Every jurisdiction your AI touches adds another law, standard, or supervisory expectation. AxiLayer AI maintains a single controls-and-evidence model mapped across all of them, so an assessment performed once produces documentation reusable everywhere, from Brussels to Washington to Seoul.
The world's first comprehensive AI law. Risk-tiered obligations for providers and deployers of AI systems placed on the EU market, with penalties up to €35M or 7% of global turnover.
High-risk obligations apply from 2 Dec 2027 (Annex III) EU · Financial servicesOperational-resilience obligations for EU financial entities, including the AI and ICT systems they run and the third-party providers behind them.
In application since Jan 2025 EU · Data protectionLawful-basis, transparency, and automated-decision-making requirements that apply to AI systems processing personal data, alongside the AI Act.
In force since 2018The de facto US standard for trustworthy AI: Govern, Map, Measure, Manage, plus the Generative AI Profile (NIST-AI-600-1) for GenAI-specific risk.
AI RMF 1.0 · GenAI Profile 2024 US · ColoradoReplaced the original Colorado AI Act (SB 24-205) in May 2026. Notice, explanation of adverse decisions and human review for automated decisions in seven consequential domains.
Applies from 1 Jan 2027 US · TexasThe Texas Responsible AI Governance Act, prohibited-use and governance obligations for AI systems operated in or affecting Texas.
State AI governance statute US · Federal cloudSecurity authorization for cloud services sold to US federal agencies, the baseline any government-facing AI platform must clear.
Government authorization regime US · HealthcarePrivacy and security rules governing protected health information, decisive for clinical AI, payer models, and health-data pipelines.
Sector privacy law US · CaliforniaCalifornia consumer-privacy rights, including emerging rules on automated decision-making technology that reach AI-driven profiling.
State privacy lawKorea's comprehensive AI statute, high-impact AI classification, transparency, and safety obligations, in force 22 January 2026.
In force Jan 2026 SingaporeIMDA's governance framework and the AI Verify testing toolkit, the reference point for demonstrating trustworthy AI across ASEAN.
Voluntary framework + test toolkit JapanJapan's innovation-first statute paired with METI/ISO-aligned business guidelines that enterprises are expected to evidence in practice.
Soft-law + 2025 statute ChinaCAC's binding measures for public-facing generative AI in China, security assessment, content, and data-sourcing obligations, plus PIPL.
Binding since Aug 2023 CanadaAIDA lapsed in January 2025. The federal directive (amended June 2025) governs government automated decisions, OSFI E-23 covers bank models from May 2027, and Bill C-36 (June 2026) proposes transparency for automated decisions.
Directive in force · C-36 tabled BrazilBrazil's general data-protection law and the risk-based AI bill advancing through Congress on the EU model.
LGPD in force · AI bill advancing United KingdomPrinciples-based expectations enforced through existing regulators (ICO, FCA, MHRA), backed by the AI Security Institute's evaluation work.
Regulator-led principlesThe first certifiable management-system standard for AI. The organizational backbone that makes EU AI Act and NIST AI RMF evidence sustainable.
Certifiable AIMS standard ISO/IEC · RiskRisk-management guidance specific to AI, extending ISO 31000 into model, data, and lifecycle risk.
Guidance standard ISO/IEC · ImpactGuidance for assessing an AI system's impact on individuals and societies, the method behind credible FRIA and impact-assessment work.
Guidance standard ISO/IEC · Audit bodiesThe requirements governing the bodies that audit and inspect AI management systems, the standards AxiLayer AI aligns its own assessment practice to.
Conformity-assessment standards ISO/IEC · SecurityInformation-security management and trust-services criteria, the security substrate every AI assurance program is expected to stand on.
Security & trust standardsVulnerability and incident reporting for products with digital elements, including AI, at 24 and 72 hours.
Reporting from 11 Sep 2026Software and AI become products, with disclosure duties and presumptions of defect.
Transposition by 9 Dec 2026Safety components with self-evolving machine learning need third-party conformity assessment.
Applies 20 Jan 2027One combined assessment for AI medical devices under device law and the AI Act.
Device AI duties 2 Aug 2028Risk management and incident reporting for essential and important entities running AI.
Transposed from Oct 2024The first binding international AI treaty, on human rights, democracy and the rule of law.
EU ratified 15 May 2026Chief AI Officers, high-impact AI practices, AI contract terms and unbiased AI principles for LLM purchases.
Issued Apr and Dec 2025Fed, OCC and FDIC guidance that replaced SR 11-7: conceptual soundness, outcomes analysis, ongoing monitoring.
Issued 17 Apr 2026Annual bias audit by an outside auditor for automated employment decision tools, with a public summary.
In force since Jul 2023Anti-bias testing counts in discrimination claims; frontier AI frameworks and incident reports.
Oct 2025 and Jan 2026No discriminatory AI in employment decisions, and notice when AI is used.
In force 1 Jan 2026Written AI program, internal audit and vendor oversight for insurers, adopted across more than 20 jurisdictions.
Since Dec 2023Deployers of AI controlling critical infrastructure need a risk policy considering NIST AI RMF or ISO/IEC 42001.
State statute, 2025High, medium and low risk tiers, with conformity assessment before deployment for high-risk AI.
In force 1 Mar 2026Principles including fairness and accountability; high-risk AI to be defined by sector regulators.
In force 14 Jan 2026Labels and provenance metadata for synthetic content; data protection duties from 13 May 2027.
In force 20 Feb 2026Visible and metadata labels on AI content; first AI provision in national law.
Sep 2025 and Jan 2026Six governance practices; automated decision transparency in privacy policies.
ADM rules from 10 Dec 2026Risk bounding, human accountability and baseline testing for AI agents.
Launched 22 Jan 2026Risk assessment, testing and periodic internal AI audits.
2024 to 2026Register of autonomous systems; certification regime anticipated in 2026.
Enacted 2023Prior approval of AI systems, risk management and an AI register for licensed firms.
Issued 5 Sep 2024Ethics principles plus a 2026 draft policy that includes AI testing requirements.
Draft consulted Apr 2026Fairness and oversight principles; a new federal authority to set standards.
2024 and Jun 2026Calls for legal frameworks against AI bias and misuse across member states.
Endorsed Jul 2024National direction on ethics, inclusion and AI capacity.
2025High-risk uses in health, education, hiring and credit, with bias prevention and three-year records.
Published 9 Sep 2025EU-style risk tiers, risk management and post-market monitoring.
In the SenateNational AI policy and a risk-based bill with impact assessments.
2025 to 2026No general AI law yet; reforms to let Congress legislate are pending.
PendingGuidance on security threats and compromises affecting AI systems.
Under publication, Oct 2026Baseline security requirements: 13 principles across five lifecycle phases.
Published Jan 2026The first AI Act standard to clear the formal vote; not yet cited in the Official Journal.
Approved 12 Jul 2026A documented bias profile across the AI lifecycle.
Published Jan 2025Safety assurance for AI in vehicles; global rules for automated driving systems.
Dec 2024 and Jun 2026The security risk lists most generative and agentic AI testing maps to.
2025 and Dec 2025243 controls across 18 domains, and an assurance program built on them.
Jul and Oct 2025Most organizations discover these frameworks one enforcement letter at a time. The result is five parallel compliance projects, five documentation sets, and five invoices, for one AI system. AxiLayer AI's approach is different: our assessment methodology maps each control we test to every framework that requires it, so a single engagement produces an evidence base you can present to an EU market-surveillance authority, a US regulator, a Korean ministry, or an enterprise procurement team.
The register above is maintained continuously. When a framework changes, a new harmonized standard under the EU AI Act, a new profile under the NIST AI RMF, an amendment to a state statute, the mapping is updated and, for clients running AxiSentinel, monitored obligations update with it.
Start with the framework that is binding for you today, and read how the others connect from there. If you are unsure which frameworks apply to your systems, that scoping question is exactly what a third-party AI audit answers first.
A scoping briefing takes under an hour and produces a jurisdictional exposure map for your AI portfolio, no obligation.
