Home / Rules by market
Four markets, in order
What binds you, and what is only guidance
The FDIS is guidance. The binding duties come from law and from the management system you claim. This page names what is held for each market and says plainly where nothing is held.
Three layers, not one
The register sits on three layers. The first is the ISO/IEC 42001 management system, which is certifiable and supplies the policy, roles, risk, impact, life-cycle and improvement controls. The second is the law that binds the use, chiefly the EU AI Act Article 14 and Article 26 for high-risk systems in the EU. The third is the guidance, which is the FDIS. A row can be supported by all three, and the page says which one it cites.
United States, European Union, United Kingdom, Australia
US: United States
No federal AI statute is held. NIST AI RMF 1.0 is the held voluntary framework, with explicit oversight controls in GOVERN, MAP and MANAGE. Colorado's AI Act is held but proposed, so it is named and not relied on.
Held and named
- NIST AI Risk Management Framework (AI RMF 1.0)
- Colorado Artificial Intelligence Act (proposed)
EU: European Union
The EU AI Act is held and binding. Article 14 is the human oversight duty for high-risk systems, Article 26 is the deployer duty, and Articles 12, 13 and 72 supply logs, transparency and post-market monitoring.
Held and named
- EU AI Act
UK: United Kingdom
No AI-specific Act is held. UK GDPR is held and applies where the system processes personal data. The UK's pro-innovation AI regulation framework is named, not held, so its expectations are not stated as requirements here.
Held and named
- UK GDPR (UK General Data Protection Regulation)
AU: Australia
The Australia Guidance for AI Adoption (2025) is held, and the Australia AI Ethics Framework is held. Neither is a statute. The Privacy Act applies where personal information is handled and is named, not stated here.
Held and named
- Australia Guidance for AI Adoption (2025)
- Australia AI Ethics Framework
ISO/IEC 42001 and the FDIS
ISO/IEC 42001:2023 is the certifiable management system. The FDIS is guidance on human oversight. The public abstract says the FDIS extends ISO/IEC TS 8200 and applies across the life cycle. The FDIS does not replace 42001, does not create a certificate and does not change the 42001 certification scope.
Where a market has no held AI statute, the register still works: the 42001 controls and the FDIS guidance apply, and the page says which legal layer is missing.
Start with the market the system reaches
If the system reaches people in the EU and is high-risk, Article 14 and Article 26 are the benchmark, and the register's use and accountability themes carry the evidence. If the system is in the US, NIST AI RMF 1.0 is the voluntary reference and 42001 is the management system. If the system processes personal data in the UK, UK GDPR applies alongside the 42001 controls. If it is in Australia, the Guidance for AI Adoption (2025) and the AI Ethics Framework are the held references.