Regulation library
Every regime. Every date.
The regulations that put duties on AI systems, each mapped to the record that proves the duty and the date it takes effect. Start from a deadline, a jurisdiction, or a workflow.
01 ·
Aug 2, 2026.
the laws that bind first — enforceable, two continents, one day
02 ·
US AI laws.
state and federal AI-specific statutes
Colorado AI Act
SB 24-205 → SB 26-189 lineage · high-risk notice/transparency (eff 2027-01-01)
NYC Local Law 144
AEDT bias-audit mandate — evidence records an independent auditor can verify
Texas TRAIGA
HB 149 intent-based AI governance (eff 2026-01-01)
Utah AI Policy Act
SB 149 / SB 226 disclosure-on-request for generative AI
Illinois HB 3773
IHRA AI-employment non-discrimination + notice (eff 2026-01-01)
EO 14179
Removing Barriers to American Leadership in AI (Jan 2025)
OMB M-25-21/22
federal AI risk-management + acquisition
High-Impact AI
M-25-21 risk class · 7 minimum practices · the pre-deployment testing obligation
03 ·
Frameworks and standards.
what you show an auditor
NIST AI RMF
NIST AI 100-1 · Govern · Map · Measure · Manage
ISO/IEC 42001
international AI management system standard
FedRAMP
Federal cloud certification · CR26 package evidence + 20x machine-readable KSIs
NIST SP 800-53 Rev. 5
controls baseline · 20 families · AI overlays
SSDF SP 800-218
Secure Software Development Framework
SLSA v1.0
supply-chain levels for software artifacts
SBOM
software bill of materials · NTIA + CISA
FIPS 140-3
crypto module validation · 4 security levels
SCITT
supply-chain integrity, transparency, trust · IETF
C-SCRM
supply-chain risk · NIST SP 800-161r1
04 ·
Health.
HIPAA, FDA, and clinical AI duties
HIPAA
health privacy · patient data confidentiality
HIPAA Security Rule
ePHI safeguards · 2025 NPRM cyber-modernization (PROPOSED)
FDA PCCP / SaMD
Predetermined Change Control · medical AI
FDA SaMD 510(k)/De Novo
clearance pathway for AI/ML device software functions
HHS §1557
ACA non-discrimination in patient-care AI
CMS
Medicare/Medicaid coverage · algorithm cannot be the sole basis to deny care
ONC HTI-1
predictive-DSI transparency · 31 source attributes · FAVES
FSMB AI / state boards
physician-responsibility · standard-of-care · state medical-board AI policy
05 ·
Defense.
export control and DoD posture
ITAR
USML technical-data control · deemed-export boundary for model artifacts
EAR
Dual-use export control (EAR99 / CCL) · AI-diffusion chip + weight controls
DFARS 252.204-7012
CUI handling · 72-hour breach reporting
CMMC
Cybersecurity Maturity Model · L1 · L2 · L3
DoW RAI S&IP
Responsible · Equitable · Traceable · Reliable · Governable
DoW IL5 / IL6
Impact Levels 5-6 · NSS + Classified-to-Secret · air-gapped delivery
SCIF / Air-Gap Posture
Offline / SCIF deployment · evidence check with no network egress
06 ·
Legal.
the lawyer's supervision duty
ABA Formal Op. 512
generative-AI duties · competence · confidentiality · candor · supervision
ABA Model Rules
Rule 1.1 · 1.6 · 3.3 · 5.1–5.3 · Op 512
FRE 702
expert testimony · reliability gatekeeping
FRE 707 (proposed)
machine-generated evidence · Rule-702-grade reliability for AI output (PROPOSED)
AI Citation Sanctions
hallucinated-authority sanctions wave · Rule 11 / 9011 · candor-to-tribunal
State Bar AI Opinions
CA · FL · TX · NY · PA · NC bar gen-AI ethics guidance roundup
07 ·
Education.
student-data and scoring duties
FERPA
education records · student-data privacy
COPPA
under-13 data · 2025 amended Rule · ed-tech consent & retention
IDEA
special-ed · IEP integrity · AI in eligibility & service determinations
Title VI
Civil Rights · disparate-impact disclosure
Section 504
disability nondiscrimination · FAPE · AI in accommodation determinations
SOPIPA
student-data-privacy model law · 20+ state adoptions · no-profiling
Proctoring Fairness
automated proctoring/grading · §504 disparate-impact across cohorts
08 ·
US states.
50 state pages, each with its AI-law status · all 50 in the A–Z →
09 ·
More ways in.
the same library, sliced differently
API path
Try the evidence path in the sandbox.
The Console shows the sealed evidence and lets anyone verify a record; the Docs carry the endpoints behind it.