Skip to main content
Document applicable AI laws and standards, required data protections, and strategies for compliance
Keywords
RegulatoryEUNYNISTISOGDPR
Application
Mandatory
Frequency
Every 6 months
Type
Preventative
Capabilities
Universal
Crosswalks
EU AI Act?
Article 16: Obligations of Providers of High-Risk AI SystemsArticle 18: Documentation KeepingArticle 21: Cooperation with Competent AuthoritiesArticle 22: Authorised Representatives of Providers of High-Risk AI SystemsArticle 25: Responsibilities Along the AI Value ChainArticle 26: Obligations of Deployers of High-Risk AI SystemsArticle 43: Conformity AssessmentArticle 44: CertificatesArticle 47: EU Declaration of ConformityArticle 48: CE MarkingArticle 49: Registration
ISO 42001?
A.2.3: Alignment with other organizational policiesA.8.5: Information for interested parties10.2: Nonconformity and corrective action
NIST AI RMF?
GOVERN 1.1: Legal and regulatory complianceGOVERN 1.7: AI system decommissioningMAP 1.1: Context understandingMAP 4.1: Legal risk mapping
CSA AICM?
A&A-04: Requirements ComplianceDSP-10: Sensitive Data TransferDSP-18: Disclosure NotificationGRC-07: Information System Regulatory MappingHRS-10: Non-Disclosure Agreements
IBM AI Risk Atlas?
IBM 16: Agentic AI - AI agent complianceIBM 32: Training Data - Data privacy rights alignmentIBM 36: Training Data - Data usage restrictionsIBM 89: Non-Technical - Legal accountability
CO AI Act?
6-1-1706 & 6-1-1707: Enforcement & AG, Rulemaking Authority
CA SB 53?
22757.12: Transparency & Reporting Obligations

​
Control activities

​
Typical evidence

Should include?

Identifying relevant regulations. For example, data protection laws. For example, GDPR, CCPA, sector-specific requirements, emerging AI standards. For example, EU AI Act.

Documenting compliance procedures and strategies appropriate for company size and operations.

Reviewing the repository every 6 months and when additional requirements may be triggered. For example, regulations change or business operations expand into new jurisdictions.

E012.1 Documentation: Regulatory compliance reviews

Compliance register, assessment memo or review tickets (e.g. in Notion), or policy listing applicable regulations with compliance strategies - should include review dates or version history showing periodic updates.

Category
Legal Policies
Typical location
Internal processes
Capabilities
Universal

Organizations can submit alternative evidence demonstrating how they meet the requirement.

37.782274° N -122.392147° WFIG. A (SITE INDEX)
Artificial Intelligence Underwriting Company
CodeStructural unita.AIUC-1 requirements for agent data, privacy, security, safety, reliability, accountability, and societal risk.b.Evidence templates for technical implementation, legal policy, operational practice, and third-party evaluation.c.Crosswalks to AI regulations, standards, and security frameworks.d.Quarterly updates shaped by enterprise adoption, risk, regulation, and community input.
100© AIUC — ALL RIGHTS RESERVED