Council of AI · regulation findings

Every signed finding, mapped to its regulator and fine tier.

Each measured (model × axis) cell is an Ed25519-signed card. Here every card is joined to the obligations it is relevant-to — EU AI Act articles, NIST AI RMF functions, OWASP ASI controls — and the statutory maximum fine for that tier, cited. Measurement, not certification.

335 signed findings64 models16 mapped axis ids4 regulators689 pairs honestly UNMEASURED
/api/findings ↗
EU AI ActRegulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence356 findings · 12 mapped axis ids · 64 models

Statute · fine regime: Article 99 administrative fines (tiers above)

Care · Care — refusal (helpfulness side) · Care — refusal (protection side) · Governance (bank) · Conformance · Continuity · Governance · Openness · Provenance · Safety · Jail-escape detection · Swarm candidates

NIST AI RMF 1.0NIST AI Risk Management Framework 1.0 (AI 100-1)241 findings · 12 mapped axis ids · 64 models

Voluntary framework · no statutory fine

Care · Care — refusal (helpfulness side) · Care — refusal (protection side) · Governance (bank) · Conformance · Continuity · Governance · Openness · Provenance · Safety · Jail-escape detection · Swarm candidates

OWASP Top 10 for Agentic Applications (2026)OWASP GenAI Security Project / Agentic Security Initiative — ASI01–ASI10218 findings · 11 mapped axis ids · 64 models

Security taxonomy · no statutory fine

Care · Care — refusal (helpfulness side) · Care — refusal (protection side) · Conformance · Continuity · Governance · Openness · Provenance · Safety · Jail-escape detection · Swarm candidates

ISO/IEC 42001:2023ISO/IEC 42001:2023 — AI management system0 findings · 0 mapped axis ids · 0 models

Management standard · no statutory fine

Figures are the statutory maximum the legislature set for the tier, cited to the provision — the ceiling for that obligation class, not a sum asserted as owed by anyone. Mappings are "relevant-to" pointers, never a finding of violation or compliance. Whether a measured result clears an obligation is a legal question for counsel and the competent authority — not a measured one.

Figures are the statutory maximum the legislature set for the tier, cited to the provision — the ceiling for that obligation class, not a sum asserted as owed by anyone. Mappings are "relevant-to" pointers, never a finding of violation or compliance. Whether a measured result clears an obligation is a legal question for counsel and the competent authority — not a measured one.

Measurement, not certification. Every finding stands behind an Ed25519-signed card you can verify. Challenge a measurement →

Enterprise / OWASP angle: verify any card · public-disclosure crosswalk schema + worked example at /signed/disclosure-crosswalk-example.json (public sources only, never a probe).