AI Compliance & Law Monitor

World's first comprehensive AI law establishing a risk-based regulatory framework for AI systems in the European Union.

• •Risk-based approach: Unacceptable, High, Limited, Minimal risk categories
• •Prohibits social scoring, real-time biometric surveillance (with exceptions)
• •High-risk AI requires conformity assessments and CE marking
• •Transparency obligations for chatbots and deepfakes

OpenAI releases detailed model specification document outlining safety behaviors, refusal categories, and alignment principles for AI assistants.

• •Defines safe AI assistant behaviors
• •Establishes refusal categories
• •Outlines alignment principles
• •Provides implementation guidance

International standard for establishing, implementing, and maintaining an AI management system.

• •First international AI management system standard
• •Based on Plan-Do-Check-Act cycle
• •Covers AI policy, risk assessment, and controls
• •Certifiable standard for organizations

Anthropic publishes Responsible Scaling Policy defining AI Safety Levels (ASL) and commitment to pause scaling if safety measures are insufficient.

• •Defines AI Safety Levels ASL-1 to ASL-4
• •Commits to safety evaluations before scaling
• •Establishes red lines for deployment
• •Requires security measures per ASL

Top 10 security risks for machine learning systems, providing guidance for secure AI development.

• •ML01: Input Manipulation (Adversarial Attacks)
• •ML02: Data Poisoning
• •ML03: Model Inversion Attacks
• •ML04: Membership Inference

New York City law requiring bias audits for AI tools used in hiring and promotion decisions.

• •Annual bias audits required for AEDTs
• •Results must be publicly posted
• •Candidates must be notified 10 days before use
• •Applies to employers and employment agencies in NYC

Voluntary framework providing organizations with guidance for managing AI risks throughout the AI lifecycle.

• •Four core functions: Govern, Map, Measure, Manage
• •Emphasizes human oversight and accountability
• •Applies to all AI systems, not just high-risk
• •Encourages continuous monitoring and improvement

Knowledge base of adversary tactics and techniques against AI systems, modeled after ATT&CK.

• •Catalogs real-world AI attack techniques
• •Organized by tactics: Reconnaissance to Impact
• •Includes case studies of AI attacks
• •Provides mitigations for each technique

California's comprehensive privacy law with specific provisions for automated decision-making technology.

• •Right to opt-out of automated decision-making
• •Businesses must disclose use of ADM technology
• •Risk assessments required for certain processing
• •Right to access information about ADM logic

EU regulation on data protection and privacy, with significant implications for AI systems processing personal data.

• •Right to explanation for automated decisions (Article 22)
• •Data minimization applies to AI training data
• •Privacy by design required for AI systems
• •Data Protection Impact Assessments for high-risk processing