{"baseline_version":"0.1","license":"CC-BY-4.0","items":[{"id":"B1","title":"Accountability and governance structure","refs":{"eu":"Art. 4; Art. 26","us":"TRAIGA safe harbor","nist":"Govern","other":"Thai draft deployer duties","iso42001":"Clause 5; A.2; A.3"}},{"id":"B2","title":"AI inventory","refs":{"eu":"Art. 26; Art. 50","us":"Colorado SB 26-189","nist":"Map","other":"Korea operator duties","iso42001":"A.4; A.6.2.7"}},{"id":"B3","title":"Acceptable use and AI literacy","refs":{"eu":"Art. 4","us":"","nist":"Govern","other":"Thai draft oversight-staff duty","iso42001":"Clause 7.2, 7.3; A.4.6"}},{"id":"B4","title":"Use-case screening and risk classification","refs":{"eu":"Art. 5; Art. 6; Annex III","us":"TRAIGA prohibited uses; Colorado high-risk definition; NYC LL144","nist":"Map; Govern","other":"","iso42001":"Clause 6.1; A.5"}},{"id":"B5","title":"Third-party and vendor AI management","refs":{"eu":"Art. 25; Art. 26","us":"","nist":"Govern 6; Map 4","other":"HAIP 2.0 deployer questions","iso42001":"A.10"}},{"id":"B6","title":"Data governance for AI use","refs":{"eu":"GDPR; Art. 26","us":"CPPA ADMT rules","nist":"Map; Measure","other":"Korea","iso42001":"A.7"}},{"id":"B7","title":"Human oversight of consequential decisions","refs":{"eu":"Art. 14; Art. 26(2)","us":"Colorado; Illinois HB 3773; NYC LL144; CPPA ADMT; TRAIGA","nist":"Manage","other":"","iso42001":"A.9; A.6.2.6"}},{"id":"B8","title":"Transparency to people","refs":{"eu":"Art. 50","us":"California bot and transparency laws; TRAIGA government disclosure; Colorado","nist":"Govern; Map","other":"Korea labelling","iso42001":"A.8"}},{"id":"B9","title":"Monitoring, logging, and performance review","refs":{"eu":"Art. 26(5), (6); Art. 12","us":"","nist":"Measure; Manage","other":"Thai draft six-month logs","iso42001":"A.6.2.6; A.6.2.8"}},{"id":"B10","title":"Incident management and reporting","refs":{"eu":"Art. 73; Art. 26(5)","us":"TRAIGA cure process","nist":"Manage","other":"Insurer remediation record","iso42001":"A.8.4"}},{"id":"B11","title":"Security of AI systems","refs":{"eu":"Art. 15; Art. 26","us":"","nist":"Cyber AI Profile","other":"OWASP LLM Top 10; CSA AICM","iso42001":"A.6.2.4; ISO 27001 controls"}},{"id":"B12","title":"Fairness and impact assessment for higher-risk uses","refs":{"eu":"Art. 27; Annex III","us":"NYC LL144; Colorado; Illinois","nist":"Map 5; Measure 2","other":"","iso42001":"A.5; ISO 42005"}},{"id":"B13","title":"Records and evidence","refs":{"eu":"Art. 26; Art. 12","us":"AB 1405 record expectations","nist":"Govern","other":"Insurer documentation requests","iso42001":"Clause 7.5; A.6.2.7"}},{"id":"B14","title":"Periodic review and improvement","refs":{"eu":"","us":"","nist":"Govern 1.5; Manage","other":"HAIP annual update","iso42001":"Clauses 9, 10"}},{"id":"B15","title":"Synthetic content provenance","refs":{"eu":"Art. 50(4); transparency Code","us":"California AI Transparency Act (providers); platform duties","nist":"","other":"Korea and China labelling; C2PA; India IT Rules","iso42001":""}}]}