Laws · Regulations · Guidance · Standards · Frameworks

Start with the authoritative source.

Find AI laws, regulations, regulatory guidance, standards and frameworks. Understand their status, scope and relevance before translating them into governance and lifecycle controls.

Know the authority, status and version before using a source.

Source facts and practitioner analysis are kept separate

Each library entry identifies the authoritative source, authority, source type, status, scope, version or edition and official link before presenting RegulatedAI.in practitioner analysis.

36 source records shown

02

Official resources, guidance and frameworks

Government and intergovernmental implementation resources, guidance and cross-sector risk or assurance frameworks, distinguished from legal text.

European Commission / AI Office

AI Act Single Information Platform / AI Act Service Desk

Official implementation resourceOperational
Record ID: R02

Source facts

Issuing authority
European Commission / AI Office
Source type
Official implementation resource
Status / treatment
Operational
Last verified
30 August 2026
Open official source

RegulatedAI.in practitioner analysis

Primary relevance
Official navigation, Explorer, compliance-support tools and implementation information; not itself the legal text
Applicability boundary
Relevance does not establish applicability. Confirm the source-native scope, role, jurisdiction, timing and user context before relying on this mapping.

Original RegulatedAI.in analysis · not source wording

UK Department for Science, Innovation and Technology

Implementing the UK's AI regulatory principles: initial guidance for regulators

Government guidancePublished 6 Feb 2024; voluntary guidance for regulators
Record ID: R08

Source facts

Issuing authority
UK Department for Science, Innovation and Technology
Source type
Government guidance
Status / treatment
Published 6 Feb 2024; voluntary guidance for regulators
Last verified
30 August 2026
Open official source

RegulatedAI.in practitioner analysis

Primary relevance
UK cross-sector principles-based regulatory context
Applicability boundary
Relevance does not establish applicability. Confirm the source-native scope, role, jurisdiction, timing and user context before relying on this mapping.

Original RegulatedAI.in analysis · not source wording

NIST

NIST Artificial Intelligence Risk Management Framework (AI RMF 1.0)

Government frameworkPublished Jan 2023; NIST states AI RMF 1.0 is being revised
Record ID: R09

Source facts

Issuing authority
NIST
Source type
Government framework
Status / treatment
Published Jan 2023; NIST states AI RMF 1.0 is being revised
Last verified
30 August 2026
Open official source

RegulatedAI.in practitioner analysis

Primary relevance
Cross-sector governance, mapping, measurement and management of AI risk
Applicability boundary
Relevance does not establish applicability. Confirm the source-native scope, role, jurisdiction, timing and user context before relying on this mapping.

Original RegulatedAI.in analysis · not source wording

NIST

NIST AI RMF Generative Artificial Intelligence Profile, NIST AI 600-1

Government framework/profilePublished Jul 2024; updated publication page Apr 2026
Record ID: R10

Source facts

Issuing authority
NIST
Source type
Government framework/profile
Status / treatment
Published Jul 2024; updated publication page Apr 2026
Last verified
30 August 2026
Open official source

RegulatedAI.in practitioner analysis

Primary relevance
Generative-AI-specific risk considerations mapped to AI RMF
Applicability boundary
Relevance does not establish applicability. Confirm the source-native scope, role, jurisdiction, timing and user context before relying on this mapping.

Original RegulatedAI.in analysis · not source wording

UK Department for Science, Innovation and Technology / Government Digital Service

Introduction to AI assurance

Government practitioner guidancePublished 2024; current government guidance resource
Record ID: R11

Source facts

Issuing authority
UK Department for Science, Innovation and Technology / Government Digital Service
Source type
Government practitioner guidance
Status / treatment
Published 2024; current government guidance resource
Last verified
30 August 2026
Open official source

RegulatedAI.in practitioner analysis

Primary relevance
Assurance concepts and techniques; practitioner education
Applicability boundary
Relevance does not establish applicability. Confirm the source-native scope, role, jurisdiction, timing and user context before relying on this mapping.

Original RegulatedAI.in analysis · not source wording

03

Standards and technical references

Bibliographic records and original RegulatedAI.in summaries only. Protected standards clauses, tables and definitions are not reproduced.

ISO/IEC

ISO/IEC 42001:2023 - Artificial intelligence - Management system

International StandardPublished, Edition 1
Record ID: R12

Source facts

Issuing authority
ISO/IEC
Source type
International Standard
Status / treatment
Published, Edition 1
Last verified
30 August 2026
Open official source

RegulatedAI.in practitioner analysis

Primary relevance
AI management system governance, policy, objectives, risk/opportunity and continual improvement
Applicability boundary
Relevance does not establish applicability. Confirm the source-native scope, role, jurisdiction, timing and user context before relying on this mapping.

Original RegulatedAI.in analysis · not source wording

ISO/IEC

ISO/IEC 23894:2023 - Artificial intelligence - Guidance on risk management

International StandardPublished, Edition 1
Record ID: R13

Source facts

Issuing authority
ISO/IEC
Source type
International Standard
Status / treatment
Published, Edition 1
Last verified
30 August 2026
Open official source

RegulatedAI.in practitioner analysis

Primary relevance
AI-specific risk-management guidance across organisations that develop, produce, deploy or use AI
Applicability boundary
Relevance does not establish applicability. Confirm the source-native scope, role, jurisdiction, timing and user context before relying on this mapping.

Original RegulatedAI.in analysis · not source wording

ISO/IEC

ISO/IEC 5338:2023 - Artificial intelligence - AI system life cycle processes

International StandardPublished, Edition 1
Record ID: R14

Source facts

Issuing authority
ISO/IEC
Source type
International Standard
Status / treatment
Published, Edition 1
Last verified
30 August 2026
Open official source

RegulatedAI.in practitioner analysis

Primary relevance
Core AI lifecycle process reference; based on 15288/12207 with AI-specific additions
Applicability boundary
Relevance does not establish applicability. Confirm the source-native scope, role, jurisdiction, timing and user context before relying on this mapping.

Original RegulatedAI.in analysis · not source wording

ISO/IEC

ISO/IEC 22989:2022 - Artificial intelligence concepts and terminology

International StandardPublished, Edition 1
Record ID: R15

Source facts

Issuing authority
ISO/IEC
Source type
International Standard
Status / treatment
Published, Edition 1
Last verified
30 August 2026
Open official source

RegulatedAI.in practitioner analysis

Primary relevance
Core terminology/definitions reference; do not reproduce substantial protected text
Applicability boundary
Relevance does not establish applicability. Confirm the source-native scope, role, jurisdiction, timing and user context before relying on this mapping.

Original RegulatedAI.in analysis · not source wording

ISO/IEC

ISO/IEC 23053:2022 - Framework for AI systems using machine learning

International StandardPublished, Edition 1
Record ID: R16

Source facts

Issuing authority
ISO/IEC
Source type
International Standard
Status / treatment
Published, Edition 1
Last verified
30 August 2026
Open official source

RegulatedAI.in practitioner analysis

Primary relevance
Conceptual framework/components/functions for ML-based AI systems
Applicability boundary
Relevance does not establish applicability. Confirm the source-native scope, role, jurisdiction, timing and user context before relying on this mapping.

Original RegulatedAI.in analysis · not source wording

ISO/IEC

ISO/IEC 8183:2023 - Artificial intelligence - Data life cycle framework

International StandardPublished, Edition 1
Record ID: R17Data Lifecycle & Data Quality · cross-lifecycle topic

Source facts

Issuing authority
ISO/IEC
Source type
International Standard
Status / treatment
Published, Edition 1
Last verified
30 August 2026
Open official source

RegulatedAI.in practitioner analysis

Primary relevance
Cross-lifecycle AI data processing from acquisition through decommissioning
Applicability boundary
Relevance does not establish applicability. Confirm the source-native scope, role, jurisdiction, timing and user context before relying on this mapping.

Original RegulatedAI.in analysis · not source wording

ISO/IEC

ISO/IEC 5259 series - Data quality for analytics and machine learning

International Standards seriesPublished series; Part 1:2024 is foundational
Record ID: R18Data Lifecycle & Data Quality · cross-lifecycle topic

Source facts

Issuing authority
ISO/IEC
Source type
International Standards series
Status / treatment
Published series; Part 1:2024 is foundational
Last verified
30 August 2026
Open official source

RegulatedAI.in practitioner analysis

Primary relevance
Data quality concepts, measures, management/process/governance across the data lifecycle
Applicability boundary
Relevance does not establish applicability. Confirm the source-native scope, role, jurisdiction, timing and user context before relying on this mapping.

Original RegulatedAI.in analysis · not source wording

ISO/IEC

ISO/IEC TR 24028:2020 - Overview of trustworthiness in artificial intelligence

Technical ReportPublished
Record ID: R19

Source facts

Issuing authority
ISO/IEC
Source type
Technical Report
Status / treatment
Published
Last verified
30 August 2026
Open official source

RegulatedAI.in practitioner analysis

Primary relevance
Trustworthiness topics including transparency, explainability, controllability, reliability, safety, security and privacy
Applicability boundary
Relevance does not establish applicability. Confirm the source-native scope, role, jurisdiction, timing and user context before relying on this mapping.

Original RegulatedAI.in analysis · not source wording

ISO/IEC

ISO/IEC TR 24027:2021 - Bias in AI systems and AI-aided decision making

Technical ReportPublished
Record ID: R20

Source facts

Issuing authority
ISO/IEC
Source type
Technical Report
Status / treatment
Published
Last verified
30 August 2026
Open official source

RegulatedAI.in practitioner analysis

Primary relevance
Bias-related vulnerabilities and assessment/treatment across AI lifecycle phases
Applicability boundary
Relevance does not establish applicability. Confirm the source-native scope, role, jurisdiction, timing and user context before relying on this mapping.

Original RegulatedAI.in analysis · not source wording

ISO/IEC/IEEE

ISO/IEC/IEEE 15288:2023 - System life cycle processes

International StandardPublished, Edition 2
Record ID: R21

Source facts

Issuing authority
ISO/IEC/IEEE
Source type
International Standard
Status / treatment
Published, Edition 2
Last verified
30 August 2026
Open official source

RegulatedAI.in practitioner analysis

Primary relevance
Supporting systems lifecycle reference; does not prescribe a specific lifecycle model
Applicability boundary
Relevance does not establish applicability. Confirm the source-native scope, role, jurisdiction, timing and user context before relying on this mapping.

Original RegulatedAI.in analysis · not source wording

ISO/IEC/IEEE

ISO/IEC/IEEE 12207:2026 - Software life cycle processes

International StandardPublished Apr 2026, Edition 2; 2017 edition withdrawn
Record ID: R22

Source facts

Issuing authority
ISO/IEC/IEEE
Source type
International Standard
Status / treatment
Published Apr 2026, Edition 2; 2017 edition withdrawn
Last verified
30 August 2026
Open official source

RegulatedAI.in practitioner analysis

Primary relevance
Supporting software lifecycle reference; full lifecycle including acquisition, operation, maintenance and disposal
Applicability boundary
Relevance does not establish applicability. Confirm the source-native scope, role, jurisdiction, timing and user context before relying on this mapping.

Original RegulatedAI.in analysis · not source wording

CEN/CENELEC

EN 18286:2026 — Artificial intelligence — Quality management system for EU AI Act regulatory purposes

European StandardPublished European Standard developed in support of implementation of the EU AI Act. Current European Commission information indicates that assessment toward harmonised-standard treatment is ongoing.
Record ID: R36

Source facts

Issuing authority
CEN/CENELEC
Source type
European Standard
Status / treatment
Published European Standard developed in support of implementation of the EU AI Act. Current European Commission information indicates that assessment toward harmonised-standard treatment is ongoing.
Last verified
11 September 2026
Open official source

RegulatedAI.in practitioner analysis

Primary relevance
European Union / European standard supporting EU AI Act implementation
Applicability boundary
Relevance does not establish applicability. Confirm the source-native scope, role, jurisdiction, timing and user context before relying on this mapping.

Original RegulatedAI.in analysis · not source wording

04

Life sciences and healthcare

Selected medical-device, medicinal-product, clinical-trial, GMP and software-assurance sources with draft and consultation status kept visible.

IMDRF

IMDRF/AIML WG/N88 FINAL:2025 - Good machine learning practice for medical device development: Guiding principles

International regulatory-forum technical documentFinal; published 29 Jan 2025
Record ID: R23

Source facts

Issuing authority
IMDRF
Source type
International regulatory-forum technical document
Status / treatment
Final; published 29 Jan 2025
Last verified
30 August 2026
Open official source

RegulatedAI.in practitioner analysis

Primary relevance
Current principal GMLP record for medical-device ML development. The 2021 FDA/Health Canada/MHRA principles are historical lineage.
Applicability boundary
Relevance does not establish applicability. Confirm the source-native scope, role, jurisdiction, timing and user context before relying on this mapping.

Original RegulatedAI.in analysis · not source wording

FDA + EMA

Guiding Principles of Good AI Practice in Drug Development

Joint regulatory principlesJanuary 2026
Record ID: R24

Source facts

Issuing authority
FDA + EMA
Source type
Joint regulatory principles
Status / treatment
January 2026
Last verified
30 August 2026
Open official source

RegulatedAI.in practitioner analysis

Primary relevance
Ten principles covering human-centric design, risk, standards, context of use, data governance, performance assessment and lifecycle management
Applicability boundary
Relevance does not establish applicability. Confirm the source-native scope, role, jurisdiction, timing and user context before relying on this mapping.

Original RegulatedAI.in analysis · not source wording

FDA

Considerations for the Use of Artificial Intelligence To Support Regulatory Decision-Making for Drug and Biological Products

Draft regulatory guidanceDraft Level 1 Guidance, Jan 2025; not for implementation
Record ID: R25

Source facts

Issuing authority
FDA
Source type
Draft regulatory guidance
Status / treatment
Draft Level 1 Guidance, Jan 2025; not for implementation
Last verified
30 August 2026
Open official source

RegulatedAI.in practitioner analysis

Primary relevance
Risk-based credibility assessment framework for AI model use in regulatory decision-making
Applicability boundary
Relevance does not establish applicability. Confirm the source-native scope, role, jurisdiction, timing and user context before relying on this mapping.

Original RegulatedAI.in analysis · not source wording

EMA

Reflection paper on the use of Artificial Intelligence (AI) in the medicinal product lifecycle

Regulatory/scientific reflection paperAdopted; first published 30 Sep 2024
Record ID: R26

Source facts

Issuing authority
EMA
Source type
Regulatory/scientific reflection paper
Status / treatment
Adopted; first published 30 Sep 2024
Last verified
30 August 2026
Open official source

RegulatedAI.in practitioner analysis

Primary relevance
AI/ML considerations across medicines lifecycle
Applicability boundary
Relevance does not establish applicability. Confirm the source-native scope, role, jurisdiction, timing and user context before relying on this mapping.

Original RegulatedAI.in analysis · not source wording

FDA

Artificial Intelligence-Enabled Device Software Functions: Lifecycle Management and Marketing Submission Recommendations

Draft regulatory guidanceDraft, Jan 2025; not for implementation
Record ID: R27

Source facts

Issuing authority
FDA
Source type
Draft regulatory guidance
Status / treatment
Draft, Jan 2025; not for implementation
Last verified
30 August 2026
Open official source

RegulatedAI.in practitioner analysis

Primary relevance
AI-enabled device TPLC and marketing-submission recommendations
Applicability boundary
Relevance does not establish applicability. Confirm the source-native scope, role, jurisdiction, timing and user context before relying on this mapping.

Original RegulatedAI.in analysis · not source wording

FDA

Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence-Enabled Device Software Functions

Final regulatory guidanceFinal, Aug 2025
Record ID: R28

Source facts

Issuing authority
FDA
Source type
Final regulatory guidance
Status / treatment
Final, Aug 2025
Last verified
30 August 2026
Open official source

RegulatedAI.in practitioner analysis

Primary relevance
Predetermined change control planning for AI-enabled device software functions
Applicability boundary
Relevance does not establish applicability. Confirm the source-native scope, role, jurisdiction, timing and user context before relying on this mapping.

Original RegulatedAI.in analysis · not source wording

European Commission / MDCG

MDCG 2025-6 - FAQ on interplay between MDR/IVDR and the Artificial Intelligence Act

Regulatory guidance / FAQPublished 19 Jun 2025
Record ID: R29

Source facts

Issuing authority
European Commission / MDCG
Source type
Regulatory guidance / FAQ
Status / treatment
Published 19 Jun 2025
Last verified
30 August 2026
Open official source

RegulatedAI.in practitioner analysis

Primary relevance
Interplay of EU medical-device regulations and AI Act
Applicability boundary
Relevance does not establish applicability. Confirm the source-native scope, role, jurisdiction, timing and user context before relying on this mapping.

Original RegulatedAI.in analysis · not source wording

MHRA

Impact of AI on the regulation of medical products

Regulator policy paperPublished/current GOV.UK policy resource
Record ID: R30

Source facts

Issuing authority
MHRA
Source type
Regulator policy paper
Status / treatment
Published/current GOV.UK policy resource
Last verified
30 August 2026
Open official source

RegulatedAI.in practitioner analysis

Primary relevance
MHRA application of UK AI regulatory principles across medical products
Applicability boundary
Relevance does not establish applicability. Confirm the source-native scope, role, jurisdiction, timing and user context before relying on this mapping.

Original RegulatedAI.in analysis · not source wording

EMA GCP Inspectors Working Group

Guideline on computerised systems and electronic data in clinical trials (EMA/INS/GCP/112288/2023)

Regulatory guidelineFinal adopted 7 Mar 2023
Record ID: R31

Source facts

Issuing authority
EMA GCP Inspectors Working Group
Source type
Regulatory guideline
Status / treatment
Final adopted 7 Mar 2023
Last verified
30 August 2026
Open official source

RegulatedAI.in practitioner analysis

Primary relevance
Computerised systems/electronic data controls in clinical trials, including AI-related considerations
Applicability boundary
Relevance does not establish applicability. Confirm the source-native scope, role, jurisdiction, timing and user context before relying on this mapping.

Original RegulatedAI.in analysis · not source wording

European Commission / EudraLex Volume 4

EU GMP Annex 11 - Computerised Systems (current effective text)

GMP guideline annexCurrent effective Annex 11; separate revision consultation closed
Record ID: R32

Source facts

Issuing authority
European Commission / EudraLex Volume 4
Source type
GMP guideline annex
Status / treatment
Current effective Annex 11; separate revision consultation closed
Last verified
30 August 2026
Open official source

RegulatedAI.in practitioner analysis

Primary relevance
Computerised-system lifecycle controls in GMP environments
Applicability boundary
Relevance does not establish applicability. Confirm the source-native scope, role, jurisdiction, timing and user context before relying on this mapping.

Original RegulatedAI.in analysis · not source wording

European Commission

Revision of EU GMP Annex 11 and new Annex 22 Artificial Intelligence - 2025 consultation package

Draft/consultation GMP materialConsultation closed 7 Oct 2025; not final GMP requirements
Record ID: R33

Source facts

Issuing authority
European Commission
Source type
Draft/consultation GMP material
Status / treatment
Consultation closed 7 Oct 2025; not final GMP requirements
Last verified
30 August 2026
Open official source

RegulatedAI.in practitioner analysis

Primary relevance
Emerging GMP expectations for computerised systems and AI; must be visibly labelled draft/consultation
Applicability boundary
Relevance does not establish applicability. Confirm the source-native scope, role, jurisdiction, timing and user context before relying on this mapping.

Original RegulatedAI.in analysis · not source wording

FDA

Computer Software Assurance for Production and Quality Management System Software

Final regulatory guidanceFinal, Feb 2026; supersedes Sep 2025 final guidance
Record ID: R34

Source facts

Issuing authority
FDA
Source type
Final regulatory guidance
Status / treatment
Final, Feb 2026; supersedes Sep 2025 final guidance
Last verified
30 August 2026
Open official source

RegulatedAI.in practitioner analysis

Primary relevance
Risk-based software assurance for medical-device production/QMS software
Applicability boundary
Relevance does not establish applicability. Confirm the source-native scope, role, jurisdiction, timing and user context before relying on this mapping.

Original RegulatedAI.in analysis · not source wording

Key Terms

Use terminology in its source-specific context.

These cards navigate terminology; they do not create universal definitions. Definitions remain source-specific. RegulatedAI.in does not create a universal definition where authoritative sources use a term differently. Protected standards definitions are not reproduced.

AI system

Source terminology

Review the source-specific terminology in R01, R15.

RegulatedAI.in explanation

Core term; source-specific differences must be preserved.

AI model

Source terminology

Review the source-specific terminology in R15, R16.

RegulatedAI.in explanation

Explain model vs system distinction without inventing a universal legal definition.

Intended purpose

Source terminology

Review the source-specific terminology in R01, R09, R24.

RegulatedAI.in explanation

Use source-specific context; connect to Q01.

Provider

Source terminology

Review the source-specific terminology in R01.

RegulatedAI.in explanation

EU AI Act actor term; do not generalise to all frameworks.

Deployer

Source terminology

Review the source-specific terminology in R01.

RegulatedAI.in explanation

EU AI Act actor term; do not substitute for generic 'user'.

High-risk AI system

Source terminology

Review the source-specific terminology in R01.

RegulatedAI.in explanation

EU AI Act legal classification only.

General-purpose AI model

Source terminology

Review the source-specific terminology in R01.

RegulatedAI.in explanation

EU AI Act legal term only.

Human oversight

Source terminology

Review the source-specific terminology in R01, R09, R19.

RegulatedAI.in explanation

Explain as governance/control concept; preserve source-specific obligations.

Risk

Source terminology

Review the source-specific terminology in R09, R13.

RegulatedAI.in explanation

Do not create a universal numerical classification.

Impact

Source terminology

Review the source-specific terminology in R01, R03, R09.

RegulatedAI.in explanation

Explain affected-person/rights/context dimension source-specifically.

Data quality

Source terminology

Review the source-specific terminology in R18.

RegulatedAI.in explanation

Cross-lifecycle data-quality concept.

Data provenance

Source terminology

Review the source-specific terminology in R09, R17, R18.

RegulatedAI.in explanation

Explain origin/lineage context without overclaiming a single standard definition.

Verification

Source terminology

Review the source-specific terminology in R14, R21, R22.

RegulatedAI.in explanation

Source terminology varies by engineering/regulatory context.

Validation

Source terminology

Review the source-specific terminology in R14, R24, R31, R34.

RegulatedAI.in explanation

Do not present GxP validation as universal AI terminology.

Monitoring

Source terminology

Review the source-specific terminology in R01, R09, R24, R27.

RegulatedAI.in explanation

Ongoing observation/evaluation; source-specific obligations differ.

Boundary and maintenance

A navigation aid, not an applicability determination.

The issuing authority remains the definitive source. Regulatory status, amendments and effective dates must be reconfirmed before an assessment or implementation decision. A source check confirms the linked record and stated metadata as of 30 August 2026. It does not guarantee that no later controlled source change has occurred.

Report a missing or changed source

Continue exploring