CSOAI OS · the regulator atlas
Every regulator. The tools and the clock.
The major AI and cybersecurity regimes worldwide — each with the top 7 tools you need and the next 7 dates that matter. The Council assistant gives a live read on any of them, then does the work: classify, assess, sign.
You are interacting with an AI system.
The atlas Q&A sends your input to the live Council chat endpoint (councilof.ai/api/gspc), where a model writes the answer. The Art 50(1) notice for this surface is registered here and being wired; until the component ships, this registry entry is the disclosure.
Disclosed under EU AI Act Article 50(1). Every surface and its classification
The first comprehensive, binding, risk-tiered AI law. Prohibited practices, high-risk obligations, transparency duties, and GPAI rules — phasing in through 2027.
- 1.Risk classification engine (prohibited / high-risk / limited / minimal)
- 2.Conformity assessment + CE-marking workflow (Art. 43)
- 3.Technical documentation pack (Annex IV)
- 4.Fundamental Rights Impact Assessment (FRIA, Art. 27)
- 5.Event logging & traceability (Art. 12)
- 6.Human-oversight controls (Art. 14)
- 7.Post-market monitoring + serious-incident reporting (Art. 72/73)
- 2 Dec 2026Art. 50 transparency duties apply (moved from Aug 2026 by the Digital Omnibus — verify final text)
- Q3–Q4 2026GPAI Code of Practice adherence reviewed; AI Office guidance expands
- 2 Dec 2027High-risk Annex III obligations apply (Digital Omnibus timeline)
- 2026–27Harmonised CEN/CENELEC standards finalised for high-risk conformity
- ongoingAI Office enforcement of GPAI systemic-risk models (>10^25 FLOP)
- ongoingMember-State penalty regimes + market-surveillance authorities stand up
- 2028+Commission review of Annex III scope + prohibited-practice list
Full obligation map, FRIA + conformity workflow, Art. 12 logging signed to Layer 0, and a live deadline clock. Comply once — crosswalk to NIST + ISO 42001. (Dates track the 2026 Digital Omnibus — verify against the final published text.)
The AI Risk Management Framework 1.0 plus the Generative AI Profile — voluntary, function-based (Govern, Map, Measure, Manage). With EO 14110 revoked (Jan 2025), the operative US federal baseline is OMB M-25-21 (which rescinded and replaced M-24-10 in April 2025) + NIST AI RMF, layered with state law (Colorado, California).
- 1.Govern/Map/Measure/Manage program scaffold
- 2.AI system inventory + context mapping
- 3.Bias & fairness measurement suite
- 4.Model cards + data sheets
- 5.Adversarial testing / red-teaming
- 6.Incident + near-miss tracking
- 7.Third-party / supply-chain risk controls
- ongoingGenAI Profile (NIST-AI-600-1) adoption across agencies + vendors
- 2026Sector crosswalks + NIST assurance guidance expand
- in effectOMB M-25-21 governs federal agencies' AI use (CAIOs, risk practices) — rescinded and replaced M-24-10 in Apr 2025; EO 14110 revoked Jan 2025
- ongoingFederal procurement + M-25-21 increasingly reference RMF conformance
- 2026–27Alignment work between RMF and ISO/IEC 42001 controls
- 1 Jan 2027State AI laws begin to bite (e.g. Colorado SB 26-189 / ADMT)
- ongoingCISA + sector guidance for AI in critical infrastructure
The Govern/Map/Measure/Manage scaffold as a live program, model cards + bias audits, red-team logging — mapped to EU AI Act so one evidence set serves both.
The first certifiable AI management system standard (2023). The 'ISO 27001 for AI' — auditable, globally recognised, and increasingly demanded in enterprise procurement.
- 1.AI Management System (AIMS) documentation
- 2.Statement of Applicability (Annex A controls)
- 3.AI risk assessment + treatment plan
- 4.AI system impact assessment
- 5.Lifecycle & data-governance controls
- 6.Internal audit + management review
- 7.Continual improvement / nonconformity log
- ongoingRising enterprise + government procurement demand for 42001 certification
- 2026Guidance standards (42005 impact assessment, 42006 audit) mature
- ongoing42001 ↔ EU AI Act conformity mapping tightens
- 2026–27Accredited certification-body capacity expands globally
- ongoingIntegration with ISO 27001 / 27701 management systems
- 2027+First scheduled review cycle of the standard
- ongoingSector profiles (health, finance) emerging
AIMS + Statement of Applicability generated from your controls, impact assessments, and audit logs — exportable and signed. One certification, mapped across regimes.
The data-protection backbone AI systems must respect — lawful basis, purpose limitation, automated-decision rights (Art. 22), and DPIAs where processing is high-risk.
- 1.Records of Processing Activities (RoPA)
- 2.Data Protection Impact Assessment (DPIA)
- 3.Lawful-basis + consent management
- 4.Art. 22 automated-decision safeguards
- 5.Data-subject-request (DSAR) workflow
- 6.Data minimisation + retention controls
- 7.Cross-border transfer mechanism (SCCs/adequacy)
- ongoingDPAs scrutinising training-data scraping + generative AI
- 2026EDPB opinions on AI models & personal data mature
- ongoingGDPR ↔ EU AI Act interplay clarified for high-risk systems
- ongoingEnforcement on biometric + emotion-recognition data
- 2026GDPR procedural regulation streamlining cross-border cases
- ongoingAutomated-decision case law (Art. 22) expanding
- ongoingRising fines for AI-driven profiling failures
DPIA + RoPA generation, Art. 22 safeguards, and DSAR workflows — with the EU AI Act FRIA sharing evidence so you don't assess twice.
Originally the first comprehensive US state AI law (SB 24-205 — a duty of reasonable care against algorithmic discrimination in consequential decisions), but repealed and replaced in May 2026 by SB 26-189, a scaled-back ADMT framework that drops the duty of care and impact-assessment mandates. Effective 1 Jan 2027. The requirements below reflect the original SB 24-205 regime.
- 1.High-risk consequential-decision inventory
- 2.Algorithmic-discrimination risk management program
- 3.Consumer notice + explanation workflow
- 4.Impact assessments (annual + on material change)
- 5.Right-to-appeal / human review path
- 6.AG disclosure of discovered discrimination
- 7.Developer↔deployer documentation exchange
- 1 Jan 2027SB 26-189 (ADMT framework) takes effect — repealed & replaced the original SB 24-205 AI Act, dropping its duty of care and impact-assessment mandates
- 2026AG rulemaking under the scaled-back ADMT framework
- ongoingOther US states watching Colorado's pivot away from the EU-style model
- ongoingInteraction with NIST RMF as the reasonable-care benchmark
- 2026–27Enforcement posture + safe-harbour clarifications
- ongoingBusiness-community amendments debated in legislature
- TBDPossible federal preemption discussions — status shifting
Consequential-decision inventory, algorithmic-discrimination testing, and consumer-notice + appeal workflows — reusing your NIST/EU evidence.
The EU's expanded cybersecurity directive — risk-management measures, incident reporting, and management accountability for essential and important entities across 18 sectors.
- 1.Asset + supply-chain risk register
- 2.Cyber risk-management measures (Art. 21)
- 3.24h/72h incident-reporting workflow
- 4.Business continuity + backup controls
- 5.Vulnerability disclosure + patch management
- 6.Management-body oversight + training
- 7.Supply-chain security assessments
- ongoingNational transposition + enforcement ramping (deadline was Oct 2024)
- 2026Registration of essential/important entities completed across states
- ongoingImplementing acts on technical + methodological requirements
- ongoingFirst enforcement actions + management-liability tests
- 2026–27Alignment with CRA + DORA for overlapping entities
- ongoingENISA guidance + sectoral thresholds refined
- ongoingCross-border incident coordination via CSIRTs network
Cyber risk register, incident-reporting clock, and supply-chain assessments — plus cyber self-scan so you can test controls, not just document them.
The Digital Operational Resilience Act — ICT risk management, incident reporting, resilience testing, and third-party (incl. cloud/AI) oversight for EU financial entities.
- 1.ICT risk-management framework
- 2.ICT-incident classification + reporting
- 3.Digital operational resilience testing (incl. TLPT)
- 4.ICT third-party register + concentration risk
- 5.Contractual clauses for critical ICT providers
- 6.Business-continuity + response/recovery plans
- 7.Board-level ICT governance
- ongoingFull application in effect (since Jan 2025) — supervisory ramp-up
- 2026Register-of-information submissions + oversight of critical TPPs
- ongoingThreat-led penetration testing (TLPT) cycles begin for larger entities
- ongoingRTS/ITS technical standards bedding in
- 2026–27Designation + oversight of critical ICT third parties
- ongoingCross-mapping with NIS2 for dual-scope entities
- ongoingAI-vendor dependency treated as ICT third-party risk
ICT risk framework, incident classification, and third-party (AI/cloud) register — resilience testing evidence signed to Layer 0.
Mandatory cybersecurity requirements for products with digital elements — secure-by-design, vulnerability handling, and CE-marking for hardware + software across the EU market.
- 1.Product security risk assessment
- 2.Secure-by-design + secure-by-default controls
- 3.SBOM (software bill of materials)
- 4.Coordinated vulnerability disclosure process
- 5.Security update / patch delivery mechanism
- 6.Conformity assessment + CE marking
- 7.Actively-exploited-vuln + incident reporting
- Sept 2026Vulnerability + incident reporting obligations begin to apply
- Dec 2027Full CRA obligations apply for products with digital elements
- 2026Harmonised standards + guidance for essential requirements
- ongoingNotified-body capacity for conformity assessment builds out
- 2026–27SBOM tooling + attestation expectations mature
- ongoingOverlap handling with AI Act for AI-enabled products
- ongoingOpen-source steward obligations clarified
SBOM + secure-by-design checklist, CVD process, and conformity workflow — with cyber self-scan checking your product surface for the evidence.
Interim Measures for Generative AI plus TC260 standards and content-labelling rules — security assessments, training-data governance, and provider registration.
- 1.Algorithm + service filing/registration
- 2.Security self-assessment
- 3.Training-data + content governance
- 4.AI-generated-content labelling
- 5.Real-name + content-moderation controls
- 6.Personal-information protection (PIPL) alignment
- 7.Incident + illegal-content handling
- ongoingAI-generated-content labelling rules in effect + enforced
- 2026New TC260 national standards on GenAI security published
- ongoingAlgorithm-filing enforcement + provider registration
- ongoingData-export + PIPL interplay for AI services
- 2026–27Sectoral rules (finance, health, autonomous) expand
- ongoingDeep-synthesis + deepfake provisions enforced
- ongoingCross-border AI service restrictions evolve
Filing/registration checklist, security self-assessment, and content-labelling controls mapped to the same evidence spine as EU/US.
A principles-based, pro-innovation approach delivered through existing regulators, with a possible AI bill for the most capable models under active debate.
- 1.Cross-sector principle mapping (safety, transparency, fairness, accountability, contestability)
- 2.Regulator-specific compliance (ICO/FCA/CMA/Ofcom)
- 3.AI assurance + audit techniques
- 4.Algorithmic transparency records (ATRS for public sector)
- 5.DPIA / data-protection alignment (UK GDPR)
- 6.Model risk + governance documentation
- 7.Incident + harm reporting
- 2026Direction on a UK AI bill for frontier models — status shifting, verify
- ongoingAI Safety Institute evaluations of frontier models
- ongoingSector regulators publishing AI strategic approaches
- 2026Algorithmic Transparency Recording Standard scaling in public sector
- ongoingICO guidance on AI + data protection updated
- ongoingInternational interoperability (EU/US) positioning
- TBDStatutory footing decisions for the AI Safety Institute
The five cross-sector principles as a live checklist, regulator mapping, and assurance evidence — bridged to EU/ISO so UK-first orgs stay portable.
The Artificial Intelligence and Data Act (part of Bill C-27) did not pass before Parliament was prorogued; Canada's statutory AI direction is being reset — track the voluntary code meanwhile.
- 1.Voluntary Code of Conduct (generative AI) alignment
- 2.High-impact-system identification
- 3.Risk mitigation + monitoring plan
- 4.Transparency + disclosure records
- 5.Human oversight measures
- 6.Bias + harm assessment
- 7.PIPEDA / privacy alignment
- 2026New legislative direction post-C-27 — status shifting, verify
- ongoingVoluntary Code of Conduct adoption by developers
- ongoingProvincial (Quebec Law 25) privacy interplay
- 2026Federal consultation on a revised AI framework
- ongoingAlignment signalling with EU AI Act + NIST
- TBDStanding up an AI & Data Commissioner function
- ongoingPublic-sector AI directive updates
Voluntary-Code alignment now, structured so you flip to statutory obligations the moment Canada's framework lands — no rework.
A practical, voluntary framework — the Model AI Governance Framework (incl. Generative AI) plus AI Verify testing toolkit — widely used as an implementation template across APAC.
- 1.Model AI Governance Framework mapping
- 2.AI Verify testing + reporting toolkit
- 3.Risk-based deployment controls
- 4.Data governance + PDPA alignment
- 5.Human-in-the-loop design patterns
- 6.Transparency + stakeholder communication
- 7.Incident management
- ongoingAI Verify + GenAI evaluation sandbox expansion
- 2026Updated GenAI governance guidance + testing standards
- ongoingCross-border interoperability work (ASEAN + global)
- ongoingSectoral guidelines (finance/health) from MAS + others
- 2026–27AI Verify Foundation tooling ecosystem grows
- ongoingAlignment with ISO 42001 for certification-minded firms
- ongoingPublic-sector AI adoption playbooks
Model Framework mapping + AI Verify-style testing evidence, bridged to ISO 42001 so a Singapore deployment ports globally.
One evidence set, mapped across every regime above — signed to Layer 0, provable not promised. That's the difference between a governance program and a pile of PDFs.