Legal & Regulatory Frameworks

AI is governed by a combination of AI-specific provisions and existing rules on matters such as discrimination, privacy, consumer protection, product safety and intellectual property. The applicable combination depends on the activity, jurisdiction and organization’s role. Standards and voluntary frameworks can organize the work, but are not interchangeable with law.

Find the relevant source

• International Standards (ISO/IEC): management-system requirements, risk and impact-assessment guidance, terminology, and requirements for certification bodies.
• EU AI Act: territorial and role-based scope, risk classes, GPAI obligations, transparency and the amended timetable.
• US Federal: executive policy, federal agency use and procurement, selected statutes, NIST and CAISI.
• US States & Cities: selected Colorado, Texas, California, New York, Illinois and other provisions, including distinctions between existing duties and future operative dates.
• International Regulation: selected regimes and initiatives outside the EU and United States.
• Sector-specific Rules: healthcare, financial services and employment overlays.
• Copyright & IP: selected decisions, data provenance, disclosure duties and limits on generalizing from individual cases.

Build an applicability record

For each potentially relevant rule, record the source and review date, the covered activity and role, the facts supporting applicability, the operative date, exceptions, required evidence and a responsible owner. Distinguish a current obligation from a proposal or an internal policy choice.

When several regimes apply, compare them provision by provision. The most demanding rule in one dimension may not satisfy a different rule’s notice, assessment, recordkeeping or reporting requirements. A common control can support several obligations only after those differences are checked.

From scope to implementation

Connect the legal review to the system and data record, technical evaluation and named decision owners. For more detailed examples, use the site’s multi-jurisdiction reference, employment references and board oversight material.

This handbook is a starting point, not an exhaustive applicability analysis. Consult the full source and qualified advisers where the decision requires it.