> ## Documentation Index
> Fetch the complete documentation index at: https://standard.aiuc-1.com/llms.txt
> Use this file to discover all available pages before exploring further.

# E012: Document regulatory compliance

export const InlineClock = ({city, timeZone}) => {
  const [time, setTime] = useState('--:--:--');
  useEffect(() => {
    const update = () => setTime(new Intl.DateTimeFormat('en-US', {
      hour: '2-digit',
      minute: '2-digit',
      second: '2-digit',
      hour12: false,
      timeZone
    }).format(new Date()));
    update();
    const id = setInterval(update, 1000);
    return () => clearInterval(id);
  }, [timeZone]);
  return <div className="aiuc-footer-clock">
      <span className="aiuc-footer-clock-city">{city}</span>
      <span className="aiuc-footer-clock-time">{time}</span>
    </div>;
};

Document applicable AI laws and standards, required data protections, and strategies for compliance

<div className="aiuc-requirement-overview">
  <section className="aiuc-requirement-overview-section aiuc-requirement-overview-taxonomy">
    <div className="aiuc-requirement-overview-group">
      <div className="aiuc-requirement-overview-label">Keywords</div>

      <div className="aiuc-requirement-overview-pill-list">
        <span className="aiuc-requirement-overview-pill">Regulatory</span>
        <span className="aiuc-requirement-overview-pill">EU</span>
        <span className="aiuc-requirement-overview-pill">NY</span>
        <span className="aiuc-requirement-overview-pill">NIST</span>
        <span className="aiuc-requirement-overview-pill">ISO</span>
        <span className="aiuc-requirement-overview-pill">GDPR</span>
      </div>
    </div>
  </section>

  <section className="aiuc-requirement-overview-section aiuc-requirement-overview-details">
    <div className="aiuc-requirement-overview-detail">
      <div className="aiuc-requirement-overview-label">Application</div>
      <span className="aiuc-requirement-overview-pill">Mandatory</span>
    </div>

    <div className="aiuc-requirement-overview-detail">
      <div className="aiuc-requirement-overview-label">Frequency</div>
      <span className="aiuc-requirement-overview-pill">Every 6 months</span>
    </div>

    <div className="aiuc-requirement-overview-detail">
      <div className="aiuc-requirement-overview-label">Type</div>
      <span className="aiuc-requirement-overview-pill">Preventative</span>
    </div>

    <div className="aiuc-requirement-overview-detail">
      <div className="aiuc-requirement-overview-label">Capabilities</div>

      <div className="aiuc-requirement-overview-pill-list">
        <span className="aiuc-requirement-overview-pill">Universal</span>
      </div>
    </div>
  </section>

  <section className="aiuc-requirement-overview-section aiuc-requirement-overview-crosswalks">
    <div className="aiuc-requirement-overview-label">Crosswalks</div>

    <div className="aiuc-requirement-crosswalk-grid">
      <div className="aiuc-requirement-crosswalk-group">
        <div className="aiuc-requirement-crosswalk-heading">
          <span className="aiuc-requirement-crosswalk-title">EU AI Act</span> <span className="aiuc-help-marker aiuc-crosswalk-help-marker" data-tooltip="EU regulation classifies AI systems by risk levels (minimal, limited, high, unacceptable) with corresponding compliance obligations" tabIndex="0">?</span>
        </div>

        <div className="aiuc-requirement-crosswalk-rule" aria-hidden="true" />

        <div className="aiuc-requirement-crosswalk-items">
          <a href="/crosswalks/eu-ai-act" title="This article states that companies providing high-risk AI systems must follow certain rules. They must make sure their AI systems meet specific standards and d…">Article 16: Obligations of Providers of High-Risk AI Systems</a>
          <a href="/crosswalks/eu-ai-act" title="This article states that providers of high-risk AI systems must keep certain documents for 10 years after the system is released. These documents include techn…">Article 18: Documentation Keeping</a>
          <a href="/crosswalks/eu-ai-act" title="This article states that companies providing high-risk AI systems must, when asked by a relevant authority, provide all the information needed to show that the…">Article 21: Cooperation with Competent Authorities</a>
          <a href="/crosswalks/eu-ai-act" title="This article states that before launching high-risk AI systems in the EU, providers from non-EU countries must appoint a representative within the EU. This rep…">Article 22: Authorised Representatives of Providers of High-Risk AI Systems</a>
          <a href="/crosswalks/eu-ai-act" title="This article states that anyone who distributes, imports, deploys, or modifies a high-risk AI system is considered a provider of that system and must follow ce…">Article 25: Responsibilities Along the AI Value Chain</a>
          <a href="/crosswalks/eu-ai-act" title="This article outlines the responsibilities of those who deploy high-risk AI systems. These include using the systems as per instructions, assigning human overs…">Article 26: Obligations of Deployers of High-Risk AI Systems</a>
          <a href="/crosswalks/eu-ai-act" title="This article discusses the process of assessing whether high-risk AI systems meet certain standards. If a provider has used certain standards in creating their…">Article 43: Conformity Assessment</a>
          <a href="/crosswalks/eu-ai-act" title="This article states that certificates for AI systems must be written in a language that can be easily understood by the relevant authorities in the country whe…">Article 44: Certificates</a>
          <a href="/crosswalks/eu-ai-act" title="The EU AI Act requires providers of high-risk AI systems to create a written declaration of conformity for each system. This document, which can be physical or…">Article 47: EU Declaration of Conformity</a>
          <a href="/crosswalks/eu-ai-act" title="This article states that the CE marking, which shows a product meets EU safety standards, must be clearly visible on high-risk AI systems. If it can't be physi…">Article 48: CE Marking</a>
          <a href="/crosswalks/eu-ai-act" title="This article states that before any high-risk AI system is launched or used, the provider or their representative must register themselves and their system in…">Article 49: Registration</a>
        </div>
      </div>

      <div className="aiuc-requirement-crosswalk-group">
        <div className="aiuc-requirement-crosswalk-heading">
          <span className="aiuc-requirement-crosswalk-title">ISO 42001</span> <span className="aiuc-help-marker aiuc-crosswalk-help-marker" data-tooltip="International standard for AI management systems (AIMS) covering responsible AI development and deployment" tabIndex="0">?</span>
        </div>

        <div className="aiuc-requirement-crosswalk-rule" aria-hidden="true" />

        <div className="aiuc-requirement-crosswalk-items">
          <a href="/crosswalks/iso-42001" title="The organization shall determine where other policies can be affected by or apply to the organization's objectives with respect to AI systems.">A.2.3: Alignment with other organizational policies</a>
          <a href="/crosswalks/iso-42001" title="The organization shall determine and document their obligations to reporting information about the AI system to interested parties.">A.8.5: Information for interested parties</a>
          <a href="/crosswalks/iso-42001" title="The organization shall address nonconformities by correcting them, dealing with consequences, and preventing recurrence.">10.2: Nonconformity and corrective action</a>
        </div>
      </div>

      <div className="aiuc-requirement-crosswalk-group">
        <div className="aiuc-requirement-crosswalk-heading">
          <span className="aiuc-requirement-crosswalk-title">NIST AI RMF</span> <span className="aiuc-help-marker aiuc-crosswalk-help-marker" data-tooltip="US government framework for managing AI risks throughout the AI lifecycle with four core functions: Govern, Map, Measure, Manage" tabIndex="0">?</span>
        </div>

        <div className="aiuc-requirement-crosswalk-rule" aria-hidden="true" />

        <div className="aiuc-requirement-crosswalk-items">
          <a href="/crosswalks/nist-ai-rmf" title="Legal and regulatory requirements involving AI are understood, managed, and documented.">GOVERN 1.1: Legal and regulatory compliance</a>
          <a href="/crosswalks/nist-ai-rmf" title="Processes and procedures are in place for decommissioning and phasing out of AI systems safely and in a manner that does not increase risks or decrease the org…">GOVERN 1.7: AI system decommissioning</a>
          <a href="/crosswalks/nist-ai-rmf" title="Intended purpose, potentially beneficial uses, context-specific laws, norms and expectations, and prospective settings in which the AI system will be deployed…">MAP 1.1: Context understanding</a>
          <a href="/crosswalks/nist-ai-rmf" title="Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and docume…">MAP 4.1: Legal risk mapping</a>
        </div>
      </div>

      <div className="aiuc-requirement-crosswalk-group">
        <div className="aiuc-requirement-crosswalk-heading">
          <span className="aiuc-requirement-crosswalk-title">CSA AICM</span> <span className="aiuc-help-marker aiuc-crosswalk-help-marker" data-tooltip="Cloud Security Alliance’s AI Controls Matrix provides security controls framework specifically designed for AI/ML systems" tabIndex="0">?</span>
        </div>

        <div className="aiuc-requirement-crosswalk-rule" aria-hidden="true" />

        <div className="aiuc-requirement-crosswalk-items">
          <a href="/crosswalks/csa-aicm" title="Verify compliance with all relevant standards, regulations, legal/contractual, and statutory requirements applicable to the audit.">A\&A-04: Requirements Compliance</a>
          <a href="/crosswalks/csa-aicm" title="Define, implement and evaluate processes, procedures and technical measures that ensure any transfer of personal or sensitive data is protected from unauthoriz…">DSP-10: Sensitive Data Transfer</a>
          <a href="/crosswalks/csa-aicm" title="The providers should implement and describe to customers the procedure to manage and respond to requests for disclosure of Personal Data by Law Enforcement Aut…">DSP-18: Disclosure Notification</a>
          <a href="/crosswalks/csa-aicm" title="Identify and document all relevant standards, regulations, legal/contractual, and statutory requirements, which are applicable to your organization. Review at…">GRC-07: Information System Regulatory Mapping</a>
          <a href="/crosswalks/csa-aicm" title="Identify, document, and review, at planned intervals, requirementsfor non-disclosure/confidentiality agreements reflecting the organization'sneeds for the prot…">HRS-10: Non-Disclosure Agreements</a>
        </div>
      </div>

      <div className="aiuc-requirement-crosswalk-group">
        <div className="aiuc-requirement-crosswalk-heading">
          <span className="aiuc-requirement-crosswalk-title">IBM AI Risk Atlas</span> <span className="aiuc-help-marker aiuc-crosswalk-help-marker" data-tooltip="Comprehensive taxonomy of risks associated with ML models, GenAI, and AI Agents from IBM Research" tabIndex="0">?</span>
        </div>

        <div className="aiuc-requirement-crosswalk-rule" aria-hidden="true" />

        <div className="aiuc-requirement-crosswalk-items">
          <a href="/crosswalks/ibm-ai-risk-atlas" title="Determining AI agents' compliance is complex and there might not be enough information to assess whether the agentic AI system is compliant with applicable leg…">IBM 16: Agentic AI - AI agent compliance</a>
          <a href="/crosswalks/ibm-ai-risk-atlas" title="Applicable laws can establish data subject rights such as opt-out rights, right to access, and right to be forgotten. Synthetic data might raise unique concern…">IBM 32: Training Data - Data privacy rights alignment</a>
          <a href="/crosswalks/ibm-ai-risk-atlas" title="Laws and other restrictions can limit or prohibit the use of some data for specific AI use cases.">IBM 36: Training Data - Data usage restrictions</a>
          <a href="/crosswalks/ibm-ai-risk-atlas" title="Determining who is responsible for an AI model is challenging without good documentation and governance processes. The use of synthetic data in model developme…">IBM 89: Non-Technical - Legal accountability</a>
        </div>
      </div>

      <div className="aiuc-requirement-crosswalk-group">
        <div className="aiuc-requirement-crosswalk-heading">
          <span className="aiuc-requirement-crosswalk-title">CO AI Act</span> <span className="aiuc-help-marker aiuc-crosswalk-help-marker" data-tooltip="Colorado AI Act requires developers and deployers of high-risk AI systems to use reasonable care to protect consumers from algorithmic discrimination" tabIndex="0">?</span>
        </div>

        <div className="aiuc-requirement-crosswalk-rule" aria-hidden="true" />

        <div className="aiuc-requirement-crosswalk-items">
          <a href="/crosswalks/co-ai-act" title="The AG has exclusive enforcement authority. Violations are unfair trade practices. Compliance with a recognised AI risk management framework is an affirmative…">6-1-1706 & 6-1-1707: Enforcement & AG, Rulemaking Authority</a>
        </div>
      </div>

      <div className="aiuc-requirement-crosswalk-group">
        <div className="aiuc-requirement-crosswalk-heading">
          <span className="aiuc-requirement-crosswalk-title">CA SB 53</span> <span className="aiuc-help-marker aiuc-crosswalk-help-marker" data-tooltip="California Senate Bill 53 establishes safety requirements for frontier AI models including shutdown capabilities and safety testing" tabIndex="0">?</span>
        </div>

        <div className="aiuc-requirement-crosswalk-rule" aria-hidden="true" />

        <div className="aiuc-requirement-crosswalk-items">
          <a href="/crosswalks/ca-sb-53" title="Requires large frontier developers to publish a Frontier AI Framework and transparency reports, and to submit quarterly catastrophic risk assessments to OES.">22757.12: Transparency & Reporting Obligations</a>
        </div>
      </div>
    </div>
  </section>
</div>

<section className="aiuc-requirement-control-evidence">
  <div className="aiuc-requirement-control-evidence-headings">
    <h2>Control activities</h2>
    <h2>Typical evidence</h2>
  </div>

  <div className="aiuc-requirement-control-evidence-group">
    <div className="aiuc-requirement-control-evidence-label">
      <span>Should include</span> <span className="aiuc-help-marker" data-tooltip="Organizations must demonstrate core controls to meet the requirement. Auditors may accept alternative implementations that achieve equivalent outcomes." tabIndex="0">?</span>
    </div>

    <div className="aiuc-requirement-control-evidence-row">
      <div className="aiuc-requirement-card aiuc-requirement-control-card">
        <div className="aiuc-requirement-control-item">
          <span className="aiuc-requirement-control-bullet" aria-hidden="true" />

          <p><strong>Identifying relevant regulations.</strong> For example, data protection laws. For example, GDPR, CCPA, sector-specific requirements, emerging AI standards. For example, EU AI Act.</p>
        </div>

        <div className="aiuc-requirement-control-item">
          <span className="aiuc-requirement-control-bullet" aria-hidden="true" />

          <p><strong>Documenting compliance procedures and strategies appropriate for company size and operations.</strong></p>
        </div>

        <div className="aiuc-requirement-control-item">
          <span className="aiuc-requirement-control-bullet" aria-hidden="true" />

          <p><strong>Reviewing the repository every 6 months and when additional requirements may be triggered.</strong> For example, regulations change or business operations expand into new jurisdictions.</p>
        </div>
      </div>

      <div className="aiuc-requirement-card aiuc-requirement-evidence-card">
        <div className="aiuc-requirement-evidence-title">E012.1 Documentation: Regulatory compliance reviews</div>
        <p>Compliance register, assessment memo or review tickets (e.g. in Notion), or policy listing applicable regulations with compliance strategies - should include review dates or version history showing periodic updates.</p>

        <div className="aiuc-requirement-evidence-meta">
          <div className="aiuc-requirement-evidence-meta-group">
            <div className="aiuc-requirement-evidence-meta-label">Category</div>
            <a href="/evidence/legal-policies">Legal Policies</a>
          </div>

          <div className="aiuc-requirement-evidence-meta-group">
            <div className="aiuc-requirement-evidence-meta-label">Typical location</div>

            <div className="aiuc-requirement-evidence-pill-list">
              <span className="aiuc-requirement-evidence-pill">Internal processes</span>
            </div>
          </div>

          <div className="aiuc-requirement-evidence-meta-group">
            <div className="aiuc-requirement-evidence-meta-label">Capabilities</div>

            <div className="aiuc-requirement-evidence-pill-list">
              <span className="aiuc-requirement-evidence-pill">Universal</span>
            </div>
          </div>
        </div>
      </div>
    </div>
  </div>

  <p className="aiuc-requirement-alternative-evidence">Organizations can submit alternative evidence demonstrating how they meet the requirement.</p>
</section>

<div className="aiuc-footer">
  <span className="aiuc-footer-corner aiuc-footer-corner-tl">
    <svg fill="none" stroke="currentColor" strokeWidth="1" viewBox="0 0 12 12" width="12" height="12">
      <line x1="0" x2="12" y1="6" y2="6" />

      <line x1="6" x2="6" y1="0" y2="12" />
    </svg>
  </span>

  <span className="aiuc-footer-corner aiuc-footer-corner-tr">
    <svg fill="none" stroke="currentColor" strokeWidth="1" viewBox="0 0 12 12" width="12" height="12">
      <line x1="0" x2="12" y1="6" y2="6" />

      <line x1="6" x2="6" y1="0" y2="12" />
    </svg>
  </span>

  <div className="aiuc-footer-strip">
    <span className="aiuc-footer-mono">37.782274° N -122.392147° W</span>
    <span className="aiuc-footer-strip-center">FIG. A (SITE INDEX)</span>

    <span />
  </div>

  <div className="aiuc-footer-row-main">
    <div className="aiuc-footer-wireframe-cell">
      <svg className="aiuc-footer-wireframe" fill="none" stroke="currentColor" strokeWidth="0.4" viewBox="0 0 200 150">
        <rect height="130" width="180" x="10" y="10" />

        <rect height="40" width="60" x="20" y="20" />

        <rect height="40" width="40" x="90" y="20" />

        <rect height="40" width="40" x="140" y="20" />

        <rect height="60" width="60" x="20" y="70" />

        <rect height="60" width="90" x="90" y="70" />

        <line strokeDasharray="2,2" x1="20" x2="180" y1="65" y2="65" />

        <line strokeDasharray="2,2" x1="85" x2="85" y1="20" y2="60" />

        <circle cx="50" cy="40" r="6" />

        <circle cx="110" cy="40" r="6" />

        <circle cx="160" cy="40" r="6" />
      </svg>
    </div>

    <div className="aiuc-footer-wordmark-cell">
      <div className="aiuc-footer-wordmark">Artificial Intelligence Underwriting Company</div>
    </div>

    <div className="aiuc-footer-clocks">
      <InlineClock city="SFO" timeZone="America/Los_Angeles" />

      <InlineClock city="NYC" timeZone="America/New_York" />

      <InlineClock city="LON" timeZone="Europe/London" />
    </div>
  </div>

  <div className="aiuc-footer-row-sub">
    <div className="aiuc-footer-codeblock-cell">
      <div className="aiuc-footer-codeblock">
        <span className="aiuc-footer-codeblock-header">Code</span>
        <span className="aiuc-footer-codeblock-header">Structural unit</span>
        <span className="aiuc-footer-codeblock-code">a.</span>
        <span className="aiuc-footer-codeblock-text">AIUC-1 requirements for agent data, privacy, security, safety, reliability, accountability, and societal risk.</span>
        <span className="aiuc-footer-codeblock-code">b.</span>
        <span className="aiuc-footer-codeblock-text">Evidence templates for technical implementation, legal policy, operational practice, and third-party evaluation.</span>
        <span className="aiuc-footer-codeblock-code">c.</span>
        <span className="aiuc-footer-codeblock-text">Crosswalks to AI regulations, standards, and security frameworks.</span>
        <span className="aiuc-footer-codeblock-code">d.</span>
        <span className="aiuc-footer-codeblock-text">Quarterly updates shaped by enterprise adoption, risk, regulation, and community input.</span>
      </div>
    </div>

    <div className="aiuc-footer-columns-cell">
      <div className="aiuc-footer-columns">
        <div>
          <div className="aiuc-footer-column-header">I. Standard</div>

          <ul className="aiuc-footer-column-list">
            <li><a className="aiuc-footer-column-link" href="/">Overview</a></li>
            <li><a className="aiuc-footer-column-link" href="/crosswalks">Crosswalks</a></li>
            <li><a className="aiuc-footer-column-link" href="/evidence">Evidence</a></li>
            <li><a className="aiuc-footer-column-link" href="/changelog">Changelog</a></li>
          </ul>
        </div>

        <div>
          <div className="aiuc-footer-column-header">II. Learn</div>

          <ul className="aiuc-footer-column-list">
            <li><a className="aiuc-footer-column-link" href="/learn/about">About AIUC-1</a></li>
            <li><a className="aiuc-footer-column-link" href="/learn/contribute">Contribute</a></li>
            <li><a className="aiuc-footer-column-link" href="/scoping">Scoping</a></li>
            <li><a className="aiuc-footer-column-link" href="/faq">FAQ</a></li>
          </ul>
        </div>

        <div>
          <div className="aiuc-footer-column-header">III. Office</div>

          <ul className="aiuc-footer-column-list">
            <li><a className="aiuc-footer-column-link" href="/consortium">Consortium</a></li>
            <li><a className="aiuc-footer-column-link" href="/contact">Contact</a></li>
            <li><a className="aiuc-footer-column-link" href="/legal/privacy">Privacy policy</a></li>
            <li><a className="aiuc-footer-column-link" href="/legal/terms">Terms of use</a></li>
          </ul>
        </div>
      </div>
    </div>
  </div>

  <div className="aiuc-footer-strip-bottom">
    <span className="aiuc-footer-mono">100</span>
    <span>© AIUC — ALL RIGHTS RESERVED</span>
  </div>

  <span className="aiuc-footer-corner aiuc-footer-corner-bl">
    <svg fill="none" stroke="currentColor" strokeWidth="1" viewBox="0 0 12 12" width="12" height="12">
      <line x1="0" x2="12" y1="6" y2="6" />

      <line x1="6" x2="6" y1="0" y2="12" />
    </svg>
  </span>

  <span className="aiuc-footer-corner aiuc-footer-corner-br">
    <svg fill="none" stroke="currentColor" strokeWidth="1" viewBox="0 0 12 12" width="12" height="12">
      <line x1="0" x2="12" y1="6" y2="6" />

      <line x1="6" x2="6" y1="0" y2="12" />
    </svg>
  </span>
</div>