Connect AI assurance evidence to the frameworks that matter
Explore laws, standards, risk frameworks and assurance criteria. Understand which technical evidence HAIEC can establish, how it relates to requirements, and which assessments remain the responsibility of your organization and independent reviewers.
A requirement is not evidence of compliance
These are five distinct evidentiary states. HAIEC contributes to the middle three; the first and last belong to the framework and to independent reviewers.
Referenced requirement
A framework or law states a requirement. This is a reference point, not evidence.
Relevant technical signal
A scan, test, or intake produces a signal that relates to the requirement.
Qualified evidence
The signal is persisted with provenance, scope, and limitations as an evidence record.
Evaluated control question
An Assurance Control maps qualified evidence to the specific control question it can support.
Independent determination
A conformity assessment, audit, examination, or legal classification made by the responsible organization or an independent professional. HAIEC does not make these.
Reference library
17 references across 6 classifications. Each entry shows what HAIEC evidence can and cannot establish.
EU AI Act
Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744
- Status
- In force, phased application
- Applies to
- Provider, Deployer, Importer, Distributor, GPAI model provider
- Reviewed
- 2026-10-20
Colorado ADMT Act
SB 26-189 (repealed and reenacted the prior SB 24-205 framework)
- Status
- Enacted; core duties effective January 1, 2027
- Applies to
- Developer, Deployer
- Reviewed
- 2026-10-20
NYC Local Law 144
Local Law 144 of 2021 (AEDT bias audit requirements)
- Status
- In effect since July 2023
- Applies to
- Employer, Employment agency
- Reviewed
- 2026-10-20
GDPR
Regulation (EU) 2016/679
- Status
- In force since May 2018
- Applies to
- Controller, Processor
- Reviewed
- 2026-10-20
CCPA / CPRA
California Consumer Privacy Act, as amended by CPRA
- Status
- In force; CPRA amendments operative since 2023
- Applies to
- Business, Service provider
- Reviewed
- 2026-10-20
UK AI regulation
No single comprehensive AI statute; sectoral regulators under the pro-innovation framework
- Status
- Principles-based, sector-led approach
- Applies to
- Context-dependent
- Reviewed
- 2026-10-20
HAIEC does not maintain a dedicated UK regulatory page. The UK applies a sector-led, principles-based approach rather than a single AI statute.
Canada AIDA
Artificial Intelligence and Data Act (Bill C-27, died on prorogation January 2025)
- Status
- Not enacted; proposed legislation did not pass
- Applies to
- N/A, not enacted
- Reviewed
- 2026-10-20
The proposed Artificial Intelligence and Data Act did not become law. HAIEC does not maintain a dedicated Canadian regulatory page.
HIPAA
Health Insurance Portability and Accountability Act
- Status
- In force
- Applies to
- Covered entity, Business associate
- Reviewed
- 2026-10-20
SOC 2
AICPA Trust Services Criteria (2017, revised 2022)
- Status
- Current criteria in use
- Applies to
- Service organization
- Reviewed
- 2026-10-20
ISO/IEC 27001
ISO/IEC 27001:2022
- Status
- Current edition 2022
- Applies to
- Organization operating an ISMS
- Reviewed
- 2026-10-20
ISO/IEC 42001
ISO/IEC 42001:2023
- Status
- Current edition 2023
- Applies to
- Organization operating an AIMS
- Reviewed
- 2026-10-20
AI management-system standard; distinct from the ISO 27001 information-security standard.
NIST AI RMF
NIST AI Risk Management Framework 1.0 (2023), with Generative AI Profile (2024)
- Status
- Published, voluntary
- Applies to
- Organization managing AI risk
- Reviewed
- 2026-10-20
NIST CSF 2.0
NIST Cybersecurity Framework 2.0 (2024)
- Status
- Published, voluntary
- Applies to
- Organization managing cybersecurity risk
- Reviewed
- 2026-10-20
OWASP LLM / Agentic AI
OWASP Top 10 for LLM Applications; OWASP Agentic AI guidance
- Status
- Community-maintained guidance
- Applies to
- Engineering and security teams
- Reviewed
- 2026-10-20
MITRE ATLAS
MITRE ATLAS adversarial ML threat knowledge base
- Status
- Maintained knowledge base
- Applies to
- Security and threat-modeling teams
- Reviewed
- 2026-10-20
ISAF v2
Integrated Security & Assurance Framework, version 2 (HAIEC-authored)
- Status
- Final author-issued manuscript; archive publication forthcoming
- Applies to
- Assurance and engineering teams
- Reviewed
- 2026-10-20
CSM-6
HAIEC six-dimension compliance-statement methodology
- Status
- HAIEC research methodology
- Applies to
- Assurance and engineering teams
- Reviewed
- 2026-10-20
From reference to evidence
Framework mappings only become useful when technical evidence exists to support them. HAIEC evaluates scoped AI systems and produces qualified evidence records an independent reviewer can inspect.