The primary texts. Read these first.
Operators need the small set of primary texts that regulators, courts and insurers treat as load bearing, more than every commentary on them. Each entry links to the source, notes its status and says where it fits.
The statutes. Where the duty is law.
Binding texts, with jurisdiction and the date they apply.
- European UnionRegulation (EU) 2024/1689, the AI ActThe horizontal rule. Article 50 transparency has applied since 2 August 2026; the Annex III high-risk obligations apply from 2 December 2027 after the Digital Omnibus. EUR-Lex, binding.
- European UnionDirective (EU) 2024/2853, product liabilityThe revised product liability regime. AI software is a product, with a rebuttable presumption of defect where the AI Act has been breached. Applies to products placed on the market after 9 December 2026. EUR-Lex, binding.
- United StatesSB 24-205, the Colorado AI ActThe first comprehensive US state AI statute, with a duty of care on developers and deployers. Postponed to 30 June 2026, then narrowed by SB26-189 with duties from 1 January 2027. Colorado General Assembly, binding.
- Republic of KoreaAI Basic ActThe first comprehensive AI statute in Asia, in force since 22 January 2026. Risk tiered classification and extraterritorial reach. Ministry of Science and ICT, binding.
Frameworks and standards. The reference texts.
Voluntary in most jurisdictions, and load bearing in practice because courts, regulators, procurement and insurers refer to them.
- United StatesNIST AI RMF 1.0Govern, Map, Measure, Manage. The framework US courts and regulators reach for when they define reasonable care. NIST, voluntary.
- United StatesNIST AI 600-1, the Generative AI ProfileThe generative AI companion to the framework, with twelve named risks relevant to agentic systems. NIST, voluntary.
- InternationalISO/IEC 42001:2023The first certifiable AI management system standard, with 38 controls in Annex A. ISO and IEC, certifiable.
- SingaporeAI Verify and the Model AI Governance FrameworkAn open source testing toolkit and a governance framework with a 2024 generative AI edition. IMDA, voluntary.
- IntergovernmentalOECD AI Principles, 2024 revisionFive values and five recommendations, the shared vocabulary of most national frameworks. OECD, recommendation.
- Council of EuropeFramework Convention on AI (2024)The first international treaty on AI, opened for signature in September 2024 and not yet in force. Council of Europe, treaty.
Regulator guidance. The operational texts.
What sector and supervisory authorities have published. Courts tend to treat these as the standard of practice.
- United KingdomICO guidance on AI and data protectionThe UK data protection authority's position on AI. Detailed, practical and often cited.
- European UnionEIOPA Opinion on AI governance and risk managementThe European insurance supervisor's expectations for AI in insurance, published 6 August 2025. Read across borders for AI and financial risk.
- SingaporeMAS FEAT Principles and the Veritas initiativeFairness, Ethics, Accountability and Transparency principles for AI in financial services.
- United StatesFTC guidance on AI claims and consumer harmThe FTC's statements, blog posts and enforcement actions that set the federal consumer protection posture on AI.
Insurance and coverage. Where residual risk is priced.
Our sister publications on how insurers read the regulation. They are published by Future Proof Intelligence, as this site is.
- CoverageAgent InsuredThe market for insuring AI agents, followed closely: who writes the cover, what it responds to, and what underwriters ask to see.
- OperatorsInsure Your AgentA plain guide for companies running agents: what is covered, what is excluded, and how to document before cover is bound.
- CertificationAgent CertifiedA published seven dimension methodology for assessing one AI agent in production, written to be read by insurers, boards and buyers.