Relevant laws and regulatory requirements are known, documented and managed.
Baseline
Applies to every organization that uses AI, regardless of size or sector.
Why
AI use is subject to both well-known regulations such as the GDPR and more recent regulations such as the EU AI Act, which bans certain AI practices outright. Obligations differ depending on whether the organization is purely a deployer or supplier/developer of AI systems.
How
An inventory of laws and regulations applicable to AI should be integrated into existing registers. Ensure that the inventory of laws and regulations (and the dates that specific clauses go into effect if applicable) is updated annually and that the last review date is noted.
Sources
- NIST AI RMF GOVERN 1.1
- AI Act Art. 5