49 regulations, bundled for the audits you actually face.

Australian Prudential Standard for operational risk management in financial institutions, including technology and AI-related risks.

ASIC report on artificial intelligence in financial services, addressing regulatory expectations and responsible AI use.

Updated ASIC regulatory guide on responsible lending. Applies to AI and algorithmic credit decision systems.

Explanatory footnotes and commentary accompanying the Australian AI Act 2024.

Australian federal legislation establishing regulatory framework for artificial intelligence systems.

Australian competition law compiled 2025. Relevant to AI market practices, algorithmic pricing, and automated trading.

Australian consumer protection law compiled 2025. Relevant to AI in consumer-facing applications and automated decision making.

Australian federal privacy legislation compiled 2025. Governs AI processing of personal information.

Template and guide for organizations to develop their own AI governance policies, aligned with Australian regulatory expectations.

Australian government guide for best practices in automated decision-making systems including AI transparency and accountability.

Australian national strategy for AI development, adoption, and governance across public and private sectors.

Australian government policy establishing principles and requirements for responsible AI use across government agencies.

Australian standard for AI transparency statements, requiring organizations to disclose AI use, purpose, and risk assessments.

The California Consumer Privacy Act, as amended by the CPRA, gives California residents rights over personal information a business collects, sells, or shares. For a website, the operative …

California wiretapping and electronic surveillance statute. Applied to websites via § 631(a) (interception of communications; aiding-and-abetting theory for embedded third-party tools) and § 638.51 (pen register / trap-and-trace …

Proposition 65 requires a business to give a "clear and reasonable warning" before knowingly exposing anyone in California to a listed chemical known to cause cancer or reproductive …

Automatic-renewal laws require that a subscription checkout clearly disclose the auto-renewal terms, obtain the consumer's affirmative consent to those terms specifically, send an acknowledgment with cancellation instructions, and …

The European Union Artificial Intelligence Act. Comprehensive regulation establishing risk-based classification and requirements for AI systems in the EU market.

Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data. 99 articles covering data subject rights, controller obligations, transfers, and enforcement. …

Requirements and testing procedures for protecting payment account data. 12 principal requirements covering network security, access controls, vulnerability management, monitoring, and information security policies.

FDA regulation for medical device quality systems. Applies to AI/ML-enabled medical devices including software as a medical device (SaMD).

Trust Services Criteria for security, availability, processing integrity, confidentiality, and privacy. The standard behind SOC 2 Type I and Type II audit reports.

CFPB circular addressing adverse action notice requirements when creditors use complex algorithms and AI in credit decisions.

Department of Defense strategy for implementing responsible AI principles across military and defense applications.

Presidential executive order establishing principles for federal agency use of AI, including transparency, accountability, and civil liberties protections.

FDA guidance on regulatory approach to AI/ML-based software as medical device (SaMD) and device software functions.

FDA guidance for manufacturers of AI/ML-enabled devices on predetermined change control plans allowing iterative model updates.

Federal law governing consumer credit reporting. Critical for AI systems used in credit decisions, lending, and financial scoring.

Federal Register notice establishing requirements for AI use across executive branch agencies.

FTC Standards for Safeguarding Customer Information under the Gramm-Leach-Bliley Act. Requires financial institutions to develop, implement, and maintain a comprehensive information security program.

Combined HIPAA Privacy Rule, Security Rule, Breach Notification Rule, and Enforcement Rule. The primary federal standard for protecting individually identifiable health information.

General administrative requirements for HIPAA including definitions, applicability, enforcement, compliance, and civil money penalties.

Full text of 45 CFR Part 164 covering security standards for electronic PHI (Subpart C), breach notification (Subpart D), and privacy of individually identifiable health information (Subpart E).

OMB memorandum on AI governance frameworks, risk management requirements, and innovation guidelines for federal agencies.

OMB memorandum directing federal agencies to accelerate AI adoption while maintaining governance frameworks and public trust.

OMB memorandum establishing procurement guidance for federal acquisition of AI technologies and services.

OMB memorandum establishing principles to reduce bias in federal AI systems and increase public confidence.

Comprehensive framework for managing risks in AI systems across the lifecycle. Core functions: Govern, Map, Measure, Manage.

Companion resource to AI RMF focused specifically on risks unique to generative AI systems including LLMs.

NIST Cybersecurity White Paper addressing intersection of cybersecurity frameworks and AI risk management.

Security requirements for protecting Controlled Unclassified Information (CUI) in nonfederal systems and organizations. Basis for CMMC certification. Required for DoD contractors.

OCC supervisory guidance on model risk management (SR 11-7 companion). Foundational for AI model governance in banking.

SEC annual examination priorities including focus areas for AI and technology in financial services compliance.

California Consumer Privacy Act as amended by the California Privacy Rights Act. Establishes consumer rights over personal information including rights to know, delete, correct, opt out, and limit …

California legislation requiring transparency in AI training data usage and disclosure requirements.

Web Content Accessibility Guidelines 2.1/2.2 Level AA and Section 508. The technical standard courts apply to ADA Title III website accessibility claims.

Two related website duties: to keep the DMCA safe harbor for hosting user content, a site must designate and register a takedown agent and run a notice-and-takedown process …

The Telephone Consumer Protection Act requires "prior express written consent" before sending autodialed or prerecorded marketing calls and texts. For a website, the compliance surface is lead-generation and …

The Video Privacy Protection Act prohibits a "video tape service provider" from knowingly disclosing personally identifiable information about what a consumer watched to a third party without specific …