GRCLibrary.ai

Standards & frameworks

The standards and frameworks in the canonical citations register.

258 citations across 22 register sections, every entry and edition read from the canonical citations register at build time.

Every entry below is read at build time from the canonical citations register, the library's single source of truth for external citations: the Standard ID with the current version the library cites, its topic, and the register's upstream check location. The crosswalk maps 19 instruments in depth, and an entry whose instrument has a crosswalk page links it. Every row is cited with the edition the register records, and with the register's upstream check location where one is recorded.

The library is aligned to these instruments, not certified against them; adopting the documents confers no certification, attestation, or legal opinion. Until a row is verified under the citation verification specification, it carries no recorded provenance beyond being written into the register.

32 citations

ISO / IEC standards

71 citations

NIST publications

  • NIST SP 800-34 Contingency Planning Guide for Federal Information Systems. Current version: Rev. 1. Upstream check location: https://csrc.nist.gov/pubs/sp/800/34/r1/final (opens in a new tab).
  • NIST SP 800-53 Security and Privacy Controls for Information Systems and Organizations. Current version: Rev. 5. Upstream check location: https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final (opens in a new tab). Mapped in the crosswalk: NIST SP 800-53 Rev. 5.
  • NIST SP 800-53A Assessing Security and Privacy Controls in Information Systems and Organizations. Current version: Rev. 5. Upstream check location: https://csrc.nist.gov/pubs/sp/800/53/a/r5/final (opens in a new tab).
  • NIST SP 800-61 Incident Response Recommendations and Considerations for Cybersecurity Risk Management (CSF 2.0 Community Profile). Current version: Rev. 3. Upstream check location: https://csrc.nist.gov/pubs/sp/800/61/r3/final (opens in a new tab).
  • NIST SP 800-63B Digital Identity Guidelines: Authentication and Authenticator Management (part of SP 800-63 Rev. 4 family). Current version: Rev. 4. Upstream check location: https://csrc.nist.gov/pubs/sp/800/63/b/4/final (opens in a new tab).
  • NIST SP 800-88 Media sanitization (Rev. 2 reframes around an enterprise media-sanitization programme and defers sanitization-technique detail to IEEE 2883, NSA specifications, or an organizationally-approved standard, retaining only cryptographic erase directly). Current version: Rev. 2. Upstream check location: https://csrc.nist.gov/pubs/sp/800/88/r2/final (opens in a new tab).
  • NIST SP 800-207 Zero Trust Architecture. Current version: 2020. Upstream check location: https://csrc.nist.gov/pubs/sp/800/207/final (opens in a new tab).
  • NIST CSF Cybersecurity Framework. Current version: 2.0. Upstream check location: https://www.nist.gov/cyberframework (opens in a new tab). Mapped in the crosswalk: NIST CSF 2.0.
  • NIST AI RMF AI Risk Management Framework (NIST announced a revision of AI RMF 1.0 under the White House AI Action Plan, with no version or date given; 1.0 remains current). Current version: 1.0. Upstream check location: https://www.nist.gov/itl/ai-risk-management-framework (opens in a new tab). Mapped in the crosswalk: NIST AI RMF 1.0.
  • NIST Privacy Framework A Tool for Improving Privacy through Enterprise Risk Management (identifier NIST.CSWP.01162020; Version 1.1 is an Initial Public Draft, not yet finalized). Current version: 1.0. Upstream check location: https://www.nist.gov/privacy-framework (opens in a new tab).
  • NIST AI 600-1 Generative AI Profile for AI RMF. Current version: 1.0. Upstream check location: https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence (opens in a new tab).
  • NIST SP 800-208 Recommendation for Stateful Hash-Based Signature Schemes (stateful hash-based digital signatures: LMS and XMSS, with the HSS and XMSS-MT multi-tree variants). Current version: 2020. Upstream check location: https://csrc.nist.gov/pubs/sp/800/208/final (opens in a new tab).
  • NIST SP 800-218 Secure Software Development Framework (SSDF) (SSDF version 1.0 preceded this Version 1.1; a 2020 NIST Cybersecurity White Paper on the SSDF has identifier NIST.CSWP.04232020; 1.0 is listed as superseded so the linter flags citations of it). Current version: 1.1. Upstream check location: https://csrc.nist.gov/pubs/sp/800/218/final (opens in a new tab).
  • NIST SP 800-161 Cybersecurity Supply Chain Risk Management. Current version: Rev. 1. Upstream check location: https://csrc.nist.gov/pubs/sp/800/161/r1/upd1/final (opens in a new tab).
  • NIST SP 800-82 Guide to Operational Technology (OT) Security (formerly Guide to Industrial Control Systems Security). Current version: Rev. 3. Upstream check location: https://csrc.nist.gov/pubs/sp/800/82/r3/final (opens in a new tab).
  • NIST FIPS 198-1 The Keyed-Hash Message Authentication Code (HMAC) (NIST has proposed withdrawing it in favour of SP 800-224, which is an initial public draft; FIPS 198-1 remains the approved standard). Upstream check location: https://csrc.nist.gov/pubs/fips/198-1/final (opens in a new tab).
  • NIST SP 800-185 SHA-3 Derived Functions: cSHAKE, KMAC, TupleHash and ParallelHash (NIST announced a revision in 2025; the 2016 final remains current). Current version: 2016. Upstream check location: https://csrc.nist.gov/pubs/sp/800/185/final (opens in a new tab).
  • NIST SP 800-84 Guide to Test, Training, and Exercise Programs for IT Plans and Capabilities. Current version: 2006. Upstream check location: https://csrc.nist.gov/pubs/sp/800/84/final (opens in a new tab).
  • NIST SP 800-184 Guide for Cybersecurity Event Recovery. Current version: 2016. Upstream check location: https://csrc.nist.gov/pubs/sp/800/184/final (opens in a new tab).
  • NIST SP 800-30 Guide for Conducting Risk Assessments. Current version: Rev. 1. Upstream check location: none recorded.
  • NIST SP 800-37 Risk Management Framework for Information Systems and Organizations. Current version: Rev. 2. Upstream check location: none recorded.
  • NIST SP 800-38D Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC. Current version: 2007. Upstream check location: none recorded.
  • NIST SP 800-38F Recommendation for Block Cipher Modes of Operation: Methods for Key Wrapping. Current version: 2012. Upstream check location: none recorded.
  • NIST SP 800-39 Managing Information Security Risk: Organization, Mission, and Information System View. Current version: 2011. Upstream check location: none recorded.
  • NIST SP 800-40 Guide to Enterprise Patch Management Planning. Current version: Rev. 4. Upstream check location: none recorded.
  • NIST SP 800-41 Guidelines on Firewalls and Firewall Policy. Current version: Rev. 1. Upstream check location: none recorded.
  • NIST SP 800-46 Guide to Enterprise Telework, Remote Access, and Bring Your Own Device (BYOD) Security. Current version: Rev. 2. Upstream check location: none recorded.
  • NIST SP 800-47 Managing the Security of Information Exchanges. Current version: Rev. 1. Upstream check location: none recorded.
  • NIST SP 800-50 Building a Cybersecurity and Privacy Learning Program (supersedes SP 800-50 of October 2003 and SP 800-16). Current version: Rev. 1. Upstream check location: none recorded.
  • NIST SP 800-52 Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations. Current version: Rev. 2. Upstream check location: none recorded.
  • NIST SP 800-55 Vol. 1 Measurement Guide for Information Security: Volume 1, Identifying and Selecting Measures (with Vol. 2, supersedes SP 800-55 Rev. 1 of July 2008). Current version: 2024. Upstream check location: none recorded.
  • NIST SP 800-55 Vol. 2 Measurement Guide for Information Security: Volume 2, Developing an Information Security Measurement Program (with Vol. 1, supersedes SP 800-55 Rev. 1 of July 2008). Current version: 2024. Upstream check location: none recorded.
  • NIST SP 800-57 Part 1 Recommendation for Key Management, Part 1: General. Current version: Rev. 5. Upstream check location: none recorded.
  • NIST SP 800-57 Part 2 Recommendation for Key Management, Part 2: Best Practices for Key Management Organizations. Current version: Rev. 1. Upstream check location: none recorded.
  • NIST SP 800-57 Part 3 Recommendation for Key Management, Part 3: Application-Specific Key Management Guidance. Current version: Rev. 1. Upstream check location: none recorded.
  • NIST SP 800-63 Digital Identity Guidelines (base volume of the SP 800-63 Rev. 4 family; publisher identifier SP 800-63-4). Current version: Rev. 4. Upstream check location: none recorded.
  • NIST SP 800-63A Digital Identity Guidelines: Identity Proofing and Enrollment (part of SP 800-63 Rev. 4 family; publisher identifier SP 800-63A-4). Current version: Rev. 4. Upstream check location: none recorded.
  • NIST SP 800-66 Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule. Current version: Rev. 2. Upstream check location: none recorded.
  • NIST SP 800-83 Guide to Malware Incident Prevention and Handling for Desktops and Laptops. Current version: Rev. 1. Upstream check location: none recorded.
  • NIST SP 800-86 Guide to Integrating Forensic Techniques into Incident Response. Current version: 2006. Upstream check location: none recorded.
  • NIST SP 800-90B Recommendation for the Entropy Sources Used for Random Bit Generation. Current version: 2018. Upstream check location: none recorded.
  • NIST SP 800-92 Guide to Computer Security Log Management. Current version: 2006. Upstream check location: none recorded.
  • NIST SP 800-94 Guide to Intrusion Detection and Prevention Systems (IDPS). Current version: 2007. Upstream check location: none recorded.
  • NIST SP 800-95 Guide to Secure Web Services. Current version: 2007. Upstream check location: none recorded.
  • NIST SP 800-111 Guide to Storage Encryption Technologies for End User Devices. Current version: 2007. Upstream check location: none recorded.
  • NIST SP 800-115 Technical Guide to Information Security Testing and Assessment. Current version: 2008. Upstream check location: none recorded.
  • NIST SP 800-116 Guidelines for the Use of PIV Credentials in Facility Access. Current version: Rev. 1. Upstream check location: none recorded.
  • NIST SP 800-124 Guidelines for Managing the Security of Mobile Devices in the Enterprise. Current version: Rev. 2. Upstream check location: none recorded.
  • NIST SP 800-128 Guide for Security-Focused Configuration Management of Information Systems (includes updates as of 2019-10-10). Current version: 2011. Upstream check location: none recorded.
  • NIST SP 800-130 A Framework for Designing Cryptographic Key Management Systems. Current version: 2013. Upstream check location: none recorded.
  • NIST SP 800-131A Transitioning the Use of Cryptographic Algorithms and Key Lengths. Current version: Rev. 2. Upstream check location: none recorded.
  • NIST SP 800-137 Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations. Current version: 2011. Upstream check location: none recorded.
  • NIST SP 800-137A Assessing Information Security Continuous Monitoring (ISCM) Programs. Current version: 2020. Upstream check location: none recorded.
  • NIST SP 800-150 Guide to Cyber Threat Information Sharing. Current version: 2016. Upstream check location: none recorded.
  • NIST SP 800-152 A Profile for U.S. Federal Cryptographic Key Management Systems (CKMS). Current version: 2015. Upstream check location: none recorded.
  • NIST SP 800-160 Vol. 1 Engineering Trustworthy Secure Systems. Current version: Rev. 1. Upstream check location: none recorded.
  • NIST SP 800-160 Vol. 2 Developing Cyber-Resilient Systems: A Systems Security Engineering Approach. Current version: Rev. 1. Upstream check location: none recorded.
  • NIST SP 800-163 Vetting the Security of Mobile Applications. Current version: Rev. 1. Upstream check location: none recorded.
  • NIST SP 800-171 Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations (Current version from the held OSCAL catalog, which records framework-version-identifier SP_800_171_3_0_0 and describes itself as the "OSCAL representation of the NIST SP 800-171 Rev 3"; the year from the held NIST SP 800-172 Rev. 3, which cites "NIST SP 800-171r3" as published in 2024; confirm the month upstream). Current version: Rev. 3. Upstream check location: none recorded.
  • NIST SP 800-177 Trustworthy Email. Current version: Rev. 1. Upstream check location: none recorded.
  • NIST SP 800-181 Workforce Framework for Cybersecurity (NICE Framework). Current version: Rev. 1. Upstream check location: none recorded.
  • NIST SP 800-188 De-Identifying Government Datasets: Techniques and Governance. Current version: 2023. Upstream check location: none recorded.
  • NIST SP 800-190 Application Container Security Guide. Current version: 2017. Upstream check location: none recorded.
  • NIST SP 800-204 Security Strategies for Microservices-based Application Systems. Current version: 2019. Upstream check location: none recorded.
  • NIST SP 800-204D Strategies for the Integration of Software Supply Chain Security in DevSecOps CI/CD Pipelines. Current version: 2024. Upstream check location: none recorded.
  • NIST SP 800-207A A Zero Trust Architecture Model for Access Control in Cloud-Native Applications in Multi-Cloud Environments. Current version: 2023. Upstream check location: none recorded.
  • NIST SP 800-210 General Access Control Guidance for Cloud Systems. Current version: 2020. Upstream check location: none recorded.
  • NIST SP 800-215 Guide to a Secure Enterprise Network Landscape. Current version: 2022. Upstream check location: none recorded.
  • NIST SP 800-221 Enterprise Impact of Information and Communications Technology Risk. Current version: 2023. Upstream check location: none recorded.
  • NIST SP 800-226 Guidelines for Evaluating Differential Privacy Guarantees. Current version: 2025. Upstream check location: none recorded.
  • NIST SP 1270 Towards a Standard for Identifying and Managing Bias in Artificial Intelligence. Current version: 2022. Upstream check location: none recorded.

2 citations

IEEE standards

  • IEEE 2883-2022 IEEE Standard for Sanitizing Storage (the clear / purge / destruct sanitization methods and technology-specific requirements; the technique standard NIST SP 800-88 Rev. 2 now defers to). Upstream check location: https://standards.ieee.org/ieee/2883/10277/ (opens in a new tab).
  • IEEE 7000-2021 IEEE Standard Model Process for Addressing Ethical Concerns during System Design (processes for eliciting and prioritizing stakeholder ethical values and tracing them through the concept of operations, ethical requirements, and ethical risk-based design; also issued as ISO/IEC/IEEE 24748-7000:2022). Upstream check location: https://standards.ieee.org/ieee/7000/6781/ (opens in a new tab).

2 citations

ETSI standards

  • ETSI EN 304 223 Securing Artificial Intelligence (SAI): baseline cyber security requirements for AI models and systems (13 principles across five lifecycle phases: secure design, development, deployment, maintenance, end of life; the European Norm evolution of the TS 104 223 baseline) V2.0.0 was the 2025-09 draft; TS 104 223 V1.1.1 (2025-04) was the predecessor Technical Specification. Current version: V2.1.1. Upstream check location: https://www.etsi.org/deliver/etsi_en/304200_304299/304223/ (opens in a new tab).
  • ETSI TR 104 128 Securing Artificial Intelligence (SAI): guide to cyber security for AI models and systems (informative implementation guide to the SAI baseline TS 104 223, carried forward into EN 304 223; AI-lifecycle scenarios and examples for the full supply chain). Current version: V1.1.1. Upstream check location: https://www.etsi.org/deliver/etsi_tr/104100_104199/104128/ (opens in a new tab).

14 citations

EU regulations and directives

33 citations

North-American regulations and frameworks

  • US HIPAA Health Insurance Portability and Accountability Act. Current version: 1996 (with HITECH 2009 and Omnibus 2013 amendments); HIPAA Security Rule NPRM issued by HHS OCR on 27 December 2024, published in the Federal Register on 6 January 2025, comment period closed 7 March 2025 with approximately 5,000 comments. The NPRM would (among other changes) make encryption of ePHI and multi-factor authentication mandatory, eliminate the "required vs addressable" implementation-specification distinction, and require an annually-refreshed asset inventory and ePHI network map. Final rule pending as of May 2026. Upstream check location: https://www.hhs.gov/hipaa/for-professionals/security/hipaa-security-rule-nprm/index.html (opens in a new tab).
  • US HITECH Health Information Technology for Economic and Clinical Health Act. Current version: 2009. Upstream check location: https://www.govinfo.gov/app/details/PLAW-111publ5 (opens in a new tab).
  • US SOX Sarbanes-Oxley Act. Current version: 2002. Upstream check location: https://www.govinfo.gov/app/details/PLAW-107publ204 (opens in a new tab).
  • US CCPA California Consumer Privacy Act. Current version: 2018, as amended (CPRA 2020; 2025 CCPA amendments per the held statute: AB 137 (Stats. 2025 Ch. 20, eff. 2025-06-30), AB 1170 (Ch. 67, ss1798.130/140/185, eff. 2026-01-01), and AB 566 (Ch. 465, Opt Me Out Act, eff. 2026-01-01, operative 2027-01-01); held text retrieved 2026-06-27). Upstream check location: https://oag.ca.gov/privacy/ccpa (opens in a new tab).
  • US CCPA Regulations 2026 California Consumer Privacy Act Regulations (11 CCR Div 6 Ch 1); ADMT (Art 11), risk assessments (Art 10), cybersecurity audits (Art 9). Current version: Final regulations effective 1 January 2026 (CCPA updates, cybersecurity audits, risk assessments, ADMT, and insurance), 11 CCR Division 6 Chapter 1, sections 7000-7304; ADMT compliance for a significant decision required no later than 1 January 2027. Upstream check location: https://cppa.ca.gov/regulations/ (opens in a new tab).
  • Illinois BIPA Biometric Information Privacy Act (740 ILCS 14/). Current version: 2008 as amended by Illinois SB 2979 (signed 2 August 2024 and effective immediately), which limits damages to a "single recovery" per BIPA §15(b) and §15(d) violation type per individual and recognizes electronic written release. Upstream check location: https://www.ilga.gov/Legislation/ILCS/Articles?ActID=3004&ChapterID=57 (opens in a new tab).
  • Colorado AI Act Colorado Consumer Protections for Artificial Intelligence (SB 24-205) as re-enacted by SB 26-189. Current version: 2024 (Colorado SB 24-205, signed 17 May 2024). Original effective date 1 February 2026; postponed by Colorado SB 25B-004 (signed 28 August 2025) to 30 June 2026. Enforcement effectively frozen by U.S. District Court for the District of Colorado on 27 April 2026 pending litigation (xAI v. Colorado). Following the Governor's Working Group framework (17 March 2026), the legislature repealed and re-enacted SB 24-205 via Colorado SB 26-189 (Automated Decision-Making Technology), signed into law May 2026, with revised automated-decision-making requirements and a revised effective date of 1 January 2027. Upstream check location: https://leg.colorado.gov/bills/sb24-205 (opens in a new tab).
  • Texas TRAIGA Texas Responsible Artificial Intelligence Governance Act: comprehensive state AI governance (prohibited AI uses, biometric provisions); Attorney-General exclusive enforcement, except Sec. 552.106 state-agency sanctions. Current version: HB 149, 89th Legislature (2025); Texas Business and Commerce Code Chapters 551-552; effective 1 January 2026. Upstream check location: https://capitol.texas.gov/ (opens in a new tab).
  • Illinois HB 3773 Illinois AI in employment: a civil-rights violation for discriminatory AI use in employment decisions and for failure to notify. Current version: Public Act 103-0804; amends the Illinois Human Rights Act (775 ILCS 5); effective 1 January 2026. Upstream check location: https://ilga.gov/ (opens in a new tab).
  • US OMB M-25-21 "Accelerating Federal Use of AI through Innovation, Governance, and Public Trust" (issued 3 April 2025): federal agency AI governance and high-impact AI minimum practices; binds covered agencies, creates no rights or obligations for the public; rescinds OMB M-24-10. Current version: 2025-04. Upstream check location: https://www.whitehouse.gov/omb/information-resources/guidance/memoranda/ (opens in a new tab).
  • US OMB M-25-22 "Driving Efficient Acquisition of Artificial Intelligence in Government" (issued 3 April 2025): federal AI acquisition contract terms (IP and government data, privacy, testing access, lock-in, M-25-21 high-impact compliance); applies from solicitations issued 180 days after issuance; rescinds OMB M-24-18. Current version: 2025-04. Upstream check location: https://www.whitehouse.gov/omb/information-resources/guidance/memoranda/ (opens in a new tab).
  • US OMB M-26-04 "Increasing Public Trust in Artificial Intelligence Through Unbiased AI Principles" (issued 11 December 2025): federal LLM procurement contract requirements and minimum vendor transparency, implementing Executive Order 14319; sunsets 11 December 2027 unless the OMB Director provides otherwise. Current version: 2025-12. Upstream check location: https://www.whitehouse.gov/omb/information-resources/guidance/memoranda/ (opens in a new tab).
  • US EO 14365 Executive Order 14365, "Ensuring a National Policy Framework for Artificial Intelligence" (11 December 2025; 90 FR 58499): federal action on state AI laws (AI Litigation Task Force, evaluation of state laws, BEAD and discretionary-grant conditions, an FCC proceeding and an FTC policy statement, a preemptive legislative recommendation). Current version: 2025-12. Upstream check location: https://www.federalregister.gov/documents/2025/12/16/2025-23092/ensuring-a-national-policy-framework-for-artificial-intelligence (opens in a new tab).
  • US AI Action Plan "America's AI Action Plan" (the White House): United States national AI strategy in three pillars; recommended policy actions, not binding. Current version: 2025-07. Upstream check location: https://www.whitehouse.gov/wp-content/uploads/2025/07/Americas-AI-Action-Plan.pdf (opens in a new tab).
  • NYC Local Law 144 (AEDT) Automated employment decision tools: annual independent bias audit and candidate notice. Current version: Local Law 144 of 2021, implemented by the DCWP final rule 6 RCNY 5-300 to 5-304; effective 1 January 2023 and enforced by the Department of Consumer and Worker Protection from 5 July 2023; in force in 2026. Upstream check location: https://www.nyc.gov/site/dca/about/automated-employment-decision-tools.page (opens in a new tab).
  • US FedRAMP Federal Risk and Authorization Management Program (rev 5 alignment with NIST SP 800-53 Rev. 5). Current version: Rev. 5. Upstream check location: https://www.fedramp.gov/ (opens in a new tab).
  • US CMMC Cybersecurity Maturity Model Certification. Current version: 2.0 (model); the 48 CFR / DFARS acquisition rule took effect 2025-11-10 (Phase 1 live). Upstream check location: https://www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-G/part-170 (opens in a new tab).
  • Canada CPPA / successor C-36 (PPCDA) Consumer Privacy Protection Act (C-27, never enacted); Protecting Privacy and Consumer Data Act (C-36, proposed) PIPEDA remains in force; C-36 would repeal PIPEDA Part 1, rename PIPEDA to the "Electronic Documents Act", and create a Privacy and Consumer Data Commissioner. Current version: CPPA lapsed 2025-01-06 (Bill C-27 died on prorogation); successor Bill C-36 (Protecting Privacy and Consumer Data Act) introduced 2026-06-15, at second reading (proposed, NOT in force). Upstream check location: https://www.parl.ca/legisinfo/en/bill/45-1/c-36 (opens in a new tab).
  • Canada PIPEDA Personal Information Protection and Electronic Documents Act. Current version: 2000, as amended by the Digital Privacy Act, S.C. 2015, c. 32 (last amended 2025-03-04; the official Justice Laws consolidation was current to 2026-09-30 when checked on 2026-10-20). Upstream check location: https://laws-lois.justice.gc.ca/eng/acts/p-8.6/ (opens in a new tab). Mapped in the crosswalk: PIPEDA.
  • Canada Breach of Security Safeguards Regulations PIPEDA breach-of-security-safeguards regulations: prescribed content of OPC reports and individual notifications, and the 24-month breach-record retention obligation (in force 1 November 2018). Current version: SOR/2018-64. Upstream check location: https://laws-lois.justice.gc.ca/eng/regulations/SOR-2018-64/index.html (opens in a new tab).
  • Canada AIDA Artificial Intelligence and Data Act (never enacted) No federal AI law has been enacted. Current version: Lapsed 2025-01-06 (Bill C-27 died on prorogation; per a June 2025 ministerial statement not held in the reference base, AIDA is reported not to return in its original form; confirm directly). Upstream check location: https://www.parl.ca/legisinfo/en/bill/44-1/c-27 (opens in a new tab).
  • Quebec Law 25 Act respecting the protection of personal information in the private sector (Quebec), as amended by Law 25 (S.Q. 2021, c. 25). Current version: CQLR c. P-39.1, as amended by S.Q. 2021, c. 25 (Law 25) (the held LegisQuebec consolidation is updated to 2026-04-01; it is held, not confirmed current upstream). Upstream check location: https://www.legisquebec.gouv.qc.ca/fr/document/lc/p-39.1 (opens in a new tab). Mapped in the crosswalk: Quebec Law 25.
  • Canada TBS Directive on Automated Decision-Making Federal public-sector automated decision-making (binding on federal institutions subject to the Policy on Service and Digital); the Algorithmic Impact Assessment tool. Current version: In force since 1 April 2019 (compliance 1 April 2020); fourth-review amendments announced 8 October 2024, with automated decision systems developed or procured before 24 June 2025 given until 24 June 2026 to meet the updated requirements. Upstream check location: https://www.tbs-sct.canada.ca/pol/doc-eng.aspx?id=32592 (opens in a new tab).
  • Canada Privacy Act Privacy Act: federal public-sector privacy (collection, retention, accuracy, disposal, use, disclosure, personal information banks, access) for government institutions as defined in section 3. Current version: R.S.C. 1985, c. P-21, as amended (last amended 2025-06-02; the official Justice Laws consolidation was current to 2026-09-03 when checked on 2026-09-25). Upstream check location: https://laws-lois.justice.gc.ca/eng/acts/P-21/ (opens in a new tab).
  • Canada TBS Policy on Privacy Protection Treasury Board policy issued under Privacy Act paragraph 71(1)(d); applies to government institutions as defined in section 3 of the Act, except the Bank of Canada. Current version: In effect since 9 October 2024 (replaces the Policy on Privacy Protection dated 26 October 2022). Upstream check location: https://www.tbs-sct.canada.ca/pol/doc-eng.aspx?id=12510 (opens in a new tab).
  • Canada Access to Information Act Access to Information Act: right of access to records under the control of a government institution (Part 1) and proactive publication (Part 2). Current version: R.S.C. 1985, c. A-1, as amended (last amended 2026-06-14; the official Justice Laws consolidation was current to 2026-09-03 when checked on 2026-09-25). Upstream check location: https://laws-lois.justice.gc.ca/eng/acts/A-1/ (opens in a new tab).
  • Canada Access to Information Regulations Access to Information Regulations: including the request form and application fee, transfers, and limits on producing records from machine-readable records. Current version: SOR/83-507, as amended (last amended 2023-06-23; the official Justice Laws consolidation was current to 2026-09-03 when checked on 2026-09-25). Upstream check location: https://laws-lois.justice.gc.ca/eng/regulations/SOR-83-507/ (opens in a new tab).
  • Canada TBS Policy on Access to Information Treasury Board policy issued under Access to Information Act paragraph 70(1)(c); applies to government institutions as defined in section 3 of the Act, except the Bank of Canada. Current version: In effect since 28 June 2023 (replaces the Policy on Access to Information dated 13 July 2022). Upstream check location: https://www.tbs-sct.canada.ca/pol/doc-eng.aspx?id=12453 (opens in a new tab).
  • Canada TBS Directive on Access to Information Requests Treasury Board directive issued under Access to Information Act paragraph 70(1)(c): processing of access requests by government institutions. Current version: In effect since 13 July 2022 (replaces the Interim Directive on the Administration of the Access to Information Act dated 5 May 2016). Upstream check location: https://www.tbs-sct.canada.ca/pol/doc-eng.aspx?id=18310 (opens in a new tab).
  • British Columbia FOIPPA Freedom of Information and Protection of Privacy Act: access to records of British Columbia public bodies (Part 2), protection of privacy including privacy breach notification (Part 3), Information and Privacy Commissioner oversight and reviews (Parts 4 and 5) and offences (Part 5.1). Current version: RSBC 1996, c. 165, as amended (the BC Laws consolidation was current to 2026-09-22 when checked on 2026-09-25, with no text change from the held capture current to 2026-09-15; any change not yet in force is listed in the BC Laws Tables of Legislative Changes). Upstream check location: https://www.bclaws.gov.bc.ca/civix/document/id/complete/statreg/96165_00 (opens in a new tab).
  • Canada OSFI Guideline E-23 Model risk management for federally regulated financial institutions (covers AI and machine-learning models). Current version: Final published 11 September 2025; effective 1 May 2027 (scope expanded to all models at all federally regulated financial institutions, expressly covering AI/ML models). Upstream check location: https://www.osfi-bsif.gc.ca/en/guidance/guidance-library/guideline-e-23-model-risk-management-2027 (opens in a new tab).
  • Ontario EDSTA Ontario public-sector artificial-intelligence accountability. Current version: Enhancing Digital Security and Trust Act, 2024 (Schedule of Bill 194, S.O. 2024, c. 24); Royal Assent 25 November 2024; the artificial-intelligence provisions were proclaimed in force 29 January 2025 by Ontario Order in Council 361/2025 (naming Schedule 1, sections 1 to 16); their AI duties apply and operate in accordance with the prescribing regulations, which an adopter confirms. Upstream check location: https://www.ola.org/en/legislative-business/bills/parliament-43/session-1/bill-194 (opens in a new tab).
  • CAN/DGSI 101:2025 Ethical design and use of artificial intelligence by small and medium organizations (voluntary national standard, Digital Governance Standards Institute). Current version: 2nd edition, 2025. Upstream check location: https://dgc-cgn.org/ (opens in a new tab).

9 citations

Asia-Pacific regulations and frameworks

14 citations

Other privacy regulations

3 citations

CSA frameworks

1 citation

ISACA frameworks

1 citation

AICPA assurance criteria

2 citations

Cybersecurity and AI security guidance

8 citations

Cybersecurity adversary frameworks

7 citations

OWASP

3 citations

Software supply-chain frameworks

  • SLSA Supply-chain Levels for Software Artifacts (OpenSSF): Build track (L0 to L3) and Source track (L1 to L4). Current version: v1.2. Upstream check location: https://slsa.dev/spec/ (opens in a new tab).
  • CycloneDX OWASP Bill of Materials specification (ECMA-424, 2nd Edition): software, hardware, services, cryptographic assets and AI models, with dependencies, vulnerabilities, VEX and attestations. Current version: 1.7. Upstream check location: https://cyclonedx.org/specification/overview/ (opens in a new tab).
  • SPDX System Package Data Exchange (formerly Software Package Data Exchange; The Linux Foundation): bill of materials specification for software and related components, including licensing, security and provenance information; SPDX 2.2.1 is published as ISO/IEC 5962:2021. Current version: 3.0.1. Upstream check location: https://spdx.dev/use/specifications/ (opens in a new tab).

6 citations

Customs and trade

22 citations

Sector-specific (energy, telecom, finance)

5 citations

OECD and global

3 citations

ICAO and IMO

1 citation

International treaties and conventions

  • Council of Europe Framework Convention on AI Council of Europe Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law (CETS No. 225), adopted 17 May 2024 and opened for signature at Vilnius 5 September 2024; open for signature by "the member States of the Council of Europe, the non-member States which have participated in its elaboration and the European Union" and binding on those that become Parties; "This Convention is subject to ratification, acceptance or approval" (Article 30, paragraph 2); as of 2026-10-23 the Treaty Office chart records 21 signatures and one consent to be bound (the European Union, 15 May 2026) and no entry into force, which needs five ratifications, acceptances or approvals including at least three Council of Europe member States (Article 30, paragraph 3). Current version: 2024. Upstream check location: https://www.coe.int/en/web/conventions/full-list?module=treaty-detail&treatynum=225 (opens in a new tab).

3 citations

AI safety evaluation programmes

16 citations

Soft-law supervisory guidance

  • WP243 (Article 29 Working Party Guidelines on Data Protection Officers) Guidelines on Data Protection Officers ('DPOs') under GDPR Articles 37-39; endorsed by EDPB in May 2018 as part of the EDPB's adoption of WP29 guidelines. Cited for Article 38(6) conflict-of-interest interpretation. Supersedes the initial 2016-12 draft. Current version: rev.01. Upstream check location: https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/index_en.htm (opens in a new tab).
  • WP216 (Article 29 Working Party Opinion 05/2014 on Anonymisation Techniques) Opinion on anonymization vs pseudonymization, the singling-out / linkability / inference re-identification tests, adopted 10 April 2014 under Directive 95/46/EC and read across to the GDPR. Cited for anonymization thresholds. Current version: Original (no later revision). Upstream check location: https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/index_en.htm (opens in a new tab).
  • WP248 rev.01 (Article 29 Working Party Guidelines on Data Protection Impact Assessment) Guidelines on DPIA and determining whether processing is 'likely to result in a high risk' for the purposes of Regulation 2016/679 (GDPR Article 35), as last revised and adopted 4 October 2017; endorsed by the EDPB. Cited for DPIA methodology and the high-risk criteria. Revises the first adoption of WP248 (4 April 2017). Current version: rev.01. Upstream check location: https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/index_en.htm (opens in a new tab).
  • EDPB Guidelines 07/2020 (concepts of controller and processor in the GDPR) The controller, joint-controller, and processor concepts under the GDPR; Version 2.1 adopted 7 July 2021 after public consultation. Cited for controller / processor determination. Current version: Version 2.1. Upstream check location: https://www.edpb.europa.eu/our-work-tools/general-guidance/guidelines-recommendations-best-practices_en (opens in a new tab).
  • EDPB Guidelines 3/2018 (territorial scope of the GDPR, Article 3) The establishment criterion and the targeting criterion for GDPR territorial scope (Article 3); Version 2.1 adopted 12 November 2019. Cited for extraterritorial applicability. Current version: Version 2.1. Upstream check location: https://www.edpb.europa.eu/our-work-tools/general-guidance/guidelines-recommendations-best-practices_en (opens in a new tab).
  • EDPB Guidelines 4/2019 (Article 25 data protection by design and by default) The Article 25 data-protection-by-design-and-by-default obligation: effective implementation of the data-protection principles, the design and default elements, and continual review of the chosen measures' effectiveness; Version 2.0 adopted 20 October 2020. Cited for the operational interpretation of Article 25. Version 1.0 was the initial 2019 adoption, for public consultation. Current version: Version 2.0. Upstream check location: https://www.edpb.europa.eu/our-work-tools/general-guidance/guidelines-recommendations-best-practices_en (opens in a new tab).
  • EDPB Guidelines 05/2020 (consent under Regulation 2016/679) The GDPR consent standard: conditionality (consent bundled with or conditioned on a service is not freely given), the unambiguous-indication requirement, and that pre-ticked boxes and scrolling do not constitute valid consent; the guidelines were adopted 4 May 2020 (Version 1.0), and Version 1.1 (13 May 2020) applied formatting corrections. Cited for the consent validity standard. Version 1.0 was the initial adoption of 4 May 2020; Version 1.1 carries the formatting corrections of 13 May 2020. Current version: Version 1.1. Upstream check location: https://www.edpb.europa.eu/our-work-tools/general-guidance/guidelines-recommendations-best-practices_en (opens in a new tab).
  • EDPB Guidelines 01/2022 (data subject rights, right of access) The scope of the right of access, "copy" as the main modality and the layered approach, the Article 15(4) third-party-rights limit, and the Article 12(5) manifestly-unfounded-or-excessive assessment; the Guidelines were adopted 28 March 2023 (Version 2.0, after public consultation), with Version 2.1 minor corrections on 30 May 2024. Cited for the right-of-access interpretation. Version 1.0 (18 January 2022) was for public consultation; Version 2.0 (28 March 2023) was the adoption after public consultation. Current version: Version 2.1. Upstream check location: https://www.edpb.europa.eu/our-work-tools/general-guidance/guidelines-recommendations-best-practices_en (opens in a new tab).
  • EDPB Guidelines 9/2022 (personal data breach notification under GDPR) The "becoming aware" doctrine and the notification deadline (without undue delay and, where feasible, within 72 hours of becoming aware; Article 33(1)), the Article 33(2) processor-to-controller notification obligation, and the risk-assessment and individual-notification criteria; Version 2.0 adopted 28 March 2023 after public consultation. Cited for the breach-notification "becoming aware" and processor-timeline interpretation. Version 1.0 (10 October 2022) updated the Article 29 Working Party guidelines WP250 rev.01 and was issued for a targeted public consultation. Current version: Version 2.0. Upstream check location: https://www.edpb.europa.eu/our-work-tools/general-guidance/guidelines-recommendations-best-practices_en (opens in a new tab).
  • EDPB Guidelines 07/2022 (certification as a tool for transfers) The use of an approved certification mechanism (GDPR Article 46(2)(f)) as an appropriate-safeguards tool for transfers to third countries, and its distinct effectiveness analysis; Version 2.0 adopted 14 February 2023 after public consultation. Cited for the certification-mechanism transfer-tool analysis. Version 1.0 (14 June 2022) was for public consultation. Current version: Version 2.0. Upstream check location: https://www.edpb.europa.eu/our-work-tools/general-guidance/guidelines-recommendations-best-practices_en (opens in a new tab).
  • EDPB Guidelines 8/2022 (identifying the lead supervisory authority) Identifying a controller or processor's lead supervisory authority for the GDPR one-stop-shop mechanism: the main-establishment test; the Guidelines were adopted 28 March 2023 (Version 2.0, after public consultation), with a Version 2.1 minor correction on 28 September 2023, a targeted update superseding the Article 29 Working Party guidelines WP244 rev.01. Cited for lead-supervisory-authority determination. Version 1.0 (10 October 2022) was for targeted public consultation; Version 2.0 (28 March 2023) was the adoption after public consultation; the Guidelines succeed WP244 rev.01. Current version: Version 2.1. Upstream check location: https://www.edpb.europa.eu/our-work-tools/general-guidance/guidelines-recommendations-best-practices_en (opens in a new tab).
  • EDPB Opinion 28/2024 (data protection aspects of AI models) Whether an AI model trained on personal data can be anonymous, the legitimate-interest legal basis across AI development and deployment, and the consequences of unlawful processing in training; adopted 17 December 2024. Cited for AI-model data-protection analysis. Current version: Original (no later revision). Upstream check location: https://www.edpb.europa.eu/our-work-tools/general-guidance/guidelines-recommendations-best-practices_en (opens in a new tab).
  • WP249 (Article 29 Working Party Opinion 2/2017 on data processing at work) Opinion 2/2017 on data processing at work, adopted 8 June 2017: the proportionality, transparency, and legitimate-interest analysis for monitoring ICT usage at the workplace (section 5.3), outside the workplace including home and remote working and BYOD (section 5.4), and time and attendance (section 5.5). Cited for the workforce-monitoring proportionality interpretation and the limits of employee consent. The source-verified held text is in the reference base. Current version: Original (no later revision). Upstream check location: https://ec.europa.eu/newsroom/article29/items/610169 (opens in a new tab).
  • UK ICO Employment practices and data protection: Monitoring workers UK Information Commissioner's Office guidance series (six pages) on monitoring workers: lawful basis, DPIA before monitoring likely to result in high risk, transparency, covert monitoring, device-activity and data-loss-prevention monitoring, biometric time and access control, and solely automated monitoring tools. Cited for the UK supervisory expectations on workforce monitoring. The ICO's page says the guidance is under review following the Data (Use and Access) Act and may change: "Due to changes made by the Data (Use and Access) Act, this guidance is under review and may be subject to change." The source-verified held text is in the reference base. Current version: Guidance series, latest update 6 June 2024. Upstream check location: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/employment/monitoring-workers/ (opens in a new tab).
  • ILO Code of Practice on the Protection of Workers' Personal Data International Labour Organization code of practice (non-binding): general principles 5.1 to 5.13 (including 5.4, security-measure data not used to control worker behaviour; 5.5, no decisions based solely on automated processing; 5.6, electronic monitoring not the only factor in performance evaluation; 5.8 and 5.11, information to and cooperation with workers' representatives) and 6.14 (advance notice of monitoring, minimal intrusion, and limits on secret and continuous monitoring). Cited for worker-privacy limits on monitoring. The source-verified held text is in the reference base (the issuer's PDF is dated 2003). Current version: 1997. Upstream check location: https://www.ilo.org/publications/protection-workers%E2%80%99-personal-data-ilo-code-practice (opens in a new tab).
  • Council of Europe Recommendation CM/Rec(2015)5 (processing of personal data in the context of employment) Committee of Ministers recommendation to member States on the processing of personal data in the context of employment: transparency (principle 10), electronic communications (principle 14), information systems not introduced for the direct and principal purpose of monitoring (principle 15), location data (principle 16), risk analysis and representative agreement (principle 20), and additional safeguards including consultation of employees' representatives (principle 21). Replaces Recommendation Rec(89)2, which it revised. Cited for employment-monitoring safeguards. The source-verified held text is in the reference base. Current version: Adopted 1 April 2015 (no later revision). Upstream check location: https://www.coe.int/en/web/data-protection/committee-of-ministers (opens in a new tab).