk condition.", "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng#art_52", "obligation": "EU AI Act Art. 52 notification of a GPAI model meeting the systemic-risk threshold", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-eu-ai-act-art-52-notification-of-a-gpai-model-meeting-the-systemic-risk-threshold", "obligationId": "AIGE-OBL-EUAIA-ART52", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-euaia-art52", "see": null }, { "topic": "inventory-registration", "framework": "nist-ai-rmf", "frameworkShort": "NIST AI RMF", "column": "nist", "reference": "GOVERN 1.7", "clauseId": "govern-1.7", "label": "GOVERN 1.7", "title": "GOVERN 1.7: Processes and procedures are in place for decommissioning and phasing out AI systems safely and in a manner that does not increase risks or decrease the organization's trustworthiness", "strength": "related", "verified": true, "note": null, "url": "https://airc.nist.gov/airmf-resources/airmf/", "obligation": "GOVERN", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-govern", "obligationId": "AIGE-OBL-NISTRMF-GOVERN", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-nistrmf-govern", "see": null }, { "topic": "inventory-registration", "framework": "csa-aicm", "frameworkShort": "CSA AICM", "column": "csa", "reference": "STA-08", "clauseId": "STA-08", "label": "STA-08", "title": "Supply Chain Inventory", "strength": "related", "verified": true, "note": null, "url": "https://cloudsecurityalliance.org/artifacts/ai-controls-matrix-v1-1", "obligation": "AICM v1.1: 247 control objectives across 18 domains", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-aicm-v11-247-control-objectives-across-18-domains", "obligationId": "AIGE-OBL-CSA-AICM", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-csa-aicm", "see": null }, { "topic": "inventory-registration", "framework": "csa-aicm", "frameworkShort": "CSA AICM", "column": "csa", "reference": "IAM-03", "clauseId": "IAM-03", "label": "IAM-03", "title": "Identity Inventory", "strength": "related", "verified": true, "note": null, "url": "https://cloudsecurityalliance.org/artifacts/ai-controls-matrix-v1-1", "obligation": "AICM v1.1: 247 control objectives across 18 domains", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-aicm-v11-247-control-objectives-across-18-domains", "obligationId": "AIGE-OBL-CSA-AICM", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-csa-aicm", "see": null }, { "topic": "inventory-registration", "framework": "kr-ai-basic-act", "frameworkShort": "Korea AI Act", "column": "kr", "reference": "Art. 33", "clauseId": "art-33", "label": "Art. 33", "title": "Confirmation of high-impact AI", "strength": "related", "verified": true, "note": null, "url": "https://www.law.go.kr/LSW/lsInfoP.do?lsiSeq=268543", "obligation": "South Korea AI Basic Act (in force 2026-01-22)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-south-korea-ai-basic-act-in-force-2026-01-22", "obligationId": "AIGE-OBL-KR-AIBASIC", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-kr-aibasic", "see": null }, { "topic": "inventory-registration", "framework": "uk-atrs", "frameworkShort": "UK ATRS", "column": "uk", "reference": "Tier 1", "clauseId": "tier-1", "label": "ATRS Tier 1", "title": "Summary information (the published record)", "strength": "core", "verified": true, "note": null, "url": "https://www.gov.uk/government/publications/algorithmic-transparency-template", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "logging-traceability", "framework": "eu-ai-act", "frameworkShort": "EU AI Act", "column": "eu", "reference": "Art. 26(6)", "clauseId": "art-26-6", "label": "Art. 26(6)", "title": "Deployers keep the automatically generated logs", "strength": "core", "verified": true, "note": null, "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng#art_26", "obligation": "EU AI Act Art. 26 deployer obligations for high-risk systems", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-eu-ai-act-art-26-deployer-obligations-for-high-risk-systems", "obligationId": "AIGE-OBL-EUAIA-ART26", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-euaia-art26", "see": null }, { "topic": "logging-traceability", "framework": "eu-ai-act", "frameworkShort": "EU AI Act", "column": "eu", "reference": "Art. 19", "clauseId": "art-19", "label": "Art. 19", "title": "Automatically generated logs", "strength": "related", "verified": true, "note": null, "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng#art_19", "obligation": "EU AI Act Art. 19 automatically generated logs kept by the provider", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-eu-ai-act-art-19-automatically-generated-logs-kept-by-the-provider", "obligationId": "AIGE-OBL-EUAIA-ART19", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-euaia-art19", "see": null }, { "topic": "logging-traceability", "framework": "iso-42001", "frameworkShort": "ISO 42001", "column": "iso", "reference": "A.6.2.8", "clauseId": "a.6.2.8", "label": "A.6.2.8", "title": "AI system recording of event logs", "strength": "core", "verified": false, "note": "Clause id and title as listed in the AI RMF to ISO/IEC FDIS 42001 crosswalk (contributed by Microsoft to NIST's AI Resource Center) and in CSA's AICM v1.1.1 mapping; the published ISO text was not opened.", "url": "https://www.iso.org/standard/42001", "obligation": "A.6 AI system life cycle", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-a6-ai-system-life-cycle", "obligationId": "AIGE-OBL-ISO42001-A6", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-iso42001-a6", "see": null }, { "topic": "logging-traceability", "framework": "csa-aicm", "frameworkShort": "CSA AICM", "column": "csa", "reference": "LOG-09", "clauseId": "LOG-09", "label": "LOG-09", "title": "Log Records", "strength": "core", "verified": true, "note": null, "url": "https://cloudsecurityalliance.org/artifacts/ai-controls-matrix-v1-1", "obligation": "AICM v1.1: 247 control objectives across 18 domains", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-aicm-v11-247-control-objectives-across-18-domains", "obligationId": "AIGE-OBL-CSA-AICM", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-csa-aicm", "see": null }, { "topic": "logging-traceability", "framework": "csa-aicm", "frameworkShort": "CSA AICM", "column": "csa", "reference": "LOG-12", "clauseId": "LOG-12", "label": "LOG-12", "title": "Transaction/Activity Logging", "strength": "related", "verified": true, "note": null, "url": "https://cloudsecurityalliance.org/artifacts/ai-controls-matrix-v1-1", "obligation": "AICM v1.1: 247 control objectives across 18 domains", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-aicm-v11-247-control-objectives-across-18-domains", "obligationId": "AIGE-OBL-CSA-AICM", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-csa-aicm", "see": null }, { "topic": "logging-traceability", "framework": "kr-ai-basic-act", "frameworkShort": "Korea AI Act", "column": "kr", "reference": "Art. 34(1)(5)", "clauseId": "art-34-1-5", "label": "Art. 34(1)(5)", "title": "Documents showing the measures taken", "strength": "core", "verified": true, "note": "The enforcement decree keeps the evidence for five years.", "url": "https://www.law.go.kr/LSW/lsInfoP.do?lsiSeq=268543", "obligation": "South Korea AI Basic Act (in force 2026-01-22)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-south-korea-ai-basic-act-in-force-2026-01-22", "obligationId": "AIGE-OBL-KR-AIBASIC", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-kr-aibasic", "see": null }, { "topic": "logging-traceability", "framework": "sg-agentic-framework", "frameworkShort": "Singapore Agentic", "column": "sg", "reference": "2.3.3", "clauseId": "_2.3.3", "label": "Agentic 2.3.3", "title": "When deploying, continuously monitor and test", "strength": "related", "verified": true, "note": null, "url": "https://www.imda.gov.sg/-/media/imda/files/about/emerging-tech-and-research/artificial-intelligence/mgf-for-agentic-ai.pdf", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "logging-traceability", "framework": "oecd-ai-principles", "frameworkShort": "OECD AI Principles", "column": "intl", "reference": "1.5(b)", "clauseId": "_1.5-b", "label": "OECD 1.5(b)", "title": "Traceability of datasets, processes and decisions", "strength": "core", "verified": true, "note": null, "url": "https://legalinstruments.oecd.org/en/instruments/OECD-LEGAL-0449", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "logging-traceability", "framework": "pren-18229-1", "frameworkShort": "prEN 18229-1", "column": "cen", "reference": "prEN 18229-1", "clauseId": "pren-18229-1", "label": "prEN 18229-1", "title": "AI trustworthiness framework, Part 1: logging (draft; supports Art. 12)", "strength": "core", "verified": false, "note": "Draft European standard; stage as reported by Genorma on 2026-09-24 (secondary); the draft text is not public.", "url": "https://genorma.com/en/standards/pren-18229-1", "obligation": "prEN 18229-1 AI trustworthiness framework, Part 1: logging (draft)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-pren-18229-1-ai-trustworthiness-framework-part-1-logging-draft", "obligationId": "AIGE-OBL-CEN-PREN18229-1", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-cen-pren18229-1", "see": null }, { "topic": "human-oversight", "framework": "eu-ai-act", "frameworkShort": "EU AI Act", "column": "eu", "reference": "Art. 14(4)(b)", "clauseId": "art-14-4-b", "label": "Art. 14(4)(b)", "title": "Awareness of automation bias", "strength": "related", "verified": true, "note": "Gate logs approver, time to decide and override rate so degrading oversight is visible.", "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng#art_14", "obligation": "EU AI Act Art. 14 human oversight", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-eu-ai-act-art-14-human-oversight", "obligationId": "AIGE-OBL-EUAIA-ART14", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-euaia-art14", "see": null }, { "topic": "human-oversight", "framework": "gdpr", "frameworkShort": "GDPR", "column": "gdpr", "reference": "Art. 22", "clauseId": "art-22", "label": "Art. 22", "title": "Automated individual decision-making, including profiling", "strength": "core", "verified": true, "note": "Human intervention and contest for solely automated significant decisions.", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng#art_22", "obligation": "GDPR Art. 22 solely automated decisions and their safeguards", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-gdpr-art-22-solely-automated-decisions-and-their-safeguards", "obligationId": "AIGE-OBL-GDPR-ART22", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-gdpr-art22", "see": null }, { "topic": "human-oversight", "framework": "nist-ai-rmf", "frameworkShort": "NIST AI RMF", "column": "nist", "reference": "MAP 3.5", "clauseId": "map-3.5", "label": "MAP 3.5", "title": "MAP 3.5: Processes for human oversight are defined, assessed, and documented in accordance with organizational policies from the GOVERN function", "strength": "core", "verified": true, "note": null, "url": "https://airc.nist.gov/airmf-resources/airmf/", "obligation": "MAP", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-map", "obligationId": "AIGE-OBL-NISTRMF-MAP", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-nistrmf-map", "see": null }, { "topic": "human-oversight", "framework": "csa-aicm", "frameworkShort": "CSA AICM", "column": "csa", "reference": "GRC-15", "clauseId": "GRC-15", "label": "GRC-15", "title": "Human supervision", "strength": "core", "verified": true, "note": null, "url": "https://cloudsecurityalliance.org/artifacts/ai-controls-matrix-v1-1", "obligation": "AICM v1.1: 247 control objectives across 18 domains", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-aicm-v11-247-control-objectives-across-18-domains", "obligationId": "AIGE-OBL-CSA-AICM", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-csa-aicm", "see": null }, { "topic": "human-oversight", "framework": "owasp-agentic-top-10", "frameworkShort": "OWASP Agentic", "column": "owasp", "reference": "ASI09", "clauseId": "asi09", "label": "ASI09", "title": "Human-Agent Trust Exploitation", "strength": "related", "verified": true, "note": null, "url": "https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/", "obligation": "Top 10 for Agentic Applications 2026", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-top-10-for-agentic-applications-2026", "obligationId": "AIGE-OBL-OWASP-AGENTIC", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-owasp-agentic", "see": null }, { "topic": "human-oversight", "framework": "kr-ai-basic-act", "frameworkShort": "Korea AI Act", "column": "kr", "reference": "Art. 34(1)(4)", "clauseId": "art-34-1-4", "label": "Art. 34(1)(4)", "title": "Human management and supervision", "strength": "core", "verified": true, "note": null, "url": "https://www.law.go.kr/LSW/lsInfoP.do?lsiSeq=268543", "obligation": "South Korea AI Basic Act (in force 2026-01-22)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-south-korea-ai-basic-act-in-force-2026-01-22", "obligationId": "AIGE-OBL-KR-AIBASIC", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-kr-aibasic", "see": null }, { "topic": "human-oversight", "framework": "uk-duaa", "frameworkShort": "UK DUAA", "column": "uk", "reference": "Art. 22C", "clauseId": "art-22c", "label": "UK GDPR Art. 22C", "title": "Safeguards for automated decision-making", "strength": "core", "verified": true, "note": "Inserted into the UK GDPR by DUAA s. 80: information, representations, human intervention and contest.", "url": "https://www.legislation.gov.uk/ukpga/2025/18/section/80", "obligation": "UK GDPR Arts. 22A–22D permission-plus-safeguards model for significant, solely automated decisions (Data (Use and Access) Act 2025)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-uk-gdpr-arts-22a22d-permission-plus-safeguards-model-for-significant-solely-automated-decisions-data-use-and-access-act-2025", "obligationId": "AIGE-OBL-UK-ADM", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-uk-adm", "see": null }, { "topic": "human-oversight", "framework": "uk-atrs", "frameworkShort": "UK ATRS", "column": "uk", "reference": "2.3.2", "clauseId": "_2.3.2", "label": "ATRS 2.3.2", "title": "Human review", "strength": "core", "verified": true, "note": null, "url": "https://www.gov.uk/government/publications/algorithmic-transparency-template", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "human-oversight", "framework": "sg-agentic-framework", "frameworkShort": "Singapore Agentic", "column": "sg", "reference": "2.2.2", "clauseId": "_2.2.2", "label": "Agentic 2.2.2", "title": "Design for meaningful human oversight", "strength": "core", "verified": true, "note": null, "url": "https://www.imda.gov.sg/-/media/imda/files/about/emerging-tech-and-research/artificial-intelligence/mgf-for-agentic-ai.pdf", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "human-oversight", "framework": "coe-cets-225", "frameworkShort": "CoE Convention", "column": "intl", "reference": "Art. 8", "clauseId": "art-8", "label": "CoE Art. 8", "title": "Transparency and oversight", "strength": "related", "verified": true, "note": null, "url": "https://rm.coe.int/1680afae3c", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "human-oversight", "framework": "oecd-ai-principles", "frameworkShort": "OECD AI Principles", "column": "intl", "reference": "1.2(b)", "clauseId": "_1.2-b", "label": "OECD 1.2(b)", "title": "Human agency and oversight safeguards", "strength": "related", "verified": true, "note": null, "url": "https://legalinstruments.oecd.org/en/instruments/OECD-LEGAL-0449", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "runtime-guardrails", "framework": "eu-ai-act", "frameworkShort": "EU AI Act", "column": "eu", "reference": "Art. 5(1)(a)–(b)", "clauseId": "art-5-1-a-b", "label": "Art. 5(1)(a)–(b)", "title": "Manipulative techniques; exploitation of vulnerabilities", "strength": "related", "verified": true, "note": null, "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng#art_5", "obligation": "EU AI Act Art. 5 prohibited practices (incl. new NCII and CSAM bans)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-eu-ai-act-art-5-prohibited-practices-incl-new-ncii-and-csam-bans", "obligationId": "AIGE-OBL-EUAIA-ART5", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-euaia-art5", "see": null }, { "topic": "runtime-guardrails", "framework": "gpai-code-of-practice", "frameworkShort": "GPAI Code", "column": "gpai", "reference": "Safety C5", "clauseId": "safety-c5", "label": "Safety C5", "title": "Commitment 5: Safety mitigations", "strength": "related", "verified": true, "note": null, "url": "https://ec.europa.eu/newsroom/dae/redirection/document/118119", "obligation": "Safety and Security (systemic-risk models only)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-safety-and-security-systemic-risk-models-only", "obligationId": "AIGE-OBL-GPAICOP-SAFETY", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-gpaicop-safety", "see": null }, { "topic": "runtime-guardrails", "framework": "csa-aicm", "frameworkShort": "CSA AICM", "column": "csa", "reference": "TVM-13", "clauseId": "TVM-13", "label": "TVM-13", "title": "Guardrails", "strength": "core", "verified": true, "note": null, "url": "https://cloudsecurityalliance.org/artifacts/ai-controls-matrix-v1-1", "obligation": "AICM v1.1: 247 control objectives across 18 domains", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-aicm-v11-247-control-objectives-across-18-domains", "obligationId": "AIGE-OBL-CSA-AICM", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-csa-aicm", "see": null }, { "topic": "runtime-guardrails", "framework": "csa-aicm", "frameworkShort": "CSA AICM", "column": "csa", "reference": "AIS-09", "clauseId": "AIS-09", "label": "AIS-09", "title": "Input Validation", "strength": "core", "verified": true, "note": null, "url": "https://cloudsecurityalliance.org/artifacts/ai-controls-matrix-v1-1", "obligation": "AICM v1.1: 247 control objectives across 18 domains", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-aicm-v11-247-control-objectives-across-18-domains", "obligationId": "AIGE-OBL-CSA-AICM", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-csa-aicm", "see": null }, { "topic": "runtime-guardrails", "framework": "csa-aicm", "frameworkShort": "CSA AICM", "column": "csa", "reference": "AIS-10", "clauseId": "AIS-10", "label": "AIS-10", "title": "Output Validation", "strength": "core", "verified": true, "note": null, "url": "https://cloudsecurityalliance.org/artifacts/ai-controls-matrix-v1-1", "obligation": "AICM v1.1: 247 control objectives across 18 domains", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-aicm-v11-247-control-objectives-across-18-domains", "obligationId": "AIGE-OBL-CSA-AICM", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-csa-aicm", "see": null }, { "topic": "runtime-guardrails", "framework": "owasp-llm-top-10", "frameworkShort": "OWASP LLM", "column": "owasp", "reference": "LLM01:2026", "clauseId": "llm01-2026", "label": "LLM01:2026", "title": "Prompt Injection", "strength": "core", "verified": true, "note": null, "url": "https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/", "obligation": "Top 10 for LLM Applications 2026", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-top-10-for-llm-applications-2026", "obligationId": "AIGE-OBL-OWASP-LLM", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-owasp-llm", "see": null }, { "topic": "runtime-guardrails", "framework": "owasp-llm-top-10", "frameworkShort": "OWASP LLM", "column": "owasp", "reference": "LLM10:2026", "clauseId": "llm10-2026", "label": "LLM10:2026", "title": "Improper Output Handling", "strength": "core", "verified": true, "note": null, "url": "https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/", "obligation": "Top 10 for LLM Applications 2026", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-top-10-for-llm-applications-2026", "obligationId": "AIGE-OBL-OWASP-LLM", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-owasp-llm", "see": null }, { "topic": "runtime-guardrails", "framework": "owasp-llm-top-10", "frameworkShort": "OWASP LLM", "column": "owasp", "reference": "LLM06:2026", "clauseId": "llm06-2026", "label": "LLM06:2026", "title": "Unbounded Consumption", "strength": "related", "verified": true, "note": null, "url": "https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/", "obligation": "Top 10 for LLM Applications 2026", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-top-10-for-llm-applications-2026", "obligationId": "AIGE-OBL-OWASP-LLM", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-owasp-llm", "see": null }, { "topic": "runtime-guardrails", "framework": "sg-agentic-framework", "frameworkShort": "Singapore Agentic", "column": "sg", "reference": "2.3.1", "clauseId": "_2.3.1", "label": "Agentic 2.3.1", "title": "During design and development, use technical controls", "strength": "core", "verified": true, "note": null, "url": "https://www.imda.gov.sg/-/media/imda/files/about/emerging-tech-and-research/artificial-intelligence/mgf-for-agentic-ai.pdf", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "robustness-security-evals", "framework": "eu-ai-act", "frameworkShort": "EU AI Act", "column": "eu", "reference": "Art. 15(3)", "clauseId": "art-15-3", "label": "Art. 15(3)", "title": "Declared accuracy levels and metrics", "strength": "related", "verified": true, "note": "Declared metrics become the eval baseline; calibration is measured in the gate.", "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng#art_15", "obligation": "EU AI Act Art. 15 accuracy, robustness and cybersecurity", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-eu-ai-act-art-15-accuracy-robustness-and-cybersecurity", "obligationId": "AIGE-OBL-EUAIA-ART15", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-euaia-art15", "see": null }, { "topic": "robustness-security-evals", "framework": "eu-ai-act", "frameworkShort": "EU AI Act", "column": "eu", "reference": "Art. 9", "clauseId": "art-9", "label": "Art. 9", "title": "Risk management system", "strength": "related", "verified": true, "note": "Art. 9(8): testing against prior defined metrics and probabilistic thresholds, before placing on the market.", "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng#art_9", "obligation": "EU AI Act Art. 9 risk management system", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-eu-ai-act-art-9-risk-management-system", "obligationId": "AIGE-OBL-EUAIA-ART9", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-euaia-art9", "see": null }, { "topic": "robustness-security-evals", "framework": "eu-ai-act", "frameworkShort": "EU AI Act", "column": "eu", "reference": "Art. 42(3)", "clauseId": "art-42-3", "label": "Art. 42(3)", "title": "Presumption of conformity for cybersecurity (Cyber Resilience Act)", "strength": "related", "verified": true, "note": "Added by the Digital Omnibus (Reg. (EU) 2026/1744): CRA conformity counts for the Art. 15 cybersecurity requirement.", "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng#art_42", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "robustness-security-evals", "framework": "gpai-code-of-practice", "frameworkShort": "GPAI Code", "column": "gpai", "reference": "Safety 3.2", "clauseId": "safety-3.2", "label": "Safety 3.2", "title": "Measure 3.2: Model evaluations", "strength": "core", "verified": true, "note": null, "url": "https://ec.europa.eu/newsroom/dae/redirection/document/118119", "obligation": "Safety and Security (systemic-risk models only)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-safety-and-security-systemic-risk-models-only", "obligationId": "AIGE-OBL-GPAICOP-SAFETY", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-gpaicop-safety", "see": null }, { "topic": "robustness-security-evals", "framework": "gpai-code-of-practice", "frameworkShort": "GPAI Code", "column": "gpai", "reference": "Safety C6", "clauseId": "safety-c6", "label": "Safety C6", "title": "Commitment 6: Security mitigations", "strength": "related", "verified": true, "note": null, "url": "https://ec.europa.eu/newsroom/dae/redirection/document/118119", "obligation": "Safety and Security (systemic-risk models only)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-safety-and-security-systemic-risk-models-only", "obligationId": "AIGE-OBL-GPAICOP-SAFETY", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-gpaicop-safety", "see": null }, { "topic": "robustness-security-evals", "framework": "gdpr", "frameworkShort": "GDPR", "column": "gdpr", "reference": "Art. 32", "clauseId": "art-32", "label": "Art. 32", "title": "Security of processing", "strength": "related", "verified": true, "note": "Privacy-attack evals (membership inference, extraction) as evidence of appropriate security.", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng#art_32", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "robustness-security-evals", "framework": "nist-ai-rmf", "frameworkShort": "NIST AI RMF", "column": "nist", "reference": "MEASURE 2.7", "clauseId": "measure-2.7", "label": "MEASURE 2.7", "title": "MEASURE 2.7: AI system security and resilience as identified in the MAP function are evaluated and documented", "strength": "core", "verified": true, "note": null, "url": "https://airc.nist.gov/airmf-resources/airmf/", "obligation": "MEASURE", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-measure", "obligationId": "AIGE-OBL-NISTRMF-MEASURE", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-nistrmf-measure", "see": null }, { "topic": "robustness-security-evals", "framework": "nist-ai-rmf", "frameworkShort": "NIST AI RMF", "column": "nist", "reference": "MEASURE 2.1", "clauseId": "measure-2.1", "label": "MEASURE 2.1", "title": "MEASURE 2.1: Test sets, metrics, and details about the tools used during TEVV are documented", "strength": "related", "verified": true, "note": null, "url": "https://airc.nist.gov/airmf-resources/airmf/", "obligation": "MEASURE", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-measure", "obligationId": "AIGE-OBL-NISTRMF-MEASURE", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-nistrmf-measure", "see": null }, { "topic": "robustness-security-evals", "framework": "nist-ai-rmf", "frameworkShort": "NIST AI RMF", "column": "nist", "reference": "MEASURE 1", "clauseId": "measure-1", "label": "MEASURE 1", "title": "MEASURE 1: Appropriate methods and metrics are identified and applied", "strength": "related", "verified": true, "note": null, "url": "https://airc.nist.gov/airmf-resources/airmf/", "obligation": "MEASURE", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-measure", "obligationId": "AIGE-OBL-NISTRMF-MEASURE", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-nistrmf-measure", "see": null }, { "topic": "robustness-security-evals", "framework": "csa-aicm", "frameworkShort": "CSA AICM", "column": "csa", "reference": "MDS-06", "clauseId": "MDS-06", "label": "MDS-06", "title": "Adversarial Attack Analysis", "strength": "core", "verified": true, "note": null, "url": "https://cloudsecurityalliance.org/artifacts/ai-controls-matrix-v1-1", "obligation": "AICM v1.1: 247 control objectives across 18 domains", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-aicm-v11-247-control-objectives-across-18-domains", "obligationId": "AIGE-OBL-CSA-AICM", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-csa-aicm", "see": null }, { "topic": "robustness-security-evals", "framework": "csa-aicm", "frameworkShort": "CSA AICM", "column": "csa", "reference": "MDS-07", "clauseId": "MDS-07", "label": "MDS-07", "title": "Robustness against Adversarial Attack / Model Hardening", "strength": "core", "verified": true, "note": null, "url": "https://cloudsecurityalliance.org/artifacts/ai-controls-matrix-v1-1", "obligation": "AICM v1.1: 247 control objectives across 18 domains", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-aicm-v11-247-control-objectives-across-18-domains", "obligationId": "AIGE-OBL-CSA-AICM", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-csa-aicm", "see": null }, { "topic": "robustness-security-evals", "framework": "csa-aicm", "frameworkShort": "CSA AICM", "column": "csa", "reference": "AIS-05", "clauseId": "AIS-05", "label": "AIS-05", "title": "Application Security Testing", "strength": "related", "verified": true, "note": null, "url": "https://cloudsecurityalliance.org/artifacts/ai-controls-matrix-v1-1", "obligation": "AICM v1.1: 247 control objectives across 18 domains", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-aicm-v11-247-control-objectives-across-18-domains", "obligationId": "AIGE-OBL-CSA-AICM", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-csa-aicm", "see": null }, { "topic": "robustness-security-evals", "framework": "owasp-llm-top-10", "frameworkShort": "OWASP LLM", "column": "owasp", "reference": "LLM01:2026", "clauseId": "llm01-2026", "label": "LLM01:2026", "title": "Prompt Injection", "strength": "related", "verified": true, "note": null, "url": "https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/", "obligation": "Top 10 for LLM Applications 2026", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-top-10-for-llm-applications-2026", "obligationId": "AIGE-OBL-OWASP-LLM", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-owasp-llm", "see": null }, { "topic": "robustness-security-evals", "framework": "owasp-agentic-top-10", "frameworkShort": "OWASP Agentic", "column": "owasp", "reference": "ASI05", "clauseId": "asi05", "label": "ASI05", "title": "Unexpected Code Execution (RCE)", "strength": "related", "verified": true, "note": null, "url": "https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/", "obligation": "Top 10 for Agentic Applications 2026", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-top-10-for-agentic-applications-2026", "obligationId": "AIGE-OBL-OWASP-AGENTIC", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-owasp-agentic", "see": null }, { "topic": "robustness-security-evals", "framework": "kr-ai-basic-act", "frameworkShort": "Korea AI Act", "column": "kr", "reference": "Art. 32(1)", "clauseId": "art-32-1", "label": "Art. 32(1)", "title": "Safety duties for AI above the compute threshold", "strength": "related", "verified": true, "note": null, "url": "https://www.law.go.kr/LSW/lsInfoP.do?lsiSeq=268543", "obligation": "South Korea AI Basic Act (in force 2026-01-22)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-south-korea-ai-basic-act-in-force-2026-01-22", "obligationId": "AIGE-OBL-KR-AIBASIC", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-kr-aibasic", "see": null }, { "topic": "robustness-security-evals", "framework": "sg-genai-framework", "frameworkShort": "Singapore GenAI", "column": "sg", "reference": "5", "clauseId": "_5", "label": "GenAI 5", "title": "Testing and Assurance", "strength": "core", "verified": true, "note": null, "url": "https://aiverifyfoundation.sg/wp-content/uploads/2024/05/Model-AI-Governance-Framework-for-Generative-AI-May-2024-1-1.pdf", "obligation": "Singapore IMDA Model AI Governance Framework for Generative AI (voluntary)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-singapore-imda-model-ai-governance-framework-for-generative-ai-voluntary", "obligationId": "AIGE-OBL-SG-GENAI", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-sg-genai", "see": null }, { "topic": "robustness-security-evals", "framework": "sg-genai-framework", "frameworkShort": "Singapore GenAI", "column": "sg", "reference": "6", "clauseId": "_6", "label": "GenAI 6", "title": "Security", "strength": "core", "verified": true, "note": null, "url": "https://aiverifyfoundation.sg/wp-content/uploads/2024/05/Model-AI-Governance-Framework-for-Generative-AI-May-2024-1-1.pdf", "obligation": "Singapore IMDA Model AI Governance Framework for Generative AI (voluntary)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-singapore-imda-model-ai-governance-framework-for-generative-ai-voluntary", "obligationId": "AIGE-OBL-SG-GENAI", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-sg-genai", "see": null }, { "topic": "robustness-security-evals", "framework": "sg-agentic-framework", "frameworkShort": "Singapore Agentic", "column": "sg", "reference": "2.3.2", "clauseId": "_2.3.2", "label": "Agentic 2.3.2", "title": "Before deploying, test agents", "strength": "core", "verified": true, "note": null, "url": "https://www.imda.gov.sg/-/media/imda/files/about/emerging-tech-and-research/artificial-intelligence/mgf-for-agentic-ai.pdf", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "robustness-security-evals", "framework": "coe-cets-225", "frameworkShort": "CoE Convention", "column": "intl", "reference": "Art. 16(2)(g)", "clauseId": "art-16-2-g", "label": "CoE Art. 16(2)(g)", "title": "Testing before first use and when significantly modified", "strength": "core", "verified": true, "note": null, "url": "https://rm.coe.int/1680afae3c", "obligation": "Council of Europe Convention Art. 16(2)(g) testing before first use and on significant modification", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-council-of-europe-convention-art-162g-testing-before-first-use-and-on-significant-modification", "obligationId": "AIGE-OBL-COE-ART16-2G", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-coe-art16-2g", "see": null }, { "topic": "robustness-security-evals", "framework": "oecd-ai-principles", "frameworkShort": "OECD AI Principles", "column": "intl", "reference": "1.4", "clauseId": "_1.4", "label": "OECD 1.4", "title": "Robustness, security and safety", "strength": "core", "verified": true, "note": null, "url": "https://legalinstruments.oecd.org/en/instruments/OECD-LEGAL-0449", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "robustness-security-evals", "framework": "g7-hiroshima-coc", "frameworkShort": "G7 Code", "column": "intl", "reference": "Action 1", "clauseId": "action-1", "label": "G7 Action 1", "title": "Identify, evaluate and mitigate risks across the lifecycle, including testing", "strength": "core", "verified": true, "note": null, "url": "https://digital-strategy.ec.europa.eu/en/library/hiroshima-process-international-code-conduct-advanced-ai-systems", "obligation": "G7 Hiroshima Code action 1: lifecycle risk management and pre-deployment testing", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-g7-hiroshima-code-action-1-lifecycle-risk-management-and-pre-deployment-testing", "obligationId": "AIGE-OBL-G7-A1", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-g7-a1", "see": null }, { "topic": "incident-monitoring", "framework": "eu-ai-act", "frameworkShort": "EU AI Act", "column": "eu", "reference": "Art. 26(5)", "clauseId": "art-26-5", "label": "Art. 26(5)", "title": "Deployer monitoring, informing the provider and suspending use", "strength": "core", "verified": true, "note": null, "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng#art_26", "obligation": "EU AI Act Art. 26 deployer obligations for high-risk systems", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-eu-ai-act-art-26-deployer-obligations-for-high-risk-systems", "obligationId": "AIGE-OBL-EUAIA-ART26", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-euaia-art26", "see": "https://aigovernanceengineer.com/bok/incidents#deployer-duties-inform-the-provider-suspend-use" }, { "topic": "incident-monitoring", "framework": "eu-ai-act", "frameworkShort": "EU AI Act", "column": "eu", "reference": "Art. 3(49)", "clauseId": "art-3-49", "label": "Art. 3(49)", "title": "Definition of serious incident", "strength": "related", "verified": true, "note": null, "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng#art_3", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": "https://aigovernanceengineer.com/bok/incidents#incident-hazard-issue-and-serious-incident" }, { "topic": "incident-monitoring", "framework": "eu-ai-act", "frameworkShort": "EU AI Act", "column": "eu", "reference": "Art. 20", "clauseId": "art-20", "label": "Art. 20", "title": "Corrective actions and duty of information", "strength": "related", "verified": true, "note": null, "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng#art_20", "obligation": "EU AI Act Art. 20 corrective actions and duty of information", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-eu-ai-act-art-20-corrective-actions-and-duty-of-information", "obligationId": "AIGE-OBL-EUAIA-ART20", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-euaia-art20", "see": "https://aigovernanceengineer.com/bok/incidents#capa-from-incident-to-risk-register-and-eval-suite" }, { "topic": "incident-monitoring", "framework": "gpai-code-of-practice", "frameworkShort": "GPAI Code", "column": "gpai", "reference": "Safety C9", "clauseId": "safety-c9", "label": "Safety C9", "title": "Commitment 9: Serious incident reporting", "strength": "core", "verified": true, "note": null, "url": "https://ec.europa.eu/newsroom/dae/redirection/document/118119", "obligation": "Safety and Security (systemic-risk models only)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-safety-and-security-systemic-risk-models-only", "obligationId": "AIGE-OBL-GPAICOP-SAFETY", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-gpaicop-safety", "see": null }, { "topic": "incident-monitoring", "framework": "gpai-code-of-practice", "frameworkShort": "GPAI Code", "column": "gpai", "reference": "Safety 3.5", "clauseId": "safety-3.5", "label": "Safety 3.5", "title": "Measure 3.5: Post-market monitoring", "strength": "related", "verified": true, "note": null, "url": "https://ec.europa.eu/newsroom/dae/redirection/document/118119", "obligation": "Safety and Security (systemic-risk models only)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-safety-and-security-systemic-risk-models-only", "obligationId": "AIGE-OBL-GPAICOP-SAFETY", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-gpaicop-safety", "see": null }, { "topic": "incident-monitoring", "framework": "gdpr", "frameworkShort": "GDPR", "column": "gdpr", "reference": "Arts. 33–34", "clauseId": "arts-33-34", "label": "Arts. 33–34", "title": "Notification and communication of a personal data breach", "strength": "core", "verified": true, "note": "A 72-hour clock beside AI Act Art. 73; AI adds regurgitation, inversion and prompt-injection breaches.", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng#art_33", "obligation": "GDPR Arts. 33–34 personal data breach notification", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-gdpr-arts-3334-personal-data-breach-notification", "obligationId": "AIGE-OBL-GDPR-ART33-34", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-gdpr-art33-34", "see": null }, { "topic": "incident-monitoring", "framework": "nist-ai-rmf", "frameworkShort": "NIST AI RMF", "column": "nist", "reference": "MANAGE 4.3", "clauseId": "manage-4.3", "label": "MANAGE 4.3", "title": "MANAGE 4.3: Incidents and errors are communicated to relevant AI actors, including affected communities. Processes for tracking, responding to, and recovering from incidents and errors are followed and documented", "strength": "core", "verified": true, "note": null, "url": "https://airc.nist.gov/airmf-resources/airmf/", "obligation": "MANAGE", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-manage", "obligationId": "AIGE-OBL-NISTRMF-MANAGE", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-nistrmf-manage", "see": "https://aigovernanceengineer.com/bok/incidents#capa-from-incident-to-risk-register-and-eval-suite" }, { "topic": "incident-monitoring", "framework": "nist-ai-rmf", "frameworkShort": "NIST AI RMF", "column": "nist", "reference": "MANAGE 2.4", "clauseId": "manage-2.4", "label": "MANAGE 2.4", "title": "MANAGE 2.4: Mechanisms are in place and applied, and responsibilities are assigned and understood, to supersede, disengage, or deactivate AI systems that demonstrate performance or outcomes inconsistent with intended use", "strength": "related", "verified": true, "note": null, "url": "https://airc.nist.gov/airmf-resources/airmf/", "obligation": "MANAGE", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-manage", "obligationId": "AIGE-OBL-NISTRMF-MANAGE", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-nistrmf-manage", "see": "https://aigovernanceengineer.com/bok/incidents#the-response-lifecycle" }, { "topic": "incident-monitoring", "framework": "nist-ai-rmf", "frameworkShort": "NIST AI RMF", "column": "nist", "reference": "GOVERN 4.3", "clauseId": "govern-4.3", "label": "GOVERN 4.3", "title": "GOVERN 4.3: Organizational practices are in place to enable AI testing, identification of incidents, and information sharing", "strength": "related", "verified": true, "note": null, "url": "https://airc.nist.gov/airmf-resources/airmf/", "obligation": "GOVERN", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-govern", "obligationId": "AIGE-OBL-NISTRMF-GOVERN", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-nistrmf-govern", "see": null }, { "topic": "incident-monitoring", "framework": "csa-aicm", "frameworkShort": "CSA AICM", "column": "csa", "reference": "SEF-07", "clauseId": "SEF-07", "label": "SEF-07", "title": "Incident Management and Response", "strength": "core", "verified": true, "note": null, "url": "https://cloudsecurityalliance.org/artifacts/ai-controls-matrix-v1-1", "obligation": "AICM v1.1: 247 control objectives across 18 domains", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-aicm-v11-247-control-objectives-across-18-domains", "obligationId": "AIGE-OBL-CSA-AICM", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-csa-aicm", "see": null }, { "topic": "incident-monitoring", "framework": "csa-aicm", "frameworkShort": "CSA AICM", "column": "csa", "reference": "SEF-08", "clauseId": "SEF-08", "label": "SEF-08", "title": "Security Breach Notification", "strength": "core", "verified": true, "note": null, "url": "https://cloudsecurityalliance.org/artifacts/ai-controls-matrix-v1-1", "obligation": "AICM v1.1: 247 control objectives across 18 domains", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-aicm-v11-247-control-objectives-across-18-domains", "obligationId": "AIGE-OBL-CSA-AICM", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-csa-aicm", "see": null }, { "topic": "incident-monitoring", "framework": "kr-ai-basic-act", "frameworkShort": "Korea AI Act", "column": "kr", "reference": "Art. 32(1)", "clauseId": "art-32-1", "label": "Art. 32(1)", "title": "Safety duties for AI above the compute threshold", "strength": "core", "verified": true, "note": "Risk monitoring and a response system for AI above the compute threshold.", "url": "https://www.law.go.kr/LSW/lsInfoP.do?lsiSeq=268543", "obligation": "South Korea AI Basic Act (in force 2026-01-22)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-south-korea-ai-basic-act-in-force-2026-01-22", "obligationId": "AIGE-OBL-KR-AIBASIC", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-kr-aibasic", "see": null }, { "topic": "incident-monitoring", "framework": "sg-genai-framework", "frameworkShort": "Singapore GenAI", "column": "sg", "reference": "4", "clauseId": "_4", "label": "GenAI 4", "title": "Incident Reporting", "strength": "core", "verified": true, "note": null, "url": "https://aiverifyfoundation.sg/wp-content/uploads/2024/05/Model-AI-Governance-Framework-for-Generative-AI-May-2024-1-1.pdf", "obligation": "Singapore IMDA Model AI Governance Framework for Generative AI (voluntary)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-singapore-imda-model-ai-governance-framework-for-generative-ai-voluntary", "obligationId": "AIGE-OBL-SG-GENAI", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-sg-genai", "see": null }, { "topic": "incident-monitoring", "framework": "sg-agentic-framework", "frameworkShort": "Singapore Agentic", "column": "sg", "reference": "2.3.3", "clauseId": "_2.3.3", "label": "Agentic 2.3.3", "title": "When deploying, continuously monitor and test", "strength": "core", "verified": true, "note": null, "url": "https://www.imda.gov.sg/-/media/imda/files/about/emerging-tech-and-research/artificial-intelligence/mgf-for-agentic-ai.pdf", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "incident-monitoring", "framework": "g7-hiroshima-coc", "frameworkShort": "G7 Code", "column": "intl", "reference": "Action 2", "clauseId": "action-2", "label": "G7 Action 2", "title": "Identify and mitigate vulnerabilities, incidents and misuse after deployment", "strength": "core", "verified": true, "note": null, "url": "https://digital-strategy.ec.europa.eu/en/library/hiroshima-process-international-code-conduct-advanced-ai-systems", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "incident-monitoring", "framework": "g7-hiroshima-coc", "frameworkShort": "G7 Code", "column": "intl", "reference": "Action 4", "clauseId": "action-4", "label": "G7 Action 4", "title": "Responsible information sharing and reporting of incidents", "strength": "core", "verified": true, "note": null, "url": "https://digital-strategy.ec.europa.eu/en/library/hiroshima-process-international-code-conduct-advanced-ai-systems", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "supply-chain", "framework": "eu-ai-act", "frameworkShort": "EU AI Act", "column": "eu", "reference": "Art. 25(4)", "clauseId": "art-25-4", "label": "Art. 25(4)", "title": "Written agreement with third-party suppliers", "strength": "core", "verified": true, "note": null, "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng#art_25", "obligation": "EU AI Act Art. 25 responsibilities along the AI value chain", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-eu-ai-act-art-25-responsibilities-along-the-ai-value-chain", "obligationId": "AIGE-OBL-EUAIA-ART25", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-euaia-art25", "see": null }, { "topic": "supply-chain", "framework": "eu-ai-act", "frameworkShort": "EU AI Act", "column": "eu", "reference": "Art. 22", "clauseId": "art-22", "label": "Art. 22", "title": "Authorised representatives of providers of high-risk AI systems", "strength": "related", "verified": true, "note": null, "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng#art_22", "obligation": "EU AI Act Art. 22 authorised representative of non-EU high-risk providers", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-eu-ai-act-art-22-authorised-representative-of-non-eu-high-risk-providers", "obligationId": "AIGE-OBL-EUAIA-ART22", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-euaia-art22", "see": null }, { "topic": "supply-chain", "framework": "eu-ai-act", "frameworkShort": "EU AI Act", "column": "eu", "reference": "Art. 23", "clauseId": "art-23", "label": "Art. 23", "title": "Obligations of importers", "strength": "related", "verified": true, "note": null, "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng#art_23", "obligation": "EU AI Act Art. 23 obligations of importers", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-eu-ai-act-art-23-obligations-of-importers", "obligationId": "AIGE-OBL-EUAIA-ART23", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-euaia-art23", "see": null }, { "topic": "supply-chain", "framework": "eu-ai-act", "frameworkShort": "EU AI Act", "column": "eu", "reference": "Art. 24", "clauseId": "art-24", "label": "Art. 24", "title": "Obligations of distributors", "strength": "related", "verified": true, "note": null, "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng#art_24", "obligation": "EU AI Act Art. 24 obligations of distributors", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-eu-ai-act-art-24-obligations-of-distributors", "obligationId": "AIGE-OBL-EUAIA-ART24", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-euaia-art24", "see": null }, { "topic": "supply-chain", "framework": "eu-ai-act", "frameworkShort": "EU AI Act", "column": "eu", "reference": "Art. 54", "clauseId": "art-54", "label": "Art. 54", "title": "Authorised representatives of providers of general-purpose AI models", "strength": "related", "verified": true, "note": null, "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng#art_54", "obligation": "EU AI Act Art. 54 authorised representative of non-EU GPAI providers", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-eu-ai-act-art-54-authorised-representative-of-non-eu-gpai-providers", "obligationId": "AIGE-OBL-EUAIA-ART54", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-euaia-art54", "see": null }, { "topic": "supply-chain", "framework": "gpai-code-of-practice", "frameworkShort": "GPAI Code", "column": "gpai", "reference": "Transparency 1.2", "clauseId": "transparency-1.2", "label": "Transparency 1.2", "title": "Providing relevant information", "strength": "related", "verified": true, "note": "Information for downstream providers that integrate the model into their AI systems.", "url": "https://ec.europa.eu/newsroom/dae/redirection/document/118120", "obligation": "Transparency", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-transparency", "obligationId": "AIGE-OBL-GPAICOP-TRANSPARENCY", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-gpaicop-transparency", "see": null }, { "topic": "supply-chain", "framework": "gdpr", "frameworkShort": "GDPR", "column": "gdpr", "reference": "Art. 28", "clauseId": "art-28", "label": "Art. 28", "title": "Processor", "strength": "core", "verified": true, "note": "AI vendor contracts: no-training clauses, retention, region, sub-processors, change notice.", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng#art_28", "obligation": "GDPR Art. 28 processors, incl. AI vendors", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-gdpr-art-28-processors-incl-ai-vendors", "obligationId": "AIGE-OBL-GDPR-ART28", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-gdpr-art28", "see": null }, { "topic": "supply-chain", "framework": "gdpr", "frameworkShort": "GDPR", "column": "gdpr", "reference": "Arts. 44–46", "clauseId": "arts-44-46", "label": "Arts. 44–46", "title": "Transfers to third countries", "strength": "related", "verified": true, "note": "Remote inference endpoints and vendor telemetry outside the EEA are transfers.", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng#art_44", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "supply-chain", "framework": "nist-ai-rmf", "frameworkShort": "NIST AI RMF", "column": "nist", "reference": "MANAGE 3.1", "clauseId": "manage-3.1", "label": "MANAGE 3.1", "title": "MANAGE 3.1: AI risks and benefits from third-party resources are regularly monitored, and risk controls are applied and documented", "strength": "core", "verified": true, "note": null, "url": "https://airc.nist.gov/airmf-resources/airmf/", "obligation": "MANAGE", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-manage", "obligationId": "AIGE-OBL-NISTRMF-MANAGE", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-nistrmf-manage", "see": null }, { "topic": "supply-chain", "framework": "nist-ai-rmf", "frameworkShort": "NIST AI RMF", "column": "nist", "reference": "GOVERN 6.2", "clauseId": "govern-6.2", "label": "GOVERN 6.2", "title": "GOVERN 6.2: Contingency processes are in place to handle failures or incidents in third-party data or AI systems deemed to be high-risk", "strength": "related", "verified": true, "note": null, "url": "https://airc.nist.gov/airmf-resources/airmf/", "obligation": "GOVERN", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-govern", "obligationId": "AIGE-OBL-NISTRMF-GOVERN", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-nistrmf-govern", "see": null }, { "topic": "supply-chain", "framework": "csa-aicm", "frameworkShort": "CSA AICM", "column": "csa", "reference": "STA-10", "clauseId": "STA-10", "label": "STA-10", "title": "Supply Chain Risk Management", "strength": "core", "verified": true, "note": null, "url": "https://cloudsecurityalliance.org/artifacts/ai-controls-matrix-v1-1", "obligation": "AICM v1.1: 247 control objectives across 18 domains", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-aicm-v11-247-control-objectives-across-18-domains", "obligationId": "AIGE-OBL-CSA-AICM", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-csa-aicm", "see": null }, { "topic": "supply-chain", "framework": "csa-aicm", "frameworkShort": "CSA AICM", "column": "csa", "reference": "STA-09", "clauseId": "STA-09", "label": "STA-09", "title": "Service Bill of Material (BOM)", "strength": "core", "verified": true, "note": null, "url": "https://cloudsecurityalliance.org/artifacts/ai-controls-matrix-v1-1", "obligation": "AICM v1.1: 247 control objectives across 18 domains", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-aicm-v11-247-control-objectives-across-18-domains", "obligationId": "AIGE-OBL-CSA-AICM", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-csa-aicm", "see": null }, { "topic": "supply-chain", "framework": "owasp-llm-top-10", "frameworkShort": "OWASP LLM", "column": "owasp", "reference": "LLM04:2026", "clauseId": "llm04-2026", "label": "LLM04:2026", "title": "Supply Chain", "strength": "core", "verified": true, "note": null, "url": "https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/", "obligation": "Top 10 for LLM Applications 2026", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-top-10-for-llm-applications-2026", "obligationId": "AIGE-OBL-OWASP-LLM", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-owasp-llm", "see": null }, { "topic": "supply-chain", "framework": "owasp-agentic-top-10", "frameworkShort": "OWASP Agentic", "column": "owasp", "reference": "ASI04", "clauseId": "asi04", "label": "ASI04", "title": "Agentic Supply Chain Vulnerabilities", "strength": "core", "verified": true, "note": null, "url": "https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/", "obligation": "Top 10 for Agentic Applications 2026", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-top-10-for-agentic-applications-2026", "obligationId": "AIGE-OBL-OWASP-AGENTIC", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-owasp-agentic", "see": null }, { "topic": "supply-chain", "framework": "uk-atrs", "frameworkShort": "UK ATRS", "column": "uk", "reference": "2.1.4", "clauseId": "_2.1.4", "label": "ATRS 2.1.4", "title": "Third party involvement", "strength": "related", "verified": true, "note": null, "url": "https://www.gov.uk/government/publications/algorithmic-transparency-template", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "supply-chain", "framework": "g7-hiroshima-coc", "frameworkShort": "G7 Code", "column": "intl", "reference": "Action 11", "clauseId": "action-11", "label": "G7 Action 11", "title": "Implement data input measures and protect personal data and intellectual property", "strength": "related", "verified": true, "note": null, "url": "https://digital-strategy.ec.europa.eu/en/library/hiroshima-process-international-code-conduct-advanced-ai-systems", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "prohibited-practices", "framework": "eu-ai-act", "frameworkShort": "EU AI Act", "column": "eu", "reference": "Art. 5", "clauseId": "art-5", "label": "Art. 5", "title": "Prohibited AI practices", "strength": "core", "verified": true, "note": "The Digital Omnibus adds new prohibitions that apply from 2026-12-02.", "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng#art_5", "obligation": "EU AI Act Art. 5 prohibited practices (incl. new NCII and CSAM bans)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-eu-ai-act-art-5-prohibited-practices-incl-new-ncii-and-csam-bans", "obligationId": "AIGE-OBL-EUAIA-ART5", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-euaia-art5", "see": null }, { "topic": "prohibited-practices", "framework": "iso-42001", "frameworkShort": "ISO 42001", "column": "iso", "reference": "A.9.4", "clauseId": "a.9.4", "label": "A.9.4", "title": "Intended use of the AI system", "strength": "related", "verified": false, "note": "Clause id and title as listed in the AI RMF to ISO/IEC FDIS 42001 crosswalk (contributed by Microsoft to NIST's AI Resource Center) and in CSA's AICM v1.1.1 mapping; the published ISO text was not opened.", "url": "https://www.iso.org/standard/42001", "obligation": "A.9 Use of AI systems", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-a9-use-of-ai-systems", "obligationId": "AIGE-OBL-ISO42001-A9", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-iso42001-a9", "see": null }, { "topic": "prohibited-practices", "framework": "nist-ai-rmf", "frameworkShort": "NIST AI RMF", "column": "nist", "reference": "GOVERN 1.1", "clauseId": "govern-1.1", "label": "GOVERN 1.1", "title": "GOVERN 1.1: Legal and regulatory requirements involving AI are understood, managed, and documented", "strength": "related", "verified": true, "note": null, "url": "https://airc.nist.gov/airmf-resources/airmf/", "obligation": "GOVERN", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-govern", "obligationId": "AIGE-OBL-NISTRMF-GOVERN", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-nistrmf-govern", "see": null }, { "topic": "prohibited-practices", "framework": "csa-aicm", "frameworkShort": "CSA AICM", "column": "csa", "reference": "GRC-09", "clauseId": "GRC-09", "label": "GRC-09", "title": "Acceptable Use of the AI Service", "strength": "related", "verified": true, "note": null, "url": "https://cloudsecurityalliance.org/artifacts/ai-controls-matrix-v1-1", "obligation": "AICM v1.1: 247 control objectives across 18 domains", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-aicm-v11-247-control-objectives-across-18-domains", "obligationId": "AIGE-OBL-CSA-AICM", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-csa-aicm", "see": null }, { "topic": "prohibited-practices", "framework": "csa-aicm", "frameworkShort": "CSA AICM", "column": "csa", "reference": "HRS-15", "clauseId": "HRS-15", "label": "HRS-15", "title": "AI Acceptable Use", "strength": "related", "verified": true, "note": null, "url": "https://cloudsecurityalliance.org/artifacts/ai-controls-matrix-v1-1", "obligation": "AICM v1.1: 247 control objectives across 18 domains", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-aicm-v11-247-control-objectives-across-18-domains", "obligationId": "AIGE-OBL-CSA-AICM", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-csa-aicm", "see": null }, { "topic": "prohibited-practices", "framework": "sg-agentic-framework", "frameworkShort": "Singapore Agentic", "column": "sg", "reference": "2.1.1", "clauseId": "_2.1.1", "label": "Agentic 2.1.1", "title": "Determine suitable use cases for agent deployment", "strength": "related", "verified": true, "note": null, "url": "https://www.imda.gov.sg/-/media/imda/files/about/emerging-tech-and-research/artificial-intelligence/mgf-for-agentic-ai.pdf", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "prohibited-practices", "framework": "coe-cets-225", "frameworkShort": "CoE Convention", "column": "intl", "reference": "Art. 16(4)", "clauseId": "art-16-4", "label": "CoE Art. 16(4)", "title": "Assess the need for a moratorium, ban or other measures for incompatible uses", "strength": "core", "verified": true, "note": null, "url": "https://rm.coe.int/1680afae3c", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "prohibited-practices", "framework": "cn-genai-measures", "frameworkShort": "China GenAI Measures", "column": "cn", "reference": "Art. 4", "clauseId": "art-4", "label": "GenAI Art. 4", "title": "Prohibited content and baseline duties", "strength": "related", "verified": true, "note": "Point (1) lists content that must not be generated; points (2) to (5) set non-discrimination, IP, rights and transparency duties; CAC text.", "url": "https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm", "obligation": "Interim Measures for Generative AI Services (in force 2023-08-15)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-interim-measures-for-generative-ai-services-in-force-2023-08-15", "obligationId": "AIGE-OBL-CN-GENAI", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-cn-genai", "see": null }, { "topic": "fairness-non-discrimination", "framework": "eu-ai-act", "frameworkShort": "EU AI Act", "column": "eu", "reference": "Art. 10(2)(f)–(g)", "clauseId": "art-10-2-f-g", "label": "Art. 10(2)(f)–(g)", "title": "Examination for possible biases; measures to detect, prevent and mitigate them", "strength": "core", "verified": true, "note": null, "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng#art_10", "obligation": "EU AI Act Art. 10 data and data governance", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-eu-ai-act-art-10-data-and-data-governance", "obligationId": "AIGE-OBL-EUAIA-ART10", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-euaia-art10", "see": null }, { "topic": "fairness-non-discrimination", "framework": "eu-ai-act", "frameworkShort": "EU AI Act", "column": "eu", "reference": "Art. 4a", "clauseId": "art-4a", "label": "Art. 4a", "title": "Special-category data for bias detection", "strength": "core", "verified": true, "note": "Added by the Digital Omnibus; strictly necessary, pseudonymised, access-controlled and deleted after correction.", "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng#art_4a", "obligation": "EU AI Act Art. 4a lawful basis for special-category data in bias detection", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-eu-ai-act-art-4a-lawful-basis-for-special-category-data-in-bias-detection", "obligationId": "AIGE-OBL-EUAIA-ART4A", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-euaia-art4a", "see": null }, { "topic": "fairness-non-discrimination", "framework": "gdpr", "frameworkShort": "GDPR", "column": "gdpr", "reference": "Art. 5(1)(a)", "clauseId": "art-5-1-a", "label": "Art. 5(1)(a)", "title": "Lawfulness, fairness and transparency", "strength": "core", "verified": true, "note": null, "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng#art_5", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "fairness-non-discrimination", "framework": "gdpr", "frameworkShort": "GDPR", "column": "gdpr", "reference": "Art. 9", "clauseId": "art-9", "label": "Art. 9", "title": "Processing of special categories of personal data", "strength": "related", "verified": true, "note": null, "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng#art_9", "obligation": "GDPR Art. 9 special categories, incl. inferred sensitive data", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-gdpr-art-9-special-categories-incl-inferred-sensitive-data", "obligationId": "AIGE-OBL-GDPR-ART9", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-gdpr-art9", "see": null }, { "topic": "fairness-non-discrimination", "framework": "iso-42001", "frameworkShort": "ISO 42001", "column": "iso", "reference": "A.5.4", "clauseId": "a.5.4", "label": "A.5.4", "title": "Assessing AI system impact on individuals or groups of individuals", "strength": "related", "verified": false, "note": "Clause id and title as listed in the AI RMF to ISO/IEC FDIS 42001 crosswalk (contributed by Microsoft to NIST's AI Resource Center) and in CSA's AICM v1.1.1 mapping; the published ISO text was not opened.", "url": "https://www.iso.org/standard/42001", "obligation": "A.5 Assessing impacts of AI systems", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-a5-assessing-impacts-of-ai-systems", "obligationId": "AIGE-OBL-ISO42001-A5", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-iso42001-a5", "see": null }, { "topic": "fairness-non-discrimination", "framework": "nist-ai-rmf", "frameworkShort": "NIST AI RMF", "column": "nist", "reference": "MEASURE 2.11", "clauseId": "measure-2.11", "label": "MEASURE 2.11", "title": "MEASURE 2.11: Fairness and bias as identified in the MAP function are evaluated and results are documented", "strength": "core", "verified": true, "note": null, "url": "https://airc.nist.gov/airmf-resources/airmf/", "obligation": "MEASURE", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-measure", "obligationId": "AIGE-OBL-NISTRMF-MEASURE", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-nistrmf-measure", "see": "https://aigovernanceengineer.com/bok/fairness-and-explainability" }, { "topic": "fairness-non-discrimination", "framework": "nist-ai-rmf", "frameworkShort": "NIST AI RMF", "column": "nist", "reference": "GOVERN 3.1", "clauseId": "govern-3.1", "label": "GOVERN 3.1", "title": "GOVERN 3.1: Decision-making related to mapping, measuring, and managing AI risks throughout the lifecycle is informed by a diverse team", "strength": "related", "verified": true, "note": null, "url": "https://airc.nist.gov/airmf-resources/airmf/", "obligation": "GOVERN", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-govern", "obligationId": "AIGE-OBL-NISTRMF-GOVERN", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-nistrmf-govern", "see": null }, { "topic": "fairness-non-discrimination", "framework": "csa-aicm", "frameworkShort": "CSA AICM", "column": "csa", "reference": "GRC-11", "clauseId": "GRC-11", "label": "GRC-11", "title": "Bias and Fairness Assessment", "strength": "core", "verified": true, "note": null, "url": "https://cloudsecurityalliance.org/artifacts/ai-controls-matrix-v1-1", "obligation": "AICM v1.1: 247 control objectives across 18 domains", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-aicm-v11-247-control-objectives-across-18-domains", "obligationId": "AIGE-OBL-CSA-AICM", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-csa-aicm", "see": null }, { "topic": "fairness-non-discrimination", "framework": "uk-atrs", "frameworkShort": "UK ATRS", "column": "uk", "reference": "2.4.2", "clauseId": "_2.4.2", "label": "ATRS 2.4.2", "title": "Model specification", "strength": "related", "verified": true, "note": "Model performance and the bias checks behind it are recorded here.", "url": "https://www.gov.uk/government/publications/algorithmic-transparency-template", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "fairness-non-discrimination", "framework": "coe-cets-225", "frameworkShort": "CoE Convention", "column": "intl", "reference": "Art. 10", "clauseId": "art-10", "label": "CoE Art. 10", "title": "Equality and non-discrimination", "strength": "core", "verified": true, "note": null, "url": "https://rm.coe.int/1680afae3c", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "fairness-non-discrimination", "framework": "oecd-ai-principles", "frameworkShort": "OECD AI Principles", "column": "intl", "reference": "1.2", "clauseId": "_1.2", "label": "OECD 1.2", "title": "Rule of law, human rights and democratic values, including fairness and privacy", "strength": "related", "verified": true, "note": null, "url": "https://legalinstruments.oecd.org/en/instruments/OECD-LEGAL-0449", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "fairness-non-discrimination", "framework": "cn-genai-measures", "frameworkShort": "China GenAI Measures", "column": "cn", "reference": "Art. 4(2)", "clauseId": "art-4-2", "label": "GenAI Art. 4(2)", "title": "Prevent discrimination in design, data, training and service", "strength": "core", "verified": true, "note": "Ethnicity, belief, country, region, sex, age, occupation and health; CAC text.", "url": "https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm", "obligation": "Interim Measures for Generative AI Services (in force 2023-08-15)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-interim-measures-for-generative-ai-services-in-force-2023-08-15", "obligationId": "AIGE-OBL-CN-GENAI", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-cn-genai", "see": null }, { "topic": "fairness-non-discrimination", "framework": "cn-algo-recommendation", "frameworkShort": "China Algo. Rec.", "column": "cn", "reference": "Art. 21", "clauseId": "art-21", "label": "AlgoRec Art. 21", "title": "No unreasonable differential treatment in trading conditions", "strength": "related", "verified": true, "note": "Bars algorithmic price discrimination based on consumer preferences and habits; CAC text.", "url": "https://www.cac.gov.cn/2022-01/04/c_1642894606364259.htm", "obligation": "Provisions on Algorithmic Recommendation (in force 2022-03-01)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-provisions-on-algorithmic-recommendation-in-force-2022-03-01", "obligationId": "AIGE-OBL-CN-ALGOREC", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-cn-algorec", "see": null }, { "topic": "privacy-data-protection", "framework": "eu-ai-act", "frameworkShort": "EU AI Act", "column": "eu", "reference": "Art. 59", "clauseId": "art-59", "label": "Art. 59", "title": "Further processing of personal data in the AI regulatory sandbox", "strength": "related", "verified": true, "note": null, "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng#art_59", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "privacy-data-protection", "framework": "eu-ai-act", "frameworkShort": "EU AI Act", "column": "eu", "reference": "Art. 4a", "clauseId": "art-4a", "label": "Art. 4a", "title": "Special-category data for bias detection", "strength": "related", "verified": true, "note": null, "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng#art_4a", "obligation": "EU AI Act Art. 4a lawful basis for special-category data in bias detection", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-eu-ai-act-art-4a-lawful-basis-for-special-category-data-in-bias-detection", "obligationId": "AIGE-OBL-EUAIA-ART4A", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-euaia-art4a", "see": null }, { "topic": "privacy-data-protection", "framework": "gdpr", "frameworkShort": "GDPR", "column": "gdpr", "reference": "Art. 5", "clauseId": "art-5", "label": "Art. 5", "title": "Principles relating to processing of personal data", "strength": "core", "verified": true, "note": null, "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng#art_5", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "privacy-data-protection", "framework": "gdpr", "frameworkShort": "GDPR", "column": "gdpr", "reference": "Art. 6", "clauseId": "art-6", "label": "Art. 6", "title": "Lawfulness of processing", "strength": "core", "verified": true, "note": null, "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng#art_6", "obligation": "GDPR Art. 6 lawful basis per processing moment", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-gdpr-art-6-lawful-basis-per-processing-moment", "obligationId": "AIGE-OBL-GDPR-ART6", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-gdpr-art6", "see": null }, { "topic": "privacy-data-protection", "framework": "gdpr", "frameworkShort": "GDPR", "column": "gdpr", "reference": "Art. 25", "clauseId": "art-25", "label": "Art. 25", "title": "Data protection by design and by default", "strength": "core", "verified": true, "note": null, "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng#art_25", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "privacy-data-protection", "framework": "gdpr", "frameworkShort": "GDPR", "column": "gdpr", "reference": "Art. 35", "clauseId": "art-35", "label": "Art. 35", "title": "Data protection impact assessment", "strength": "related", "verified": true, "note": null, "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng#art_35", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "privacy-data-protection", "framework": "iso-42001", "frameworkShort": "ISO 42001", "column": "iso", "reference": "A.7", "clauseId": "a.7", "label": "A.7", "title": "Data for AI systems", "strength": "related", "verified": true, "note": null, "url": "https://www.iso.org/standard/42001", "obligation": "A.7 Data for AI systems", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-a7-data-for-ai-systems", "obligationId": "AIGE-OBL-ISO42001-A7", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-iso42001-a7", "see": null }, { "topic": "privacy-data-protection", "framework": "nist-ai-rmf", "frameworkShort": "NIST AI RMF", "column": "nist", "reference": "MEASURE 2.10", "clauseId": "measure-2.10", "label": "MEASURE 2.10", "title": "MEASURE 2.10: Privacy risk of the AI system as identified in the MAP function is examined and documented", "strength": "core", "verified": true, "note": null, "url": "https://airc.nist.gov/airmf-resources/airmf/", "obligation": "MEASURE", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-measure", "obligationId": "AIGE-OBL-NISTRMF-MEASURE", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-nistrmf-measure", "see": null }, { "topic": "privacy-data-protection", "framework": "csa-aicm", "frameworkShort": "CSA AICM", "column": "csa", "reference": "DSP-08", "clauseId": "DSP-08", "label": "DSP-08", "title": "Data Privacy by Design and Default", "strength": "core", "verified": true, "note": null, "url": "https://cloudsecurityalliance.org/artifacts/ai-controls-matrix-v1-1", "obligation": "AICM v1.1: 247 control objectives across 18 domains", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-aicm-v11-247-control-objectives-across-18-domains", "obligationId": "AIGE-OBL-CSA-AICM", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-csa-aicm", "see": null }, { "topic": "privacy-data-protection", "framework": "csa-aicm", "frameworkShort": "CSA AICM", "column": "csa", "reference": "DSP-22", "clauseId": "DSP-22", "label": "DSP-22", "title": "Privacy Enhancing Technologies", "strength": "related", "verified": true, "note": null, "url": "https://cloudsecurityalliance.org/artifacts/ai-controls-matrix-v1-1", "obligation": "AICM v1.1: 247 control objectives across 18 domains", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-aicm-v11-247-control-objectives-across-18-domains", "obligationId": "AIGE-OBL-CSA-AICM", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-csa-aicm", "see": null }, { "topic": "privacy-data-protection", "framework": "owasp-llm-top-10", "frameworkShort": "OWASP LLM", "column": "owasp", "reference": "LLM02:2026", "clauseId": "llm02-2026", "label": "LLM02:2026", "title": "Sensitive Information Disclosure", "strength": "core", "verified": true, "note": null, "url": "https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/", "obligation": "Top 10 for LLM Applications 2026", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-top-10-for-llm-applications-2026", "obligationId": "AIGE-OBL-OWASP-LLM", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-owasp-llm", "see": null }, { "topic": "privacy-data-protection", "framework": "uk-duaa", "frameworkShort": "UK DUAA", "column": "uk", "reference": "Art. 22B", "clauseId": "art-22b", "label": "UK GDPR Art. 22B", "title": "Restrictions on automated decision-making", "strength": "related", "verified": true, "note": "Tighter rules where a significant decision rests on special-category data; UK GDPR as amended by DUAA s. 80.", "url": "https://www.legislation.gov.uk/ukpga/2025/18/section/80", "obligation": "UK GDPR Arts. 22A–22D permission-plus-safeguards model for significant, solely automated decisions (Data (Use and Access) Act 2025)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-uk-gdpr-arts-22a22d-permission-plus-safeguards-model-for-significant-solely-automated-decisions-data-use-and-access-act-2025", "obligationId": "AIGE-OBL-UK-ADM", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-uk-adm", "see": null }, { "topic": "privacy-data-protection", "framework": "sg-genai-framework", "frameworkShort": "Singapore GenAI", "column": "sg", "reference": "2", "clauseId": "_2", "label": "GenAI 2", "title": "Data", "strength": "related", "verified": true, "note": "Trusted use of personal data in training and deployment.", "url": "https://aiverifyfoundation.sg/wp-content/uploads/2024/05/Model-AI-Governance-Framework-for-Generative-AI-May-2024-1-1.pdf", "obligation": "Singapore IMDA Model AI Governance Framework for Generative AI (voluntary)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-singapore-imda-model-ai-governance-framework-for-generative-ai-voluntary", "obligationId": "AIGE-OBL-SG-GENAI", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-sg-genai", "see": null }, { "topic": "privacy-data-protection", "framework": "coe-cets-225", "frameworkShort": "CoE Convention", "column": "intl", "reference": "Art. 11", "clauseId": "art-11", "label": "CoE Art. 11", "title": "Privacy and personal data protection", "strength": "core", "verified": true, "note": null, "url": "https://rm.coe.int/1680afae3c", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "privacy-data-protection", "framework": "oecd-ai-principles", "frameworkShort": "OECD AI Principles", "column": "intl", "reference": "1.2", "clauseId": "_1.2", "label": "OECD 1.2", "title": "Rule of law, human rights and democratic values, including fairness and privacy", "strength": "related", "verified": true, "note": null, "url": "https://legalinstruments.oecd.org/en/instruments/OECD-LEGAL-0449", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "privacy-data-protection", "framework": "g7-hiroshima-coc", "frameworkShort": "G7 Code", "column": "intl", "reference": "Action 11", "clauseId": "action-11", "label": "G7 Action 11", "title": "Implement data input measures and protect personal data and intellectual property", "strength": "related", "verified": true, "note": null, "url": "https://digital-strategy.ec.europa.eu/en/library/hiroshima-process-international-code-conduct-advanced-ai-systems", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "privacy-data-protection", "framework": "cn-genai-measures", "frameworkShort": "China GenAI Measures", "column": "cn", "reference": "Art. 7(3)", "clauseId": "art-7-3", "label": "GenAI Art. 7(3)", "title": "Consent or another lawful basis for personal information in training data", "strength": "core", "verified": true, "note": "CAC text.", "url": "https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm", "obligation": "Interim Measures for Generative AI Services (in force 2023-08-15)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-interim-measures-for-generative-ai-services-in-force-2023-08-15", "obligationId": "AIGE-OBL-CN-GENAI", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-cn-genai", "see": null }, { "topic": "privacy-data-protection", "framework": "cn-genai-measures", "frameworkShort": "China GenAI Measures", "column": "cn", "reference": "Art. 11", "clauseId": "art-11", "label": "GenAI Art. 11", "title": "Protection of user input and records", "strength": "core", "verified": true, "note": "No unnecessary collection; access, correction and deletion requests handled; CAC text.", "url": "https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm", "obligation": "Interim Measures for Generative AI Services (in force 2023-08-15)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-interim-measures-for-generative-ai-services-in-force-2023-08-15", "obligationId": "AIGE-OBL-CN-GENAI", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-cn-genai", "see": null }, { "topic": "explainability", "framework": "eu-ai-act", "frameworkShort": "EU AI Act", "column": "eu", "reference": "Art. 86", "clauseId": "art-86", "label": "Art. 86", "title": "Right to explanation of individual decision-making", "strength": "core", "verified": true, "note": null, "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng#art_86", "obligation": "EU AI Act Art. 86 right to explanation of individual decision-making", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-eu-ai-act-art-86-right-to-explanation-of-individual-decision-making", "obligationId": "AIGE-OBL-EUAIA-ART86", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-euaia-art86", "see": null }, { "topic": "explainability", "framework": "eu-ai-act", "frameworkShort": "EU AI Act", "column": "eu", "reference": "Art. 13(3)(b)(iv)–(v)", "clauseId": "art-13-3-b-iv-v", "label": "Art. 13(3)(b)(iv)–(v)", "title": "Information relevant to explain output; performance for specific persons or groups", "strength": "core", "verified": true, "note": null, "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng#art_13", "obligation": "EU AI Act Art. 13 transparency and information to deployers", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-eu-ai-act-art-13-transparency-and-information-to-deployers", "obligationId": "AIGE-OBL-EUAIA-ART13", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-euaia-art13", "see": null }, { "topic": "explainability", "framework": "gdpr", "frameworkShort": "GDPR", "column": "gdpr", "reference": "Art. 15(1)(h)", "clauseId": "art-15-1-h", "label": "Art. 15(1)(h)", "title": "Meaningful information about the logic involved", "strength": "core", "verified": true, "note": null, "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng#art_15", "obligation": "GDPR Art. 15(1)(h) access to meaningful information about the logic involved", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-gdpr-art-151h-access-to-meaningful-information-about-the-logic-involved", "obligationId": "AIGE-OBL-GDPR-ART15-1H", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-gdpr-art15-1h", "see": null }, { "topic": "explainability", "framework": "gdpr", "frameworkShort": "GDPR", "column": "gdpr", "reference": "Art. 13(2)(f)", "clauseId": "art-13-2-f", "label": "Art. 13(2)(f)", "title": "Existence of automated decision-making", "strength": "related", "verified": true, "note": null, "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng#art_13", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "explainability", "framework": "gdpr", "frameworkShort": "GDPR", "column": "gdpr", "reference": "Art. 22(3)", "clauseId": "art-22-3", "label": "Art. 22(3)", "title": "Right to obtain human intervention and to contest the decision", "strength": "related", "verified": true, "note": null, "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng#art_22", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "explainability", "framework": "iso-42001", "frameworkShort": "ISO 42001", "column": "iso", "reference": "A.8.2", "clauseId": "a.8.2", "label": "A.8.2", "title": "System documentation and information for users", "strength": "related", "verified": false, "note": "Clause id and title as listed in the AI RMF to ISO/IEC FDIS 42001 crosswalk (contributed by Microsoft to NIST's AI Resource Center) and in CSA's AICM v1.1.1 mapping; the published ISO text was not opened.", "url": "https://www.iso.org/standard/42001", "obligation": "A.8 Information for interested parties", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-a8-information-for-interested-parties", "obligationId": "AIGE-OBL-ISO42001-A8", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-iso42001-a8", "see": null }, { "topic": "explainability", "framework": "nist-ai-rmf", "frameworkShort": "NIST AI RMF", "column": "nist", "reference": "MEASURE 2.9", "clauseId": "measure-2.9", "label": "MEASURE 2.9", "title": "MEASURE 2.9: The AI model is explained, validated, and documented, and AI system output is interpreted within its context as identified in the MAP function to inform responsible use and governance", "strength": "core", "verified": true, "note": null, "url": "https://airc.nist.gov/airmf-resources/airmf/", "obligation": "MEASURE", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-measure", "obligationId": "AIGE-OBL-NISTRMF-MEASURE", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-nistrmf-measure", "see": null }, { "topic": "explainability", "framework": "nist-ai-rmf", "frameworkShort": "NIST AI RMF", "column": "nist", "reference": "MEASURE 2.8", "clauseId": "measure-2.8", "label": "MEASURE 2.8", "title": "MEASURE 2.8: Risks associated with transparency and accountability as identified in the MAP function are examined and documented", "strength": "related", "verified": true, "note": null, "url": "https://airc.nist.gov/airmf-resources/airmf/", "obligation": "MEASURE", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-measure", "obligationId": "AIGE-OBL-NISTRMF-MEASURE", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-nistrmf-measure", "see": null }, { "topic": "explainability", "framework": "csa-aicm", "frameworkShort": "CSA AICM", "column": "csa", "reference": "GRC-13", "clauseId": "GRC-13", "label": "GRC-13", "title": "Explainability Requirement", "strength": "core", "verified": true, "note": null, "url": "https://cloudsecurityalliance.org/artifacts/ai-controls-matrix-v1-1", "obligation": "AICM v1.1: 247 control objectives across 18 domains", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-aicm-v11-247-control-objectives-across-18-domains", "obligationId": "AIGE-OBL-CSA-AICM", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-csa-aicm", "see": null }, { "topic": "explainability", "framework": "csa-aicm", "frameworkShort": "CSA AICM", "column": "csa", "reference": "GRC-14", "clauseId": "GRC-14", "label": "GRC-14", "title": "Explainability Evaluation", "strength": "core", "verified": true, "note": null, "url": "https://cloudsecurityalliance.org/artifacts/ai-controls-matrix-v1-1", "obligation": "AICM v1.1: 247 control objectives across 18 domains", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-aicm-v11-247-control-objectives-across-18-domains", "obligationId": "AIGE-OBL-CSA-AICM", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-csa-aicm", "see": null }, { "topic": "explainability", "framework": "kr-ai-basic-act", "frameworkShort": "Korea AI Act", "column": "kr", "reference": "Art. 34(1)(2)", "clauseId": "art-34-1-2", "label": "Art. 34(1)(2)", "title": "Explanation plan: result, main criteria, training-data overview", "strength": "core", "verified": true, "note": null, "url": "https://www.law.go.kr/LSW/lsInfoP.do?lsiSeq=268543", "obligation": "South Korea AI Basic Act (in force 2026-01-22)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-south-korea-ai-basic-act-in-force-2026-01-22", "obligationId": "AIGE-OBL-KR-AIBASIC", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-kr-aibasic", "see": null }, { "topic": "explainability", "framework": "uk-duaa", "frameworkShort": "UK DUAA", "column": "uk", "reference": "Art. 22C", "clauseId": "art-22c", "label": "UK GDPR Art. 22C", "title": "Safeguards for automated decision-making", "strength": "core", "verified": true, "note": "Information about the decision, representations, human intervention and contest.", "url": "https://www.legislation.gov.uk/ukpga/2025/18/section/80", "obligation": "UK GDPR Arts. 22A–22D permission-plus-safeguards model for significant, solely automated decisions (Data (Use and Access) Act 2025)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-uk-gdpr-arts-22a22d-permission-plus-safeguards-model-for-significant-solely-automated-decisions-data-use-and-access-act-2025", "obligationId": "AIGE-OBL-UK-ADM", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-uk-adm", "see": null }, { "topic": "explainability", "framework": "uk-atrs", "frameworkShort": "UK ATRS", "column": "uk", "reference": "2.3.5", "clauseId": "_2.3.5", "label": "ATRS 2.3.5", "title": "Appeals and review", "strength": "related", "verified": true, "note": null, "url": "https://www.gov.uk/government/publications/algorithmic-transparency-template", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "explainability", "framework": "sg-genai-framework", "frameworkShort": "Singapore GenAI", "column": "sg", "reference": "3", "clauseId": "_3", "label": "GenAI 3", "title": "Trusted Development and Deployment", "strength": "related", "verified": true, "note": null, "url": "https://aiverifyfoundation.sg/wp-content/uploads/2024/05/Model-AI-Governance-Framework-for-Generative-AI-May-2024-1-1.pdf", "obligation": "Singapore IMDA Model AI Governance Framework for Generative AI (voluntary)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-singapore-imda-model-ai-governance-framework-for-generative-ai-voluntary", "obligationId": "AIGE-OBL-SG-GENAI", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-sg-genai", "see": null }, { "topic": "explainability", "framework": "coe-cets-225", "frameworkShort": "CoE Convention", "column": "intl", "reference": "Art. 14(2)", "clauseId": "art-14-2", "label": "CoE Art. 14(2)", "title": "Documentation sufficient to contest decisions; complaint to authorities", "strength": "related", "verified": true, "note": null, "url": "https://rm.coe.int/1680afae3c", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "explainability", "framework": "oecd-ai-principles", "frameworkShort": "OECD AI Principles", "column": "intl", "reference": "1.3", "clauseId": "_1.3", "label": "OECD 1.3", "title": "Transparency and explainability", "strength": "core", "verified": true, "note": null, "url": "https://legalinstruments.oecd.org/en/instruments/OECD-LEGAL-0449", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "explainability", "framework": "cn-algo-recommendation", "frameworkShort": "China Algo. Rec.", "column": "cn", "reference": "Art. 17", "clauseId": "art-17", "label": "AlgoRec Art. 17", "title": "Explain where an algorithm significantly affects user rights", "strength": "related", "verified": true, "note": "Third paragraph; the first two give an opt-out and control over user tags; CAC text.", "url": "https://www.cac.gov.cn/2022-01/04/c_1642894606364259.htm", "obligation": "Provisions on Algorithmic Recommendation (in force 2022-03-01)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-provisions-on-algorithmic-recommendation-in-force-2022-03-01", "obligationId": "AIGE-OBL-CN-ALGOREC", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-cn-algorec", "see": null }, { "topic": "ai-literacy", "framework": "eu-ai-act", "frameworkShort": "EU AI Act", "column": "eu", "reference": "Art. 4", "clauseId": "art-4", "label": "Art. 4", "title": "AI literacy", "strength": "core", "verified": true, "note": "Reworded by the Digital Omnibus: providers and deployers take measures to support AI literacy, without a guaranteed level.", "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng#art_4", "obligation": "EU AI Act Art. 4 AI literacy", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-eu-ai-act-art-4-ai-literacy", "obligationId": "AIGE-OBL-EUAIA-ART4", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-euaia-art4", "see": "https://aigovernanceengineer.com/bok/eu-ai-act#ai-literacy-and-bias-detection-data" }, { "topic": "ai-literacy", "framework": "eu-ai-act", "frameworkShort": "EU AI Act", "column": "eu", "reference": "Art. 26(2)", "clauseId": "art-26-2", "label": "Art. 26(2)", "title": "Oversight by people with the competence, training and authority it needs", "strength": "related", "verified": true, "note": null, "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng#art_26", "obligation": "EU AI Act Art. 26 deployer obligations for high-risk systems", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-eu-ai-act-art-26-deployer-obligations-for-high-risk-systems", "obligationId": "AIGE-OBL-EUAIA-ART26", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-euaia-art26", "see": null }, { "topic": "ai-literacy", "framework": "eu-ai-act", "frameworkShort": "EU AI Act", "column": "eu", "reference": "Art. 95(2)(c)", "clauseId": "art-95-2-c", "label": "Art. 95(2)(c)", "title": "Codes of conduct: promoting AI literacy", "strength": "related", "verified": true, "note": null, "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng#art_95", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "ai-literacy", "framework": "gdpr", "frameworkShort": "GDPR", "column": "gdpr", "reference": "Art. 39(1)(b)", "clauseId": "art-39-1-b", "label": "Art. 39(1)(b)", "title": "DPO tasks: awareness-raising and training of staff", "strength": "related", "verified": false, "note": "Read on a secondary reproduction of the GDPR; EUR-Lex refused automated access on 2026-09-24 and chapter 19 does not cite this article (verify).", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng#art_39", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "ai-literacy", "framework": "iso-42001", "frameworkShort": "ISO 42001", "column": "iso", "reference": "7.2", "clauseId": "_7.2", "label": "7.2", "title": "Competence", "strength": "core", "verified": false, "note": "Clause id and title as listed in the AI RMF to ISO/IEC FDIS 42001 crosswalk (contributed by Microsoft to NIST's AI Resource Center) and in CSA's AICM v1.1.1 mapping; the published ISO text was not opened.", "url": "https://www.iso.org/standard/42001", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "ai-literacy", "framework": "iso-42001", "frameworkShort": "ISO 42001", "column": "iso", "reference": "7.3", "clauseId": "_7.3", "label": "7.3", "title": "Awareness", "strength": "related", "verified": false, "note": "Clause id and title as listed in the AI RMF to ISO/IEC FDIS 42001 crosswalk (contributed by Microsoft to NIST's AI Resource Center) and in CSA's AICM v1.1.1 mapping; the published ISO text was not opened.", "url": "https://www.iso.org/standard/42001", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "ai-literacy", "framework": "nist-ai-rmf", "frameworkShort": "NIST AI RMF", "column": "nist", "reference": "GOVERN 2.2", "clauseId": "govern-2.2", "label": "GOVERN 2.2", "title": "GOVERN 2.2: The organization's personnel and partners receive AI risk management training to enable them to perform their duties and responsibilities consistent with related policies, procedures, and agreements", "strength": "core", "verified": true, "note": null, "url": "https://airc.nist.gov/airmf-resources/airmf/", "obligation": "GOVERN", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-govern", "obligationId": "AIGE-OBL-NISTRMF-GOVERN", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-nistrmf-govern", "see": null }, { "topic": "ai-literacy", "framework": "nist-ai-rmf", "frameworkShort": "NIST AI RMF", "column": "nist", "reference": "MAP 3.4", "clauseId": "map-3.4", "label": "MAP 3.4", "title": "MAP 3.4: Processes for operator and practitioner proficiency with AI system performance and trustworthiness, and relevant technical standards and certifications, are defined, assessed, and documented", "strength": "related", "verified": true, "note": null, "url": "https://airc.nist.gov/airmf-resources/airmf/", "obligation": "MAP", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-map", "obligationId": "AIGE-OBL-NISTRMF-MAP", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-nistrmf-map", "see": null }, { "topic": "ai-literacy", "framework": "csa-aicm", "frameworkShort": "CSA AICM", "column": "csa", "reference": "HRS-14", "clauseId": "HRS-14", "label": "HRS-14", "title": "AI Competency Training", "strength": "core", "verified": true, "note": null, "url": "https://cloudsecurityalliance.org/artifacts/ai-controls-matrix-v1-1", "obligation": "AICM v1.1: 247 control objectives across 18 domains", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-aicm-v11-247-control-objectives-across-18-domains", "obligationId": "AIGE-OBL-CSA-AICM", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-csa-aicm", "see": null }, { "topic": "ai-literacy", "framework": "csa-aicm", "frameworkShort": "CSA AICM", "column": "csa", "reference": "HRS-11", "clauseId": "HRS-11", "label": "HRS-11", "title": "Security Awareness Training", "strength": "related", "verified": true, "note": null, "url": "https://cloudsecurityalliance.org/artifacts/ai-controls-matrix-v1-1", "obligation": "AICM v1.1: 247 control objectives across 18 domains", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-aicm-v11-247-control-objectives-across-18-domains", "obligationId": "AIGE-OBL-CSA-AICM", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-csa-aicm", "see": null }, { "topic": "ai-literacy", "framework": "uk-atrs", "frameworkShort": "UK ATRS", "column": "uk", "reference": "2.3.4", "clauseId": "_2.3.4", "label": "ATRS 2.3.4", "title": "Required training", "strength": "related", "verified": true, "note": null, "url": "https://www.gov.uk/government/publications/algorithmic-transparency-template", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "ai-literacy", "framework": "sg-agentic-framework", "frameworkShort": "Singapore Agentic", "column": "sg", "reference": "2.4", "clauseId": "_2.4", "label": "Agentic 2.4", "title": "Enable end-user responsibility", "strength": "core", "verified": true, "note": null, "url": "https://www.imda.gov.sg/-/media/imda/files/about/emerging-tech-and-research/artificial-intelligence/mgf-for-agentic-ai.pdf", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "ai-literacy", "framework": "sg-genai-framework", "frameworkShort": "Singapore GenAI", "column": "sg", "reference": "9", "clauseId": "_9", "label": "GenAI 9", "title": "AI for Public Good", "strength": "related", "verified": true, "note": "Includes upskilling workers.", "url": "https://aiverifyfoundation.sg/wp-content/uploads/2024/05/Model-AI-Governance-Framework-for-Generative-AI-May-2024-1-1.pdf", "obligation": "Singapore IMDA Model AI Governance Framework for Generative AI (voluntary)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-singapore-imda-model-ai-governance-framework-for-generative-ai-voluntary", "obligationId": "AIGE-OBL-SG-GENAI", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-sg-genai", "see": null }, { "topic": "ai-literacy", "framework": "cn-genai-measures", "frameworkShort": "China GenAI Measures", "column": "cn", "reference": "Art. 10", "clauseId": "art-10", "label": "GenAI Art. 10", "title": "Guide users to understand and use generative AI rationally", "strength": "related", "verified": true, "note": "Also protects minors from over-reliance; CAC text.", "url": "https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm", "obligation": "Interim Measures for Generative AI Services (in force 2023-08-15)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-interim-measures-for-generative-ai-services-in-force-2023-08-15", "obligationId": "AIGE-OBL-CN-GENAI", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-cn-genai", "see": null }, { "topic": "conformity-assessment", "framework": "eu-ai-act", "frameworkShort": "EU AI Act", "column": "eu", "reference": "Art. 43", "clauseId": "art-43", "label": "Art. 43", "title": "Conformity assessment", "strength": "core", "verified": true, "note": null, "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng#art_43", "obligation": "EU AI Act Art. 43 conformity assessment", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-eu-ai-act-art-43-conformity-assessment", "obligationId": "AIGE-OBL-EUAIA-ART43", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-euaia-art43", "see": null }, { "topic": "conformity-assessment", "framework": "eu-ai-act", "frameworkShort": "EU AI Act", "column": "eu", "reference": "Art. 47", "clauseId": "art-47", "label": "Art. 47", "title": "EU declaration of conformity", "strength": "related", "verified": true, "note": null, "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng#art_47", "obligation": "EU AI Act Art. 47 EU declaration of conformity", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-eu-ai-act-art-47-eu-declaration-of-conformity", "obligationId": "AIGE-OBL-EUAIA-ART47", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-euaia-art47", "see": null }, { "topic": "conformity-assessment", "framework": "eu-ai-act", "frameworkShort": "EU AI Act", "column": "eu", "reference": "Art. 48", "clauseId": "art-48", "label": "Art. 48", "title": "CE marking", "strength": "related", "verified": true, "note": null, "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng#art_48", "obligation": "EU AI Act Art. 48 CE marking", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-eu-ai-act-art-48-ce-marking", "obligationId": "AIGE-OBL-EUAIA-ART48", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-euaia-art48", "see": null }, { "topic": "conformity-assessment", "framework": "eu-ai-act", "frameworkShort": "EU AI Act", "column": "eu", "reference": "Art. 40", "clauseId": "art-40", "label": "Art. 40", "title": "Harmonised standards and standardisation deliverables", "strength": "related", "verified": true, "note": "Presumption of conformity once a harmonised standard is cited in the Official Journal.", "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng#art_40", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "conformity-assessment", "framework": "gdpr", "frameworkShort": "GDPR", "column": "gdpr", "reference": "Art. 42", "clauseId": "art-42", "label": "Art. 42", "title": "Certification", "strength": "related", "verified": false, "note": "Read on a secondary reproduction of the GDPR; EUR-Lex refused automated access on 2026-09-24 and chapter 19 does not cite this article (verify).", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng#art_42", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "conformity-assessment", "framework": "iso-42001", "frameworkShort": "ISO 42001", "column": "iso", "reference": "9.2", "clauseId": "_9.2", "label": "9.2", "title": "Internal audit", "strength": "related", "verified": false, "note": "Clause id and title as listed in the AI RMF to ISO/IEC FDIS 42001 crosswalk (contributed by Microsoft to NIST's AI Resource Center) and in CSA's AICM v1.1.1 mapping; the published ISO text was not opened.", "url": "https://www.iso.org/standard/42001", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "conformity-assessment", "framework": "iso-42006", "frameworkShort": "ISO 42006", "column": "iso-more", "reference": "ISO/IEC 42006", "clauseId": "iso-iec-42006", "label": "ISO/IEC 42006", "title": "Requirements for bodies providing audit and certification of AI management systems", "strength": "core", "verified": true, "note": "The whole standard: who may credibly certify an organisation to ISO/IEC 42001.", "url": "https://www.iso.org/standard/42006", "obligation": "ISO/IEC 42006:2025 requirements for AIMS certification bodies", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-isoiec-420062025-requirements-for-aims-certification-bodies", "obligationId": "AIGE-OBL-ISO42006-CB", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-iso42006-cb", "see": null }, { "topic": "conformity-assessment", "framework": "nist-ai-rmf", "frameworkShort": "NIST AI RMF", "column": "nist", "reference": "MEASURE 1.3", "clauseId": "measure-1.3", "label": "MEASURE 1.3", "title": "MEASURE 1.3: Internal experts who did not serve as front-line developers for the system and/or independent assessors are involved in regular assessments and updates", "strength": "related", "verified": true, "note": null, "url": "https://airc.nist.gov/airmf-resources/airmf/", "obligation": "MEASURE", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-measure", "obligationId": "AIGE-OBL-NISTRMF-MEASURE", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-nistrmf-measure", "see": null }, { "topic": "conformity-assessment", "framework": "csa-aicm", "frameworkShort": "CSA AICM", "column": "csa", "reference": "A&A-02", "clauseId": "A_A-02", "label": "A&A-02", "title": "Independent Assessments", "strength": "core", "verified": true, "note": null, "url": "https://cloudsecurityalliance.org/artifacts/ai-controls-matrix-v1-1", "obligation": "AICM v1.1: 247 control objectives across 18 domains", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-aicm-v11-247-control-objectives-across-18-domains", "obligationId": "AIGE-OBL-CSA-AICM", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-csa-aicm", "see": null }, { "topic": "conformity-assessment", "framework": "csa-aicm", "frameworkShort": "CSA AICM", "column": "csa", "reference": "A&A-04", "clauseId": "A_A-04", "label": "A&A-04", "title": "Requirements Compliance", "strength": "related", "verified": true, "note": null, "url": "https://cloudsecurityalliance.org/artifacts/ai-controls-matrix-v1-1", "obligation": "AICM v1.1: 247 control objectives across 18 domains", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-aicm-v11-247-control-objectives-across-18-domains", "obligationId": "AIGE-OBL-CSA-AICM", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-csa-aicm", "see": null }, { "topic": "conformity-assessment", "framework": "kr-ai-basic-act", "frameworkShort": "Korea AI Act", "column": "kr", "reference": "Art. 33", "clauseId": "art-33", "label": "Art. 33", "title": "Confirmation of high-impact AI", "strength": "related", "verified": true, "note": null, "url": "https://www.law.go.kr/LSW/lsInfoP.do?lsiSeq=268543", "obligation": "South Korea AI Basic Act (in force 2026-01-22)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-south-korea-ai-basic-act-in-force-2026-01-22", "obligationId": "AIGE-OBL-KR-AIBASIC", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-kr-aibasic", "see": null }, { "topic": "conformity-assessment", "framework": "sg-genai-framework", "frameworkShort": "Singapore GenAI", "column": "sg", "reference": "5", "clauseId": "_5", "label": "GenAI 5", "title": "Testing and Assurance", "strength": "related", "verified": true, "note": "Third-party testing and common testing standards.", "url": "https://aiverifyfoundation.sg/wp-content/uploads/2024/05/Model-AI-Governance-Framework-for-Generative-AI-May-2024-1-1.pdf", "obligation": "Singapore IMDA Model AI Governance Framework for Generative AI (voluntary)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-singapore-imda-model-ai-governance-framework-for-generative-ai-voluntary", "obligationId": "AIGE-OBL-SG-GENAI", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-sg-genai", "see": null }, { "topic": "conformity-assessment", "framework": "en-18286", "frameworkShort": "EN 18286", "column": "cen", "reference": "EN 18286", "clauseId": "en-18286", "label": "EN 18286", "title": "Quality management system for EU AI Act regulatory purposes", "strength": "related", "verified": true, "note": "A harmonised-standard candidate for Art. 17; not cited in the Official Journal as of 2026-09-24.", "url": "https://www.cencenelec.eu/news-events/news/2026/en-in-the-spotlight/2026-07-30-ai-quality-management/", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "conformity-assessment", "framework": "cn-genai-measures", "frameworkShort": "China GenAI Measures", "column": "cn", "reference": "Art. 17", "clauseId": "art-17", "label": "GenAI Art. 17", "title": "Security assessment and algorithm filing", "strength": "related", "verified": true, "note": "Services with public-opinion attributes or social-mobilisation capacity; CAC text.", "url": "https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm", "obligation": "Interim Measures for Generative AI Services (in force 2023-08-15)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-interim-measures-for-generative-ai-services-in-force-2023-08-15", "obligationId": "AIGE-OBL-CN-GENAI", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-cn-genai", "see": null }, { "topic": "gpai-foundation-models", "framework": "eu-ai-act", "frameworkShort": "EU AI Act", "column": "eu", "reference": "Art. 53", "clauseId": "art-53", "label": "Art. 53", "title": "Obligations for providers of general-purpose AI models", "strength": "core", "verified": true, "note": null, "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng#art_53", "obligation": "EU AI Act Art. 53 GPAI provider obligations", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-eu-ai-act-art-53-gpai-provider-obligations", "obligationId": "AIGE-OBL-EUAIA-ART53", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-euaia-art53", "see": null }, { "topic": "gpai-foundation-models", "framework": "eu-ai-act", "frameworkShort": "EU AI Act", "column": "eu", "reference": "Art. 55", "clauseId": "art-55", "label": "Art. 55", "title": "Obligations of providers of general-purpose AI models with systemic risk", "strength": "core", "verified": true, "note": null, "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng#art_55", "obligation": "EU AI Act Art. 55 GPAI models with systemic risk", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-eu-ai-act-art-55-gpai-models-with-systemic-risk", "obligationId": "AIGE-OBL-EUAIA-ART55", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-euaia-art55", "see": null }, { "topic": "gpai-foundation-models", "framework": "eu-ai-act", "frameworkShort": "EU AI Act", "column": "eu", "reference": "Art. 51", "clauseId": "art-51", "label": "Art. 51", "title": "Classification of general-purpose AI models as general-purpose AI models with systemic risk", "strength": "related", "verified": true, "note": null, "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng#art_51", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "gpai-foundation-models", "framework": "eu-ai-act", "frameworkShort": "EU AI Act", "column": "eu", "reference": "Art. 56", "clauseId": "art-56", "label": "Art. 56", "title": "Codes of practice", "strength": "related", "verified": true, "note": null, "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng#art_56", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "gpai-foundation-models", "framework": "gpai-code-of-practice", "frameworkShort": "GPAI Code", "column": "gpai", "reference": "Transparency 1.1", "clauseId": "transparency-1.1", "label": "Transparency 1.1", "title": "Drawing up and keeping up-to-date model documentation", "strength": "core", "verified": true, "note": null, "url": "https://ec.europa.eu/newsroom/dae/redirection/document/118120", "obligation": "Transparency", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-transparency", "obligationId": "AIGE-OBL-GPAICOP-TRANSPARENCY", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-gpaicop-transparency", "see": null }, { "topic": "gpai-foundation-models", "framework": "gpai-code-of-practice", "frameworkShort": "GPAI Code", "column": "gpai", "reference": "Safety C1", "clauseId": "safety-c1", "label": "Safety C1", "title": "Commitment 1: Safety and Security Framework", "strength": "core", "verified": true, "note": null, "url": "https://ec.europa.eu/newsroom/dae/redirection/document/118119", "obligation": "Safety and Security (systemic-risk models only)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-safety-and-security-systemic-risk-models-only", "obligationId": "AIGE-OBL-GPAICOP-SAFETY", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-gpaicop-safety", "see": null }, { "topic": "gpai-foundation-models", "framework": "gpai-code-of-practice", "frameworkShort": "GPAI Code", "column": "gpai", "reference": "Safety 3.2", "clauseId": "safety-3.2", "label": "Safety 3.2", "title": "Measure 3.2: Model evaluations", "strength": "related", "verified": true, "note": null, "url": "https://ec.europa.eu/newsroom/dae/redirection/document/118119", "obligation": "Safety and Security (systemic-risk models only)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-safety-and-security-systemic-risk-models-only", "obligationId": "AIGE-OBL-GPAICOP-SAFETY", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-gpaicop-safety", "see": null }, { "topic": "gpai-foundation-models", "framework": "gpai-code-of-practice", "frameworkShort": "GPAI Code", "column": "gpai", "reference": "Safety C7", "clauseId": "safety-c7", "label": "Safety C7", "title": "Commitment 7: Safety and Security Model Reports", "strength": "related", "verified": true, "note": null, "url": "https://ec.europa.eu/newsroom/dae/redirection/document/118119", "obligation": "Safety and Security (systemic-risk models only)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-safety-and-security-systemic-risk-models-only", "obligationId": "AIGE-OBL-GPAICOP-SAFETY", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-gpaicop-safety", "see": null }, { "topic": "gpai-foundation-models", "framework": "csa-aicm", "frameworkShort": "CSA AICM", "column": "csa", "reference": "MDS-12", "clauseId": "MDS-12", "label": "MDS-12", "title": "Open Model Risk Assessment", "strength": "related", "verified": true, "note": null, "url": "https://cloudsecurityalliance.org/artifacts/ai-controls-matrix-v1-1", "obligation": "AICM v1.1: 247 control objectives across 18 domains", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-aicm-v11-247-control-objectives-across-18-domains", "obligationId": "AIGE-OBL-CSA-AICM", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-csa-aicm", "see": null }, { "topic": "gpai-foundation-models", "framework": "csa-aicm", "frameworkShort": "CSA AICM", "column": "csa", "reference": "MDS-03", "clauseId": "MDS-03", "label": "MDS-03", "title": "Model Documentation", "strength": "related", "verified": true, "note": null, "url": "https://cloudsecurityalliance.org/artifacts/ai-controls-matrix-v1-1", "obligation": "AICM v1.1: 247 control objectives across 18 domains", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-aicm-v11-247-control-objectives-across-18-domains", "obligationId": "AIGE-OBL-CSA-AICM", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-csa-aicm", "see": null }, { "topic": "gpai-foundation-models", "framework": "kr-ai-basic-act", "frameworkShort": "Korea AI Act", "column": "kr", "reference": "Art. 32", "clauseId": "art-32", "label": "Art. 32", "title": "Safety duties for AI above the compute threshold", "strength": "core", "verified": true, "note": "Applies where cumulative training compute exceeds the threshold the enforcement decree sets.", "url": "https://www.law.go.kr/LSW/lsInfoP.do?lsiSeq=268543", "obligation": "South Korea AI Basic Act (in force 2026-01-22)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-south-korea-ai-basic-act-in-force-2026-01-22", "obligationId": "AIGE-OBL-KR-AIBASIC", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-kr-aibasic", "see": null }, { "topic": "gpai-foundation-models", "framework": "sg-genai-framework", "frameworkShort": "Singapore GenAI", "column": "sg", "reference": "8", "clauseId": "_8", "label": "GenAI 8", "title": "Safety and Alignment R&D", "strength": "related", "verified": true, "note": null, "url": "https://aiverifyfoundation.sg/wp-content/uploads/2024/05/Model-AI-Governance-Framework-for-Generative-AI-May-2024-1-1.pdf", "obligation": "Singapore IMDA Model AI Governance Framework for Generative AI (voluntary)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-singapore-imda-model-ai-governance-framework-for-generative-ai-voluntary", "obligationId": "AIGE-OBL-SG-GENAI", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-sg-genai", "see": null }, { "topic": "gpai-foundation-models", "framework": "g7-hiroshima-coc", "frameworkShort": "G7 Code", "column": "intl", "reference": "Action 1", "clauseId": "action-1", "label": "G7 Action 1", "title": "Identify, evaluate and mitigate risks across the lifecycle, including testing", "strength": "related", "verified": true, "note": "The whole code addresses organisations developing advanced AI systems.", "url": "https://digital-strategy.ec.europa.eu/en/library/hiroshima-process-international-code-conduct-advanced-ai-systems", "obligation": "G7 Hiroshima Code action 1: lifecycle risk management and pre-deployment testing", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-g7-hiroshima-code-action-1-lifecycle-risk-management-and-pre-deployment-testing", "obligationId": "AIGE-OBL-G7-A1", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-g7-a1", "see": null }, { "topic": "gpai-foundation-models", "framework": "cn-genai-measures", "frameworkShort": "China GenAI Measures", "column": "cn", "reference": "Art. 7", "clauseId": "art-7", "label": "GenAI Art. 7", "title": "Lawful data and foundation-model sources", "strength": "related", "verified": true, "note": "Point (1): use data and foundation models with lawful sources; CAC text.", "url": "https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm", "obligation": "Interim Measures for Generative AI Services (in force 2023-08-15)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-interim-measures-for-generative-ai-services-in-force-2023-08-15", "obligationId": "AIGE-OBL-CN-GENAI", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-cn-genai", "see": null }, { "topic": "ip-copyright", "framework": "eu-ai-act", "frameworkShort": "EU AI Act", "column": "eu", "reference": "Art. 53(1)(c)", "clauseId": "art-53-1-c", "label": "Art. 53(1)(c)", "title": "Copyright policy, including rights reservations", "strength": "core", "verified": true, "note": "Identify and honour reservations of rights under Art. 4(3) of Directive (EU) 2019/790.", "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng#art_53", "obligation": "EU AI Act Art. 53 GPAI provider obligations", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-eu-ai-act-art-53-gpai-provider-obligations", "obligationId": "AIGE-OBL-EUAIA-ART53", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-euaia-art53", "see": null }, { "topic": "ip-copyright", "framework": "eu-ai-act", "frameworkShort": "EU AI Act", "column": "eu", "reference": "Art. 53(1)(d)", "clauseId": "art-53-1-d", "label": "Art. 53(1)(d)", "title": "Public summary of the content used for training", "strength": "related", "verified": true, "note": null, "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng#art_53", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "ip-copyright", "framework": "gpai-code-of-practice", "frameworkShort": "GPAI Code", "column": "gpai", "reference": "Copyright 1.1", "clauseId": "copyright-1.1", "label": "Copyright 1.1", "title": "Draw up, keep up-to-date and implement a copyright policy", "strength": "core", "verified": true, "note": null, "url": "https://ec.europa.eu/newsroom/dae/redirection/document/118115", "obligation": "Copyright", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-copyright", "obligationId": "AIGE-OBL-GPAICOP-COPYRIGHT", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-gpaicop-copyright", "see": null }, { "topic": "ip-copyright", "framework": "gpai-code-of-practice", "frameworkShort": "GPAI Code", "column": "gpai", "reference": "Copyright 1.2", "clauseId": "copyright-1.2", "label": "Copyright 1.2", "title": "Reproduce and extract only lawfully accessible copyright-protected content", "strength": "core", "verified": true, "note": null, "url": "https://ec.europa.eu/newsroom/dae/redirection/document/118115", "obligation": "Copyright", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-copyright", "obligationId": "AIGE-OBL-GPAICOP-COPYRIGHT", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-gpaicop-copyright", "see": null }, { "topic": "ip-copyright", "framework": "gpai-code-of-practice", "frameworkShort": "GPAI Code", "column": "gpai", "reference": "Copyright 1.3", "clauseId": "copyright-1.3", "label": "Copyright 1.3", "title": "Identify and comply with rights reservations when crawling the World Wide Web", "strength": "core", "verified": true, "note": null, "url": "https://ec.europa.eu/newsroom/dae/redirection/document/118115", "obligation": "Copyright", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-copyright", "obligationId": "AIGE-OBL-GPAICOP-COPYRIGHT", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-gpaicop-copyright", "see": null }, { "topic": "ip-copyright", "framework": "gpai-code-of-practice", "frameworkShort": "GPAI Code", "column": "gpai", "reference": "Copyright 1.4", "clauseId": "copyright-1.4", "label": "Copyright 1.4", "title": "Mitigate the risk of copyright-infringing outputs", "strength": "core", "verified": true, "note": null, "url": "https://ec.europa.eu/newsroom/dae/redirection/document/118115", "obligation": "Copyright", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-copyright", "obligationId": "AIGE-OBL-GPAICOP-COPYRIGHT", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-gpaicop-copyright", "see": null }, { "topic": "ip-copyright", "framework": "gpai-code-of-practice", "frameworkShort": "GPAI Code", "column": "gpai", "reference": "Copyright 1.5", "clauseId": "copyright-1.5", "label": "Copyright 1.5", "title": "Designate a point of contact and enable the lodging of complaints", "strength": "related", "verified": true, "note": null, "url": "https://ec.europa.eu/newsroom/dae/redirection/document/118115", "obligation": "Copyright", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-copyright", "obligationId": "AIGE-OBL-GPAICOP-COPYRIGHT", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-gpaicop-copyright", "see": null }, { "topic": "ip-copyright", "framework": "nist-ai-rmf", "frameworkShort": "NIST AI RMF", "column": "nist", "reference": "GOVERN 6.1", "clauseId": "govern-6.1", "label": "GOVERN 6.1", "title": "GOVERN 6.1: Policies and procedures are in place that address AI risks associated with third-party entities, including risks of infringement of a third-party's intellectual property or other rights", "strength": "core", "verified": true, "note": null, "url": "https://airc.nist.gov/airmf-resources/airmf/", "obligation": "GOVERN", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-govern", "obligationId": "AIGE-OBL-NISTRMF-GOVERN", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-nistrmf-govern", "see": null }, { "topic": "ip-copyright", "framework": "nist-ai-rmf", "frameworkShort": "NIST AI RMF", "column": "nist", "reference": "MAP 4.1", "clauseId": "map-4.1", "label": "MAP 4.1", "title": "MAP 4.1: Approaches for mapping AI technology and legal risks of its components, including the use of third-party data or software, are in place, followed, and documented, as are risks of infringement of a third party's intellectual property or other rights", "strength": "related", "verified": true, "note": null, "url": "https://airc.nist.gov/airmf-resources/airmf/", "obligation": "MAP", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-map", "obligationId": "AIGE-OBL-NISTRMF-MAP", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-nistrmf-map", "see": null }, { "topic": "ip-copyright", "framework": "csa-aicm", "frameworkShort": "CSA AICM", "column": "csa", "reference": "DSP-20", "clauseId": "DSP-20", "label": "DSP-20", "title": "Data Provenance and Transparency", "strength": "related", "verified": true, "note": null, "url": "https://cloudsecurityalliance.org/artifacts/ai-controls-matrix-v1-1", "obligation": "AICM v1.1: 247 control objectives across 18 domains", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-aicm-v11-247-control-objectives-across-18-domains", "obligationId": "AIGE-OBL-CSA-AICM", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-csa-aicm", "see": null }, { "topic": "ip-copyright", "framework": "sg-genai-framework", "frameworkShort": "Singapore GenAI", "column": "sg", "reference": "2", "clauseId": "_2", "label": "GenAI 2", "title": "Data", "strength": "related", "verified": true, "note": "Balancing copyright with data accessibility for training.", "url": "https://aiverifyfoundation.sg/wp-content/uploads/2024/05/Model-AI-Governance-Framework-for-Generative-AI-May-2024-1-1.pdf", "obligation": "Singapore IMDA Model AI Governance Framework for Generative AI (voluntary)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-singapore-imda-model-ai-governance-framework-for-generative-ai-voluntary", "obligationId": "AIGE-OBL-SG-GENAI", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-sg-genai", "see": null }, { "topic": "ip-copyright", "framework": "g7-hiroshima-coc", "frameworkShort": "G7 Code", "column": "intl", "reference": "Action 11", "clauseId": "action-11", "label": "G7 Action 11", "title": "Implement data input measures and protect personal data and intellectual property", "strength": "core", "verified": true, "note": null, "url": "https://digital-strategy.ec.europa.eu/en/library/hiroshima-process-international-code-conduct-advanced-ai-systems", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "ip-copyright", "framework": "cn-genai-measures", "frameworkShort": "China GenAI Measures", "column": "cn", "reference": "Art. 7(2)", "clauseId": "art-7-2", "label": "GenAI Art. 7(2)", "title": "No infringement of IP rights in training data", "strength": "core", "verified": true, "note": "CAC text.", "url": "https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm", "obligation": "Interim Measures for Generative AI Services (in force 2023-08-15)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-interim-measures-for-generative-ai-services-in-force-2023-08-15", "obligationId": "AIGE-OBL-CN-GENAI", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-cn-genai", "see": null }, { "topic": "ip-copyright", "framework": "cn-genai-measures", "frameworkShort": "China GenAI Measures", "column": "cn", "reference": "Art. 4(3)", "clauseId": "art-4-3", "label": "GenAI Art. 4(3)", "title": "Respect IP rights and business ethics", "strength": "related", "verified": true, "note": "CAC text.", "url": "https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm", "obligation": "Interim Measures for Generative AI Services (in force 2023-08-15)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-interim-measures-for-generative-ai-services-in-force-2023-08-15", "obligationId": "AIGE-OBL-CN-GENAI", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-cn-genai", "see": null }, { "topic": "agent-identity-autonomy", "framework": "eu-ai-act", "frameworkShort": "EU AI Act", "column": "eu", "reference": "Art. 14", "clauseId": "art-14", "label": "Art. 14", "title": "Human oversight", "strength": "related", "verified": true, "note": "No agent-specific article; oversight and the Art. 14(4)(e) stop duty apply to agentic high-risk systems.", "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng#art_14", "obligation": "EU AI Act Art. 14 human oversight", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-eu-ai-act-art-14-human-oversight", "obligationId": "AIGE-OBL-EUAIA-ART14", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-euaia-art14", "see": null }, { "topic": "agent-identity-autonomy", "framework": "nist-ai-rmf", "frameworkShort": "NIST AI RMF", "column": "nist", "reference": "GOVERN 3.2", "clauseId": "govern-3.2", "label": "GOVERN 3.2", "title": "GOVERN 3.2: Policies and procedures are in place to define and differentiate roles and responsibilities for human-AI configurations and oversight of AI systems", "strength": "related", "verified": true, "note": null, "url": "https://airc.nist.gov/airmf-resources/airmf/", "obligation": "GOVERN", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-govern", "obligationId": "AIGE-OBL-NISTRMF-GOVERN", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-nistrmf-govern", "see": null }, { "topic": "agent-identity-autonomy", "framework": "csa-aicm", "frameworkShort": "CSA AICM", "column": "csa", "reference": "IAM-18", "clauseId": "IAM-18", "label": "IAM-18", "title": "Agent Access Restriction", "strength": "core", "verified": true, "note": null, "url": "https://cloudsecurityalliance.org/artifacts/ai-controls-matrix-v1-1", "obligation": "AICM v1.1: 247 control objectives across 18 domains", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-aicm-v11-247-control-objectives-across-18-domains", "obligationId": "AIGE-OBL-CSA-AICM", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-csa-aicm", "see": null }, { "topic": "agent-identity-autonomy", "framework": "csa-aicm", "frameworkShort": "CSA AICM", "column": "csa", "reference": "AIS-11", "clauseId": "AIS-11", "label": "AIS-11", "title": "Agents Security Boundaries", "strength": "core", "verified": true, "note": null, "url": "https://cloudsecurityalliance.org/artifacts/ai-controls-matrix-v1-1", "obligation": "AICM v1.1: 247 control objectives across 18 domains", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-aicm-v11-247-control-objectives-across-18-domains", "obligationId": "AIGE-OBL-CSA-AICM", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-csa-aicm", "see": null }, { "topic": "agent-identity-autonomy", "framework": "csa-aicm", "frameworkShort": "CSA AICM", "column": "csa", "reference": "IAM-12", "clauseId": "IAM-12", "label": "IAM-12", "title": "Unique Identities", "strength": "related", "verified": true, "note": null, "url": "https://cloudsecurityalliance.org/artifacts/ai-controls-matrix-v1-1", "obligation": "AICM v1.1: 247 control objectives across 18 domains", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-aicm-v11-247-control-objectives-across-18-domains", "obligationId": "AIGE-OBL-CSA-AICM", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-csa-aicm", "see": null }, { "topic": "agent-identity-autonomy", "framework": "owasp-agentic-top-10", "frameworkShort": "OWASP Agentic", "column": "owasp", "reference": "ASI03", "clauseId": "asi03", "label": "ASI03", "title": "Identity and Privilege Abuse", "strength": "core", "verified": true, "note": null, "url": "https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/", "obligation": "Top 10 for Agentic Applications 2026", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-top-10-for-agentic-applications-2026", "obligationId": "AIGE-OBL-OWASP-AGENTIC", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-owasp-agentic", "see": null }, { "topic": "agent-identity-autonomy", "framework": "owasp-llm-top-10", "frameworkShort": "OWASP LLM", "column": "owasp", "reference": "LLM03:2026", "clauseId": "llm03-2026", "label": "LLM03:2026", "title": "Excessive Agency", "strength": "core", "verified": true, "note": null, "url": "https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/", "obligation": "Top 10 for LLM Applications 2026", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-top-10-for-llm-applications-2026", "obligationId": "AIGE-OBL-OWASP-LLM", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-owasp-llm", "see": null }, { "topic": "agent-identity-autonomy", "framework": "owasp-agentic-top-10", "frameworkShort": "OWASP Agentic", "column": "owasp", "reference": "ASI02", "clauseId": "asi02", "label": "ASI02", "title": "Tool Misuse and Exploitation", "strength": "related", "verified": true, "note": null, "url": "https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/", "obligation": "Top 10 for Agentic Applications 2026", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-top-10-for-agentic-applications-2026", "obligationId": "AIGE-OBL-OWASP-AGENTIC", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-owasp-agentic", "see": null }, { "topic": "agent-identity-autonomy", "framework": "owasp-agentic-top-10", "frameworkShort": "OWASP Agentic", "column": "owasp", "reference": "ASI07", "clauseId": "asi07", "label": "ASI07", "title": "Insecure Inter-Agent Communication", "strength": "related", "verified": true, "note": null, "url": "https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/", "obligation": "Top 10 for Agentic Applications 2026", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-top-10-for-agentic-applications-2026", "obligationId": "AIGE-OBL-OWASP-AGENTIC", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-owasp-agentic", "see": null }, { "topic": "agent-identity-autonomy", "framework": "owasp-agentic-top-10", "frameworkShort": "OWASP Agentic", "column": "owasp", "reference": "ASI10", "clauseId": "asi10", "label": "ASI10", "title": "Rogue Agents", "strength": "related", "verified": true, "note": null, "url": "https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/", "obligation": "Top 10 for Agentic Applications 2026", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-top-10-for-agentic-applications-2026", "obligationId": "AIGE-OBL-OWASP-AGENTIC", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-owasp-agentic", "see": null }, { "topic": "agent-identity-autonomy", "framework": "sg-agentic-framework", "frameworkShort": "Singapore Agentic", "column": "sg", "reference": "2.1.2", "clauseId": "_2.1.2", "label": "Agentic 2.1.2", "title": "Bound risks through design by defining agents limits and permissions", "strength": "core", "verified": true, "note": "Includes agent identity: unique, verifiable and tied to an accountable human or supervising agent.", "url": "https://www.imda.gov.sg/-/media/imda/files/about/emerging-tech-and-research/artificial-intelligence/mgf-for-agentic-ai.pdf", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "agent-identity-autonomy", "framework": "sg-agentic-framework", "frameworkShort": "Singapore Agentic", "column": "sg", "reference": "2.2.2", "clauseId": "_2.2.2", "label": "Agentic 2.2.2", "title": "Design for meaningful human oversight", "strength": "related", "verified": true, "note": null, "url": "https://www.imda.gov.sg/-/media/imda/files/about/emerging-tech-and-research/artificial-intelligence/mgf-for-agentic-ai.pdf", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "agent-identity-autonomy", "framework": "cn-tc260-framework", "frameworkShort": "TC260 Framework 3.0", "column": "cn", "reference": "App. 2 II.2", "clauseId": "app-2-ii.2", "label": "TC260 App. 2 II.2", "title": "Identity and access management", "strength": "core", "verified": true, "note": "Identity and permissions per agent; printed pp. 120-121.", "url": "https://www.cac.gov.cn/rootimages/uploadimg/1791137114683961/1791137114683961.pdf", "obligation": "TC260 Framework 3.0 Appendix 2: agentic AI risk management (voluntary; 2026-09-14)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-tc260-framework-30-appendix-2-agentic-ai-risk-management-voluntary-2026-09-14", "obligationId": "AIGE-OBL-CN-TC260-AGENTS", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-cn-tc260-agents", "see": null }, { "topic": "agent-identity-autonomy", "framework": "cn-tc260-framework", "frameworkShort": "TC260 Framework 3.0", "column": "cn", "reference": "App. 2 II.3", "clauseId": "app-2-ii.3", "label": "TC260 App. 2 II.3", "title": "Strengthen human approval", "strength": "related", "verified": true, "note": null, "url": "https://www.cac.gov.cn/rootimages/uploadimg/1791137114683961/1791137114683961.pdf", "obligation": "TC260 Framework 3.0 Appendix 2: agentic AI risk management (voluntary; 2026-09-14)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-tc260-framework-30-appendix-2-agentic-ai-risk-management-voluntary-2026-09-14", "obligationId": "AIGE-OBL-CN-TC260-AGENTS", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-cn-tc260-agents", "see": null }, { "topic": "content-provenance", "framework": "eu-ai-act", "frameworkShort": "EU AI Act", "column": "eu", "reference": "Art. 50(2)", "clauseId": "art-50-2", "label": "Art. 50(2)", "title": "Machine-readable marking of synthetic content", "strength": "core", "verified": true, "note": null, "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng#art_50", "obligation": "EU AI Act Art. 50 transparency for certain AI systems", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-eu-ai-act-art-50-transparency-for-certain-ai-systems", "obligationId": "AIGE-OBL-EUAIA-ART50", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-euaia-art50", "see": null }, { "topic": "content-provenance", "framework": "eu-ai-act", "frameworkShort": "EU AI Act", "column": "eu", "reference": "Art. 50(4)", "clauseId": "art-50-4", "label": "Art. 50(4)", "title": "Disclosure of deep fakes", "strength": "core", "verified": true, "note": null, "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng#art_50", "obligation": "EU AI Act Art. 50 transparency for certain AI systems", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-eu-ai-act-art-50-transparency-for-certain-ai-systems", "obligationId": "AIGE-OBL-EUAIA-ART50", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-euaia-art50", "see": null }, { "topic": "content-provenance", "framework": "eu-ai-act", "frameworkShort": "EU AI Act", "column": "eu", "reference": "Art. 3(60)", "clauseId": "art-3-60", "label": "Art. 3(60)", "title": "Definition of deep fake", "strength": "related", "verified": true, "note": null, "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng#art_3", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "content-provenance", "framework": "csa-aicm", "frameworkShort": "CSA AICM", "column": "csa", "reference": "MDS-09", "clauseId": "MDS-09", "label": "MDS-09", "title": "Model Signing/Ownership Verification", "strength": "related", "verified": true, "note": "Model provenance rather than content provenance; the signing mechanism is the same.", "url": "https://cloudsecurityalliance.org/artifacts/ai-controls-matrix-v1-1", "obligation": "AICM v1.1: 247 control objectives across 18 domains", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-aicm-v11-247-control-objectives-across-18-domains", "obligationId": "AIGE-OBL-CSA-AICM", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-csa-aicm", "see": null }, { "topic": "content-provenance", "framework": "owasp-llm-top-10", "frameworkShort": "OWASP LLM", "column": "owasp", "reference": "LLM07:2026", "clauseId": "llm07-2026", "label": "LLM07:2026", "title": "Misinformation", "strength": "related", "verified": true, "note": null, "url": "https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/", "obligation": "Top 10 for LLM Applications 2026", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-top-10-for-llm-applications-2026", "obligationId": "AIGE-OBL-OWASP-LLM", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-owasp-llm", "see": null }, { "topic": "content-provenance", "framework": "kr-ai-basic-act", "frameworkShort": "Korea AI Act", "column": "kr", "reference": "Art. 31", "clauseId": "art-31", "label": "Art. 31", "title": "Transparency: prior notice, output labelling, realistic synthetic content", "strength": "core", "verified": true, "note": "Outputs labelled as generated; sound, images or video hard to tell from reality must be recognisable as AI-generated.", "url": "https://www.law.go.kr/LSW/lsInfoP.do?lsiSeq=268543", "obligation": "South Korea AI Basic Act (in force 2026-01-22)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-south-korea-ai-basic-act-in-force-2026-01-22", "obligationId": "AIGE-OBL-KR-AIBASIC", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-kr-aibasic", "see": null }, { "topic": "content-provenance", "framework": "sg-genai-framework", "frameworkShort": "Singapore GenAI", "column": "sg", "reference": "7", "clauseId": "_7", "label": "GenAI 7", "title": "Content Provenance", "strength": "core", "verified": true, "note": null, "url": "https://aiverifyfoundation.sg/wp-content/uploads/2024/05/Model-AI-Governance-Framework-for-Generative-AI-May-2024-1-1.pdf", "obligation": "Singapore IMDA Model AI Governance Framework for Generative AI (voluntary)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-singapore-imda-model-ai-governance-framework-for-generative-ai-voluntary", "obligationId": "AIGE-OBL-SG-GENAI", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-sg-genai", "see": null }, { "topic": "content-provenance", "framework": "g7-hiroshima-coc", "frameworkShort": "G7 Code", "column": "intl", "reference": "Action 7", "clauseId": "action-7", "label": "G7 Action 7", "title": "Deploy content authentication and provenance mechanisms where feasible", "strength": "core", "verified": true, "note": null, "url": "https://digital-strategy.ec.europa.eu/en/library/hiroshima-process-international-code-conduct-advanced-ai-systems", "obligation": "G7 Hiroshima Code action 7: content authentication and provenance", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-g7-hiroshima-code-action-7-content-authentication-and-provenance", "obligationId": "AIGE-OBL-G7-A7", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-g7-a7", "see": null }, { "topic": "content-provenance", "framework": "cn-content-labelling", "frameworkShort": "China AI Labelling", "column": "cn", "reference": "Art. 4", "clauseId": "art-4", "label": "Label Art. 4", "title": "Explicit labels for generated content", "strength": "core", "verified": true, "note": null, "url": "https://www.cac.gov.cn/2025-03/14/c_1743654684782215.htm", "obligation": "Measures for Labelling AI-Generated Synthetic Content with GB 45438-2025 (in force 2025-09-01)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-measures-for-labelling-ai-generated-synthetic-content-with-gb-45438-2025-in-force-2025-09-01", "obligationId": "AIGE-OBL-CN-LABEL", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-cn-label", "see": null }, { "topic": "content-provenance", "framework": "cn-content-labelling", "frameworkShort": "China AI Labelling", "column": "cn", "reference": "Art. 5", "clauseId": "art-5", "label": "Label Art. 5", "title": "Implicit (metadata) labels", "strength": "core", "verified": true, "note": null, "url": "https://www.cac.gov.cn/2025-03/14/c_1743654684782215.htm", "obligation": "Measures for Labelling AI-Generated Synthetic Content with GB 45438-2025 (in force 2025-09-01)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-measures-for-labelling-ai-generated-synthetic-content-with-gb-45438-2025-in-force-2025-09-01", "obligationId": "AIGE-OBL-CN-LABEL", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-cn-label", "see": null }, { "topic": "content-provenance", "framework": "cn-deep-synthesis", "frameworkShort": "China Deep Synthesis", "column": "cn", "reference": "Art. 17", "clauseId": "art-17", "label": "DeepSyn Art. 17", "title": "Conspicuous labels for confusable content", "strength": "core", "verified": true, "note": null, "url": "https://www.cac.gov.cn/2022-12/11/c_1672221949354811.htm", "obligation": "Provisions on Deep Synthesis (in force 2023-01-10)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-provisions-on-deep-synthesis-in-force-2023-01-10", "obligationId": "AIGE-OBL-CN-DEEPSYN", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-cn-deepsyn", "see": null }, { "topic": "content-provenance", "framework": "cn-genai-measures", "frameworkShort": "China GenAI Measures", "column": "cn", "reference": "Art. 12", "clauseId": "art-12", "label": "GenAI Art. 12", "title": "Labelling of generated content", "strength": "related", "verified": true, "note": null, "url": "https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm", "obligation": "Interim Measures for Generative AI Services (in force 2023-08-15)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-interim-measures-for-generative-ai-services-in-force-2023-08-15", "obligationId": "AIGE-OBL-CN-GENAI", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-cn-genai", "see": null }, { "topic": "sandboxes-real-world-testing", "framework": "eu-ai-act", "frameworkShort": "EU AI Act", "column": "eu", "reference": "Art. 57", "clauseId": "art-57", "label": "Art. 57", "title": "AI regulatory sandboxes", "strength": "core", "verified": true, "note": "At least one national sandbox per Member State, due by 2 Aug 2027 after the Digital Omnibus (was 2 Aug 2026).", "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng#art_57", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": "https://aigovernanceengineer.com/bok/eu-ai-act#sandboxes-and-real-world-testing" }, { "topic": "sandboxes-real-world-testing", "framework": "eu-ai-act", "frameworkShort": "EU AI Act", "column": "eu", "reference": "Art. 58", "clauseId": "art-58", "label": "Art. 58", "title": "Detailed arrangements for, and functioning of, AI regulatory sandboxes", "strength": "related", "verified": true, "note": null, "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng#art_58", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "sandboxes-real-world-testing", "framework": "eu-ai-act", "frameworkShort": "EU AI Act", "column": "eu", "reference": "Art. 59", "clauseId": "art-59", "label": "Art. 59", "title": "Further processing of personal data in the AI regulatory sandbox", "strength": "related", "verified": true, "note": null, "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng#art_59", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "sandboxes-real-world-testing", "framework": "eu-ai-act", "frameworkShort": "EU AI Act", "column": "eu", "reference": "Art. 60", "clauseId": "art-60", "label": "Art. 60", "title": "Testing of high-risk AI systems in real world conditions outside AI regulatory sandboxes", "strength": "core", "verified": true, "note": null, "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng#art_60", "obligation": "EU AI Act Art. 60 testing in real-world conditions outside sandboxes", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-eu-ai-act-art-60-testing-in-real-world-conditions-outside-sandboxes", "obligationId": "AIGE-OBL-EUAIA-ART60", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-euaia-art60", "see": null }, { "topic": "sandboxes-real-world-testing", "framework": "eu-ai-act", "frameworkShort": "EU AI Act", "column": "eu", "reference": "Art. 61", "clauseId": "art-61", "label": "Art. 61", "title": "Informed consent to participate in testing in real world conditions", "strength": "related", "verified": true, "note": null, "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng#art_61", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "sandboxes-real-world-testing", "framework": "iso-42001", "frameworkShort": "ISO 42001", "column": "iso", "reference": "A.6.2.4", "clauseId": "a.6.2.4", "label": "A.6.2.4", "title": "AI system verification and validation", "strength": "related", "verified": false, "note": "Clause id and title as listed in the AI RMF to ISO/IEC FDIS 42001 crosswalk (contributed by Microsoft to NIST's AI Resource Center) and in CSA's AICM v1.1.1 mapping; the published ISO text was not opened.", "url": "https://www.iso.org/standard/42001", "obligation": "A.6 AI system life cycle", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-a6-ai-system-life-cycle", "obligationId": "AIGE-OBL-ISO42001-A6", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-iso42001-a6", "see": null }, { "topic": "sandboxes-real-world-testing", "framework": "nist-ai-rmf", "frameworkShort": "NIST AI RMF", "column": "nist", "reference": "MEASURE 2.3", "clauseId": "measure-2.3", "label": "MEASURE 2.3", "title": "MEASURE 2.3: AI system performance or assurance criteria are measured qualitatively or quantitatively and demonstrated for conditions similar to deployment setting(s)", "strength": "related", "verified": true, "note": null, "url": "https://airc.nist.gov/airmf-resources/airmf/", "obligation": "MEASURE", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-measure", "obligationId": "AIGE-OBL-NISTRMF-MEASURE", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-nistrmf-measure", "see": null }, { "topic": "sandboxes-real-world-testing", "framework": "csa-aicm", "frameworkShort": "CSA AICM", "column": "csa", "reference": "AIS-13", "clauseId": "AIS-13", "label": "AIS-13", "title": "AI Sandboxing", "strength": "related", "verified": true, "note": "Technical isolation of AI tools and plugins, not a regulatory sandbox.", "url": "https://cloudsecurityalliance.org/artifacts/ai-controls-matrix-v1-1", "obligation": "AICM v1.1: 247 control objectives across 18 domains", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-aicm-v11-247-control-objectives-across-18-domains", "obligationId": "AIGE-OBL-CSA-AICM", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-csa-aicm", "see": null }, { "topic": "sandboxes-real-world-testing", "framework": "sg-agentic-framework", "frameworkShort": "Singapore Agentic", "column": "sg", "reference": "2.3.2", "clauseId": "_2.3.2", "label": "Agentic 2.3.2", "title": "Before deploying, test agents", "strength": "related", "verified": true, "note": null, "url": "https://www.imda.gov.sg/-/media/imda/files/about/emerging-tech-and-research/artificial-intelligence/mgf-for-agentic-ai.pdf", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "sandboxes-real-world-testing", "framework": "coe-cets-225", "frameworkShort": "CoE Convention", "column": "intl", "reference": "Art. 13", "clauseId": "art-13", "label": "CoE Art. 13", "title": "Safe innovation (controlled testing environments)", "strength": "core", "verified": true, "note": null, "url": "https://rm.coe.int/1680afae3c", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "sandboxes-real-world-testing", "framework": "cn-tc260-framework", "frameworkShort": "TC260 Framework 3.0", "column": "cn", "reference": "App. 2 II.6", "clauseId": "app-2-ii.6", "label": "TC260 App. 2 II.6", "title": "Sandbox validation and red teaming", "strength": "related", "verified": true, "note": "Technical sandbox validation for agents, not a regulatory sandbox; printed pp. 124-125.", "url": "https://www.cac.gov.cn/rootimages/uploadimg/1791137114683961/1791137114683961.pdf", "obligation": "TC260 Framework 3.0 Appendix 2: agentic AI risk management (voluntary; 2026-09-14)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-tc260-framework-30-appendix-2-agentic-ai-risk-management-voluntary-2026-09-14", "obligationId": "AIGE-OBL-CN-TC260-AGENTS", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-cn-tc260-agents", "see": null }, { "topic": "environmental-impact", "framework": "eu-ai-act", "frameworkShort": "EU AI Act", "column": "eu", "reference": "Annex XI 1(2)(e)", "clauseId": "annex-xi-1-2-e", "label": "Annex XI 1(2)(e)", "title": "Known or estimated energy consumption of the GPAI model", "strength": "core", "verified": true, "note": "Part of the technical documentation GPAI providers keep under Art. 53(1)(a); may be estimated from compute where unknown.", "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng#anx_XI", "obligation": "EU AI Act Art. 53 GPAI provider obligations", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-eu-ai-act-art-53-gpai-provider-obligations", "obligationId": "AIGE-OBL-EUAIA-ART53", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-euaia-art53", "see": null }, { "topic": "environmental-impact", "framework": "eu-ai-act", "frameworkShort": "EU AI Act", "column": "eu", "reference": "Art. 40(2)", "clauseId": "art-40-2", "label": "Art. 40(2)", "title": "Standardisation deliverables on energy and resource performance", "strength": "related", "verified": true, "note": null, "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng#art_40", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "environmental-impact", "framework": "eu-ai-act", "frameworkShort": "EU AI Act", "column": "eu", "reference": "Art. 95(2)(b)", "clauseId": "art-95-2-b", "label": "Art. 95(2)(b)", "title": "Codes of conduct: environmental sustainability", "strength": "related", "verified": true, "note": null, "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng#art_95", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "environmental-impact", "framework": "gpai-code-of-practice", "frameworkShort": "GPAI Code", "column": "gpai", "reference": "Transparency 1.1", "clauseId": "transparency-1.1", "label": "Transparency 1.1", "title": "Drawing up and keeping up-to-date model documentation", "strength": "core", "verified": true, "note": "The Model Documentation Form asks for energy used in training and inference.", "url": "https://ec.europa.eu/newsroom/dae/redirection/document/118120", "obligation": "Transparency", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-transparency", "obligationId": "AIGE-OBL-GPAICOP-TRANSPARENCY", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-gpaicop-transparency", "see": null }, { "topic": "environmental-impact", "framework": "nist-ai-rmf", "frameworkShort": "NIST AI RMF", "column": "nist", "reference": "MEASURE 2.12", "clauseId": "measure-2.12", "label": "MEASURE 2.12", "title": "MEASURE 2.12: Environmental impact and sustainability of AI model training and management activities as identified in the MAP function are assessed and documented", "strength": "core", "verified": true, "note": null, "url": "https://airc.nist.gov/airmf-resources/airmf/", "obligation": "MEASURE", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-measure", "obligationId": "AIGE-OBL-NISTRMF-MEASURE", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-nistrmf-measure", "see": null }, { "topic": "environmental-impact", "framework": "sg-genai-framework", "frameworkShort": "Singapore GenAI", "column": "sg", "reference": "9", "clauseId": "_9", "label": "GenAI 9", "title": "AI for Public Good", "strength": "related", "verified": true, "note": "Includes developing AI systems sustainably.", "url": "https://aiverifyfoundation.sg/wp-content/uploads/2024/05/Model-AI-Governance-Framework-for-Generative-AI-May-2024-1-1.pdf", "obligation": "Singapore IMDA Model AI Governance Framework for Generative AI (voluntary)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-singapore-imda-model-ai-governance-framework-for-generative-ai-voluntary", "obligationId": "AIGE-OBL-SG-GENAI", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-sg-genai", "see": null }, { "topic": "environmental-impact", "framework": "oecd-ai-principles", "frameworkShort": "OECD AI Principles", "column": "intl", "reference": "1.1", "clauseId": "_1.1", "label": "OECD 1.1", "title": "Inclusive growth, sustainable development and well-being", "strength": "core", "verified": true, "note": null, "url": "https://legalinstruments.oecd.org/en/instruments/OECD-LEGAL-0449", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "deployment-change-decommissioning", "framework": "eu-ai-act", "frameworkShort": "EU AI Act", "column": "eu", "reference": "Art. 26", "clauseId": "art-26", "label": "Art. 26", "title": "Obligations of deployers of high-risk AI systems", "strength": "core", "verified": true, "note": null, "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng#art_26", "obligation": "EU AI Act Art. 26 deployer obligations for high-risk systems", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-eu-ai-act-art-26-deployer-obligations-for-high-risk-systems", "obligationId": "AIGE-OBL-EUAIA-ART26", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-euaia-art26", "see": null }, { "topic": "deployment-change-decommissioning", "framework": "eu-ai-act", "frameworkShort": "EU AI Act", "column": "eu", "reference": "Art. 25", "clauseId": "art-25", "label": "Art. 25", "title": "Responsibilities along the AI value chain", "strength": "related", "verified": true, "note": "A substantial modification or a changed intended purpose makes the deployer a provider.", "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng#art_25", "obligation": "EU AI Act Art. 25 responsibilities along the AI value chain", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-eu-ai-act-art-25-responsibilities-along-the-ai-value-chain", "obligationId": "AIGE-OBL-EUAIA-ART25", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-euaia-art25", "see": null }, { "topic": "deployment-change-decommissioning", "framework": "eu-ai-act", "frameworkShort": "EU AI Act", "column": "eu", "reference": "Art. 43(4)", "clauseId": "art-43-4", "label": "Art. 43(4)", "title": "New conformity assessment on substantial modification", "strength": "related", "verified": true, "note": null, "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng#art_43", "obligation": "EU AI Act Art. 43 conformity assessment", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-eu-ai-act-art-43-conformity-assessment", "obligationId": "AIGE-OBL-EUAIA-ART43", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-euaia-art43", "see": null }, { "topic": "deployment-change-decommissioning", "framework": "eu-ai-act", "frameworkShort": "EU AI Act", "column": "eu", "reference": "Art. 20", "clauseId": "art-20", "label": "Art. 20", "title": "Corrective actions and duty of information", "strength": "related", "verified": true, "note": "Bring into conformity, withdraw, disable or recall.", "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng#art_20", "obligation": "EU AI Act Art. 20 corrective actions and duty of information", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-eu-ai-act-art-20-corrective-actions-and-duty-of-information", "obligationId": "AIGE-OBL-EUAIA-ART20", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-euaia-art20", "see": null }, { "topic": "deployment-change-decommissioning", "framework": "eu-ai-act", "frameworkShort": "EU AI Act", "column": "eu", "reference": "Art. 79", "clauseId": "art-79", "label": "Art. 79", "title": "Procedure at national level for dealing with AI systems presenting a risk", "strength": "related", "verified": true, "note": null, "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng#art_79", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "deployment-change-decommissioning", "framework": "eu-ai-act", "frameworkShort": "EU AI Act", "column": "eu", "reference": "Art. 86", "clauseId": "art-86", "label": "Art. 86", "title": "Right to explanation of individual decision-making", "strength": "related", "verified": true, "note": null, "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng#art_86", "obligation": "EU AI Act Art. 86 right to explanation of individual decision-making", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-eu-ai-act-art-86-right-to-explanation-of-individual-decision-making", "obligationId": "AIGE-OBL-EUAIA-ART86", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-euaia-art86", "see": null }, { "topic": "deployment-change-decommissioning", "framework": "iso-42001", "frameworkShort": "ISO 42001", "column": "iso", "reference": "A.9", "clauseId": "a.9", "label": "A.9", "title": "Use of AI systems", "strength": "related", "verified": true, "note": null, "url": "https://www.iso.org/standard/42001", "obligation": "A.9 Use of AI systems", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-a9-use-of-ai-systems", "obligationId": "AIGE-OBL-ISO42001-A9", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-iso42001-a9", "see": null }, { "topic": "deployment-change-decommissioning", "framework": "iso-42001", "frameworkShort": "ISO 42001", "column": "iso", "reference": "A.6.2.5", "clauseId": "a.6.2.5", "label": "A.6.2.5", "title": "AI system deployment", "strength": "core", "verified": false, "note": "Clause id and title as listed in the AI RMF to ISO/IEC FDIS 42001 crosswalk (contributed by Microsoft to NIST's AI Resource Center) and in CSA's AICM v1.1.1 mapping; the published ISO text was not opened.", "url": "https://www.iso.org/standard/42001", "obligation": "A.6 AI system life cycle", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-a6-ai-system-life-cycle", "obligationId": "AIGE-OBL-ISO42001-A6", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-iso42001-a6", "see": null }, { "topic": "deployment-change-decommissioning", "framework": "iso-42001", "frameworkShort": "ISO 42001", "column": "iso", "reference": "A.6.2.6", "clauseId": "a.6.2.6", "label": "A.6.2.6", "title": "AI system operation and monitoring", "strength": "core", "verified": false, "note": "Clause id and title as listed in the AI RMF to ISO/IEC FDIS 42001 crosswalk (contributed by Microsoft to NIST's AI Resource Center) and in CSA's AICM v1.1.1 mapping; the published ISO text was not opened.", "url": "https://www.iso.org/standard/42001", "obligation": "A.6 AI system life cycle", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-a6-ai-system-life-cycle", "obligationId": "AIGE-OBL-ISO42001-A6", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-iso42001-a6", "see": null }, { "topic": "deployment-change-decommissioning", "framework": "nist-ai-rmf", "frameworkShort": "NIST AI RMF", "column": "nist", "reference": "MANAGE 2.4", "clauseId": "manage-2.4", "label": "MANAGE 2.4", "title": "MANAGE 2.4: Mechanisms are in place and applied, and responsibilities are assigned and understood, to supersede, disengage, or deactivate AI systems that demonstrate performance or outcomes inconsistent with intended use", "strength": "core", "verified": true, "note": null, "url": "https://airc.nist.gov/airmf-resources/airmf/", "obligation": "MANAGE", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-manage", "obligationId": "AIGE-OBL-NISTRMF-MANAGE", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-nistrmf-manage", "see": null }, { "topic": "deployment-change-decommissioning", "framework": "nist-ai-rmf", "frameworkShort": "NIST AI RMF", "column": "nist", "reference": "MANAGE 4.1", "clauseId": "manage-4.1", "label": "MANAGE 4.1", "title": "MANAGE 4.1: Post-deployment AI system monitoring plans are implemented, including mechanisms for capturing and evaluating input from users and other relevant AI actors, appeal and override, decommissioning, incident response, recovery, and change management", "strength": "core", "verified": true, "note": null, "url": "https://airc.nist.gov/airmf-resources/airmf/", "obligation": "MANAGE", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-manage", "obligationId": "AIGE-OBL-NISTRMF-MANAGE", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-nistrmf-manage", "see": null }, { "topic": "deployment-change-decommissioning", "framework": "nist-ai-rmf", "frameworkShort": "NIST AI RMF", "column": "nist", "reference": "GOVERN 1.7", "clauseId": "govern-1.7", "label": "GOVERN 1.7", "title": "GOVERN 1.7: Processes and procedures are in place for decommissioning and phasing out AI systems safely and in a manner that does not increase risks or decrease the organization's trustworthiness", "strength": "core", "verified": true, "note": null, "url": "https://airc.nist.gov/airmf-resources/airmf/", "obligation": "GOVERN", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-govern", "obligationId": "AIGE-OBL-NISTRMF-GOVERN", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-nistrmf-govern", "see": null }, { "topic": "deployment-change-decommissioning", "framework": "csa-aicm", "frameworkShort": "CSA AICM", "column": "csa", "reference": "AIS-06", "clauseId": "AIS-06", "label": "AIS-06", "title": "Secure Application Deployment", "strength": "core", "verified": true, "note": null, "url": "https://cloudsecurityalliance.org/artifacts/ai-controls-matrix-v1-1", "obligation": "AICM v1.1: 247 control objectives across 18 domains", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-aicm-v11-247-control-objectives-across-18-domains", "obligationId": "AIGE-OBL-CSA-AICM", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-csa-aicm", "see": null }, { "topic": "deployment-change-decommissioning", "framework": "csa-aicm", "frameworkShort": "CSA AICM", "column": "csa", "reference": "CCC-01", "clauseId": "CCC-01", "label": "CCC-01", "title": "Change Management Policy and Procedures", "strength": "related", "verified": true, "note": null, "url": "https://cloudsecurityalliance.org/artifacts/ai-controls-matrix-v1-1", "obligation": "AICM v1.1: 247 control objectives across 18 domains", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-aicm-v11-247-control-objectives-across-18-domains", "obligationId": "AIGE-OBL-CSA-AICM", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-csa-aicm", "see": null }, { "topic": "deployment-change-decommissioning", "framework": "csa-aicm", "frameworkShort": "CSA AICM", "column": "csa", "reference": "DSP-02", "clauseId": "DSP-02", "label": "DSP-02", "title": "Secure Disposal", "strength": "related", "verified": true, "note": null, "url": "https://cloudsecurityalliance.org/artifacts/ai-controls-matrix-v1-1", "obligation": "AICM v1.1: 247 control objectives across 18 domains", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-aicm-v11-247-control-objectives-across-18-domains", "obligationId": "AIGE-OBL-CSA-AICM", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-csa-aicm", "see": null }, { "topic": "deployment-change-decommissioning", "framework": "sg-agentic-framework", "frameworkShort": "Singapore Agentic", "column": "sg", "reference": "2.3.3", "clauseId": "_2.3.3", "label": "Agentic 2.3.3", "title": "When deploying, continuously monitor and test", "strength": "related", "verified": true, "note": null, "url": "https://www.imda.gov.sg/-/media/imda/files/about/emerging-tech-and-research/artificial-intelligence/mgf-for-agentic-ai.pdf", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "deployment-change-decommissioning", "framework": "coe-cets-225", "frameworkShort": "CoE Convention", "column": "intl", "reference": "Art. 16(2)(g)", "clauseId": "art-16-2-g", "label": "CoE Art. 16(2)(g)", "title": "Testing before first use and when significantly modified", "strength": "related", "verified": true, "note": null, "url": "https://rm.coe.int/1680afae3c", "obligation": "Council of Europe Convention Art. 16(2)(g) testing before first use and on significant modification", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-council-of-europe-convention-art-162g-testing-before-first-use-and-on-significant-modification", "obligationId": "AIGE-OBL-COE-ART16-2G", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-coe-art16-2g", "see": null }, { "topic": "deployment-change-decommissioning", "framework": "oecd-ai-principles", "frameworkShort": "OECD AI Principles", "column": "intl", "reference": "1.4", "clauseId": "_1.4", "label": "OECD 1.4", "title": "Robustness, security and safety", "strength": "related", "verified": true, "note": "The 2024 revision asks for mechanisms to override, repair or decommission safely.", "url": "https://legalinstruments.oecd.org/en/instruments/OECD-LEGAL-0449", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "deployment-change-decommissioning", "framework": "cn-tc260-framework", "frameworkShort": "TC260 Framework 3.0", "column": "cn", "reference": "5.3", "clauseId": "_5.3", "label": "TC260 5.3", "title": "Operators' safety guidelines", "strength": "related", "verified": true, "note": "Logs kept at least six months and audited; voluntary.", "url": "https://www.cac.gov.cn/rootimages/uploadimg/1791137114683961/1791137114683961.pdf", "obligation": "TC260 AI Safety Governance Framework 3.0: operators' guidelines §5.3 (voluntary; 2026-09-14)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-tc260-ai-safety-governance-framework-30-operators-guidelines-53-voluntary-2026-09-14", "obligationId": "AIGE-OBL-CN-TC260-OPS", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-cn-tc260-ops", "see": null }, { "topic": "deployment-change-decommissioning", "framework": "cn-tc260-framework", "frameworkShort": "TC260 Framework 3.0", "column": "cn", "reference": "5.3.19", "clauseId": "_5.3.19", "label": "TC260 5.3.19", "title": "Re-assessment on material change", "strength": "related", "verified": true, "note": null, "url": "https://www.cac.gov.cn/rootimages/uploadimg/1791137114683961/1791137114683961.pdf", "obligation": "TC260 AI Safety Governance Framework 3.0: operators' guidelines §5.3 (voluntary; 2026-09-14)", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-tc260-ai-safety-governance-framework-30-operators-guidelines-53-voluntary-2026-09-14", "obligationId": "AIGE-OBL-CN-TC260-OPS", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-cn-tc260-ops", "see": null }, { "topic": "risk-management", "framework": "us-gao-ai-accountability", "frameworkShort": "GAO AI Accountability", "column": "gao", "reference": "1.6", "clauseId": "_1.6", "label": "1.6", "title": "Risk management: implement an AI-specific risk management plan to systematically identify, analyze, and mitigate risks", "strength": "core", "verified": true, "note": null, "url": "https://www.gao.gov/products/gao-21-519sp", "obligation": "GAO AI Accountability Framework principle 1: governance", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-gao-ai-accountability-framework-principle-1-governance", "obligationId": "AIGE-OBL-USGAO-GOV", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-usgao-gov", "see": null }, { "topic": "governance-accountability", "framework": "us-gao-ai-accountability", "frameworkShort": "GAO AI Accountability", "column": "gao", "reference": "1.2", "clauseId": "_1.2", "label": "1.2", "title": "Roles and responsibilities: define clear roles, responsibilities, and delegation of authority for the AI system", "strength": "core", "verified": true, "note": null, "url": "https://www.gao.gov/products/gao-21-519sp", "obligation": "GAO AI Accountability Framework principle 1: governance", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-gao-ai-accountability-framework-principle-1-governance", "obligationId": "AIGE-OBL-USGAO-GOV", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-usgao-gov", "see": null }, { "topic": "governance-accountability", "framework": "us-gao-ai-accountability", "frameworkShort": "GAO AI Accountability", "column": "gao", "reference": "1.1", "clauseId": "_1.1", "label": "1.1", "title": "Clear goals: define clear goals and objectives for the AI system", "strength": "related", "verified": true, "note": null, "url": "https://www.gao.gov/products/gao-21-519sp", "obligation": "GAO AI Accountability Framework principle 1: governance", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-gao-ai-accountability-framework-principle-1-governance", "obligationId": "AIGE-OBL-USGAO-GOV", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-usgao-gov", "see": null }, { "topic": "governance-accountability", "framework": "us-gao-ai-accountability", "frameworkShort": "GAO AI Accountability", "column": "gao", "reference": "1.3", "clauseId": "_1.3", "label": "1.3", "title": "Values: demonstrate a commitment to values and principles established by the entity", "strength": "related", "verified": true, "note": null, "url": "https://www.gao.gov/products/gao-21-519sp", "obligation": "GAO AI Accountability Framework principle 1: governance", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-gao-ai-accountability-framework-principle-1-governance", "obligationId": "AIGE-OBL-USGAO-GOV", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-usgao-gov", "see": null }, { "topic": "impact-assessment", "framework": "us-gao-ai-accountability", "frameworkShort": "GAO AI Accountability", "column": "gao", "reference": "1.5", "clauseId": "_1.5", "label": "1.5", "title": "Stakeholder involvement: include diverse perspectives from a community of stakeholders throughout the AI life cycle", "strength": "related", "verified": true, "note": null, "url": "https://www.gao.gov/products/gao-21-519sp", "obligation": "GAO AI Accountability Framework principle 1: governance", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-gao-ai-accountability-framework-principle-1-governance", "obligationId": "AIGE-OBL-USGAO-GOV", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-usgao-gov", "see": null }, { "topic": "data-governance", "framework": "us-gao-ai-accountability", "frameworkShort": "GAO AI Accountability", "column": "gao", "reference": "2.1", "clauseId": "_2.1", "label": "2.1", "title": "Sources: document sources and origins of data used to develop the models", "strength": "core", "verified": true, "note": null, "url": "https://www.gao.gov/products/gao-21-519sp", "obligation": "GAO AI Accountability Framework principle 2: data", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-gao-ai-accountability-framework-principle-2-data", "obligationId": "AIGE-OBL-USGAO-DATA", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-usgao-data", "see": null }, { "topic": "data-governance", "framework": "us-gao-ai-accountability", "frameworkShort": "GAO AI Accountability", "column": "gao", "reference": "2.2", "clauseId": "_2.2", "label": "2.2", "title": "Reliability: assess reliability of data used to develop the models", "strength": "core", "verified": true, "note": null, "url": "https://www.gao.gov/products/gao-21-519sp", "obligation": "GAO AI Accountability Framework principle 2: data", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-gao-ai-accountability-framework-principle-2-data", "obligationId": "AIGE-OBL-USGAO-DATA", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-usgao-data", "see": null }, { "topic": "data-governance", "framework": "us-gao-ai-accountability", "frameworkShort": "GAO AI Accountability", "column": "gao", "reference": "2.4", "clauseId": "_2.4", "label": "2.4", "title": "Variable selection: assess data variables used in the AI component models", "strength": "related", "verified": true, "note": null, "url": "https://www.gao.gov/products/gao-21-519sp", "obligation": "GAO AI Accountability Framework principle 2: data", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-gao-ai-accountability-framework-principle-2-data", "obligationId": "AIGE-OBL-USGAO-DATA", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-usgao-data", "see": null }, { "topic": "data-governance", "framework": "us-gao-ai-accountability", "frameworkShort": "GAO AI Accountability", "column": "gao", "reference": "2.5", "clauseId": "_2.5", "label": "2.5", "title": "Enhancement: assess the use of synthetic, imputed, and/or augmented data", "strength": "related", "verified": true, "note": null, "url": "https://www.gao.gov/products/gao-21-519sp", "obligation": "GAO AI Accountability Framework principle 2: data", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-gao-ai-accountability-framework-principle-2-data", "obligationId": "AIGE-OBL-USGAO-DATA", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-usgao-data", "see": null }, { "topic": "documentation-transparency", "framework": "us-gao-ai-accountability", "frameworkShort": "GAO AI Accountability", "column": "gao", "reference": "1.9", "clauseId": "_1.9", "label": "1.9", "title": "Transparency: enable external stakeholders to access information on the design, operation, and limitations of the AI system", "strength": "core", "verified": true, "note": null, "url": "https://www.gao.gov/products/gao-21-519sp", "obligation": "GAO AI Accountability Framework principle 1: governance", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-gao-ai-accountability-framework-principle-1-governance", "obligationId": "AIGE-OBL-USGAO-GOV", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-usgao-gov", "see": null }, { "topic": "documentation-transparency", "framework": "us-gao-ai-accountability", "frameworkShort": "GAO AI Accountability", "column": "gao", "reference": "3.5", "clauseId": "_3.5", "label": "3.5", "title": "Documentation: document the methods for assessment, performance metrics, and outcomes of the AI system", "strength": "core", "verified": true, "note": null, "url": "https://www.gao.gov/products/gao-21-519sp", "obligation": "GAO AI Accountability Framework principle 3: performance", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-gao-ai-accountability-framework-principle-3-performance", "obligationId": "AIGE-OBL-USGAO-PERF", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-usgao-perf", "see": null }, { "topic": "documentation-transparency", "framework": "us-gao-ai-accountability", "frameworkShort": "GAO AI Accountability", "column": "gao", "reference": "1.7", "clauseId": "_1.7", "label": "1.7", "title": "Specifications: establish and document technical specifications", "strength": "related", "verified": true, "note": null, "url": "https://www.gao.gov/products/gao-21-519sp", "obligation": "GAO AI Accountability Framework principle 1: governance", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-gao-ai-accountability-framework-principle-1-governance", "obligationId": "AIGE-OBL-USGAO-GOV", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-usgao-gov", "see": null }, { "topic": "inventory-registration", "framework": "us-gao-ai-accountability", "frameworkShort": "GAO AI Accountability", "column": "gao", "reference": "3.1", "clauseId": "_3.1", "label": "3.1", "title": "Documentation: catalog model and non-model components, along with operating specifications and parameters", "strength": "related", "verified": true, "note": null, "url": "https://www.gao.gov/products/gao-21-519sp", "obligation": "GAO AI Accountability Framework principle 3: performance", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-gao-ai-accountability-framework-principle-3-performance", "obligationId": "AIGE-OBL-USGAO-PERF", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-usgao-perf", "see": null }, { "topic": "logging-traceability", "framework": "us-gao-ai-accountability", "frameworkShort": "GAO AI Accountability", "column": "gao", "reference": "4.3", "clauseId": "_4.3", "label": "4.3", "title": "Traceability: document results of monitoring activities and any corrective actions taken", "strength": "core", "verified": true, "note": null, "url": "https://www.gao.gov/products/gao-21-519sp", "obligation": "GAO AI Accountability Framework principle 4: monitoring", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-gao-ai-accountability-framework-principle-4-monitoring", "obligationId": "AIGE-OBL-USGAO-MON", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-usgao-mon", "see": null }, { "topic": "human-oversight", "framework": "us-gao-ai-accountability", "frameworkShort": "GAO AI Accountability", "column": "gao", "reference": "3.9", "clauseId": "_3.9", "label": "3.9", "title": "Human supervision: define and develop procedures for human supervision of the AI system", "strength": "core", "verified": true, "note": null, "url": "https://www.gao.gov/products/gao-21-519sp", "obligation": "GAO AI Accountability Framework principle 3: performance", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-gao-ai-accountability-framework-principle-3-performance", "obligationId": "AIGE-OBL-USGAO-PERF", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-usgao-perf", "see": null }, { "topic": "robustness-security-evals", "framework": "us-gao-ai-accountability", "frameworkShort": "GAO AI Accountability", "column": "gao", "reference": "3.7", "clauseId": "_3.7", "label": "3.7", "title": "Assessment: assess performance against defined metrics to ensure the AI system functions as intended and is sufficiently robust", "strength": "core", "verified": true, "note": null, "url": "https://www.gao.gov/products/gao-21-519sp", "obligation": "GAO AI Accountability Framework principle 3: performance", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-gao-ai-accountability-framework-principle-3-performance", "obligationId": "AIGE-OBL-USGAO-PERF", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-usgao-perf", "see": null }, { "topic": "robustness-security-evals", "framework": "us-gao-ai-accountability", "frameworkShort": "GAO AI Accountability", "column": "gao", "reference": "3.2", "clauseId": "_3.2", "label": "3.2", "title": "Metrics: define performance metrics that are precise, consistent, and reproducible", "strength": "related", "verified": true, "note": null, "url": "https://www.gao.gov/products/gao-21-519sp", "obligation": "GAO AI Accountability Framework principle 3: performance", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-gao-ai-accountability-framework-principle-3-performance", "obligationId": "AIGE-OBL-USGAO-PERF", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-usgao-perf", "see": null }, { "topic": "incident-monitoring", "framework": "us-gao-ai-accountability", "frameworkShort": "GAO AI Accountability", "column": "gao", "reference": "4.1", "clauseId": "_4.1", "label": "4.1", "title": "Planning: develop plans for continuous or routine monitoring of the AI system", "strength": "core", "verified": true, "note": null, "url": "https://www.gao.gov/products/gao-21-519sp", "obligation": "GAO AI Accountability Framework principle 4: monitoring", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-gao-ai-accountability-framework-principle-4-monitoring", "obligationId": "AIGE-OBL-USGAO-MON", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-usgao-mon", "see": null }, { "topic": "incident-monitoring", "framework": "us-gao-ai-accountability", "frameworkShort": "GAO AI Accountability", "column": "gao", "reference": "4.2", "clauseId": "_4.2", "label": "4.2", "title": "Drift: establish the range of data and model drift that is acceptable", "strength": "core", "verified": true, "note": null, "url": "https://www.gao.gov/products/gao-21-519sp", "obligation": "GAO AI Accountability Framework principle 4: monitoring", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-gao-ai-accountability-framework-principle-4-monitoring", "obligationId": "AIGE-OBL-USGAO-MON", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-usgao-mon", "see": null }, { "topic": "supply-chain", "framework": "us-gao-ai-accountability", "frameworkShort": "GAO AI Accountability", "column": "gao", "reference": "2.6", "clauseId": "_2.6", "label": "2.6", "title": "Dependency: assess interconnectivities and dependencies of data streams that operationalize the AI system", "strength": "related", "verified": true, "note": null, "url": "https://www.gao.gov/products/gao-21-519sp", "obligation": "GAO AI Accountability Framework principle 2: data", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-gao-ai-accountability-framework-principle-2-data", "obligationId": "AIGE-OBL-USGAO-DATA", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-usgao-data", "see": null }, { "topic": "fairness-non-discrimination", "framework": "us-gao-ai-accountability", "frameworkShort": "GAO AI Accountability", "column": "gao", "reference": "2.7", "clauseId": "_2.7", "label": "2.7", "title": "Bias: assess reliability, quality, and representativeness of the data used in operation, including potential biases", "strength": "core", "verified": true, "note": null, "url": "https://www.gao.gov/products/gao-21-519sp", "obligation": "GAO AI Accountability Framework principle 2: data", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-gao-ai-accountability-framework-principle-2-data", "obligationId": "AIGE-OBL-USGAO-DATA", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-usgao-data", "see": null }, { "topic": "fairness-non-discrimination", "framework": "us-gao-ai-accountability", "frameworkShort": "GAO AI Accountability", "column": "gao", "reference": "3.8", "clauseId": "_3.8", "label": "3.8", "title": "Bias: identify potential biases, inequities, and other societal concerns resulting from the AI system", "strength": "core", "verified": true, "note": null, "url": "https://www.gao.gov/products/gao-21-519sp", "obligation": "GAO AI Accountability Framework principle 3: performance", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-gao-ai-accountability-framework-principle-3-performance", "obligationId": "AIGE-OBL-USGAO-PERF", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-usgao-perf", "see": null }, { "topic": "privacy-data-protection", "framework": "us-gao-ai-accountability", "frameworkShort": "GAO AI Accountability", "column": "gao", "reference": "2.8", "clauseId": "_2.8", "label": "2.8", "title": "Security and privacy: assess data security and privacy for the AI system", "strength": "core", "verified": true, "note": null, "url": "https://www.gao.gov/products/gao-21-519sp", "obligation": "GAO AI Accountability Framework principle 2: data", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-gao-ai-accountability-framework-principle-2-data", "obligationId": "AIGE-OBL-USGAO-DATA", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-usgao-data", "see": null }, { "topic": "ai-literacy", "framework": "us-gao-ai-accountability", "frameworkShort": "GAO AI Accountability", "column": "gao", "reference": "1.4", "clauseId": "_1.4", "label": "1.4", "title": "Workforce: recruit, develop, and retain personnel with multidisciplinary skills and experiences", "strength": "related", "verified": true, "note": null, "url": "https://www.gao.gov/products/gao-21-519sp", "obligation": "GAO AI Accountability Framework principle 1: governance", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-gao-ai-accountability-framework-principle-1-governance", "obligationId": "AIGE-OBL-USGAO-GOV", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-usgao-gov", "see": null }, { "topic": "conformity-assessment", "framework": "us-gao-ai-accountability", "frameworkShort": "GAO AI Accountability", "column": "gao", "reference": "1.8", "clauseId": "_1.8", "label": "1.8", "title": "Compliance: ensure the AI system complies with relevant laws, regulations, standards, and guidance", "strength": "related", "verified": true, "note": null, "url": "https://www.gao.gov/products/gao-21-519sp", "obligation": "GAO AI Accountability Framework principle 1: governance", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-gao-ai-accountability-framework-principle-1-governance", "obligationId": "AIGE-OBL-USGAO-GOV", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-usgao-gov", "see": null }, { "topic": "deployment-change-decommissioning", "framework": "us-gao-ai-accountability", "frameworkShort": "GAO AI Accountability", "column": "gao", "reference": "4.4", "clauseId": "_4.4", "label": "4.4", "title": "Ongoing assessment: assess the utility of the AI system to ensure its relevance to the current context", "strength": "related", "verified": true, "note": null, "url": "https://www.gao.gov/products/gao-21-519sp", "obligation": "GAO AI Accountability Framework principle 4: monitoring", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-gao-ai-accountability-framework-principle-4-monitoring", "obligationId": "AIGE-OBL-USGAO-MON", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-usgao-mon", "see": null }, { "topic": "deployment-change-decommissioning", "framework": "us-gao-ai-accountability", "frameworkShort": "GAO AI Accountability", "column": "gao", "reference": "4.5", "clauseId": "_4.5", "label": "4.5", "title": "Scaling: identify conditions, if any, under which the AI system may be scaled or expanded beyond its current use", "strength": "related", "verified": true, "note": null, "url": "https://www.gao.gov/products/gao-21-519sp", "obligation": "GAO AI Accountability Framework principle 4: monitoring", "chapter": "https://aigovernanceengineer.com/resources/frameworks#ob-gao-ai-accountability-framework-principle-4-monitoring", "obligationId": "AIGE-OBL-USGAO-MON", "obligationUrl": "https://aigovernanceengineer.com/obligations/aige-obl-usgao-mon", "see": null }, { "topic": "risk-management", "framework": "sg-ai-verify", "frameworkShort": "AI Verify", "column": "aiverify", "reference": "4.3.1", "clauseId": "_4.3.1", "label": "4.3.1", "title": "Safety: assess risks, risk metrics and risk levels of the AI system in each specific use case", "strength": "core", "verified": true, "note": "AI Verify x NIST AI 600-1 crosswalk maps GV-1.3-001/002/007 (GOVERN 1.3) and MG-1.3-001 (MANAGE 1.3) to 4.3.1; AI Verify x ISO/IEC 42001 crosswalk maps group A.6 to it.", "url": "https://aiverifyfoundation.sg/tools/ai-verify-testing-framework/", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "risk-management", "framework": "sg-ai-verify", "frameworkShort": "AI Verify", "column": "aiverify", "reference": "4.7.1", "clauseId": "_4.7.1", "label": "4.7.1", "title": "Safety: identify and track residual risk that cannot be measured or mitigated, and assess the organisation's tolerance for it", "strength": "core", "verified": true, "note": "AI Verify x NIST AI 600-1 crosswalk maps MS-3.2-001 (MEASURE 3) and MS-1.1-009 to 4.7.1; AI Verify x ISO/IEC 42001 crosswalk lists it under the A.6.2 group.", "url": "https://aiverifyfoundation.sg/tools/ai-verify-testing-framework/", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "risk-management", "framework": "sg-ai-verify", "frameworkShort": "AI Verify", "column": "aiverify", "reference": "4.2.1", "clauseId": "_4.2.1", "label": "4.2.1", "title": "Safety: carry out an assessment of materiality on key stakeholders, highlighting the risks of the proposed AI solution", "strength": "related", "verified": true, "note": "AI Verify x NIST AI 600-1 crosswalk maps GV-1.3-001 (GOVERN 1.3) and MP-1.1-003 to 4.2.1.", "url": "https://aiverifyfoundation.sg/tools/ai-verify-testing-framework/", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "governance-accountability", "framework": "sg-ai-verify", "frameworkShort": "AI Verify", "column": "aiverify", "reference": "9.1.1", "clauseId": "_9.1.1", "label": "9.1.1", "title": "Accountability: establish policies on the development and use of AI aligned with other organisational policies", "strength": "core", "verified": true, "note": "AI Verify x ISO/IEC 42001 crosswalk maps A.2 (Policies related to AI) to 9.1.1; AI Verify x G7 Code of Conduct crosswalk maps Action 5.c to it.", "url": "https://aiverifyfoundation.sg/tools/ai-verify-testing-framework/", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "governance-accountability", "framework": "sg-ai-verify", "frameworkShort": "AI Verify", "column": "aiverify", "reference": "9.5.2", "clauseId": "_9.5.2", "label": "9.5.2", "title": "Accountability: clear internal governance mechanisms and roles, including a cross-departmental AI governance committee", "strength": "core", "verified": true, "note": "AI Verify x NIST AI 600-1 crosswalk maps GV-2.1-002 and GV-2.1-004 (GOVERN 2, roles and responsibilities) to 9.5.2; AI Verify x G7 Code of Conduct crosswalk maps Action 5.d to outcome 9.5.", "url": "https://aiverifyfoundation.sg/tools/ai-verify-testing-framework/", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "impact-assessment", "framework": "sg-ai-verify", "frameworkShort": "AI Verify", "column": "aiverify", "reference": "11.2.1", "clauseId": "_11.2.1", "label": "11.2.1", "title": "Inclusive growth, societal and environmental well-being: assess the impact of the AI system on individuals and society", "strength": "core", "verified": true, "note": "AI Verify x ISO/IEC 42001 crosswalk maps A.5.4 and A.5.5 (impacts on individuals and on society) to 11.2.1.", "url": "https://aiverifyfoundation.sg/tools/ai-verify-testing-framework/", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "impact-assessment", "framework": "sg-ai-verify", "frameworkShort": "AI Verify", "column": "aiverify", "reference": "4.2.1", "clauseId": "_4.2.1", "label": "4.2.1", "title": "Safety: carry out an assessment of materiality on key stakeholders", "strength": "related", "verified": true, "note": "AI Verify x ISO/IEC 42001 crosswalk maps A.5.2 and A.5.3 (impact assessment process and its documentation) to 4.2.1 among other Safety checks.", "url": "https://aiverifyfoundation.sg/tools/ai-verify-testing-framework/", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "data-governance", "framework": "sg-ai-verify", "frameworkShort": "AI Verify", "column": "aiverify", "reference": "8.1.1", "clauseId": "_8.1.1", "label": "8.1.1", "title": "Data Governance: put in place measures to ensure data quality over time", "strength": "core", "verified": true, "note": "AI Verify x ISO/IEC 42001 crosswalk maps A.7 (Data for AI systems) to 8.1.1; AI Verify x NIST AI 600-1 crosswalk maps MP-2.3-002 and MS-2.10-003 (MEASURE 2.10) to it.", "url": "https://aiverifyfoundation.sg/tools/ai-verify-testing-framework/", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "data-governance", "framework": "sg-ai-verify", "frameworkShort": "AI Verify", "column": "aiverify", "reference": "8.2.1", "clauseId": "_8.2.1", "label": "8.2.1", "title": "Data Governance: understand the lineage of data (origin, collection, curation, movement) through a data provenance record", "strength": "core", "verified": true, "note": "AI Verify x ISO/IEC 42001 crosswalk maps groups A.4 and A.7 (A.7.2 to A.7.6, incl. A.7.5 Data provenance) to 8.2.1; AI Verify x NIST AI 600-1 crosswalk maps MP-2.1-001/002 and MP-2.2-001 (MAP 2) to it.", "url": "https://aiverifyfoundation.sg/tools/ai-verify-testing-framework/", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "documentation-transparency", "framework": "sg-ai-verify", "frameworkShort": "AI Verify", "column": "aiverify", "reference": "1.1.6", "clauseId": "_1.1.6", "label": "1.1.6", "title": "Transparency: publicly report accuracy, intended use cases, limitations, risk assessment and mitigations to stakeholders", "strength": "core", "verified": true, "note": "AI Verify x ISO/IEC 42001 crosswalk maps A.8 to 1.1.6; AI Verify x G7 Code of Conduct crosswalk maps Actions 3.b and 3.c to it; AI Verify x NIST AI 600-1 crosswalk maps GV-1.2-001.", "url": "https://aiverifyfoundation.sg/tools/ai-verify-testing-framework/", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "documentation-transparency", "framework": "sg-ai-verify", "frameworkShort": "AI Verify", "column": "aiverify", "reference": "1.7.2", "clauseId": "_1.7.2", "label": "1.7.2", "title": "Transparency: make model or system cards publicly available where warranted by public interest", "strength": "core", "verified": true, "note": "AI Verify x ISO/IEC 42001 crosswalk maps A.8 and the A.6.2 group (incl. A.6.2.7 technical documentation) to 1.7.2.", "url": "https://aiverifyfoundation.sg/tools/ai-verify-testing-framework/", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "documentation-transparency", "framework": "sg-ai-verify", "frameworkShort": "AI Verify", "column": "aiverify", "reference": "1.1.1", "clauseId": "_1.1.1", "label": "1.1.1", "title": "Transparency: design an in-house policy on communication to consumers that articulates the principles for transparency", "strength": "related", "verified": true, "note": "AI Verify x ISO/IEC 42001 crosswalk maps A.8 to 1.1.1; AI Verify x NIST AI 600-1 crosswalk maps GV-1.2-001 and MP-5.1-003 to it.", "url": "https://aiverifyfoundation.sg/tools/ai-verify-testing-framework/", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "inventory-registration", "framework": "sg-ai-verify", "frameworkShort": "AI Verify", "column": "aiverify", "reference": "9.12.1", "clauseId": "_9.12.1", "label": "9.12.1", "title": "Accountability: inventory AI systems and their data, tooling, computing and human resources according to risk priorities", "strength": "core", "verified": true, "note": "AI Verify x NIST AI 600-1 crosswalk maps GV-1.6-003 (GOVERN 1.6, AI system inventory) to 9.12.1; AI Verify x ISO/IEC 42001 crosswalk maps A.4 to it. AI Verify has no registration-with-authorities check.", "url": "https://aiverifyfoundation.sg/tools/ai-verify-testing-framework/", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "inventory-registration", "framework": "sg-ai-verify", "frameworkShort": "AI Verify", "column": "aiverify", "reference": "5.5.1", "clauseId": "_5.5.1", "label": "5.5.1", "title": "Security: identify, track and protect AI-related assets (models, data, prompts, logs, assessments)", "strength": "related", "verified": true, "note": "AI Verify x NIST AI 600-1 crosswalk maps GV-1.6-001, -002 and -003 (GOVERN 1.6) to 5.5.1.", "url": "https://aiverifyfoundation.sg/tools/ai-verify-testing-framework/", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "logging-traceability", "framework": "sg-ai-verify", "frameworkShort": "AI Verify", "column": "aiverify", "reference": "3.4.1", "clauseId": "_3.4.1", "label": "3.4.1", "title": "Reproducibility: log all inputs and inference outputs of the model and keep them for a reasonable time for review", "strength": "core", "verified": true, "note": "AI Verify x ISO/IEC 42001 crosswalk maps the A.6.2 group (incl. A.6.2.8 recording of event logs) to 3.4.1; AI Verify x G7 Code of Conduct crosswalk maps Action 1.b (traceability) to 3.1.1 to 3.4.1.", "url": "https://aiverifyfoundation.sg/tools/ai-verify-testing-framework/", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "logging-traceability", "framework": "sg-ai-verify", "frameworkShort": "AI Verify", "column": "aiverify", "reference": "9.8.1", "clauseId": "_9.8.1", "label": "9.8.1", "title": "Accountability: process or governance-by-design technology for auditability: versioned code, models and data, and an audit trail of deployments and inputs/outputs", "strength": "core", "verified": true, "note": "No ISO or NIST crosswalk row cites 9.8.1; AI Verify x G7 Code of Conduct crosswalk maps Actions 5 and 5.c to it, and the check itself names the audit trail.", "url": "https://aiverifyfoundation.sg/tools/ai-verify-testing-framework/", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "logging-traceability", "framework": "sg-ai-verify", "frameworkShort": "AI Verify", "column": "aiverify", "reference": "5.10.1", "clauseId": "_5.10.1", "label": "5.10.1", "title": "Security: monitor and log inputs to the AI system (queries, prompts, requests)", "strength": "related", "verified": true, "note": "AI Verify x ISO/IEC 42001 crosswalk maps the A.6.2 group to 5.10.1; AI Verify x NIST AI 600-1 crosswalk maps MS-2.6-006 to it.", "url": "https://aiverifyfoundation.sg/tools/ai-verify-testing-framework/", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "human-oversight", "framework": "sg-ai-verify", "frameworkShort": "AI Verify", "column": "aiverify", "reference": "10.3.1", "clauseId": "_10.3.1", "label": "10.3.1", "title": "Human Agency and Oversight: define the role of the human in oversight and control of the AI system (in, over or out of the loop)", "strength": "core", "verified": true, "note": "AI Verify x ISO/IEC 42001 crosswalk maps A.3 (Internal organization) to 10.3.1; no crosswalk row ties it to A.9 or MANAGE 2.4, so the topic fit rests on the check's wording.", "url": "https://aiverifyfoundation.sg/tools/ai-verify-testing-framework/", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "human-oversight", "framework": "sg-ai-verify", "frameworkShort": "AI Verify", "column": "aiverify", "reference": "10.3.2", "clauseId": "_10.3.2", "label": "10.3.2", "title": "Human Agency and Oversight: flag decisions the model is significantly unsure of for human review, and monitor human overrides", "strength": "core", "verified": true, "note": "AI Verify x NIST AI 600-1 crosswalk maps MS-4.2-004 to 10.3.2.", "url": "https://aiverifyfoundation.sg/tools/ai-verify-testing-framework/", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "human-oversight", "framework": "sg-ai-verify", "frameworkShort": "AI Verify", "column": "aiverify", "reference": "9.4.1", "clauseId": "_9.4.1", "label": "9.4.1", "title": "Accountability: a manual to deactivate the AI model and a communications plan for disengagement", "strength": "related", "verified": true, "note": "AI Verify x NIST AI 600-1 crosswalk maps MG-2.4-001 and MG-2.4-004 (MANAGE 2.4, disengage or deactivate) to 9.4.1.", "url": "https://aiverifyfoundation.sg/tools/ai-verify-testing-framework/", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "runtime-guardrails", "framework": "sg-ai-verify", "frameworkShort": "AI Verify", "column": "aiverify", "reference": "4.8.1", "clauseId": "_4.8.1", "label": "4.8.1", "title": "Safety: assess harms and implement measures that prevent the model generating unlawful or harmful content (CSAM, NCII, CBRN, offensive cyber)", "strength": "related", "verified": true, "note": "AI Verify x NIST AI 600-1 crosswalk maps MG-2.2-005 (MANAGE 2) to 4.8.1; AI Verify x ISO/IEC 42001 crosswalk maps groups A.5 and A.6.1 to it.", "url": "https://aiverifyfoundation.sg/tools/ai-verify-testing-framework/", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "robustness-security-evals", "framework": "sg-ai-verify", "frameworkShort": "AI Verify", "column": "aiverify", "reference": "4.1.1", "clauseId": "_4.1.1", "label": "4.1.1", "title": "Safety (technical test): run use-case benchmarks and red-teaming to evaluate for safety and possible harms (e.g. hallucination, toxicity)", "strength": "core", "verified": true, "note": "AI Verify x NIST AI 600-1 crosswalk maps MS-2.3-001 to -004, MS-2.6-007 and MS-2.7-007 (MEASURE 2) to 4.1.1; AI Verify x G7 Code of Conduct crosswalk maps Action 1 to Safety 4.1.1 to 4.8.1.", "url": "https://aiverifyfoundation.sg/tools/ai-verify-testing-framework/", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "robustness-security-evals", "framework": "sg-ai-verify", "frameworkShort": "AI Verify", "column": "aiverify", "reference": "6.1.1", "clauseId": "_6.1.1", "label": "6.1.1", "title": "Robustness (technical test): compare accuracy with and without added noise to document and monitor performance", "strength": "core", "verified": true, "note": "AI Verify x NIST AI 600-1 crosswalk maps MS-2.3-001 (MEASURE 2.3) to 6.1.1.", "url": "https://aiverifyfoundation.sg/tools/ai-verify-testing-framework/", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "robustness-security-evals", "framework": "sg-ai-verify", "frameworkShort": "AI Verify", "column": "aiverify", "reference": "5.2.1", "clauseId": "_5.2.1", "label": "5.2.1", "title": "Security: conduct security risk assessments that model threats and risks to the AI system", "strength": "core", "verified": true, "note": "AI Verify x NIST AI 600-1 crosswalk maps MS-2.7-001, -002, -004 and -009 (MEASURE 2.7) to 5.2.1; AI Verify x G7 Code of Conduct crosswalk maps Action 1 to it.", "url": "https://aiverifyfoundation.sg/tools/ai-verify-testing-framework/", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "robustness-security-evals", "framework": "sg-ai-verify", "frameworkShort": "AI Verify", "column": "aiverify", "reference": "5.9.1", "clauseId": "_5.9.1", "label": "5.9.1", "title": "Security: release AI systems only after appropriate and effective security checks and evaluation", "strength": "related", "verified": true, "note": "AI Verify x NIST AI 600-1 crosswalk maps MS-4.2-001 and -002 to 5.9.1; AI Verify x G7 Code of Conduct crosswalk maps Actions 6.b and 6.c to it.", "url": "https://aiverifyfoundation.sg/tools/ai-verify-testing-framework/", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "incident-monitoring", "framework": "sg-ai-verify", "frameworkShort": "AI Verify", "column": "aiverify", "reference": "9.5.4", "clauseId": "_9.5.4", "label": "9.5.4", "title": "Accountability: enable an incident management process to report and respond to actions or decisions that affect the AI system's outcome", "strength": "core", "verified": true, "note": "Cited by all three 2025 crosswalks: ISO/IEC 42001 A.8 (incl. A.8.4); NIST AI 600-1 MG-4.3-001/003, MG-2.4-002/003 and GV-4.3-002/003; G7 Actions 2.a to 2.c and 4.", "url": "https://aiverifyfoundation.sg/tools/ai-verify-testing-framework/", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "incident-monitoring", "framework": "sg-ai-verify", "frameworkShort": "AI Verify", "column": "aiverify", "reference": "1.5.1", "clauseId": "_1.5.1", "label": "1.5.1", "title": "Transparency: communicate to end users whenever an incident has occurred", "strength": "core", "verified": true, "note": "AI Verify x ISO/IEC 42001 crosswalk maps A.8 (incl. A.8.4 Communication of incidents) to 1.5.1; AI Verify x G7 Code of Conduct crosswalk maps Actions 2.a to 2.c and 4 to it.", "url": "https://aiverifyfoundation.sg/tools/ai-verify-testing-framework/", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "incident-monitoring", "framework": "sg-ai-verify", "frameworkShort": "AI Verify", "column": "aiverify", "reference": "1.6.1", "clauseId": "_1.6.1", "label": "1.6.1", "title": "Transparency: give end users and external parties the means to report adverse impacts, with whistleblower protection", "strength": "related", "verified": true, "note": "AI Verify x ISO/IEC 42001 crosswalk maps A.3 (incl. A.3.3 Reporting of concerns) and A.8 to 1.6.1; AI Verify x G7 Code of Conduct crosswalk maps Actions 2.a to 2.c and 4 to it.", "url": "https://aiverifyfoundation.sg/tools/ai-verify-testing-framework/", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "incident-monitoring", "framework": "sg-ai-verify", "frameworkShort": "AI Verify", "column": "aiverify", "reference": "5.11.1", "clauseId": "_5.11.1", "label": "5.11.1", "title": "Security: monitor AI system outputs and behaviour after deployment and alert system owners to issues", "strength": "related", "verified": true, "note": "AI Verify x NIST AI 600-1 crosswalk maps MS-2.6-005 and -006 to 5.11.1; AI Verify x ISO/IEC 42001 crosswalk maps the A.6.2 group (incl. A.6.2.6 operation and monitoring) to it.", "url": "https://aiverifyfoundation.sg/tools/ai-verify-testing-framework/", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "supply-chain", "framework": "sg-ai-verify", "frameworkShort": "AI Verify", "column": "aiverify", "reference": "9.7.1", "clauseId": "_9.7.1", "label": "9.7.1", "title": "Accountability: clear responsibilities between parties in the supply chain, set in service level agreements and contracts", "strength": "core", "verified": true, "note": "AI Verify x ISO/IEC 42001 crosswalk maps A.10 (Third-party and customer relationships) to 9.7.1; AI Verify x NIST AI 600-1 crosswalk maps MG-3.1-001/002/003/005 (MANAGE 3.1) and GV-6.1 actions to it.", "url": "https://aiverifyfoundation.sg/tools/ai-verify-testing-framework/", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "supply-chain", "framework": "sg-ai-verify", "frameworkShort": "AI Verify", "column": "aiverify", "reference": "5.3.1", "clauseId": "_5.3.1", "label": "5.3.1", "title": "Security: secure the supply chain by assessing and monitoring its security risks across the life cycle", "strength": "core", "verified": true, "note": "AI Verify x NIST AI 600-1 crosswalk maps GV-6.2-001, -003, -004 and -007 (GOVERN 6.2) and GV-6.1-006 to 5.3.1.", "url": "https://aiverifyfoundation.sg/tools/ai-verify-testing-framework/", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "supply-chain", "framework": "sg-ai-verify", "frameworkShort": "AI Verify", "column": "aiverify", "reference": "4.5.2", "clauseId": "_4.5.2", "label": "4.5.2", "title": "Safety: continuously monitor third-party systems, with a fallback plan and contracts that assign liability", "strength": "core", "verified": true, "note": "AI Verify x NIST AI 600-1 crosswalk maps all seven GV-6.2 actions (GOVERN 6.2) to 4.5.2.", "url": "https://aiverifyfoundation.sg/tools/ai-verify-testing-framework/", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "supply-chain", "framework": "sg-ai-verify", "frameworkShort": "AI Verify", "column": "aiverify", "reference": "9.3.1", "clauseId": "_9.3.1", "label": "9.3.1", "title": "Accountability: select AI system suppliers aligned with the organisation's approach, with remedial action when they underperform", "strength": "related", "verified": true, "note": "AI Verify x ISO/IEC 42001 crosswalk maps A.10 and A.9 to 9.3.1.", "url": "https://aiverifyfoundation.sg/tools/ai-verify-testing-framework/", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "fairness-non-discrimination", "framework": "sg-ai-verify", "frameworkShort": "AI Verify", "column": "aiverify", "reference": "7.1.1", "clauseId": "_7.1.1", "label": "7.1.1", "title": "Fairness (technical test): measure algorithmic fairness of predictions against ground truth, with metrics chosen for the sensitive feature", "strength": "core", "verified": true, "note": "AI Verify x G7 Code of Conduct crosswalk maps Action 11 to Fairness 7.1.1 to 7.11.1; technical test for traditional AI.", "url": "https://aiverifyfoundation.sg/tools/ai-verify-testing-framework/", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "fairness-non-discrimination", "framework": "sg-ai-verify", "frameworkShort": "AI Verify", "column": "aiverify", "reference": "7.2.1", "clauseId": "_7.2.1", "label": "7.2.1", "title": "Fairness (technical test): benchmark and red-team for harms against individuals or groups (generative AI)", "strength": "core", "verified": true, "note": "AI Verify x NIST AI 600-1 crosswalk maps MS-2.11-002 (MEASURE 2.11, fairness and bias) to 7.2.1.", "url": "https://aiverifyfoundation.sg/tools/ai-verify-testing-framework/", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "fairness-non-discrimination", "framework": "sg-ai-verify", "frameworkShort": "AI Verify", "column": "aiverify", "reference": "7.8.1", "clauseId": "_7.8.1", "label": "7.8.1", "title": "Fairness: check that training data is representative of the end-user population, resampling or collecting more data where needed", "strength": "related", "verified": true, "note": "AI Verify x NIST AI 600-1 crosswalk maps MS-2.11-004 and -005 (MEASURE 2.11) and GV-1.3-005 to 7.8.1.", "url": "https://aiverifyfoundation.sg/tools/ai-verify-testing-framework/", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "privacy-data-protection", "framework": "sg-ai-verify", "frameworkShort": "AI Verify", "column": "aiverify", "reference": "8.3.1", "clauseId": "_8.3.1", "label": "8.3.1", "title": "Data Governance: data protection, consent, collection, use, withdrawal and retention comply with regulatory requirements or industry standards", "strength": "core", "verified": true, "note": "AI Verify x ISO/IEC 42001 crosswalk maps A.7 to 8.3.1; AI Verify x NIST AI 600-1 crosswalk maps MS-2.2-003 and GV-1.1-001; AI Verify x G7 Code of Conduct crosswalk maps Action 5.a to it and Action 11.c to outcome 8.3.", "url": "https://aiverifyfoundation.sg/tools/ai-verify-testing-framework/", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "privacy-data-protection", "framework": "sg-ai-verify", "frameworkShort": "AI Verify", "column": "aiverify", "reference": "8.3.2", "clauseId": "_8.3.2", "label": "8.3.2", "title": "Data Governance: detect personal or sensitive data in generated output and apply anonymisation and privacy-enhancing technologies", "strength": "core", "verified": true, "note": "AI Verify x NIST AI 600-1 crosswalk maps MS-2.2-004, MP-4.1-009 and MG-2.2-009 to 8.3.2.", "url": "https://aiverifyfoundation.sg/tools/ai-verify-testing-framework/", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "privacy-data-protection", "framework": "sg-ai-verify", "frameworkShort": "AI Verify", "column": "aiverify", "reference": "1.4.1", "clauseId": "_1.4.1", "label": "1.4.1", "title": "Transparency: publish a privacy policy on the use of personal data in the AI system", "strength": "related", "verified": true, "note": "AI Verify x ISO/IEC 42001 crosswalk maps A.8 to 1.4.1; AI Verify x G7 Code of Conduct crosswalk maps Action 11 to it.", "url": "https://aiverifyfoundation.sg/tools/ai-verify-testing-framework/", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "explainability", "framework": "sg-ai-verify", "frameworkShort": "AI Verify", "column": "aiverify", "reference": "2.2.1", "clauseId": "_2.2.1", "label": "2.2.1", "title": "Explainability: document the rationale and trade-offs of a less explainable model and apply explainable AI techniques", "strength": "core", "verified": true, "note": "AI Verify x NIST AI 600-1 crosswalk maps MS-2.9-001 (MEASURE 2.9, explained and interpreted) and MS-4.2-003 to 2.2.1.", "url": "https://aiverifyfoundation.sg/tools/ai-verify-testing-framework/", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "explainability", "framework": "sg-ai-verify", "frameworkShort": "AI Verify", "column": "aiverify", "reference": "1.1.4", "clauseId": "_1.1.4", "label": "1.1.4", "title": "Transparency: tell people using or affected by the system the factors behind a decision and that it was made wholly or partly by an automated system", "strength": "core", "verified": true, "note": "AI Verify x ISO/IEC 42001 crosswalk maps A.8 (incl. A.8.2 information for users) to 1.1.4.", "url": "https://aiverifyfoundation.sg/tools/ai-verify-testing-framework/", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "ai-literacy", "framework": "sg-ai-verify", "frameworkShort": "AI Verify", "column": "aiverify", "reference": "9.5.3", "clauseId": "_9.5.3", "label": "9.5.3", "title": "Accountability: policies, procedures and training so that staff know their duties and the organisation's risk management practices", "strength": "related", "verified": true, "note": "AI Verify x NIST AI 600-1 crosswalk maps GV-1.5-001 to 9.5.3; no row ties it to GOVERN 2.2 or ISO/IEC 42001 7.2, so the fit rests on the check's wording.", "url": "https://aiverifyfoundation.sg/tools/ai-verify-testing-framework/", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "ai-literacy", "framework": "sg-ai-verify", "frameworkShort": "AI Verify", "column": "aiverify", "reference": "5.1.1", "clauseId": "_5.1.1", "label": "5.1.1", "title": "Security: training and guidance on AI security risks for all personnel, including developers, system owners and senior leaders", "strength": "related", "verified": true, "note": "AI Verify x NIST AI 600-1 crosswalk maps MP-3.4-003 (MAP 3.4) and GV-2.1-003 to 5.1.1.", "url": "https://aiverifyfoundation.sg/tools/ai-verify-testing-framework/", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "ai-literacy", "framework": "sg-ai-verify", "frameworkShort": "AI Verify", "column": "aiverify", "reference": "8.4.1", "clauseId": "_8.4.1", "label": "8.4.1", "title": "Data Governance: ensure team competency in data governance roles and responsibilities", "strength": "related", "verified": true, "note": "AI Verify x NIST AI 600-1 crosswalk maps MP-3.4-002 and MP-3.4-003 (MAP 3.4) to 8.4.1.", "url": "https://aiverifyfoundation.sg/tools/ai-verify-testing-framework/", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "gpai-foundation-models", "framework": "sg-ai-verify", "frameworkShort": "AI Verify", "column": "aiverify", "reference": "4.1.1", "clauseId": "_4.1.1", "label": "4.1.1", "title": "Safety (technical test): run benchmarks and red-teaming to evaluate a generative model for safety and possible harms", "strength": "related", "verified": true, "note": "AI Verify x G7 Code of Conduct crosswalk maps Action 1 (advanced AI systems) to Safety 4.1.1 to 4.8.1; AI Verify addresses the deploying organisation, not model-provider duties.", "url": "https://aiverifyfoundation.sg/tools/ai-verify-testing-framework/", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "gpai-foundation-models", "framework": "sg-ai-verify", "frameworkShort": "AI Verify", "column": "aiverify", "reference": "4.8.1", "clauseId": "_4.8.1", "label": "4.8.1", "title": "Safety: identify and prevent content that violates laws or is harmful, including CBRN information and offensive cyber capabilities", "strength": "related", "verified": true, "note": "AI Verify x G7 Code of Conduct crosswalk maps Action 1.c (CBRN, offensive cyber and other risks) to Safety 4.1.1 to 4.8.1.", "url": "https://aiverifyfoundation.sg/tools/ai-verify-testing-framework/", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "ip-copyright", "framework": "sg-ai-verify", "frameworkShort": "AI Verify", "column": "aiverify", "reference": "8.5.1", "clauseId": "_8.5.1", "label": "8.5.1", "title": "Data Governance: address risks from third parties, including infringement of their rights (copyright, intellectual property)", "strength": "core", "verified": true, "note": "AI Verify x NIST AI 600-1 crosswalk maps GV-6.1-001/002 (GOVERN 6.1) and MP-4.1-001/002/006 (MAP 4.1) to 8.5.1; AI Verify x G7 Code of Conduct crosswalk maps Action 11 and AI Verify x ISO/IEC 42001 crosswalk maps A.7 to it.", "url": "https://aiverifyfoundation.sg/tools/ai-verify-testing-framework/", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "ip-copyright", "framework": "sg-ai-verify", "frameworkShort": "AI Verify", "column": "aiverify", "reference": "8.1.1", "clauseId": "_8.1.1", "label": "8.1.1", "title": "Data Governance: verify data quality, including intellectual property and privacy risks", "strength": "related", "verified": true, "note": "AI Verify x NIST AI 600-1 crosswalk maps MP-4.1-004, -005 and -010 (MAP 4.1) to 8.1.1; the check names intellectual property.", "url": "https://aiverifyfoundation.sg/tools/ai-verify-testing-framework/", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "content-provenance", "framework": "sg-ai-verify", "frameworkShort": "AI Verify", "column": "aiverify", "reference": "4.9.1", "clauseId": "_4.9.1", "label": "4.9.1", "title": "Safety: establish policies for content provenance: identify provenance harms such as deepfakes and trace content origin", "strength": "core", "verified": true, "note": "AI Verify x G7 Code of Conduct crosswalk maps Actions 7 and 7.a to 4.9.1; AI Verify x NIST AI 600-1 crosswalk maps GV-6.1-003/008 and MG-2.2-002/003/007 to it.", "url": "https://aiverifyfoundation.sg/tools/ai-verify-testing-framework/", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "content-provenance", "framework": "sg-ai-verify", "frameworkShort": "AI Verify", "column": "aiverify", "reference": "4.9.2", "clauseId": "_4.9.2", "label": "4.9.2", "title": "Safety: evaluate content provenance mechanisms, including the effectiveness and reliability of watermarks", "strength": "core", "verified": true, "note": "AI Verify x G7 Code of Conduct crosswalk maps Actions 7, 7.b and 10 to 4.9.2.", "url": "https://aiverifyfoundation.sg/tools/ai-verify-testing-framework/", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "content-provenance", "framework": "sg-ai-verify", "frameworkShort": "AI Verify", "column": "aiverify", "reference": "1.1.3", "clauseId": "_1.1.3", "label": "1.1.3", "title": "Transparency: labelling or disclaimers so users know when they interact with an AI system and understand content lineage", "strength": "core", "verified": true, "note": "AI Verify x G7 Code of Conduct crosswalk maps Actions 7.d and 10.a to 1.1.3; AI Verify x ISO/IEC 42001 crosswalk maps A.8 to it.", "url": "https://aiverifyfoundation.sg/tools/ai-verify-testing-framework/", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "environmental-impact", "framework": "sg-ai-verify", "frameworkShort": "AI Verify", "column": "aiverify", "reference": "11.1.1", "clauseId": "_11.1.1", "label": "11.1.1", "title": "Inclusive growth, societal and environmental well-being: determine that the AI system benefits the environment (e.g. energy and water use)", "strength": "core", "verified": true, "note": "AI Verify x NIST AI 600-1 crosswalk maps MS-2.12-001 to -004 (MEASURE 2.12, environmental impact) to 11.1.1.", "url": "https://aiverifyfoundation.sg/tools/ai-verify-testing-framework/", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "deployment-change-decommissioning", "framework": "sg-ai-verify", "frameworkShort": "AI Verify", "column": "aiverify", "reference": "9.4.1", "clauseId": "_9.4.1", "label": "9.4.1", "title": "Accountability: a policy to deactivate, decommission and phase out AI systems safely", "strength": "core", "verified": true, "note": "AI Verify x NIST AI 600-1 crosswalk maps GV-1.7-001/002 (GOVERN 1.7) and MG-2.4-001/004 (MANAGE 2.4) to 9.4.1; AI Verify x ISO/IEC 42001 crosswalk maps A.9 and A.4 to it.", "url": "https://aiverifyfoundation.sg/tools/ai-verify-testing-framework/", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "deployment-change-decommissioning", "framework": "sg-ai-verify", "frameworkShort": "AI Verify", "column": "aiverify", "reference": "5.14.1", "clauseId": "_5.14.1", "label": "5.14.1", "title": "Security: proper and secure disposal of data and models", "strength": "core", "verified": true, "note": "AI Verify x NIST AI 600-1 crosswalk maps GV-1.7-002 (GOVERN 1.7, decommissioning) to 5.14.1.", "url": "https://aiverifyfoundation.sg/tools/ai-verify-testing-framework/", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "deployment-change-decommissioning", "framework": "sg-ai-verify", "frameworkShort": "AI Verify", "column": "aiverify", "reference": "6.5.1", "clauseId": "_6.5.1", "label": "6.5.1", "title": "Robustness: review changes in code, input data and output data to decide when a new robustness review is due", "strength": "core", "verified": true, "note": "AI Verify x ISO/IEC 42001 crosswalk maps the A.6.2 group (incl. A.6.2.5 deployment, A.6.2.6 operation) to 6.5.1; AI Verify x G7 Code of Conduct crosswalk maps Action 1 to it.", "url": "https://aiverifyfoundation.sg/tools/ai-verify-testing-framework/", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null }, { "topic": "deployment-change-decommissioning", "framework": "sg-ai-verify", "frameworkShort": "AI Verify", "column": "aiverify", "reference": "4.6.1", "clauseId": "_4.6.1", "label": "4.6.1", "title": "Safety: deployment strategies such as blue-green and canary deployments", "strength": "related", "verified": true, "note": "AI Verify x ISO/IEC 42001 crosswalk maps the A.6.2 group (incl. A.6.2.5 deployment) to 4.6.1.", "url": "https://aiverifyfoundation.sg/tools/ai-verify-testing-framework/", "obligation": null, "chapter": null, "obligationId": null, "obligationUrl": null, "see": null } ] }