Menu

Laws · Regulations · Guidance · Standards · Frameworks

Start with the authoritative source.

Find AI laws, regulations, regulatory guidance, standards and frameworks. Understand their status, scope and relevance before translating them into governance and lifecycle controls.

Know the authority, status and version before using a source.

Source facts and practitioner analysis are kept separate

Each library entry identifies the authoritative source, authority, source type, status, scope, version or edition and official link before presenting RegulatedAI.in practitioner analysis.

46 source records shown

European Union

EU Artificial Intelligence Act, Regulation (EU) 2024/1689, current consolidated text

Law / RegulationConsolidated text current as of 27 Jul 2026
Record ID: R01

Source facts

Issuing authority
European Union
Source type
Law / Regulation
Status / treatment
Consolidated text current as of 27 Jul 2026
Last verified
30 August 2026
Open official source

RegulatedAI.in practitioner analysis

Primary relevance
Cross-sector EU AI obligations; QMS under Article 17; lifecycle controls across high-risk/GPAI and other applicable provisions
Applicability boundary
Relevance does not establish applicability. Confirm the source-native scope, role, jurisdiction, timing and user context before relying on this mapping.

Original RegulatedAI.in analysis · not source wording

European Commission / AI Office

AI Act Single Information Platform / AI Act Service Desk

Official implementation resourceOperational
Record ID: R02

Source facts

Issuing authority
European Commission / AI Office
Source type
Official implementation resource
Status / treatment
Operational
Last verified
30 August 2026
Open official source

RegulatedAI.in practitioner analysis

Primary relevance
Official navigation, Explorer, compliance-support tools and implementation information; not itself the legal text
Applicability boundary
Relevance does not establish applicability. Confirm the source-native scope, role, jurisdiction, timing and user context before relying on this mapping.

Original RegulatedAI.in analysis · not source wording

Council of Europe

Council of Europe Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law (CETS No. 225)

International treaty frameworkOpen for signature; entry-into-force condition not yet met as of 30 Aug 2026
Record ID: R03

Source facts

Issuing authority
Council of Europe
Source type
International treaty framework
Status / treatment
Open for signature; entry-into-force condition not yet met as of 30 Aug 2026
Last verified
30 August 2026
Open official source

RegulatedAI.in practitioner analysis

Primary relevance
Human rights, democracy and rule-of-law lifecycle risk/impact framework
Applicability boundary
Relevance does not establish applicability. Confirm the source-native scope, role, jurisdiction, timing and user context before relying on this mapping.

Original RegulatedAI.in analysis · not source wording

State of Colorado

Colorado Artificial Intelligence / Automated Decision-Making Technology law framework (current post-SB26-189 position)

State lawCurrent law requires exact official-title/status display from the enacted text
Record ID: R04

Source facts

Issuing authority
State of Colorado
Source type
State law
Status / treatment
Current law requires exact official-title/status display from the enacted text
Last verified
30 August 2026
Open official source

RegulatedAI.in practitioner analysis

Primary relevance
Consequential-decision automated decision-making obligations; keep state-law record source-native
Applicability boundary
Relevance does not establish applicability. Confirm the source-native scope, role, jurisdiction, timing and user context before relying on this mapping.

Original RegulatedAI.in analysis · not source wording

State of Texas

Texas Responsible Artificial Intelligence Governance Act (HB 149)

State lawEffective 1 Jan 2026
Record ID: R05

Source facts

Issuing authority
State of Texas
Source type
State law
Status / treatment
Effective 1 Jan 2026
Last verified
30 August 2026
Open official source

RegulatedAI.in practitioner analysis

Primary relevance
Texas AI governance/prohibited-use/transparency framework; use official enacted text for detailed obligations
Applicability boundary
Relevance does not establish applicability. Confirm the source-native scope, role, jurisdiction, timing and user context before relying on this mapping.

Original RegulatedAI.in analysis · not source wording

State of California

Transparency in Frontier Artificial Intelligence Act (SB 53)

State lawEnacted 2025
Record ID: R06

Source facts

Issuing authority
State of California
Source type
State law
Status / treatment
Enacted 2025
Last verified
30 August 2026
Open official source

RegulatedAI.in practitioner analysis

Primary relevance
Frontier-model safety/transparency obligations; specialist source, not a general AI law
Applicability boundary
Relevance does not establish applicability. Confirm the source-native scope, role, jurisdiction, timing and user context before relying on this mapping.

Original RegulatedAI.in analysis · not source wording

State of New York

Responsible AI Safety and Education Act (RAISE Act)

State lawSigned Dec 2025; effective timing to be displayed from enacted text
Record ID: R07

Source facts

Issuing authority
State of New York
Source type
State law
Status / treatment
Signed Dec 2025; effective timing to be displayed from enacted text
Last verified
30 August 2026
Open official source

RegulatedAI.in practitioner analysis

Primary relevance
Frontier AI developer safety/security obligations; specialist source
Applicability boundary
Relevance does not establish applicability. Confirm the source-native scope, role, jurisdiction, timing and user context before relying on this mapping.

Original RegulatedAI.in analysis · not source wording

UK Department for Science, Innovation and Technology

Implementing the UK's AI regulatory principles: initial guidance for regulators

Government guidancePublished 6 Feb 2024; voluntary guidance for regulators
Record ID: R08

Source facts

Issuing authority
UK Department for Science, Innovation and Technology
Source type
Government guidance
Status / treatment
Published 6 Feb 2024; voluntary guidance for regulators
Last verified
30 August 2026
Open official source

RegulatedAI.in practitioner analysis

Primary relevance
UK cross-sector principles-based regulatory context
Applicability boundary
Relevance does not establish applicability. Confirm the source-native scope, role, jurisdiction, timing and user context before relying on this mapping.

Original RegulatedAI.in analysis · not source wording

NIST

NIST Artificial Intelligence Risk Management Framework (AI RMF 1.0)

Government frameworkPublished Jan 2023; NIST states AI RMF 1.0 is being revised
Record ID: R09

Source facts

Issuing authority
NIST
Source type
Government framework
Status / treatment
Published Jan 2023; NIST states AI RMF 1.0 is being revised
Last verified
30 August 2026
Open official source

RegulatedAI.in practitioner analysis

Primary relevance
Cross-sector governance, mapping, measurement and management of AI risk
Applicability boundary
Relevance does not establish applicability. Confirm the source-native scope, role, jurisdiction, timing and user context before relying on this mapping.

Original RegulatedAI.in analysis · not source wording

NIST

NIST AI RMF Generative Artificial Intelligence Profile, NIST AI 600-1

Government framework/profilePublished Jul 2024; updated publication page Apr 2026
Record ID: R10

Source facts

Issuing authority
NIST
Source type
Government framework/profile
Status / treatment
Published Jul 2024; updated publication page Apr 2026
Last verified
30 August 2026
Open official source

RegulatedAI.in practitioner analysis

Primary relevance
Generative-AI-specific risk considerations mapped to AI RMF
Applicability boundary
Relevance does not establish applicability. Confirm the source-native scope, role, jurisdiction, timing and user context before relying on this mapping.

Original RegulatedAI.in analysis · not source wording

UK Department for Science, Innovation and Technology / Government Digital Service

Introduction to AI assurance

Government practitioner guidancePublished 2024; current government guidance resource
Record ID: R11

Source facts

Issuing authority
UK Department for Science, Innovation and Technology / Government Digital Service
Source type
Government practitioner guidance
Status / treatment
Published 2024; current government guidance resource
Last verified
30 August 2026
Open official source

RegulatedAI.in practitioner analysis

Primary relevance
Assurance concepts and techniques; practitioner education
Applicability boundary
Relevance does not establish applicability. Confirm the source-native scope, role, jurisdiction, timing and user context before relying on this mapping.

Original RegulatedAI.in analysis · not source wording

ISO/IEC

ISO/IEC 42001:2023 - Artificial intelligence - Management system

International StandardPublished, Edition 1
Record ID: R12

Source facts

Issuing authority
ISO/IEC
Source type
International Standard
Status / treatment
Published, Edition 1
Last verified
30 August 2026
Open official source

RegulatedAI.in practitioner analysis

Primary relevance
AI management system governance, policy, objectives, risk/opportunity and continual improvement
Applicability boundary
Relevance does not establish applicability. Confirm the source-native scope, role, jurisdiction, timing and user context before relying on this mapping.

Original RegulatedAI.in analysis · not source wording

ISO/IEC

ISO/IEC 23894:2023 - Artificial intelligence - Guidance on risk management

International StandardPublished, Edition 1
Record ID: R13

Source facts

Issuing authority
ISO/IEC
Source type
International Standard
Status / treatment
Published, Edition 1
Last verified
30 August 2026
Open official source

RegulatedAI.in practitioner analysis

Primary relevance
AI-specific risk-management guidance across organisations that develop, produce, deploy or use AI
Applicability boundary
Relevance does not establish applicability. Confirm the source-native scope, role, jurisdiction, timing and user context before relying on this mapping.

Original RegulatedAI.in analysis · not source wording

ISO/IEC

ISO/IEC 5338:2023 - Artificial intelligence - AI system life cycle processes

International StandardPublished, Edition 1
Record ID: R14

Source facts

Issuing authority
ISO/IEC
Source type
International Standard
Status / treatment
Published, Edition 1
Last verified
30 August 2026
Open official source

RegulatedAI.in practitioner analysis

Primary relevance
Core AI lifecycle process reference; based on 15288/12207 with AI-specific additions
Applicability boundary
Relevance does not establish applicability. Confirm the source-native scope, role, jurisdiction, timing and user context before relying on this mapping.

Original RegulatedAI.in analysis · not source wording

ISO/IEC

ISO/IEC 22989:2022 - Artificial intelligence concepts and terminology

International StandardPublished, Edition 1
Record ID: R15

Source facts

Issuing authority
ISO/IEC
Source type
International Standard
Status / treatment
Published, Edition 1
Last verified
30 August 2026
Open official source

RegulatedAI.in practitioner analysis

Primary relevance
Core terminology/definitions reference; do not reproduce substantial protected text
Applicability boundary
Relevance does not establish applicability. Confirm the source-native scope, role, jurisdiction, timing and user context before relying on this mapping.

Original RegulatedAI.in analysis · not source wording

ISO/IEC

ISO/IEC 23053:2022 - Framework for AI systems using machine learning

International StandardPublished, Edition 1
Record ID: R16

Source facts

Issuing authority
ISO/IEC
Source type
International Standard
Status / treatment
Published, Edition 1
Last verified
30 August 2026
Open official source

RegulatedAI.in practitioner analysis

Primary relevance
Conceptual framework/components/functions for ML-based AI systems
Applicability boundary
Relevance does not establish applicability. Confirm the source-native scope, role, jurisdiction, timing and user context before relying on this mapping.

Original RegulatedAI.in analysis · not source wording

ISO/IEC

ISO/IEC 8183:2023 - Artificial intelligence - Data life cycle framework

International StandardPublished, Edition 1
Record ID: R17Data Lifecycle & Data Quality · cross-lifecycle topic

Source facts

Issuing authority
ISO/IEC
Source type
International Standard
Status / treatment
Published, Edition 1
Last verified
30 August 2026
Open official source

RegulatedAI.in practitioner analysis

Primary relevance
Cross-lifecycle AI data processing from acquisition through decommissioning
Applicability boundary
Relevance does not establish applicability. Confirm the source-native scope, role, jurisdiction, timing and user context before relying on this mapping.

Original RegulatedAI.in analysis · not source wording

ISO/IEC

ISO/IEC 5259 series - Data quality for analytics and machine learning

International Standards seriesPublished series; Part 1:2024 is foundational; Part 5:2025 published February 2025, Edition 1
Record ID: R18Data Lifecycle & Data Quality · cross-lifecycle topic

Source facts

Issuing authority
ISO/IEC
Source type
International Standards series
Status / treatment
Published series; Part 1:2024 is foundational; Part 5:2025 published February 2025, Edition 1
Last verified
4 October 2026
Open official source

RegulatedAI.in practitioner analysis

Primary relevance
Data quality across the data lifecycle, including governance oversight and accountability. ISO/IEC 5259-5:2025, Artificial intelligence — Data quality for analytics and machine learning (ML) — Part 5: Data quality governance framework, adds a governance-level reference within the series.
Applicability boundary
Relevance does not establish applicability. Confirm the source-native scope, role, jurisdiction, timing and user context before relying on this mapping.

Original RegulatedAI.in analysis · not source wording

ISO/IEC

ISO/IEC TR 24028:2020 - Overview of trustworthiness in artificial intelligence

Technical ReportPublished
Record ID: R19

Source facts

Issuing authority
ISO/IEC
Source type
Technical Report
Status / treatment
Published
Last verified
30 August 2026
Open official source

RegulatedAI.in practitioner analysis

Primary relevance
Trustworthiness topics including transparency, explainability, controllability, reliability, safety, security and privacy
Applicability boundary
Relevance does not establish applicability. Confirm the source-native scope, role, jurisdiction, timing and user context before relying on this mapping.

Original RegulatedAI.in analysis · not source wording

ISO/IEC

ISO/IEC TR 24027:2021 - Bias in AI systems and AI-aided decision making

Technical ReportPublished
Record ID: R20

Source facts

Issuing authority
ISO/IEC
Source type
Technical Report
Status / treatment
Published
Last verified
30 August 2026
Open official source

RegulatedAI.in practitioner analysis

Primary relevance
Bias-related vulnerabilities and assessment/treatment across AI lifecycle phases
Applicability boundary
Relevance does not establish applicability. Confirm the source-native scope, role, jurisdiction, timing and user context before relying on this mapping.

Original RegulatedAI.in analysis · not source wording

ISO/IEC/IEEE

ISO/IEC/IEEE 15288:2023 - System life cycle processes

International StandardPublished, Edition 2
Record ID: R21

Source facts

Issuing authority
ISO/IEC/IEEE
Source type
International Standard
Status / treatment
Published, Edition 2
Last verified
30 August 2026
Open official source

RegulatedAI.in practitioner analysis

Primary relevance
Supporting systems lifecycle reference; does not prescribe a specific lifecycle model
Applicability boundary
Relevance does not establish applicability. Confirm the source-native scope, role, jurisdiction, timing and user context before relying on this mapping.

Original RegulatedAI.in analysis · not source wording

ISO/IEC/IEEE

ISO/IEC/IEEE 12207:2026 - Software life cycle processes

International StandardPublished Apr 2026, Edition 2; 2017 edition withdrawn
Record ID: R22

Source facts

Issuing authority
ISO/IEC/IEEE
Source type
International Standard
Status / treatment
Published Apr 2026, Edition 2; 2017 edition withdrawn
Last verified
30 August 2026
Open official source

RegulatedAI.in practitioner analysis

Primary relevance
Supporting software lifecycle reference; full lifecycle including acquisition, operation, maintenance and disposal
Applicability boundary
Relevance does not establish applicability. Confirm the source-native scope, role, jurisdiction, timing and user context before relying on this mapping.

Original RegulatedAI.in analysis · not source wording

IMDRF

IMDRF/AIML WG/N88 FINAL:2025 - Good machine learning practice for medical device development: Guiding principles

International regulatory-forum technical documentFinal; published 29 Jan 2025
Record ID: R23

Source facts

Issuing authority
IMDRF
Source type
International regulatory-forum technical document
Status / treatment
Final; published 29 Jan 2025
Last verified
30 August 2026
Open official source

RegulatedAI.in practitioner analysis

Primary relevance
Current principal GMLP record for medical-device ML development. The 2021 FDA/Health Canada/MHRA principles are historical lineage.
Applicability boundary
Relevance does not establish applicability. Confirm the source-native scope, role, jurisdiction, timing and user context before relying on this mapping.

Original RegulatedAI.in analysis · not source wording

FDA + EMA

Guiding Principles of Good AI Practice in Drug Development

Joint regulatory principlesJanuary 2026
Record ID: R24

Source facts

Issuing authority
FDA + EMA
Source type
Joint regulatory principles
Status / treatment
January 2026
Last verified
30 August 2026
Open official source

RegulatedAI.in practitioner analysis

Primary relevance
Ten principles covering human-centric design, risk, standards, context of use, data governance, performance assessment and lifecycle management
Applicability boundary
Relevance does not establish applicability. Confirm the source-native scope, role, jurisdiction, timing and user context before relying on this mapping.

Original RegulatedAI.in analysis · not source wording

FDA

Considerations for the Use of Artificial Intelligence To Support Regulatory Decision-Making for Drug and Biological Products

Draft regulatory guidanceDraft Level 1 Guidance, Jan 2025; not for implementation
Record ID: R25

Source facts

Issuing authority
FDA
Source type
Draft regulatory guidance
Status / treatment
Draft Level 1 Guidance, Jan 2025; not for implementation
Last verified
30 August 2026
Open official source

RegulatedAI.in practitioner analysis

Primary relevance
Risk-based credibility assessment framework for AI model use in regulatory decision-making
Applicability boundary
Relevance does not establish applicability. Confirm the source-native scope, role, jurisdiction, timing and user context before relying on this mapping.

Original RegulatedAI.in analysis · not source wording

EMA

Reflection paper on the use of Artificial Intelligence (AI) in the medicinal product lifecycle

Regulatory/scientific reflection paperAdopted; first published 30 Sep 2024
Record ID: R26

Source facts

Issuing authority
EMA
Source type
Regulatory/scientific reflection paper
Status / treatment
Adopted; first published 30 Sep 2024
Last verified
30 August 2026
Open official source

RegulatedAI.in practitioner analysis

Primary relevance
AI/ML considerations across medicines lifecycle
Applicability boundary
Relevance does not establish applicability. Confirm the source-native scope, role, jurisdiction, timing and user context before relying on this mapping.

Original RegulatedAI.in analysis · not source wording

FDA

Artificial Intelligence-Enabled Device Software Functions: Lifecycle Management and Marketing Submission Recommendations

Draft regulatory guidanceDraft, Jan 2025; not for implementation
Record ID: R27

Source facts

Issuing authority
FDA
Source type
Draft regulatory guidance
Status / treatment
Draft, Jan 2025; not for implementation
Last verified
30 August 2026
Open official source

RegulatedAI.in practitioner analysis

Primary relevance
AI-enabled device TPLC and marketing-submission recommendations
Applicability boundary
Relevance does not establish applicability. Confirm the source-native scope, role, jurisdiction, timing and user context before relying on this mapping.

Original RegulatedAI.in analysis · not source wording

FDA

Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence-Enabled Device Software Functions

Final regulatory guidanceFinal, Aug 2025
Record ID: R28

Source facts

Issuing authority
FDA
Source type
Final regulatory guidance
Status / treatment
Final, Aug 2025
Last verified
30 August 2026
Open official source

RegulatedAI.in practitioner analysis

Primary relevance
Predetermined change control planning for AI-enabled device software functions
Applicability boundary
Relevance does not establish applicability. Confirm the source-native scope, role, jurisdiction, timing and user context before relying on this mapping.

Original RegulatedAI.in analysis · not source wording

European Commission / MDCG

MDCG 2025-6 - FAQ on interplay between MDR/IVDR and the Artificial Intelligence Act

Regulatory guidance / FAQPublished 19 Jun 2025
Record ID: R29

Source facts

Issuing authority
European Commission / MDCG
Source type
Regulatory guidance / FAQ
Status / treatment
Published 19 Jun 2025
Last verified
30 August 2026
Open official source

RegulatedAI.in practitioner analysis

Primary relevance
Interplay of EU medical-device regulations and AI Act
Applicability boundary
Relevance does not establish applicability. Confirm the source-native scope, role, jurisdiction, timing and user context before relying on this mapping.

Original RegulatedAI.in analysis · not source wording

MHRA

Impact of AI on the regulation of medical products

Regulator policy paperPublished/current GOV.UK policy resource
Record ID: R30

Source facts

Issuing authority
MHRA
Source type
Regulator policy paper
Status / treatment
Published/current GOV.UK policy resource
Last verified
30 August 2026
Open official source

RegulatedAI.in practitioner analysis

Primary relevance
MHRA application of UK AI regulatory principles across medical products
Applicability boundary
Relevance does not establish applicability. Confirm the source-native scope, role, jurisdiction, timing and user context before relying on this mapping.

Original RegulatedAI.in analysis · not source wording

EMA GCP Inspectors Working Group

Guideline on computerised systems and electronic data in clinical trials (EMA/INS/GCP/112288/2023)

Regulatory guidelineFinal adopted 7 Mar 2023
Record ID: R31

Source facts

Issuing authority
EMA GCP Inspectors Working Group
Source type
Regulatory guideline
Status / treatment
Final adopted 7 Mar 2023
Last verified
30 August 2026
Open official source

RegulatedAI.in practitioner analysis

Primary relevance
Computerised systems/electronic data controls in clinical trials, including AI-related considerations
Applicability boundary
Relevance does not establish applicability. Confirm the source-native scope, role, jurisdiction, timing and user context before relying on this mapping.

Original RegulatedAI.in analysis · not source wording

European Commission / EudraLex Volume 4

EU GMP Annex 11 - Computerised Systems (current effective text)

GMP guideline annexCurrent effective Annex 11; separate revision consultation closed
Record ID: R32

Source facts

Issuing authority
European Commission / EudraLex Volume 4
Source type
GMP guideline annex
Status / treatment
Current effective Annex 11; separate revision consultation closed
Last verified
30 August 2026
Open official source

RegulatedAI.in practitioner analysis

Primary relevance
Computerised-system lifecycle controls in GMP environments
Applicability boundary
Relevance does not establish applicability. Confirm the source-native scope, role, jurisdiction, timing and user context before relying on this mapping.

Original RegulatedAI.in analysis · not source wording

European Commission

Revision of EU GMP Annex 11 and new Annex 22 Artificial Intelligence - 2025 consultation package

Draft/consultation GMP materialConsultation closed 7 Oct 2025; not final GMP requirements
Record ID: R33

Source facts

Issuing authority
European Commission
Source type
Draft/consultation GMP material
Status / treatment
Consultation closed 7 Oct 2025; not final GMP requirements
Last verified
30 August 2026
Open official source

RegulatedAI.in practitioner analysis

Primary relevance
Emerging GMP expectations for computerised systems and AI; must be visibly labelled draft/consultation
Applicability boundary
Relevance does not establish applicability. Confirm the source-native scope, role, jurisdiction, timing and user context before relying on this mapping.

Original RegulatedAI.in analysis · not source wording

FDA

Computer Software Assurance for Production and Quality Management System Software

Final regulatory guidanceFinal, Feb 2026; supersedes Sep 2025 final guidance
Record ID: R34

Source facts

Issuing authority
FDA
Source type
Final regulatory guidance
Status / treatment
Final, Feb 2026; supersedes Sep 2025 final guidance
Last verified
30 August 2026
Open official source

RegulatedAI.in practitioner analysis

Primary relevance
Risk-based software assurance for medical-device production/QMS software
Applicability boundary
Relevance does not establish applicability. Confirm the source-native scope, role, jurisdiction, timing and user context before relying on this mapping.

Original RegulatedAI.in analysis · not source wording

US FDA / eCFR

21 CFR Part 11 - Electronic Records; Electronic Signatures

Federal regulationCurrent regulation; verify eCFR current text at use
Record ID: R35

Source facts

Issuing authority
US FDA / eCFR
Source type
Federal regulation
Status / treatment
Current regulation; verify eCFR current text at use
Last verified
30 August 2026
Open official source

RegulatedAI.in practitioner analysis

Primary relevance
Supporting electronic-record/e-signature requirements where applicable
Applicability boundary
Relevance does not establish applicability. Confirm the source-native scope, role, jurisdiction, timing and user context before relying on this mapping.

Original RegulatedAI.in analysis · not source wording

CEN/CENELEC

EN 18286:2026 — Artificial intelligence — Quality management system for EU AI Act regulatory purposes

European StandardPublished European Standard developed in support of implementation of the EU AI Act. Current European Commission information indicates that assessment toward harmonised-standard treatment is ongoing.
Record ID: R36

Source facts

Issuing authority
CEN/CENELEC
Source type
European Standard
Status / treatment
Published European Standard developed in support of implementation of the EU AI Act. Current European Commission information indicates that assessment toward harmonised-standard treatment is ongoing.
Last verified
11 September 2026
Open official source

RegulatedAI.in practitioner analysis

Primary relevance
European Union / European standard supporting EU AI Act implementation
Applicability boundary
Relevance does not establish applicability. Confirm the source-native scope, role, jurisdiction, timing and user context before relying on this mapping.

Original RegulatedAI.in analysis · not source wording

European Commission

Guidelines on the implementation of the transparency obligations for certain AI systems under Article 50 of the AI Act

European Commission GuidelinesPublished 20 July 2026; supports implementation of Article 50 of Regulation (EU) 2024/1689, whose transparency obligations apply from 2 August 2026. The Guidelines do not independently create those legal obligations.
Record ID: R37

Source facts

Issuing authority
European Commission
Source type
European Commission Guidelines
Status / treatment
Published 20 July 2026; supports implementation of Article 50 of Regulation (EU) 2024/1689, whose transparency obligations apply from 2 August 2026. The Guidelines do not independently create those legal obligations.
Last verified
4 October 2026
Open official source

RegulatedAI.in practitioner analysis

Primary relevance
Identify applicable provider/deployer transparency duties and incorporate them into design, deployment and operating controls, with evidence of how relevant disclosures are implemented.
Applicability boundary
Relevance does not establish applicability. Confirm the source-native scope, role, jurisdiction, timing and user context before relying on this mapping.

Original RegulatedAI.in analysis · not source wording

National Commission into the Regulation of AI in Healthcare / MHRA

National Commission into the Regulation of AI in Healthcare: Recommendations for a future regulatory framework

Research and analysis / recommendationsPublished 10 September 2026; recommendations, not legislation or binding MHRA requirements. The UK Government accepted all 44 recommendations on 6 October 2026; delivery commitments are policy implementation, not new binding legislation.
Record ID: R38

Source facts

Issuing authority
National Commission into the Regulation of AI in Healthcare / MHRA
Source type
Research and analysis / recommendations
Status / treatment
Published 10 September 2026; recommendations, not legislation or binding MHRA requirements. The UK Government accepted all 44 recommendations on 6 October 2026; delivery commitments are policy implementation, not new binding legislation.
Last verified
7 October 2026
Open official source Related authoritative response / statutory basis

RegulatedAI.in practitioner analysis

Primary relevance
A reference for considering healthcare AI accountability, transparency and organisational assurance when reviewing governance across the lifecycle; proposed directions must not be treated as current binding controls.
Applicability boundary
Relevance does not establish applicability. Confirm the source-native scope, role, jurisdiction, timing and user context before relying on this mapping.

Original RegulatedAI.in analysis · not source wording

MeitY / IndiaAI, Government of India

India AI Governance Guidelines

Governmental AI governance guidelinesLaunched 5 November 2025; governance guidelines, not an Indian AI Act or binding AI legislation.
Record ID: R39

Source facts

Issuing authority
MeitY / IndiaAI, Government of India
Source type
Governmental AI governance guidelines
Status / treatment
Launched 5 November 2025; governance guidelines, not an Indian AI Act or binding AI legislation.
Last verified
4 October 2026
Open official source

RegulatedAI.in practitioner analysis

Primary relevance
Inform risk mitigation, accountability and transparent AI development and deployment in the Indian context, while separately determining applicable legal requirements.
Applicability boundary
Relevance does not establish applicability. Confirm the source-native scope, role, jurisdiction, timing and user context before relying on this mapping.

Original RegulatedAI.in analysis · not source wording

Indian Council of Medical Research (ICMR)

Ethical Guidelines for Application of Artificial Intelligence in Biomedical Research and Healthcare

ICMR ethical guidelinesPublished 2023; ethical guidance, not legislation or a universally mandatory regulatory requirement.
Record ID: R40

Source facts

Issuing authority
Indian Council of Medical Research (ICMR)
Source type
ICMR ethical guidelines
Status / treatment
Published 2023; ethical guidance, not legislation or a universally mandatory regulatory requirement.
Last verified
4 October 2026
Open official source

RegulatedAI.in practitioner analysis

Primary relevance
Consider ethical decision-making and governance when developing, deploying or adopting AI-based solutions in biomedical research and healthcare.
Applicability boundary
Relevance does not establish applicability. Confirm the source-native scope, role, jurisdiction, timing and user context before relying on this mapping.

Original RegulatedAI.in analysis · not source wording

Ministry of Health and Family Welfare / CDSCO, Government of India

AI-enabled medical devices in India - Update on Secure AI in Health Initiative

Government explanatory publication on the medical-device regulatory frameworkPublished 10 March 2026; explains AI-enabled device coverage under the binding Medical Devices Rules, 2017, notified 31 January 2017. This publication is not a separate AI medical-device regulation.
Record ID: R41

Source facts

Issuing authority
Ministry of Health and Family Welfare / CDSCO, Government of India
Source type
Government explanatory publication on the medical-device regulatory framework
Status / treatment
Published 10 March 2026; explains AI-enabled device coverage under the binding Medical Devices Rules, 2017, notified 31 January 2017. This publication is not a separate AI medical-device regulation.
Last verified
4 October 2026
Open official source

RegulatedAI.in practitioner analysis

Primary relevance
For AI-enabled medical devices within the Indian framework, connect lifecycle evidence to safety/performance, software verification and validation, risk controls, clinical evidence, quality management and software releases as applicable.
Applicability boundary
Relevance does not establish applicability. Confirm the source-native scope, role, jurisdiction, timing and user context before relying on this mapping.

Original RegulatedAI.in analysis · not source wording

ISO/IEC

ISO/IEC 42005:2025, Information technology — Artificial intelligence (AI) — AI system impact assessment

Standard / technical referencePublished International Standard, edition 1; 28 May 2025
Record ID: R42

Source facts

Issuing authority
ISO/IEC
Source type
Standard / technical reference
Status / treatment
Published International Standard, edition 1; 28 May 2025
Last verified
7 October 2026
Open official source

RegulatedAI.in practitioner analysis

Primary relevance
Context and lifecycle impact assessment for AI systems, including foreseeable effects on people and groups. Informs impact analysis without defining a statutory classification.
Applicability boundary
Relevance does not establish applicability. Confirm the source-native scope, role, jurisdiction, timing and user context before relying on this mapping.

Original RegulatedAI.in analysis · not source wording

ISO

ISO/TS 24971-2:2026, Medical devices — Guidance on the application of ISO 14971 — Part 2: Machine learning in artificial intelligence

Standard / technical referencePublished Technical Specification, edition 1; 17 June 2026
Record ID: R43

Source facts

Issuing authority
ISO
Source type
Standard / technical reference
Status / treatment
Published Technical Specification, edition 1; 17 June 2026
Last verified
7 October 2026
Open official source

RegulatedAI.in practitioner analysis

Primary relevance
MEDTECH-SPECIFIC guidance for applying medical-device risk management to ML-enabled medical devices, alongside ISO 14971 and ISO/TR 24971. Its scope excludes devices employing large language models or generative AI; other relevant device and GenAI controls remain.
Applicability boundary
Relevance does not establish applicability. Confirm the source-native scope, role, jurisdiction, timing and user context before relying on this mapping.

Original RegulatedAI.in analysis · not source wording

ISO

ISO 14971:2019, Medical devices — Application of risk management to medical devices

Standard / technical referencePublished International Standard, edition 3 (2019); reviewed and confirmed in 2025, current
Record ID: R44

Source facts

Issuing authority
ISO
Source type
Standard / technical reference
Status / treatment
Published International Standard, edition 3 (2019); reviewed and confirmed in 2025, current
Last verified
7 October 2026
Open official source

RegulatedAI.in practitioner analysis

Primary relevance
MEDTECH-SPECIFIC medical-device risk management for relevant device pathways. It is not the universal risk-management basis for all AI systems. Referencing this standard does not establish conformity or certification.
Applicability boundary
Relevance does not establish applicability. Confirm the source-native scope, role, jurisdiction, timing and user context before relying on this mapping.

Original RegulatedAI.in analysis · not source wording

FDA; US Congress / GovInfo

Clinical Decision Support Software, Guidance for Industry and Food and Drug Administration Staff; 21 USC 360j, General provisions respecting control of devices intended for human use

Nonbinding regulatory guidanceFinal nonbinding guidance; Statute; 29 January 2026, supersedes 6 January 2026; Current official linked US Code accessed 7 October 2026
Record ID: R45

Source facts

Issuing authority
FDA; US Congress / GovInfo
Source type
Nonbinding regulatory guidance
Status / treatment
Final nonbinding guidance; Statute; 29 January 2026, supersedes 6 January 2026; Current official linked US Code accessed 7 October 2026
Last verified
7 October 2026
Open official source Related authoritative response / statutory basis

RegulatedAI.in practitioner analysis

Primary relevance
Supports the bounded four-criterion Non-Device CDS exclusion under section 520(o)(1)(E). Failure to establish this exclusion requires separate device-status and applicable FDA-policy determination; it does not automatically establish regulated medical-device status.
Applicability boundary
Relevance does not establish applicability. Confirm the source-native scope, role, jurisdiction, timing and user context before relying on this mapping.

Original RegulatedAI.in analysis · not source wording

MDCG / European Commission

MDCG 2019-11 rev.1, Guidance on Qualification and Classification of Software in Regulation (EU) 2017/745 – MDR and Regulation (EU) 2017/746 – IVDR

Nonbinding regulatory guidanceNonbinding guidance interpreting MDR/IVDR; June 2025
Record ID: R46

Source facts

Issuing authority
MDCG / European Commission
Source type
Nonbinding regulatory guidance
Status / treatment
Nonbinding guidance interpreting MDR/IVDR; June 2025
Last verified
7 October 2026
Open official source

RegulatedAI.in practitioner analysis

Primary relevance
Medical-device and IVD software qualification/classification guidance. Rule 11 gives a preliminary indication only for qualified standalone MDR software, subject to all other applicable rules and dependencies. IVDR classification remains separate.
Applicability boundary
Relevance does not establish applicability. Confirm the source-native scope, role, jurisdiction, timing and user context before relying on this mapping.

Original RegulatedAI.in analysis · not source wording

Key Terms

Use terminology in its source-specific context.

These cards navigate terminology; they do not create universal definitions. Definitions remain source-specific. RegulatedAI.in does not create a universal definition where authoritative sources use a term differently. Protected standards definitions are not reproduced.

Three distinct assessment concepts
Regulatory classificationInitial riskResidual risk
Source-specific legal category. Mitigation does not change it.RegulatedAI.in rating before separately assessed control credit.RegulatedAI.in rating after demonstrated effective controls and full recomputation.

AI system

Source terminology

Review the source-specific terminology in R01, R15.

RegulatedAI.in explanation

In this assessment, identify actual inference, autonomy, objectives and output influence; keep ordinary software domain risk review where relevant. Avoid calling every computer program AI.

AI model

Source terminology

Review the source-specific terminology in R15, R16.

RegulatedAI.in explanation

Explain model vs system distinction without inventing a universal legal definition.

Intended purpose

Source terminology

Review the source-specific terminology in R01, R09, R24.

RegulatedAI.in explanation

The specific supported activity, population, user, setting, outputs and boundaries that this assessment evaluates. Provider claims and actual context distinguished; do not silently legitimise misuse.

Provider

Source terminology

Review the source-specific terminology in R01.

RegulatedAI.in explanation

EU AI Act actor term; do not generalise to all frameworks.

Deployer

Source terminology

Review the source-specific terminology in R01.

RegulatedAI.in explanation

EU AI Act actor term; do not substitute for generic 'user'.

High-risk AI system

Source terminology

Review the source-specific terminology in R01.

RegulatedAI.in explanation

Keep separate from RegulatedAI.in High initial/residual risk; controls do not reduce the legal category. Show prospective duty dates, not imply all currently operative.

General-purpose AI model

Source terminology

Review the source-specific terminology in R01.

RegulatedAI.in explanation

EU AI Act legal term only.

Human oversight

Source terminology

Review the source-specific terminology in R01, R09, R19.

RegulatedAI.in explanation

Intervention opportunity means a person could act before impact. Effective oversight additionally needs qualified understanding, independent review where required, material-error detection and reliable timely intervention, override/correction, supported by current-context evidence. Untested or nominal oversight gives no risk-reduction credit. Framework-specific legal meanings remain separate.

Risk

Source terminology

Review the source-specific terminology in R09, R13.

RegulatedAI.in explanation

A context-specific credible harm pathway considered through consequence, likelihood/exposure, influence and limitations; own bands are methodology choices. No arbitrary numerical total or universal “Unacceptable” band.

Impact

Source terminology

Review the source-specific terminology in R01, R03, R09.

RegulatedAI.in explanation

Effect on people, rights, safety, quality, evidence, processes or wider outcomes; assess severity separately from likelihood. Impact and risk are not synonyms; no copied ISO definition.

Data quality

Source terminology

Review the source-specific terminology in R18.

RegulatedAI.in explanation

Cross-lifecycle data-quality concept.

Data provenance

Source terminology

Review the source-specific terminology in R09, R17, R18.

RegulatedAI.in explanation

Explain origin/lineage context without overclaiming a single standard definition.

Verification

Source terminology

Review the source-specific terminology in R14, R21, R22.

RegulatedAI.in explanation

Check stated facts/results/requirements against appropriate evidence; individual source Last verified remains a separate provenance date. Do not conflate source checking with release date.

Validation

Source terminology

Review the source-specific terminology in R14, R24, R31, R34.

RegulatedAI.in explanation

Demonstrate that the function/control is fit for the defined use under relevant acceptance criteria; refer to applicable domain requirements. No promise that one validation method fits all AI.

Monitoring

Source terminology

Review the source-specific terminology in R01, R09, R24, R27.

RegulatedAI.in explanation

Observe relevant performance, changes and incidents with defined owners and action thresholds; monitoring may trigger reassessment. Monitoring after harm is not automatically preventive.

Context of use

Source terminology

Review the source-specific terminology in R23, R24, R28.

RegulatedAI.in explanation

The task, user, population, workflow, setting, inputs, output reliance and operating conditions covered by an assessment. Do not turn FDA draft terminology into universal law.

Regulatory classification

Source terminology

Review the source-specific terminology in R01, R45, R46.

RegulatedAI.in explanation

A classification under a specified applicable legal framework, recorded with its source, provision and factual basis. It remains separate from RegulatedAI.in initial and residual risk. No High/Medium/Low legal label where source does not create one.

Initial risk

Source terminology

Review the source-specific terminology in R09.

RegulatedAI.in explanation

Initial risk is the RegulatedAI.in risk rating before giving risk-reduction credit for separately assessed controls. Record baseline assumption explicitly.

Residual risk

Source terminology

Review the source-specific terminology in R09, R44.

RegulatedAI.in explanation

The RegulatedAI.in risk rating after demonstrated effective, pathway-specific controls are considered and the complete risk logic is rerun. Statutory classification remains unchanged.

Risk control

Source terminology

Review the source-specific terminology in R09, R26, R31.

RegulatedAI.in explanation

A measure intended to address a specified risk driver or applicable requirement. Reduction credit requires evidence that its mechanism is effective for the affected pathway in the assessed use. Control existence alone is not effectiveness.

Safety component

Source terminology

Review the source-specific terminology in R01.

RegulatedAI.in explanation

A source-specific product/system safety function or failure with health/safety consequences; establish actual function and applicable legislation. Quality optimisation is not automatically a safety component.

Reassessment

Source terminology

Review the source-specific terminology in R09, R26.

RegulatedAI.in explanation

Reopen affected facts and recompute dependent conclusions when material context, evidence, performance or requirements change. Preserve earlier snapshot; do not rewrite history.

About this Library

The Regulatory Library is a curated collection of authoritative sources relevant to AI governance and lifecycle controls. It is not an exhaustive catalogue of laws, regulations, standards or guidance that may apply to an organisation or AI system. Other requirements, including sector, jurisdiction, privacy, data protection, cybersecurity, product, safety and other domain-specific requirements, may also apply depending on the intended purpose and context of use.

Boundary and maintenance

A navigation aid, not an applicability determination.

The issuing authority remains the definitive source. Regulatory status, amendments and effective dates must be reconfirmed before an assessment or implementation decision. Last verified is the date on which the individual record’s source facts and status were checked against its authoritative source. It is not the website release date.

Report a missing or changed source

Continue exploring