AI Governance & Assurance
Sources & scopeView overview diagram
Research focusPractical human authority, intervention and evidence of effect.
The branches overlap. They organize areas to examine, rather than prescribe a universal sequence or establish compliance.
All areas
No matching topics
Try a broader term or reset the filters.
Explore the knowledge map
01Regulation, rights and obligations
Requirements depend on jurisdiction, activity, actor and the people affected. These selected references organize questions for further examination; they do not determine an institution’s legal obligations.
Enactment, effective dates and the start of individual duties are distinct. Selected state and local records show verified dates and their limits. Coverage is scoped to the listed instruments; the U.S. register identifies jurisdictions awaiting review.
United States / Federal
U.S. consumer protectionlaw
Consumer-protection rules can apply to claims and conduct involving AI products and services. The Federal Trade Commission Act addresses unfair or deceptive acts and practices within the Commission’s jurisdiction.
What evidence supports the claims made to customers about this system?
Coverage depends on the conduct, entity and statutory jurisdiction; an AI label does not decide the legal analysis.
United States · Federal Trade Commission Act, Section 5 · Enacted law
Employment equality and disabilitylaw and agency guidance
Employment decisions involving software or AI remain subject to applicable discrimination laws. Disability-related questions include whether a tool excludes qualified people or prevents them from receiving an appropriate accommodation.
Can a person challenge a technology-assisted employment decision and obtain an accessible review?
Different statutes cover different employers, people and decisions. The listed resources do not determine whether a particular decision was discriminatory.
United States · Federal employment discrimination laws; EEOC AI and ADA resources · Enacted laws; agency explanatory resources
United States / Sector
Credit decisions and reasonslaw and regulation
Credit rules address discrimination and notification of adverse action. Where specific reasons are required, a qualifying-score label alone is insufficient; the explanation must relate to the actual decision factors.
Can the creditor reconstruct and accurately explain the principal reasons for the adverse decision?
Notice requirements vary with the transaction and applicant. This topic describes selected credit rules, not all financial-services obligations.
United States / Credit · Equal Credit Opportunity Act; Regulation B, 12 CFR 1002.9 · Enacted law and regulation
Medical-device softwareguidance and draft guidance
FDA guidance distinguishes software functions subject to device oversight from other functions. Its AI lifecycle draft describes proposed documentation and risk-management recommendations for AI-enabled devices.
What intended use, operating conditions and evidence support the device function being examined?
Whether software is a medical device depends on its function and intended use. The AI lifecycle draft is not a binding rule or a completed approval of any product.
United States / Medical devices · FDA software policy (2022); AI lifecycle draft guidance (January 2025) · Final nonbinding software guidance; AI lifecycle document remains draft and not for implementation
United States / State
California privacy and automated decisionslaw and adopted regulations
California’s privacy framework includes adopted rules on specified uses of automated decisionmaking technology, risk assessments and cybersecurity audits. It connects data practices with consumer information and choices.
Which personal data and automated decisions are covered, and how would the business respond to a valid request?
Coverage, exceptions and compliance schedules differ across provisions. These rules do not apply identically to every business or every use of AI.
- Jurisdiction
- California, United States
- Instrument
- CCPA; CPPA 2025 adopted ADMT, risk-assessment and cybersecurity regulations
- Status
- Enacted law and effective regulations; compliance dates vary
- Effective dates & deadlines
- 2025 regulations effective 1 January 2026; ADMT compliance from 1 January 2027; initial cybersecurity audit reports staggered across 2028–2030
California: employment decision systemsregulation
These regulations clarify how employment discrimination protections apply to automated decision systems. They address protected-characteristic discrimination, disability-related inquiries and retention of relevant employment records, including automated-decision data, for at least four years.
Can retained records show how the system affected the employment decision and support examination of discrimination concerns?
This entry concerns the 2025 employment regulations, not the separate CCPA automated-decision rules or all subsequently enacted employment AI laws. Covered entities and particular records require a scoped assessment.
- Jurisdiction
- California, United States
- Instrument
- Civil Rights Council automated-decision-system regulations under FEHA; approved 27 June 2025
- Status
- Adopted regulation; effective
- Effective dates & deadlines
- 1 October 2025
California: frontier-model transparencylaw
Large frontier developers must implement and publish a framework addressing catastrophic risk. The framework covers matters including risk thresholds, mitigations, incident response and internal model use. The law also protects specified employee disclosures about catastrophic risk or violations.
What evidence connects the published framework to risk assessments, mitigations and the handling of reported concerns?
Frontier models, large frontier developers, catastrophic risks and covered employees are defined categories. Publishing a framework does not establish that a model is safe for every application.
- Jurisdiction
- California, United States
- Instrument
- SB53 (2025), Transparency in Frontier Artificial Intelligence Act; Business & Professions Code section 22757.10 et seq.
- Status
- Enacted law; effective
- Effective dates & deadlines
- 1 January 2026; particular reporting and review deadlines are separate
California: companion-chatbot safeguardslaw
California requires covered companion-chatbot operators to identify AI when users could reasonably mistake it for a human and maintain published protocols addressing suicide and self-harm. Current protections for known minors include AI disclosure, break reminders and sexual-content safeguards. A 2026 amendment establishes a broader child-safety regime with core duties operative in July 2027.
Can users recognize a simulated relationship, step away and reach human crisis support, and what evidence documents those safeguards?
The definition and qualified business-use, game and voice-assistant exclusions determine coverage. Current three-hour reminders concern known minors during continuing interactions. These provisions do not create a universal human-review or override right. SB1119 changes the known-minor provisions and adds requirements with separate operative dates; the current and forthcoming regimes must be read separately.
- Jurisdiction
- California, United States
- Instrument
- SB243 (2025), chapter 677, Business & Professions Code §§22601–22605; SB1119 (2026), chapter 190, amendment and Adam’s Law
- Status
- Current safeguards effective; further child-safety requirements enacted with later dates.
- Effective dates & deadlines
- SB243 effective 1 January 2026; annual Office of Suicide Prevention reporting begins 1 July 2027. SB1119 effective 1 January 2027; core child duties in §§21812, 21812.5 and 21813 operative 1 July 2027. Audit provisions have later and conditional deadlines.
Colorado: consequential decisionslaw
Colorado’s 2026 law addresses automated technology that materially influences specified consequential decisions. Its provisions cover documentation, consumer notices, data correction and requests for human review after adverse outcomes.
What information would let a person understand the technology’s role and request a meaningful reconsideration?
Definitions, exemptions, implementing rules and the timing of individual duties matter. The 2024 law alone is not a current account of this framework.
- Jurisdiction
- Colorado, United States
- Instrument
- SB26-189, Automated Decision-Making Technology (2026)
- Status
- Enacted law; act effective, specified duties begin later
- Effective dates & deadlines
- Act effective 14 May 2026; developer documentation duties begin 1 January 2027; other provisions retain their own timing
Colorado: AI-assisted health-care reviewlaw
Colorado’s enacted law sets conditions for AI-assisted utilization review. It requires retained audit records and disclosures of human oversight arrangements. A carrier’s denial based on medical necessity cannot rest solely on AI output without review and approval by a competent regulated professional and review of coverage terms.
What evidence would show that a qualified reviewer examined the patient’s circumstances and could change a proposed denial before it was issued?
This entry covers selected utilization-review provisions in the enacted text, not the broader introduced bill. Relevant entity definitions and coverage terms matter. The research question is an editorial connection to practical human control, not a claim that TAE, HIT or CEC establishes compliance.
- Jurisdiction
- Colorado, United States
- Instrument
- HB26-1139 (2026), Chapter 325; section 2 adds C.R.S. 10-16-112.7
- Status
- Enacted; not yet effective as of 8 October 2026
- Effective dates & deadlines
- Scheduled for 1 January 2027; section 4 contains a referendum contingency and applies the act to actions on or after the applicable effective date.
Colorado: AI use in psychotherapylaw
Colorado’s law requires synchronous, real-time participation by the regulated professional during AI therapeutic communication and professional review and approval of AI-generated therapeutic recommendations or treatment plans. AI recording or transcription requires advance written disclosure and written consent; refusal or withdrawal cannot be grounds to deny psychotherapy services.
What evidence distinguishes active professional participation from later review, and shows that refusing or withdrawing recording consent changed system behavior?
The recording and transcription consent rule is specific to those uses. Educational, research, wellness and certain FDA-authorized uses have defined conditions or exceptions. The enacted text also restricts misleading claims about professional equivalence and therapist-like confidentiality.
- Jurisdiction
- Colorado, United States
- Instrument
- HB26-1195 (2026), Chapter 358; C.R.S. 12-245-224.5 and 6-1-1705.2
- Status
- Enacted law; effective date listed as 12 August 2026
- Effective dates & deadlines
- Signed 3 June 2026; effective date listed as 12 August 2026, subject to the section 4 referendum contingency. The act applies to actions on or after the applicable effective date.
Colorado: conversational AI safeguardslaw
Colorado’s law establishes duties for covered conversational AI operators, including AI disclosures, crisis referral and escalation protocols, and restrictions on claims of professional equivalence. It also specifies safeguards for minors concerning sexual content, emotional dependence, engagement rewards and privacy controls.
What records would show that disclosures, crisis escalation and protections for minors operated during actual interactions?
Coverage depends on statutory definitions and exclusions, including specified enterprise, research, transactional, health-care and educational uses. The age-estimation wording precedes the January 2027 clause; the later date should not be applied to every duty. Proposed implementing rules require a separate status check.
- Jurisdiction
- Colorado, United States
- Instrument
- HB26-1263 (2026), Chapter 208; C.R.S. 6-1-1701 and 6-1-1708
- Status
- Enacted law; act effective, specified duties begin later
- Effective dates & deadlines
- Signed 29 May 2026; act effective date listed as 12 August 2026, subject to the section 3 referendum contingency. Specified operator duties begin 1 January 2027; annual reporting begins 1 July 2027.
Connecticut: automated employment decisionslaw
The selected provisions address automated technology that materially influences employment decisions. They provide for developer information and notices to employees or applicants. Using the technology is not a defense to discrimination claims; the quality of anti-bias testing and the response to its results may be considered.
What connects the notice, the system’s actual role in the decision and the institution’s response to testing findings?
Employment decisions, developers, deployers and substantial influence are defined terms with exclusions. These sections do not create a general right to override every automated decision. The act’s effective date must be distinguished from the later start of specified duties.
- Jurisdiction
- Connecticut, United States
- Instrument
- Public Act 26-15 (2026), sections 7–14; broader act subsequently amended by Public Act 26-100
- Status
- Enacted law; selected provisions effective, specified deployment duties begin later
- Effective dates & deadlines
- Sections 7–14 effective 1 October 2026; sections 8–10 information and notice duties apply to deployments on or after 1 October 2027
Illinois: AI in employment decisionslaw
The amendment addresses employer AI use that subjects employees to discrimination on protected grounds, and the use of ZIP codes as a protected-class proxy. It also requires notice of AI use for specified employment purposes.
Can the employer trace the tool’s role, examine discriminatory effects and show that required notice was provided?
Coverage follows the Human Rights Act and specified employment activities. Notice implementation is subject to agency rulemaking. This statute does not create a universal human-review or override requirement.
- Jurisdiction
- Illinois, United States
- Instrument
- Illinois Human Rights Act, Public Act 103-0804 (HB3773)
- Status
- Enacted law; effective
- Effective dates & deadlines
- 1 January 2026.
Illinois: AI support in psychological serviceslaw
The act restricts AI use in therapy and psychotherapy. Licensed professionals retain responsibility for permitted support; AI cannot independently make therapeutic decisions or directly conduct therapeutic communication. AI recommendations and treatment plans require professional review and approval.
Can records show the professional’s review, responsibility and consent arrangements for the permitted support function?
The act defines covered services and professionals. Additional restrictions concern emotion or mental-state detection and consent for recording or transcription used in supplementary support; this is not a blanket rule for all health software.
- Jurisdiction
- Illinois, United States
- Instrument
- Wellness and Oversight for Psychological Resources Act, Public Act 104-0054 (HB1806)
- Status
- Enacted law; effective
- Effective dates & deadlines
- 1 August 2025.
Illinois: AI video interviewslaw
For covered recorded interviews, employers must explain AI use and obtain consent before assessment. The act restricts video sharing, provides deletion on request and requires demographic reporting where AI alone selects applicants for an in-person interview.
Can an applicant understand the use, withhold consent and obtain deletion across every recipient of the interview?
The act concerns AI analysis of applicant-submitted videos for Illinois-based positions. Sole reliance on AI for in-person interview selection triggers reporting; the act does not categorically prohibit that reliance.
- Jurisdiction
- Illinois, United States
- Instrument
- Artificial Intelligence Video Interview Act, 820 ILCS 42
- Status
- Enacted law; effective
- Effective dates & deadlines
- 1 January 2020; demographic-reporting provisions effective 1 January 2022.
Illinois: biometric information privacylaw
BIPA sets requirements for covered private entities collecting or holding biometric identifiers and information. Selected duties address written notice and release, retention and destruction policies, disclosure restrictions and safeguards for storage and transmission.
What evidence connects consent and stated purpose to collection, access, onward disclosure and actual deletion?
Statutory definitions and exclusions determine coverage; not all images, identity data or AI uses are covered biometrics. This is a biometric-privacy law, not a general AI-governance act.
- Jurisdiction
- Illinois, United States
- Instrument
- Biometric Information Privacy Act (BIPA), 740 ILCS 14; selected §15 duties
- Status
- Enacted law; effective
- Effective dates & deadlines
- 3 October 2008 for the selected retention, collection and disclosure duties.
Illinois: frontier-model safety and auditslaw
The act establishes frontier-model transparency, catastrophic-risk framework and incident-reporting requirements. It adds an annual independent audit requirement for covered large frontier developers, with access, competence and financial-independence conditions.
Can an independent auditor inspect the evidence needed to assess whether the developer follows its published framework?
Model and developer thresholds limit coverage. The act’s general effective date differs from the start of framework and audit duties; it should not be presented as an audit obligation already in force.
- Jurisdiction
- Illinois, United States
- Instrument
- Artificial Intelligence Safety Measures Act, Public Act 104-0538 (SB315)
- Status
- Enacted; future commencement and phased duties
- Effective dates & deadlines
- Act effective 1 January 2027; framework duties begin 1 January 2028. Independent audits begin then or 90 days after qualifying as a large frontier developer, whichever is later.
Minnesota: profiling and reevaluationlaw
Consumers have specified rights concerning profiling used for decisions with legal or similarly significant effects. They may contest the outcome, obtain its reason and examine relevant personal data. Where inaccurate data determined the decision, correction and reevaluation are available.
Did correcting the data produce a reevaluation, and what evidence establishes the resulting effect?
The act’s coverage thresholds, exclusions and consumer definition apply. These rights do not apply identically to every employment or service decision merely because profiling is involved.
- Jurisdiction
- Minnesota, United States
- Instrument
- Minnesota Consumer Data Privacy Act (2024)
- Status
- Enacted law; effective
- Effective dates & deadlines
- 31 July 2025
New York: agency AI inventory and disclosurelaw
New York requires a state-agency AI inventory and agency publication of lists describing automated employment decision tools. The inventory concerns AI systems that directly impact the public; specified information may be withheld for security or public-records reasons.
Does the published inventory reflect the systems actually used, their purposes and changes in use?
This entry concerns state agencies, not a general private-sector mandate. The 2025 amendment replaced the earlier impact-assessment and meaningful-human-review provisions; those removed provisions should not be treated as current duties.
- Jurisdiction
- New York State, United States
- Instrument
- State Technology Law §§103-e and 402; 2025 chapter 96 (S822)
- Status
- Enacted law; effective
- Effective dates & deadlines
- 1 July 2025; annual publication is specified for 30 December.
New York: frontier-model transparencylaw
The amended RAISE Act establishes frontier-developer transparency and critical-incident reporting requirements. Large frontier developers must implement and publish a framework addressing catastrophic risk, assessments, mitigations, deployment decisions and internal governance.
What evidence would show that published safeguards informed deployment decisions and that an incident reached the responsible authority?
Coverage depends on the statutory model and developer definitions and the New York connection. Academic-research and other specified exceptions apply. Publication alone does not establish effective control.
- Jurisdiction
- New York State, United States
- Instrument
- RAISE Act, General Business Law Article 44-B; 2026 chapter 96 (S8828), amending 2025 chapter 699
- Status
- Enacted; substantive framework not yet effective
- Effective dates & deadlines
- 1 January 2027; the 2026 amendment replaces the original commencement schedule.
New York: AI companion safeguardslaw
New York requires covered AI companion operators to provide clear, conspicuous notices that users are not communicating with a human and reasonable-efforts protocols for detecting self-harm or suicidal ideation and directing users to crisis services. Notices are provided at interaction start, need not exceed once daily for those initial notices, and recur at least every three hours during continuing interactions.
What evidence shows that users understand the companion’s nonhuman nature and receive an appropriate crisis referral when risk appears during a sustained conversation?
Coverage concerns defined companions for personal use in New York, with exclusions for specified customer-service, research, technical-assistance and internal-business systems. Article 47 does not require a staffed human handoff or guarantee detection. Separate Safe by Design provisions (§1540(7)) require age assurance before covered users can access integrated companions on covered platforms, and disable access by default for covered minors, subject to parental override, from 1 January 2027. S9051B is a separate proposal, not part of the enacted duties described here.
- Jurisdiction
- New York State, United States
- Instrument
- General Business Law Article 47 (§§1700–1704); Laws 2025, chapter 58, Part U (S3008C)
- Status
- Enacted law; effective. Separate platform duties begin in 2027.
- Effective dates & deadlines
- Article 47 effective 5 November 2025. Separate Safe by Design platform duties under Laws 2026, chapter 58, Part Y (A10008C) take effect 1 January 2027. The statute website’s revision date is not the commencement date.
- New York: companion definition and exclusions, §1700
- New York: crisis protocols, §1701
- New York: nonhuman-interaction notices, §1702
- Enacted 2025 budget: chapter 58, Part U
- New York Governor: 5 November 2025 commencement
- Enacted 2026 budget: chapter 58, Part Y (A10008C)
- Separate forthcoming platform controls: §1540, effective January 2027
- Separate proposal: S9051B status
Texas: AI uses and disclosureslaw
TRAIGA sets disclosure requirements for specified government and healthcare uses, prohibits specified AI practices and provides for enforcement by the Attorney General. It also establishes a regulatory sandbox program with defined admission and operating conditions.
What records show that the relevant disclosure reached the person and that the system stayed within its permitted use?
Requirements depend on the actor and use. The discrimination prohibition has an intent requirement; disparate impact alone does not establish that intent. A research sandbox is not automatically a participant in the statutory program.
- Jurisdiction
- Texas, United States
- Instrument
- HB149 (2025), Texas Responsible Artificial Intelligence Governance Act; Business & Commerce Code Chapter 552
- Status
- Enacted law; effective
- Effective dates & deadlines
- 1 January 2026
Utah: mental-health chatbotslaw
Suppliers of covered mental-health chatbots must disclose that the service is AI rather than a human. The law specifies disclosure points and also limits certain sharing of users’ information and advertising practices.
Can the retained record establish that the required disclosure appeared at the relevant point in the interaction?
This entry covers the mental-health-chatbot provisions, not every Utah AI law. The defined chatbot, supplier and Utah-user scope matters. A disclosure does not establish clinical effectiveness or confer professional licensure.
- Jurisdiction
- Utah, United States
- Instrument
- Utah Code Title 13, Chapter 72a, Part 2; HB452 (2025)
- Status
- Enacted law; effective
- Effective dates & deadlines
- 7 May 2025 for the Part 2 provisions described here
Virginia: profiling and privacy requestslaw
The act provides an opt-out right for profiling used in decisions with legal or similarly significant effects. Controllers must also provide an appeal process when they decline to act on a consumer’s request to exercise statutory data rights.
Can the institution show that an eligible opt-out request was implemented and a refused request could be appealed?
An appeal of a refused privacy request is not a universal appeal of the underlying automated decision. Coverage thresholds, entity and data exclusions, and the consumer definition must be examined.
- Jurisdiction
- Virginia, United States
- Instrument
- Consumer Data Protection Act; Virginia Code section 59.1-577
- Status
- Enacted law; effective
- Effective dates & deadlines
- 1 January 2023 for the original act; this entry uses the current section 59.1-577
Wisconsin: AI disclosure in political communicationslaw
Covered political audio and video communications containing synthetic media substantially produced using generative AI require disclosures. The provisions concern specified advocacy and referendum communications.
Does the published communication retain the required disclosure, and can its production and distribution be reconstructed?
This is a targeted political-communications law, not a comprehensive enterprise AI framework. The medium, content and statutory definitions determine the disclosure required.
- Jurisdiction
- Wisconsin, United States
- Instrument
- 2023 Wisconsin Act 123; Wis. Stat. §11.1303(2m)
- Status
- Enacted law; effective
- Effective dates & deadlines
- 23 March 2024.
Wisconsin: insurance AI governance guidanceguidance
The bulletin sets expectations for insurers’ written AI-system programs, accountability, risk controls, validation, monitoring and third-party oversight. It describes evidence OCI may request when examining AI-supported insurance decisions.
Can the insurer produce evidence that its AI program, testing and vendor oversight operate in the decisions under examination?
The bulletin explains regulatory expectations under existing insurance laws and permits alternative ways to demonstrate compliance. It is guidance, not a new AI statute or a requirement for one prescribed documentation format.
- Jurisdiction
- Wisconsin, United States
- Instrument
- Office of the Commissioner of Insurance bulletin, The Use of Artificial Intelligence Systems in Insurance, 18 March 2025
- Status
- Issued regulator guidance under existing insurance law
- Effective dates & deadlines
- Bulletin issued 18 March 2025; it does not establish a separate statutory commencement date.
United States / Local
New York City: employment-tool bias auditslaw
Covered employers and employment agencies must obtain an independent bias audit before using an automated employment decision tool, keep the audit within the required annual period, publish audit information and give required notices to affected candidates or employees.
Which tool and use did the audit examine, and can an affected person find the relevant audit information and notice?
This is a New York City requirement for defined hiring and promotion tools, not a statewide rule or a general certification that an AI system is fair. The city rules and definitions determine coverage.
- Jurisdiction
- New York City, New York, United States
- Instrument
- Local Law 144 of 2021; NYC automated employment decision tool requirements
- Status
- Enacted city law; enforcement underway
- Effective dates & deadlines
- Law effective 1 January 2023; city enforcement began 5 July 2023.
European Union / AI Act
Prohibited AI practiceslaw
The AI Act prohibits specified practices involving manipulation, exploitation, social scoring and certain biometric or other uses. The precise conditions and exceptions determine the scope of each prohibition.
Does the intended use fall within a prohibited practice before any control or assurance claim is considered?
Consult the current article and relevant exceptions. A general risk score or a successful test cannot authorize a prohibited use.
European Union · Regulation (EU) 2024/1689; consolidated text 27 July 2026 · Enacted regulation; provision-specific application
High-risk systems and requirementslaw
High-risk classification depends on specified product and use-case criteria. Relevant requirements include risk management, data governance, documentation, logging, oversight, accuracy, robustness and cybersecurity.
What classification applies to this use, and which evidence would support the relevant requirements?
Not every consequential use of AI is automatically classified as high-risk. Article 6, the annexes, exceptions and applicable transition provisions require review.
European Union · Regulation (EU) 2024/1689; consolidated text 27 July 2026 · Enacted regulation; provision-specific application
Transparency and generated contentlaw
Article 50 addresses information about certain AI interactions and generated or manipulated content. Different duties apply to providers and deployers, with specific exceptions.
Would an affected person receive the relevant information in a form they can notice and understand?
Not every AI use or piece of assisted content has the same disclosure duty. The type of interaction, content, actor and exception matters.
European Union · Regulation (EU) 2024/1689; consolidated text 27 July 2026 · Enacted regulation; provision-specific application
General-purpose AI modelslaw
The Act sets provider obligations for general-purpose AI models, including documentation, downstream information and copyright-related measures. Models classified as presenting systemic risk have additional obligations.
What information does a downstream institution need about the model’s capabilities, limits and relevant risks?
General-purpose AI is a defined regulatory category; it does not mean artificial general intelligence. Provider roles, exemptions and systemic-risk classification require separate examination.
European Union · Regulation (EU) 2024/1689; consolidated text 27 July 2026 · Enacted regulation; provision-specific application
Responsibilities across the value chainlaw
The Act assigns different responsibilities to providers, deployers and other actors. Rebranding, substantial modification or a changed intended purpose can alter the responsible legal role.
Who is responsible for this version and use, and who can supply the information needed to examine it?
A supplier contract or an internal job title does not by itself settle the statutory role. Article 25 addresses specified value-chain circumstances.
European Union · Regulation (EU) 2024/1689; consolidated text 27 July 2026 · Enacted regulation; provision-specific application
European Union / AI Act / High-risk systems
Human oversightlaw
Article 14 addresses oversight of high-risk AI systems, including understanding limitations, interpreting outputs and intervening as appropriate. Oversight measures relate to the system’s risks, autonomy and context.
What evidence shows that a reviewer could use their authority, and what happened when they tried?
This is a scoped legal provision, not a universal requirement to put a person behind every AI output. Node & Norm’s research questions do not establish legal conformity.
European Union · Regulation (EU) 2024/1689; consolidated text 27 July 2026 · Enacted regulation; provision-specific application
Related risks & investigation questions
Loss of human agency and autonomy
A formal right to review is worth examining alongside the practical opportunity to question or redirect an AI-assisted decision. This is a research connection, not a legal interpretation of the MIT category.
Question to test Could an authorized reviewer examine the relevant evidence and act before the consequential step?
Evidence to examine
- The information and alternatives available at the review checkpoint.
- The reviewer’s authority, timing and observable opportunity to intervene.
Informs TAE
MIT risk record 06.12.00 · 5.2 > Loss of human agency and autonomy
A framework for ethical Ai at the United Nations, p. 10. Source workbook.
These editorial connections identify questions to investigate. They do not establish a legal duty, validate TAE or HIT, or make imported records admissible CEC evidence.
Mapping checked 2026-10-08. MIT metadata: CC BY 4.0. Investigation questions and connections: node&norm.
Related obligations / Privacy
Personal data and automated decisionslaw
Data-protection duties can apply to the personal data used in an AI workflow. The GDPR also addresses certain decisions based solely on automated processing that produce legal or similarly significant effects.
What data supports the decision, and which information, correction or challenge rights apply to the person affected?
Article 22 has defined conditions, exceptions and safeguards; it is not a general prohibition on all automated decisions. Other data-protection duties can apply even when Article 22 does not.
European Union · General Data Protection Regulation, Regulation (EU) 2016/679; Article 22 and related rights · Enacted regulation
Related obligations / Cybersecurity
Cybersecurity of covered organizationsdirective
NIS2 addresses cybersecurity risk management and incident reporting for covered organizations and sectors. Supply-chain security and vulnerability management can affect the systems on which an AI workflow relies.
Can the institution identify a relevant cyber incident, contain its effects and preserve an accountable response?
Coverage depends on sector, entity characteristics and national implementation. NIS2 is not an AI-specific assurance standard.
European Union and national implementing laws · NIS2, Directive (EU) 2022/2555 · Adopted directive; national implementation matters
Cybersecurity of digital productslaw
The Cyber Resilience Act addresses cybersecurity of covered hardware and software products with digital elements. It connects product design and maintenance with vulnerability handling and supporting information.
What evidence supports the product’s security claims and the handling of vulnerabilities over its support period?
Product scope, exclusions, actor responsibilities and transition provisions matter. Inclusion here does not mean every AI service falls within the Act.
European Union · Cyber Resilience Act, Regulation (EU) 2024/2847 · Enacted regulation; phased application
Selected other jurisdictions / AI laws
Republic of Korea: AI Basic Actlaw
Korea’s AI Basic Act combines support for AI development with rules concerning transparency, safety and high-impact AI. Its implementing framework distinguishes the circumstances and actors to which particular duties apply.
What use category applies, and what information and oversight arrangements need examination?
Use the current Korean instruments and implementing guidance for an applicability decision. Terms such as high-impact should not be assumed equivalent to EU high-risk classifications.
Republic of Korea · AI Basic Act and Enforcement Decree (2026) · Enacted law and decree
China: generative AI servicesregulation
The measures address generative AI services offered to the public within China, including data practices, service responsibilities and complaint handling. Their scope differs from a general framework for every internal AI activity.
Who provides the service, to which public, and what evidence supports its data and service practices?
The measures distinguish public-facing services from research and uses not offered to the domestic public. Other applicable Chinese laws and later measures require separate review.
China · Interim Measures for the Management of Generative AI Services, Order No. 15 (2023) · Adopted regulatory measures
Japan: AI development and uselaw
Japan’s AI law organizes promotion of AI research and use alongside attention to risks. It defines governmental and stakeholder responsibilities and provides for policy coordination and guidance.
How do responsibilities and relevant guidance translate into the way this institution develops or uses AI?
The law’s promotion-and-governance approach should not be presented as the same risk-classification regime used elsewhere. Existing laws and sector guidance remain relevant.
Japan · Act No. 53 of 2025: promotion of AI-related technology research, development and use · Enacted law
Selected other jurisdictions / Privacy
India: digital personal datalaw and rules
India’s digital-personal-data framework addresses lawful processing, organizational responsibilities and individuals’ rights. It provides relevant context when an AI workflow collects or uses covered personal data.
What personal data is needed, who is responsible for it, and how can a person exercise an applicable right?
The law and rules have scope conditions, exemptions and phased provisions. Their existence does not establish that every duty applies to every AI activity.
India · Digital Personal Data Protection Act 2023; DPDP Rules 2025 · Enacted law and notified rules; phased implementation
Brazil: data protection and reviewlaw
Brazil’s LGPD governs covered processing of personal data and provides rights for affected people. Those rights include requesting review of decisions made solely through automated personal-data processing that affect their interests.
What record would let a person understand and contest a covered automated decision?
The right to request review should not be relabeled as a universal guarantee of human review. Scope, exceptions and regulator guidance require examination.
Brazil · Lei Geral de Proteção de Dados Pessoais, Law 13.709/2018, as amended · Enacted law
Institutional commitments
Procurement, contracts and stated purposesresearch context
An institution may set requirements through purchasing terms, supplier agreements and its stated purpose for using a system. Those commitments help identify the records, access and responsibilities needed to examine its use.
What did the institution and its suppliers commit to, and what evidence could show whether those commitments were met?
This topic concerns commitments to examine, rather than a single law. The terms of a particular agreement, applicable law and responsible parties determine its effect. A supplier assurance does not by itself establish that a control worked.
02Standards, principles and guidance
These references help institutions organize management, risk, impact and security work. Their purposes and authority differ. A named standard or principle does not establish that a particular system performs as intended.
ISO descriptions here use public abstracts. Requirements and conformance assessments depend on the applicable edition and full text.
Management, risk and impact
AI management systems · ISO/IEC 42001:2023standard
An international standard for establishing, operating and improving an organization's AI management system. It concerns organizational arrangements around AI development or use; it is not a test of a particular system's effectiveness.
What evidence shows that the organization's AI responsibilities and review processes operate in practice?
AI risk management · ISO/IEC 23894:2023standard
An international standard providing guidance for integrating AI risk management into an organization's activities. Its application depends on the organization and the context in which AI is developed, supplied or used.
Which risks arise in this use, who addresses them, and what evidence supports the response?
AI impact assessment · ISO/IEC 42005:2025standard
An international standard providing guidance on assessing AI systems' potential effects on individuals, groups and society. Its public overview describes identifying, evaluating and documenting impacts across the system lifecycle.
Whose interests could be affected, and what changes when new evidence of impact emerges?
AI Risk Management Framework · NIST AI RMF 1.0guidance
Voluntary guidance organized around Govern, Map, Measure and Manage. These functions support continuing risk management rather than a fixed checklist. This entry refers to the January 2023 edition; NIST reports that a revision is in progress.
How do the identified risks, evaluation findings and management decisions connect for this use?
Generative AI risk profile · NIST AI 600-1guidance
A July 2024 companion to AI RMF 1.0 addressing generative AI risks and suggested management actions. It helps organizations adapt the framework to a particular use; it does not establish that a model or application is safe.
Which generative AI risks matter in this deployment, and what evidence supports the chosen controls?
Language, rights and principles
Shared AI terminology · ISO/IEC 22989:2022standard
An international standard defining AI terminology and describing concepts to support communication across organizations and disciplines. Shared terms help readers identify the system, actors and activities under discussion.
Are the people examining this decision using the same terms for the system and its activities?
Trustworthy AI principles · OECDprinciples
Intergovernmental principles, adopted in 2019 and updated in May 2024, address human rights, fairness, transparency, safety and accountability alongside inclusive growth. They guide AI actors and inform public policy; this entry does not identify a directly applicable law.
How can affected people understand, question and seek an accountable response to this AI use?
Ethics of AI · UNESCO Recommendationprinciples
Adopted in 2021, this ethical and policy recommendation places human rights and dignity at the center of AI governance. It addresses human oversight, accountability, inclusion and environmental effects across the AI lifecycle.
Whose rights and dignity are at stake, and who remains responsible for responding to harm?
Security and identity
LLM application security risks · OWASP Top 10 (2025)guidance
Community security guidance describing common risks in applications using large language models, including prompt injection, sensitive information disclosure and excessive agency. The list helps frame application-specific testing; it is not a complete security assessment.
Can untrusted input cause the application to disclose information or act beyond its intended authority?
Adversarial threat knowledge · MITRE ATLASthreat knowledge
A living knowledge base of adversary tactics and techniques involving AI, informed by observed attacks and realistic demonstrations. Its cases can help select threat scenarios for examination; a listed technique does not establish exposure in every system.
Which documented attack paths are plausible here, and what evidence tests the relevant defenses?
Digital identity · NIST SP 800-63-4guidance
The July 2025 guidelines set technical requirements and recommendations for user identity proofing, authentication and federation in their stated government-system scope. Establishing a user's identity is distinct from deciding what that user may authorize; this is not a complete agent-identity framework.
Whose identity was established, by what assurance process, and what separate authority governed the action?
Information security management · ISO/IEC 27001:2022standard
An international standard specifying requirements for an information security management system. Its scope includes managing risks to information confidentiality, integrity and availability. It provides relevant security context for AI without replacing AI-specific evaluation or privacy obligations.
What protects the decision's data and records from unauthorized access, alteration or loss?
03Roles and decision authority
Explore who sets the purpose, makes decisions, examines concerns and can authorize a response.
A role on paper does not establish practical authority. Legal role definitions depend on the relevant instrument and context.
Organizational responsibility
Leadership and accountable ownershipresearch topic
Examine who sets the purpose, accepts risks and remains answerable for the use. Identify how leadership, governance boards and system or model owners divide decisions.
Who must act when a concern exceeds the system owner’s authority?
Organizational responsibility must be examined in context; naming an owner is not evidence of effective oversight.
Related risks & investigation questions
Diffusion of responsibility
A workflow crossing teams or suppliers can leave authority and correction duties unclear. A bounded test can trace who could act and whether a correction reached the affected outcome.
Question to test Who had authority at each boundary, and where did the ability to intervene or repair stop?
Evidence to examine
- Delegation, escalation and responsibility records for the examined workflow.
- Separate evidence of internal acknowledgments and downstream effects.
MIT risk record 01.01.00 · 6.5 > Governance failure
TASRA: a Taxonomy and Analysis of Societal-Scale Risks from AI, p. 3. Source workbook.
These editorial connections identify questions to investigate. They do not establish a legal duty, validate TAE or HIT, or make imported records admissible CEC evidence.
Mapping checked 2026-10-08. MIT metadata: CC BY 4.0. Investigation questions and connections: node&norm.
Domain specialists and frontline usersresearch topic
Examine the expertise, information and working conditions of the people using AI in a particular task. Distinguish advice from authority to decide.
Does the person handling the decision have the information, time and expertise needed to question it?
A credential or job title alone does not establish task competence, available time or freedom to disagree.
Delivery relationships
Developers, suppliers and deployersresearch topic
Trace responsibilities across those building, supplying, integrating and operating the system. Identify who controls each dependency and where information or authority stops.
Which organization can change the component involved, and how does a concern reach it?
These are descriptive delivery roles. Any legal meaning or duty must be checked against the applicable instrument.
Oversight
Reviewers and independent assessorsresearch topic
Identify the remit and access of reviewers, auditors, risk and compliance teams, and privacy or security specialists. Examine their ability to raise findings without interference.
What can the reviewer inspect, and who must respond to an unresolved finding?
Independence, access and competence are separate matters; none follows automatically from an assessment label.
Related risks & investigation questions
Overreliance and unsafe use
A persuasive recommendation can affect how review is performed. Interface and workflow tests can examine opportunities for independent review; claims about actual understanding or overreliance require evidence about people.
Question to test What conditions let the reviewer question the recommendation, and which human-behavior claims remain untested?
Evidence to examine
- The recommendation, evidence presentation, available time and intervention options.
- A suitable human-participant study if the claim concerns cognition or behavior.
MIT risk record 17.05.01 · 5.1 > Overreliance and unsafe use
Ethical and social risks of harm from language models, p. 29. Source workbook.
These editorial connections identify questions to investigate. They do not establish a legal duty, validate TAE or HIT, or make imported records admissible CEC evidence.
Mapping checked 2026-10-08. MIT metadata: CC BY 4.0. Investigation questions and connections: node&norm.
Participation and challenge
Affected people and routes to challengeresearch topic
Consider people who experience the decision, including those who never directly use the AI system. Examine how their concerns reach someone able to investigate and respond.
Can an affected person raise a concern and obtain an intelligible response?
A feedback channel is not necessarily an appeal process or an effective remedy. Rights and duties vary by context.
Intervention and repair
Authority to intervene and repairresearch topic
Distinguish who may pause, override, escalate, investigate, hear an appeal or authorize a correction. Examine whether those powers can be used when needed.
If a person challenges the decision, who can change what happens next?
Formal authority, usable access and an effect on the action are separate questions. A research link does not establish legal compliance.
Related risks & investigation questions
Loss of human agency and autonomy
A formal right to review is worth examining alongside the practical opportunity to question or redirect an AI-assisted decision. This is a research connection, not a legal interpretation of the MIT category.
Question to test Could an authorized reviewer examine the relevant evidence and act before the consequential step?
Evidence to examine
- The information and alternatives available at the review checkpoint.
- The reviewer’s authority, timing and observable opportunity to intervene.
Informs TAE
MIT risk record 06.12.00 · 5.2 > Loss of human agency and autonomy
A framework for ethical Ai at the United Nations, p. 10. Source workbook.
These editorial connections identify questions to investigate. They do not establish a legal duty, validate TAE or HIT, or make imported records admissible CEC evidence.
Mapping checked 2026-10-08. MIT metadata: CC BY 4.0. Investigation questions and connections: node&norm.
04Controls and operations
Explore the arrangements that govern access, action, intervention and follow-up during use.
A control description is a starting point for examination. Its operation and effects require evidence in the relevant setting.
System records
Inventories and change recordsresearch topic
Keep the system under examination identifiable: models, applications, agents, intended uses, owners and versions. Record changes that may alter a previous assessment.
Which version and intended use does this decision or test result concern?
An inventory describes the stated estate; its completeness and accuracy still need examination.
Data controls
Data handling and retained recordsresearch topic
Examine data access, origin, classification, retention and handling of sensitive information. Consider whether the records needed for review remain available and protected.
Can the relevant record be retrieved and examined without exposing information beyond the reviewer’s authority?
Retention and access depend on context and applicable duties. More data is not automatically better evidence.
Identity and access
Identity, permissions and delegationresearch topic
Separate establishing identity from granting permission. Examine who or what can use each tool, the limits of delegated authority and how access can be withdrawn.
Which identity and permission allowed the action, and who could revoke that permission?
NIST digital identity guidance has a stated user and government-system scope; it is not a complete specification for agent identity or delegation.
Human intervention
Stopping, containment and recoveryresearch topic
Examine the routes for review, escalation and stopping or containing an action. Identify what can still be recovered if the system has already acted.
Can the intervention reach the relevant action before its effects become irreversible?
Some actions cannot be reversed. A stop control, a recovery process and correction of harm require different evidence.
Related risks & investigation questions
Control and intervention
A recorded stop request can be compared with what the system actually did. Paired cases can distinguish an effective stop, an acknowledgment without effect and an intervention after the action.
Question to test Did the intervention reach the action it was intended to govern, and what remains unresolved?
Evidence to examine
- An intervention record with timestamps and the applicable scoring contract.
- An independently retained outcome trace, separate from the assessment packet.
MIT risk record 15.01.08 · 7.1 > AI pursuing its own goals in conflict with human goals or values
The Risks of Machine Learning Systems, p. 12. Source workbook.
These editorial connections identify questions to investigate. They do not establish a legal duty, validate TAE or HIT, or make imported records admissible CEC evidence.
Mapping checked 2026-10-08. MIT metadata: CC BY 4.0. Investigation questions and connections: node&norm.
Monitoring and response
Logs, incidents and follow-upresearch topic
Examine how logs, exceptions, incidents and complaints reveal problems. Follow the record from detection to investigation, assigned action and checks on what changed.
What happens after a warning is recorded, and how is the response examined?
A recorded warning is not evidence that anyone understood it or that a corrective action worked.
Dependencies and external effects
Supplier and agent action boundariesresearch topic
Examine tool access, permitted actions and effects outside the immediate application. Identify dependencies that another supplier or institution controls.
Could the system act beyond the intended scope, and which boundary would prevent or contain it?
A documented boundary does not establish enforcement. Test the relevant configuration and retain limits on external visibility.
Related risks & investigation questions
Diffusion of responsibility
A workflow crossing teams or suppliers can leave authority and correction duties unclear. A bounded test can trace who could act and whether a correction reached the affected outcome.
Question to test Who had authority at each boundary, and where did the ability to intervene or repair stop?
Evidence to examine
- Delegation, escalation and responsibility records for the examined workflow.
- Separate evidence of internal acknowledgments and downstream effects.
MIT risk record 01.01.00 · 6.5 > Governance failure
TASRA: a Taxonomy and Analysis of Societal-Scale Risks from AI, p. 3. Source workbook.
These editorial connections identify questions to investigate. They do not establish a legal duty, validate TAE or HIT, or make imported records admissible CEC evidence.
Mapping checked 2026-10-08. MIT metadata: CC BY 4.0. Investigation questions and connections: node&norm.
05Evaluation and testing
Explore what can be tested about a model, application, control or assessment method, and under which conditions.
Software tests, documentary analysis and studies involving people answer different questions. Results retain their stated conditions and limits.
Capability tests
Model capabilities and limitationsresearch topic
Examine what a model can do using stated tasks, inputs and assessment methods. Retain failures, uncertainty and conditions under which results may change.
What does this result establish about the model, and what was not tested?
A model benchmark does not by itself establish the performance or safety of an application using that model.
Use in context
Application and mission-specific testsresearch topic
Examine the application in conditions relevant to its intended task. Include the surrounding data, tools, users and operating constraints.
How closely do the test conditions match the setting in which people will rely on the result?
Performance under a stated test condition does not establish performance in every population, environment or later version.
Control tests
Tests of intervention and authorityresearch topic
Test whether an authorized intervention changes the action it is intended to govern. Retain the request, the system response and the observable result.
When the reviewer tried to intervene, what actually changed?
A scripted control demonstration, a documentary reconstruction and an observed human intervention support different conclusions.
Related risks & investigation questions
Control and intervention
A recorded stop request can be compared with what the system actually did. Paired cases can distinguish an effective stop, an acknowledgment without effect and an intervention after the action.
Question to test Did the intervention reach the action it was intended to govern, and what remains unresolved?
Evidence to examine
- An intervention record with timestamps and the applicable scoring contract.
- An independently retained outcome trace, separate from the assessment packet.
MIT risk record 15.01.08 · 7.1 > AI pursuing its own goals in conflict with human goals or values
The Risks of Machine Learning Systems, p. 12. Source workbook.
These editorial connections identify questions to investigate. They do not establish a legal duty, validate TAE or HIT, or make imported records admissible CEC evidence.
Mapping checked 2026-10-08. MIT metadata: CC BY 4.0. Investigation questions and connections: node&norm.
Stress and misuse tests
Adversarial tests and failure injectionresearch topic
Examine plausible attacks, misuse and component failures in a controlled test setting. Record the tested paths and how detection or containment responded.
Which failure or attack paths were examined, and what happened at the relevant boundary?
Passing selected scenarios does not establish complete security. Testing authority and limits must be agreed for the setting.
Human factors
Human judgment and working conditionsresearch topic
Examine information, workload, expertise, incentives and opportunities to question the system. Choose methods that fit the question about people and their work.
What conditions helped or prevented the person from examining and challenging the output?
Records can describe conditions; measuring behavior requires an appropriate study. Subjective workload does not establish effective oversight.
- NIST AI RMF 1.0 · January 2023 publication (PDF)
- NASA Task Load Index · Subjective workload
- Related Node & Norm work · HIT independent application
Related risks & investigation questions
Overreliance and unsafe use
A persuasive recommendation can affect how review is performed. Interface and workflow tests can examine opportunities for independent review; claims about actual understanding or overreliance require evidence about people.
Question to test What conditions let the reviewer question the recommendation, and which human-behavior claims remain untested?
Evidence to examine
- The recommendation, evidence presentation, available time and intervention options.
- A suitable human-participant study if the claim concerns cognition or behavior.
MIT risk record 17.05.01 · 5.1 > Overreliance and unsafe use
Ethical and social risks of harm from language models, p. 29. Source workbook.
These editorial connections identify questions to investigate. They do not establish a legal duty, validate TAE or HIT, or make imported records admissible CEC evidence.
Mapping checked 2026-10-08. MIT metadata: CC BY 4.0. Investigation questions and connections: node&norm.
Inspection and repetition
Reproducibility and retained test artifactsresearch topic
Retain the inputs, versions, procedures, scoring rules and results needed to examine a test. Identify missing material and sources of variation.
Can another assessor inspect or repeat the procedure and understand why results differ?
Repeatability does not establish that the chosen measure answers the intended question or generalizes to field use.
Change and continuing evaluation
Rechecking after changesresearch topic
Identify which earlier findings need review when a model, tool, data source, rule or operating condition changes. Compare results and retain new failures.
What changed, which claims could it affect, and what was retested?
A previous result belongs to its tested configuration and conditions; it should not silently transfer to an updated system.
06Evidence and assurance
Explore how records support a claim, where uncertainty remains, and how another person can inspect the reasoning.
Assurance communicates the confidence evidence warrants. Responsibility for action and correction remains with the authorized people or institutions.
Framing the assessment
Claims, criteria and scoperesearch topic
State what is being assessed, for which decision and under what conditions. Make the criteria visible before deciding whether the evidence supports the claim.
Exactly what conclusion is the reader being asked to accept?
A criterion may come from law, a standard, a contract or a research method. Identify its source rather than treating them as interchangeable.
Source examination
Sources, provenance and missing recordsresearch topic
Identify where a record came from, who produced it and what transformed it. Keep gaps, restricted access and uncertain attribution visible.
What is the source of this evidence, and what relevant material is unavailable?
A traceable record can still be incomplete or wrong. Provenance supports examination without establishing truth on its own.
Related risks & investigation questions
Transparency and inspectable evidence
An explanation can appear plausible while the retained record is insufficient to establish what happened. Evidence completeness and provenance can be tested independently of presentation quality.
Question to test Can another assessor reconstruct the decision and intervention from the admissible record?
Evidence to examine
- Source identifiers, record provenance and known missing material.
- Cases with effective control but insufficient retained evidence, preserving an unresolved outcome.
MIT risk record 06.06.00 · 7.4 > Lack of transparency or interpretability
A framework for ethical Ai at the United Nations, p. 8. Source workbook.
These editorial connections identify questions to investigate. They do not establish a legal duty, validate TAE or HIT, or make imported records admissible CEC evidence.
Mapping checked 2026-10-08. MIT metadata: CC BY 4.0. Investigation questions and connections: node&norm.
Reconstruction
Reconstructing the decision and interventionresearch topic
Connect the available records of the decision, human intervention and subsequent events. Separate recorded events from assumptions about what caused the outcome.
What can the available record establish about the intervention and what followed it?
A missing record is not automatically evidence of failure; an event occurring later does not by itself establish causation.
- Related Node & Norm work · Trust, Autonomy & Evidence
- Related Node & Norm work · Governed Decision Intelligence
Related risks & investigation questions
Transparency and inspectable evidence
An explanation can appear plausible while the retained record is insufficient to establish what happened. Evidence completeness and provenance can be tested independently of presentation quality.
Question to test Can another assessor reconstruct the decision and intervention from the admissible record?
Evidence to examine
- Source identifiers, record provenance and known missing material.
- Cases with effective control but insufficient retained evidence, preserving an unresolved outcome.
MIT risk record 06.06.00 · 7.4 > Lack of transparency or interpretability
A framework for ethical Ai at the United Nations, p. 8. Source workbook.
These editorial connections identify questions to investigate. They do not establish a legal duty, validate TAE or HIT, or make imported records admissible CEC evidence.
Mapping checked 2026-10-08. MIT metadata: CC BY 4.0. Investigation questions and connections: node&norm.
Assessment
Conflicting evidence and unresolved findingsresearch topic
Examine supporting and conflicting material together. State how gaps, alternative explanations and measurement limits affect the conclusion.
What would weaken this conclusion, and which questions remain unresolved?
Unresolved means the available evidence does not settle the question. It should not silently become either approval or a finding of failure.
Inspection and communication
Review, challenge and communicationresearch topic
Present the claim, sources, reasoning and limits so another person can examine them. Make disagreements and responses understandable to the intended audience.
Can another reader trace the conclusion to its evidence and challenge the reasoning?
Public availability does not establish independent validation. Access restrictions and the assessor’s remit should remain clear.
Correction and learning
Correction records and evidence of effectsresearch topic
Record what changed, who authorized it and why. Examine subsequent evidence to distinguish completing an action from achieving its intended effect.
What evidence shows whether the correction reached the people or decisions it was meant to affect?
An assurance finding does not itself authorize a correction. Responsibility stays with the people or institutions empowered to act.
U.S. coverage register
Selected sources reviewed in 10 of 50 states, plus New York City. Each entry covers the instruments listed. A state marked “Not yet reviewed” may still have relevant requirements.
View all 50 states
| State | Coverage | Topics | Source review |
|---|---|---|---|
| Alabama | Not yet reviewed | 0 | Not reviewed |
| Alaska | Not yet reviewed | 0 | Not reviewed |
| Arizona | Not yet reviewed | 0 | Not reviewed |
| Arkansas | Not yet reviewed | 0 | Not reviewed |
| California | Selected sources reviewed | 4 | 2026-10-08 |
| Colorado | Selected sources reviewed | 4 | 2026-10-08 |
| Connecticut | Selected sources reviewed | 1 | 2026-10-08 |
| Delaware | Not yet reviewed | 0 | Not reviewed |
| Florida | Not yet reviewed | 0 | Not reviewed |
| Georgia | Not yet reviewed | 0 | Not reviewed |
| Hawaii | Not yet reviewed | 0 | Not reviewed |
| Idaho | Not yet reviewed | 0 | Not reviewed |
| Illinois | Selected sources reviewed | 5 | 2026-10-08 |
| Indiana | Not yet reviewed | 0 | Not reviewed |
| Iowa | Not yet reviewed | 0 | Not reviewed |
| Kansas | Not yet reviewed | 0 | Not reviewed |
| Kentucky | Not yet reviewed | 0 | Not reviewed |
| Louisiana | Not yet reviewed | 0 | Not reviewed |
| Maine | Not yet reviewed | 0 | Not reviewed |
| Maryland | Not yet reviewed | 0 | Not reviewed |
| Massachusetts | Not yet reviewed | 0 | Not reviewed |
| Michigan | Not yet reviewed | 0 | Not reviewed |
| Minnesota | Selected sources reviewed | 1 | 2026-10-08 |
| Mississippi | Not yet reviewed | 0 | Not reviewed |
| Missouri | Not yet reviewed | 0 | Not reviewed |
| Montana | Not yet reviewed | 0 | Not reviewed |
| Nebraska | Not yet reviewed | 0 | Not reviewed |
| Nevada | Not yet reviewed | 0 | Not reviewed |
| New Hampshire | Not yet reviewed | 0 | Not reviewed |
| New Jersey | Not yet reviewed | 0 | Not reviewed |
| New Mexico | Not yet reviewed | 0 | Not reviewed |
| New York | Selected sources reviewed | 3 | 2026-10-08 |
| North Carolina | Not yet reviewed | 0 | Not reviewed |
| North Dakota | Not yet reviewed | 0 | Not reviewed |
| Ohio | Not yet reviewed | 0 | Not reviewed |
| Oklahoma | Not yet reviewed | 0 | Not reviewed |
| Oregon | Not yet reviewed | 0 | Not reviewed |
| Pennsylvania | Not yet reviewed | 0 | Not reviewed |
| Rhode Island | Not yet reviewed | 0 | Not reviewed |
| South Carolina | Not yet reviewed | 0 | Not reviewed |
| South Dakota | Not yet reviewed | 0 | Not reviewed |
| Tennessee | Not yet reviewed | 0 | Not reviewed |
| Texas | Selected sources reviewed | 1 | 2026-10-08 |
| Utah | Selected sources reviewed | 1 | 2026-10-08 |
| Vermont | Not yet reviewed | 0 | Not reviewed |
| Virginia | Selected sources reviewed | 1 | 2026-10-08 |
| Washington | Not yet reviewed | 0 | Not reviewed |
| West Virginia | Not yet reviewed | 0 | Not reviewed |
| Wisconsin | Selected sources reviewed | 2 | 2026-10-08 |
| Wyoming | Not yet reviewed | 0 | Not reviewed |
Local coverage and open checks
- New York City
- Local Law 144 is included as a city requirement.
- Chicago
- The O2024-0008864 ordinance record was located; adoption and current status remain unverified. It is excluded from the law topics. Illinois state requirements remain a separate question.
- Other jurisdictions
- The District of Columbia and U.S. territories have not been reviewed in this pass. Other local jurisdictions remain outside this selected coverage.
Review dates record editorial checks of sources. They do not establish that every law or court order in a jurisdiction has been examined. Federal sources are listed separately in the explorer.
Questions across different systems
The same branches can inform several kinds of inquiry. The relevant requirements and tests depend on the use, the people affected and the actions a system can take.
- Predictive, generative and frontier models
- Which capabilities and limits were evaluated, under what conditions? What needs to be examined again after an update?
- Identity and access systems
- Whose identity was established, what authority followed, and how could a mistaken grant or denial be challenged? Identity controls may govern an AI workflow without themselves using AI.
- Agents using tools and taking actions
- Who delegated authority? Can an action be stopped, contained or reconstructed when it crosses system boundaries?
- Possible future capabilities
- How might more persistent autonomy change the evidence needed for intervention? This prospective question includes proposed artificial general intelligence (AGI). It does not predict its arrival or imply that current methods are validated for it. AGI and the EU AI Act’s general-purpose AI category are distinct terms.
Sources, scope and correction
Each topic links to a source and records its review date. Laws, standards, guidance and research questions have different roles. Legal applicability depends on the jurisdiction, activity, actor and relevant dates; the map does not determine an institution’s obligations or certify a system.
Sources reviewed 7–8 October 2026; each topic retains its own review date. References are checked during editorial updates; this page does not provide automatic legal monitoring. Living references and proposals may change. Versioned sources remain attached where available so an earlier account can be examined.
Connected sources & review status
- MIT AI Risk Repository
- Five reviewed research connections link selected risks to TAE, HIT and CEC questions across ten topics. The source workbook is AI Risk Database v4, dated 2025-12-03; this published snapshot was checked on 8 October 2026.
- LegiScan
Active Colorado pilot. First live check completed on 8 October 2026: three searches across recent sessions returned 23 distinct bill records. Searches use “artificial intelligence,” “automated decision” and “algorithmic discrimination.”
3 selected Colorado bills have been checked against the legislature’s enacted texts and added to the explorer:
- Colorado: AI-assisted health-care review
- Colorado: AI use in psychotherapy
- Colorado: conversational AI safeguards
Selected California and New York records have also received official-source review, adding these companion-AI topics:
California and New York were checked once; recurring checks remain limited to Colorado. Other returned candidates await substantive review.
Nationwide activation is deferred after inconsistent search totals. Weekly checks require the local research workstation to be available. Legislative metadata: LegiScan, adapted under CC BY 4.0.
- AI Incident Database
- Weekly checks watch for new snapshot announcements. Incident contents and third-party reports have not been imported.
- Review rhythm
- Selected sources are checked weekly when the local research workstation is available. Editorial review is scheduled monthly, with material corrections considered sooner; coverage is reviewed quarterly. Checks flag failed retrievals and overdue reviews. These checks do not monitor every linked law or calculate legal deadlines.
- Publication
- Source observations and proposed changes are retained separately from published topics. A successful download does not constitute an editorial review. Current coverage remains limited to the listed sources and records.
Download the reviewed research connections (JSON) · Legislative review record (JSON)
This map uses node&norm’s own organization, wording and visual composition. It does not imply endorsement. Read the research-integrity and correction commitments.