Corpus

Questions about AI rules, answered

Short, sourced answers to the questions people ask about AI rules, each linked to the rule behind it.

Questions120

Groups7

Checked21 Oct 2026

01 / Cross-jurisdiction

Cross-jurisdiction

SBOMWhat goes in an SBOM for a federal AI deployment?AI Citation SanctionsCan I be sanctioned for AI-hallucinated citations?AI Citation SanctionsWhat was Johnson v. Dunn and what does it mean for AI legal tools?AI Citation SanctionsDoes having an AI policy protect my firm from sanctions?AI Citation SanctionsHow do I verify AI legal research before filing?Proctoring FairnessCan automated proctoring software violate Section 504 / the ADA?Proctoring FairnessHow do we audit a remote-proctoring tool deployment for disability disparate impact?Proctoring FairnessWhat audit evidence does a district CIO need before buying an AI grader?

02 / European Union

European Union

EU AI ActWhen does the EU AI Act apply to high-risk systems?EU AI ActWhat is EU AI Act post-market monitoring?EU GPAI Code of PracticeIs the EU GPAI Code of Practice mandatory?

03 / International

International

ISO/IEC 42001Is ISO/IEC 42001 certification required for federal AI?SCITTIs SCITT a final standard yet?ISO/IEC 42001 · Annex AHow does ISO 42001 Annex A map to an AI audit?GMLPWhat are the 10 Good Machine Learning Practice (GMLP) principles?

04 / Other national jurisdictions

Other national jurisdictions

UK Pro-Innovation AIDoes the UK have an AI law?UK Pro-Innovation AIIs Canada's AIDA in force?China AI LabellingWhat does China require for labelling AI-generated content?China AI LabellingHow long must China AI labelling records be kept?India IT Rules (SGI)What is synthetically generated information under India's IT Rules?India IT Rules (SGI)How fast must synthetic content be taken down in India?Korea AI Framework ActWhat does Korea's AI Framework Act require of generative AI?Korea AI Framework ActWhen do Korea's AI Framework Act penalties begin?

05 / US federal

US federal

NIST AI RMFHow does an evidence record map to NIST AI RMF?OMB M-25-21/22What's the difference between OMB M-25-21 and M-25-22?DoW RAI S&IPWhat does the CDAO RAI Toolkit / GenAI Guardrails require for fielded models?EO 14179Did EO 14179 replace the Biden AI executive order?EO 14179What is the AI Action Plan and does it create testing duties?SHA-256 / FIPS 180-4How does SHA-256 pinning make an AI audit record tamper-evident?CMMCIs CMMC required now, or is it still being phased in?CMMCWhen does CMMC Level 2 certification become mandatory in contracts?CMMCWhat evidence does a C3PAO expect for AI under CMMC Level 2?CMMCHow do I show AI model behavior evidence for NIST SP 800-171 controls?ATOHow do I get an ATO for a generative AI capability under the AI RCC pilots?DFARS 252.204-7012Does DFARS 252.204-7012 apply to AI systems handling CUI?HHS §1557Is the HHS §1557 patient-care-decision-support-tools rule still in effect in 2026?HHS §1557How do I audit a clinical algorithm for §1557 nondiscrimination?HHS §1557What's the difference between §1557's algorithm provision and its gender-identity provisions?FRE 702Does AI output have to meet FRE 702 reliability standards?FRE 702What did the 2023 FRE 702 amendment change for expert testimony?FERPADoes FERPA let us put student records into an AI tutor?Title VIHow do we audit an AI admissions tool for Title VI disparate impact?NIST AI RMF · GOVERNWhat does a NIST AI RMF GOVERN program look like for a federal agency?NIST AI RMF · MEASUREWhat ongoing-monitoring evidence does M-25-21 expect?NIST AI RMF · MEASUREWhich NIST AI RMF MEASURE subcategories can a third party evidence?NIST AI RMF · MEASUREDoes NIST AI RMF require independent / third-party evaluation?OMB M-25-21How do I prove pre-deployment testing for a federal AI system?OMB M-25-22What AI clauses must federal contracts include after Sept 2025?OMB M-25-22How do I prevent AI vendor lock-in in a federal contract?High-Impact AIWhat does OMB M-25-21 require for high-impact AI?High-Impact AIWhat counts as "high-impact AI" under the federal AI memo?SSDF · Protect Software (PS)How does SLSA provenance satisfy SSDF requirements?NIST 800-53 · AUWhich NIST 800-53 controls cover AI audit logging?FedRAMPWhat is FedRAMP 20x and how does it change the FedRAMP Certification path?FedRAMPHow do I produce machine-readable KSI / continuous-monitoring evidence?FedRAMPWhat's the difference between an agency ATO and FedRAMP Certification?FedRAMPIs FedRAMP High enough for DoD, or do I also need an Impact Level?DoW IL5 / IL6Which DoD Impact Level do I need — IL4, IL5, or IL6 — for my AI workload?RMF (SP 800-37)What are the steps in the RMF (SP 800-37) authorization lifecycle?RMF (SP 800-37)How does SHA-256 pinning support continuous monitoring under RMF?ITARDoes auditing my model risk an ITAR deemed-export of the weights?ITARAre AI model outputs considered ITAR or EAR controlled technical data?EARAre AI model weights subject to EAR export controls?SCIF / Air-Gap PostureCan I run a compliance audit on an air-gapped or SCIF AI system?SCIF / Air-Gap PostureHow do I deploy AI evidence collection at IL5/IL6 without network egress?SCIF / Air-Gap PostureCan a third party recompute my evidence record without my model?CMSCan a Medicare Advantage plan use AI to deny coverage?CMSHow do I show my utilization-management algorithm assessed the individual patient?ONC HTI-1When did the ONC HTI-1 predictive-DSI requirements take effect?ONC HTI-1How do I demonstrate FAVES for a predictive DSI?ONC HTI-1How can an AI tool deployment audit produce one evidence record across HTI-1, §1557, FDA PCCP, and CMS at once?DSI Source AttributesWhat are the 31 source attributes required for predictive DSI under HTI-1?DSI Source AttributesDo I have to keep HTI-1 source attributes updated, and how often?FDA PCCPWhat goes in an FDA Predetermined Change Control Plan (PCCP)?FDA PCCPCan I update my AI model after 510(k) clearance without a new submission?FDA PCCPHow do I prove my AI model hasn't drifted since validation?FDA SaMD 510(k)/De NovoDoes my AI feature need FDA 510(k) or De Novo clearance?HIPAA Security RuleIs an ambient AI scribe a HIPAA business associate, and what does the 2025 Security Rule NPRM change?HIPAA Security RuleDoes the proposed HIPAA Security Rule require encryption and MFA for AI systems?FRE 707 (proposed)Is AI-generated evidence admissible in federal court?FRE 707 (proposed)What is proposed Federal Rule of Evidence 707?FRE 707 (proposed)When does FRE 707 take effect?FRE 707 (proposed)How do I lay a reliability foundation for an AI model's output?FRE 707 (proposed)Can an audit record prove my AI tool is reliable enough for court?Section 504Can a generative AI tool legally write Section 504 plans?Section 504What's the difference between Section 504 and IDEA for AI accommodation tools?IDEAHow do we audit an AI special-ed eligibility tool for IDEA integrity?COPPADoes the 2025 COPPA amendment apply to our ed-tech tutor product?COPPAHow do we prove an under-13 AI tutor didn't retain student data after the 2025 COPPA Rule?COPPAIs there a COPPA school-authorization exception for ed-tech in 2026?OCR AI GuidanceWhat does ED OCR's AI guidance require schools to check for?OCR AI GuidanceHow do we show OCR we measured our school AI for discrimination?OCR AI GuidanceHow do we show an early-warning / dropout-prediction model's results across cohorts?

06 / US professional guidance

US professional guidance

ABA Formal Op. 512What does ABA Formal Opinion 512 require of lawyers using AI?ABA Formal Op. 512Do I need a client's consent to put their info into an AI tool?ABA Formal Op. 512How do I show competence (MR 1.1) in the AI tools my firm uses?

07 / US states

US states

FSMB AI / state boardsWho is liable when a physician follows an AI recommendation that causes harm?FSMB AI / state boardsWhat do state medical boards say about using AI in clinical decisions?FSMB AI / state boardsDo I need patient consent to use AI in a clinical encounter?State Bar AI OpinionsWhat are the state bar rules on using AI as a lawyer?State Bar AI OpinionsWhat does the California / Florida / Texas bar say about AI?State Bar AI OpinionsDo I have to disclose to a client or court that I used AI?State Bar AI OpinionsHow does a GC evaluate an outside AI legal-tech vendor?SOPIPADoes SOPIPA stop our ed-tech vendor from training AI on student data?SOPIPAWhich states have SOPIPA-style student-data-privacy laws?NYC Local Law 144What is NYC Local Law 144 bias audit?NYC Local Law 144Who can perform a Local Law 144 bias audit?NYC Local Law 144How much is the NYC AEDT audit penalty?Colorado AI ActIs the Colorado AI Act still in effect?Colorado AI ActWhen does the Colorado AI Act take effect?Colorado AI ActWhich states have comprehensive AI laws?Colorado AI ActWill federal law preempt state AI laws?Texas TRAIGAWhen does Texas TRAIGA take effect?Texas TRAIGADoes Texas require an AI impact assessment?Utah AI Policy ActDoes Utah require AI disclosure?Illinois HB 3773What does Illinois HB 3773 require employers to do?California AI TransparencyDoes California require AI training-data disclosure?California AI TransparencyWhen does California SB 942 take effect?California AI TransparencyWhat is California SB 53 frontier AI law?California AI TransparencyDo CCPA ADMT rules require a risk assessment?