Home / Rules

The rules that apply to you

The draft is guidance. The obligations an AI governance lead already carries come from the AIMS standard, the AI risk guidance and the law of each market. This page names the held frameworks per market, in market order, and says plainly where a regime is not held.

The record this product reads

ISO/IEC 42001:2023, 38 Annex A controls, and ISO/IEC 23894:2023, 54 units. Every requirement page states one of them in our words and cites the clause. Open the record.

Three questions the record raises for an AIMS

Scope: does the certification scope of the AI management system include every generative AI system in use, including one embedded in bought software? Clause 4.3 of ISO/IEC 42001 is named here, not stated.
Internal audit: does the audit programme cover the generative AI use, and can it show the risk assessment and the treatment evidence? Internal audit is main-body clause 9.2, read with the AIMS audit programme.
Comparison with ISO/IEC 27001: where the organisation already holds an information security management system, which Annex A controls can reuse the existing evidence, and which need a generative AI specific record? The comparison is a mapping decision for the organisation, and the record cites the controls so the decision can be checked.

What is out of scope here

This page does not decide applicability under any law and does not restate a statute. It names the held frameworks so the boundary of the record is visible. A market with no held framework keeps its section and says so.

United States

NIST AI Risk Management Framework (AI RMF 1.0), 72 controls, held
NIST AI 600-1: Generative AI Profile, 8 controls, held
Colorado Artificial Intelligence Act (proposed SB 24-205), 19 controls, held and labelled proposed

The federal AI risk framework and its generative AI profile are the primary reference. The state Act is named as proposed, which is how the record holds it.

Scan: grounding_scan.py us "AI system,automated decision,privacy,personal data,employment,health,safety"

European Union

EU AI Act, 43 controls, held
GDPR, 41 controls, held

The AI Act sets duties on providers and deployers by risk tier, and the GDPR applies to the personal data in prompts and outputs. Both run on their own dates and neither is changed by the draft.

Scan: grounding_scan.py eu "AI system,automated decision,privacy,personal data,employment,health,safety"

United Kingdom

UK AI Regulation Framework, 12 controls, held
UK GDPR (UK General Data Protection Regulation), 44 controls, held

The UK framework is principles based and regulator led, and the UK GDPR applies to personal data. Neither is displaced by the draft.

Scan: grounding_scan.py uk "AI system,automated decision,privacy,personal data,employment,health,safety"

Australia

Australia Guidance for AI Adoption (2025), 74 controls, held
Australia AI Ethics Framework, 8 controls, held

The national AI guidance and ethics framework are the held references. The Privacy Act 1988 is named in the record but its controls are placeholder only in our holdings, so this site does not state it.

Scan: grounding_scan.py au "AI system,automated decision,privacy,personal data,employment,health,safety"

What this page is not

It is not a legal register and it does not state the text of any law. It names the frameworks the record holds for each market so a reader can see the boundary of what this product covers. Where a market's regime is not held, it is named rather than paraphrased.

Not legal advice; does not certify.