This is the full list of AI regulations, standards and guidelines we're paying attention to right now. 46 documents in all. 23 are already mapped into the Unified Control Fabric.
The other 23 are planned for 2027.
Each one is tagged with the question it answers.
Is it required by law?
Or does it tell you how to organize the work, prove it, or implement it?
The older documents mostly answer the first two. The newer ones lean toward law and implementation.
That makes sense. Regulators are setting more dates, and industry bodies like OWASP and CSA have stepped up to write the controls to meet them.
Ten of the laws on this list take effect in 2026 or 2027.
AI governance documents at a glance
| Document | Issued | In effect | The question it answers | Mapped status |
|---|---|---|---|---|
| 2020 | ||||
| Singapore Model AI Governance Framework | Jan 2020 | How to organize the work | Mapped | |
| ENISA AI Threat Landscape | Dec 2020 | How to organize the work | Mapped | |
| 2021 | ||||
| EU AI Act proposal (2021) | Apr 2021 | Required by law (history) | Mapped | |
| Colorado CRS 10-3-1104.9 (SB 21-169) | 2021 | Required by law | Mapped | |
| NYC Local Law 144 | Dec 2021 | Jan 2023 | Required by law | Mapping in 2027 |
| 2022 | ||||
| ISO/IEC 23053 | Jun 2022 | How to organize the work | Mapping in 2027 | |
| ISO/IEC 22989 | Jul 2022 | How to organize the work | Mapping in 2027 | |
| ISO/IEC 38507 | 2022 | How to organize the work | Mapped | |
| Blueprint for an AI Bill of Rights | Oct 2022 | How to organize the work | Mapped | |
| NIS2 Directive | Dec 2022 | Required by law | Mapped | |
| 2023 | ||||
| NIST AI RMF | Jan 2023 | How to organize the work | Mapped | |
| NIST AI RMF Playbook | 2023 | How to organize the work | Mapped | |
| ISO/IEC 23894 | Feb 2023 | How to organize the work | Mapped | |
| Colorado Regulation 10-1-1 | Sep 2023 | Nov 2023 | Required by law | Mapped |
| ISO/IEC 42001 | Dec 2023 | How to prove the work | Mapped | |
| ISO/IEC 5338 | Dec 2023 | How to implement it | Mapped | |
| 2024 | ||||
| Alaska Bulletin B 24-01 | Feb 2024 | Feb 2024 | Required by law | Mapped |
| Australia Voluntary AI Safety Standard | 2024 | How to organize the work | Mapping in 2027 | |
| Colorado AI Act (SB 24-205, repealed) | May 2024 | Required by law | Mapped | |
| EU AI Act | Jun 2024 | Aug 2024, main duties Aug 2026 | Required by law | Mapped |
| NIST AI 600-1 | Jul 2024 | How to organize the work | Mapped | |
| Arkansas Bulletin 13-2024 | Jul 2024 | Required by law | Mapped | |
| NY DFS Circular Letter 7 | Jul 2024 | Required by law | Mapped | |
| Illinois HB 3773 | Aug 2024 | Jan 2026 | Required by law | Mapping in 2027 |
| California AB 2013 | Sep 2024 | Jan 2026 | Required by law | Mapping in 2027 |
| California SB 942 | Sep 2024 | Aug 2026 | Required by law | Mapping in 2027 |
| NIS2 Implementing Regulation | Oct 2024 | Oct 2024 | Required by law, how to implement it | Mapped |
| Korea AI Framework Act | Dec 2024 | Jan 2026 | Required by law | Mapping in 2027 |
| 2025 | ||||
| ISO/IEC 42005 | 2025 | How to prove the work | Mapped | |
| Texas TRAIGA | Jun 2025 | Jan 2026 | Required by law | Mapping in 2027 |
| EU GPAI Code of Practice | Jul 2025 | Aug 2026 | Required by law | Mapping in 2027 |
| California SB 53 (all frontier developers) | Sep 2025 | Jan 2026 | Required by law | Mapping in 2027 |
| California SB 53 (large frontier developers) | Sep 2025 | Jan 2026 | Required by law | Mapping in 2027 |
| California AB 853 | Oct 2025 | Jan 2027 | Required by law | Mapping in 2027 |
| Australia Guidance for AI Adoption, Foundations | Oct 2025 | How to organize the work | Mapping in 2027 | |
| Australia Guidance for AI Adoption, Implementation | Oct 2025 | How to implement it | Mapping in 2027 | |
| Australia Policy for Responsible Use of AI in Government | Dec 2025 | Dec 2026 | Required by law | Mapping in 2027 |
| OWASP Top 10 for Agentic Applications | Dec 2025 | How to implement it | Mapping in 2027 | |
| 2026 | ||||
| CRI Financial Services AI RMF | Feb 2026 | How to implement it | Mapped | |
| EN ISO/IEC 42001 | Mar 2026 | How to prove the work | Mapping in 2027 | |
| Colorado SB 26-189 | May 2026 | Jan 2027 | Required by law | Mapping in 2027 |
| CSA AI Controls Matrix v1.1 | Mid 2026 | How to implement it | Mapping in 2027 | |
| OWASP AISVS 1.0 | Jun 2026 | How to implement it | Mapped | |
| OWASP Top 10 for LLM Applications 2026 | Aug 2026 | How to implement it | Mapping in 2027 | |
| ISO/IEC 27090 | Oct 2026, pending | How to implement it | Mapping in 2027 | |
| ISO/IEC FDIS 27091 | Pending | How to implement it | Mapping in 2027 | |
Want the detail behind each document?
We have two free guides.
The AI Governance Shortlist covers the 23 we've already mapped. For each one, it explains who issues it, why it matters, what it covers, and how many requirements we pulled from it.
The AI Mapping Roadmap covers the 23 we will be mapping in 2027, with the same breakdown of their purpose and the dates they take effect.