From 4a04801d3f118cdc4831ccc758ac31145a640d48 Mon Sep 17 00:00:00 2001 From: Bill Stout Date: Sun, 4 Oct 2026 17:13:29 -0700 Subject: [PATCH 1/2] =?UTF-8?q?Stop=20publishing=20Cursor=E2=86=94Kombai?= =?UTF-8?q?=20message=20board=20files=20to=20GitHub.?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Keep the drop-box local-only by removing tracked board paths and ignoring .board-cursor-kombai/, BOARD.md, and .kombai/. Co-authored-by: Cursor --- .board-cursor-kombai/README.md | 64 -------------- .board-cursor-kombai/archive/.gitkeep | 0 .board-cursor-kombai/open.example.md | 51 ----------- .board-cursor-kombai/outbox-cursor/.gitkeep | 0 .board-cursor-kombai/outbox-kombai/.gitkeep | 0 .board-cursor-kombai/turn.example.md | 1 - .gitignore | 14 +-- .kombai/MESSAGE-BOARD.example.md | 95 --------------------- .kombai/README.md | 36 -------- BOARD.md | 7 -- 10 files changed, 4 insertions(+), 264 deletions(-) delete mode 100644 .board-cursor-kombai/README.md delete mode 100644 .board-cursor-kombai/archive/.gitkeep delete mode 100644 .board-cursor-kombai/open.example.md delete mode 100644 .board-cursor-kombai/outbox-cursor/.gitkeep delete mode 100644 .board-cursor-kombai/outbox-kombai/.gitkeep delete mode 100644 .board-cursor-kombai/turn.example.md delete mode 100644 .kombai/MESSAGE-BOARD.example.md delete mode 100644 .kombai/README.md delete mode 100644 BOARD.md diff --git a/.board-cursor-kombai/README.md b/.board-cursor-kombai/README.md deleted file mode 100644 index b860d55..0000000 --- a/.board-cursor-kombai/README.md +++ /dev/null @@ -1,64 +0,0 @@ -# Cursor ↔ Kombai directory drop-box - -Near-synchronous messaging between Cursor and Kombai uses this directory in a **git checkout**, not Project Context and not `~/.kombai`. - -**Absolute path (Bill’s Mac checkout):** - -```text -/Users/billstout/Documents/Claude/Projects/AISharedResponsibility.com/.board-cursor-kombai/ -``` - -Wrong path (home app data; never the board): - -```text -/Users/billstout/.kombai/ -``` - -In Finder, press **⌘⇧.** to show the `.board-cursor-kombai` dotfolder inside the checkout. - -## Layout - -| Path | Tracked? | Role | -|------|----------|------| -| `README.md` | yes | This protocol | -| `open.example.md` | yes | Template for the current brief | -| `turn.example.md` | yes | Template for whose turn | -| `outbox-cursor/.gitkeep` | yes | Cursor → Kombai dated messages | -| `outbox-kombai/.gitkeep` | yes | Kombai → Cursor dated messages | -| `archive/.gitkeep` | yes | Completed message pairs | -| `open.md` | **no** (gitignored) | Current brief Kombai should read | -| `turn.md` | **no** (gitignored) | Exactly one of: `cursor` \| `kombai` \| `idle` | -| `outbox-cursor/*` | **no** (except `.gitkeep`) | Cursor-authored dated files | -| `outbox-kombai/*` | **no** (except `.gitkeep`) | Kombai-authored dated files | -| `archive/*` | **no** (except `.gitkeep`) | Archived done files | - -## Near-sync protocol - -1. `turn.md` contains exactly one of: `cursor` | `kombai` | `idle` (plus an optional trailing newline). No other text. -2. **When Cursor needs Kombai:** write a dated file to `outbox-cursor/YYYYMMDD-HHMMSS-.md`, copy or update `open.md` to that brief, set `turn.md` to `kombai`. -3. **Kombai polls:** if `turn.md` is `kombai`, read `open.md` and the latest file in `outbox-cursor/`, do **design-only** work, write `outbox-kombai/YYYYMMDD-HHMMSS-.md`, set `turn.md` to `cursor`. -4. **Cursor reads** the new file in `outbox-kombai/`, archives both sides’ done files into `archive/`, sets `turn.md` to `idle` or starts the next task. -5. **Never** edit the other side’s outbox files. **Never** commit live `open.md`, `turn.md`, outbox contents, or archive contents. -6. Path is always `/.board-cursor-kombai/`. Not under `~/.kombai`. - -## Bootstrap (local only) - -From the repo root after `git pull`: - -```bash -cp .board-cursor-kombai/open.example.md .board-cursor-kombai/open.md -cp .board-cursor-kombai/turn.example.md .board-cursor-kombai/turn.md -# When ready for Kombai: echo kombai > .board-cursor-kombai/turn.md -``` - -## Standing rules (design-only) - -- Design-only: no git edits, no PR, no `llms*.txt` / JSON changes -- Direction: Decision record leads (`var_4ffaabd2c1ca`) -- Viewport one: no patient-triage L1–L5 ledger (Scenario-first / `var_c7ea383f3261` rejected) -- First viewport: brand + one headline + one short support + one CTA group + one Decision Record visual plane -- Visual language: paper `#f4f5f7`, ink `#1a2332`, CoSAI blue `#1a3a6b`, slate `#d5dae3`; Public Sans + Source Serif; 1px rules, 2px corners, no shadows; no purple/cream AI defaults, no glow, no hero cards - -## Deprecated - -`.kombai/MESSAGE-BOARD.md` (single-file board) is deprecated. Prefer this directory. Keep ignoring any leftover `.kombai/MESSAGE-BOARD.md`; do not commit it. diff --git a/.board-cursor-kombai/archive/.gitkeep b/.board-cursor-kombai/archive/.gitkeep deleted file mode 100644 index e69de29..0000000 diff --git a/.board-cursor-kombai/open.example.md b/.board-cursor-kombai/open.example.md deleted file mode 100644 index 9503856..0000000 --- a/.board-cursor-kombai/open.example.md +++ /dev/null @@ -1,51 +0,0 @@ -This is the live channel open brief when copied to open.md. - -Read `turn.md`: only act when it says `kombai`. Reply in `outbox-kombai/`, then set `turn.md` to `cursor`. Do not edit `outbox-cursor/`. Path: `/.board-cursor-kombai/`. Design-only: no git edits, no PR, no `llms*.txt` / JSON. - -STATUS: Your Cursor review plan for the homepage was REJECTED. -Reason: It cited Decision record leads (var_4ffaabd2c1ca) but put the full patient-triage L1–L5 ledger in the first viewport. That is Scenario-first (var_c7ea383f3261), already rejected. - -REQUIRED REDRAW — Decision record leads only (var_4ffaabd2c1ca) - -Primary page: homepage first viewport (index.html mocks only; Cursor will implement later). - -Goal (one sentence): Shorten the hero so brand + one claim + one Decision Record CTA + one Decision Record visual plane fill viewport one. - -First viewport MUST contain only: -- Brand at hero level (CoSAI / AI Shared Responsibility), not only in nav -- One headline (prefer live lead: “Make responsibility clear before you scale AI”) -- One short supporting sentence (maps obligation/control to an owner; do not let this overpower brand as sole H1) -- One CTA group: primary Create a Decision Record → /tools/decision-record/ -- One dominant visual: Decision Record preview or form plane (layers, residual gaps, attestation/sign-off) - -First viewport MUST NOT contain: -- Patient-triage scenario text -- Complete L1–L5 owner mapping / ledger / matrix -- Flags band for the triage example -- Scenario | analysis split as the hero’s second composition -- Secondary “Open the SRF Stress Test” as a competing hero CTA (Stress Test stays in its own later section) - -Keep elsewhere (not viewport one): -- Patient-triage example and L1–L5 assignments stay in the SRF Stress Test section (restyle in place if needed; if fixing aria-hidden, fix there, do not migrate into the hero) -- Role links, announcement/PDF, full lede, comparison, five-layer reference, tools, machine-readable resources, footer order unchanged - -File boundaries for the eventual Cursor implement (state these as non-changes in your handoff): -- Cursor may edit index.html page-local hero only -- No shared/styles.css, shared/components.js, JSON, llms.txt, llms-full.txt, other routes - -Visual language: reuse existing tokens (paper #f4f5f7, ink #1a2332, CoSAI blue #1a3a6b, slate #d5dae3). Public Sans + Source Serif. 1px rules, 2px corners, no shadows. No purple/cream AI defaults, no glow, no hero cards. - -Return format (design-only handoff back to Cursor): -1. Task restated -2. Chosen direction (must be Decision record leads / var_4ffaabd2c1ca) -3. First viewport (brand, headline, support, CTA, Decision Record visual plane) -4. Tokens to change (or “unchanged”) -5. Section plan after the hero (Stress Test keeps triage evidence) -6. Motion (2–3 max, or none) -7. Explicit non-changes (nav, footer, triage stays out of viewport one, JSON, llms*) -8. Assets (describe only) -9. Open questions for Bill - -Do not produce another Cursor implementation plan that puts triage L1–L5 in the hero. - -When finished: write `outbox-kombai/YYYYMMDD-HHMMSS-.md` with the handoff, then set `turn.md` to exactly `cursor`. Do not rely on Project Context as a board. diff --git a/.board-cursor-kombai/outbox-cursor/.gitkeep b/.board-cursor-kombai/outbox-cursor/.gitkeep deleted file mode 100644 index e69de29..0000000 diff --git a/.board-cursor-kombai/outbox-kombai/.gitkeep b/.board-cursor-kombai/outbox-kombai/.gitkeep deleted file mode 100644 index e69de29..0000000 diff --git a/.board-cursor-kombai/turn.example.md b/.board-cursor-kombai/turn.example.md deleted file mode 100644 index 5a5e41c..0000000 --- a/.board-cursor-kombai/turn.example.md +++ /dev/null @@ -1 +0,0 @@ -idle diff --git a/.gitignore b/.gitignore index b1f411d..948f9ed 100644 --- a/.gitignore +++ b/.gitignore @@ -16,13 +16,7 @@ __pycache__/ *.py[cod] build/nist_ai_rmf/.cache/ -# Deprecated single-file board (local only if present). -.kombai/MESSAGE-BOARD.md - -# Live Cursor↔Kombai drop-box state stays local; never commit. -.board-cursor-kombai/open.md -.board-cursor-kombai/turn.md -.board-cursor-kombai/outbox-cursor/* -.board-cursor-kombai/outbox-kombai/* -.board-cursor-kombai/archive/* -!.board-cursor-kombai/**/.gitkeep +# Cursor↔Kombai messaging stays local only; never publish to GitHub. +.board-cursor-kombai/ +BOARD.md +.kombai/ diff --git a/.kombai/MESSAGE-BOARD.example.md b/.kombai/MESSAGE-BOARD.example.md deleted file mode 100644 index ffaa99d..0000000 --- a/.kombai/MESSAGE-BOARD.example.md +++ /dev/null @@ -1,95 +0,0 @@ -# DEPRECATED — use `.board-cursor-kombai/` instead - -This single-file board is deprecated. Live near-sync channel: [`.board-cursor-kombai/`](../.board-cursor-kombai/) (`open.md`, `turn.md`, outboxes). See `.board-cursor-kombai/README.md` and repo `BOARD.md`. - ---- - -# Kombai ↔ Cursor live message board (legacy seed) - -**Legacy path only.** Prefer `.board-cursor-kombai/open.md`. If named `MESSAGE-BOARD.md` under `.kombai/`, it is gitignored and not on GitHub. Not under `~/.kombai` (that is Kombai app data). Project Context is only a pointer for humans in Cursor. - -**Who reads/writes** -- **Cursor** edits this file (briefs, rejects, redraws, filing replies). -- **Bill** pastes Kombai’s design-only handoff into **Kombai replies** below (or asks Cursor to paste it). -- **Kombai** reads this file from this checkout. Design-only: no git edits, no PR, no `llms*.txt` / JSON unless Bill gives an explicit override for that task. Kombai cannot read Cursor Project Context / Agent Store. - -**Standing rules** -- Design-only: no git edits, no PR, no `llms*.txt` / JSON changes -- Direction: Decision record leads (`var_4ffaabd2c1ca`) -- Viewport one: no patient-triage L1–L5 ledger (that is Scenario-first / `var_c7ea383f3261`, rejected) -- First viewport: brand + one headline + one short support + one CTA group + one Decision Record visual plane -- Visual language: paper `#f4f5f7`, ink `#1a2332`, CoSAI blue `#1a3a6b`, slate `#d5dae3`; Public Sans + Source Serif; 1px rules, 2px corners, no shadows; no purple/cream AI defaults, no glow, no hero cards - ---- - -## Open for Kombai (paste this) - -Copy everything inside the fence into Kombai. - -```text -Read and follow the brief in .kombai/MESSAGE-BOARD.md. You are design-only: do not edit any git repo files, do not open a PR, do not change llms*.txt or JSON. - -STATUS: Your Cursor review plan for the homepage was REJECTED. -Reason: It cited Decision record leads (var_4ffaabd2c1ca) but put the full patient-triage L1–L5 ledger in the first viewport. That is Scenario-first (var_c7ea383f3261), already rejected. - -REQUIRED REDRAW — Decision record leads only (var_4ffaabd2c1ca) - -Primary page: homepage first viewport (index.html mocks only; Cursor will implement later). - -Goal (one sentence): Shorten the hero so brand + one claim + one Decision Record CTA + one Decision Record visual plane fill viewport one. - -First viewport MUST contain only: -- Brand at hero level (CoSAI / AI Shared Responsibility), not only in nav -- One headline (prefer live lead: “Make responsibility clear before you scale AI”) -- One short supporting sentence (maps obligation/control to an owner; do not let this overpower brand as sole H1) -- One CTA group: primary Create a Decision Record → /tools/decision-record/ -- One dominant visual: Decision Record preview or form plane (layers, residual gaps, attestation/sign-off) - -First viewport MUST NOT contain: -- Patient-triage scenario text -- Complete L1–L5 owner mapping / ledger / matrix -- Flags band for the triage example -- Scenario | analysis split as the hero’s second composition -- Secondary “Open the SRF Stress Test” as a competing hero CTA (Stress Test stays in its own later section) - -Keep elsewhere (not viewport one): -- Patient-triage example and L1–L5 assignments stay in the SRF Stress Test section (restyle in place if needed; if fixing aria-hidden, fix there, do not migrate into the hero) -- Role links, announcement/PDF, full lede, comparison, five-layer reference, tools, machine-readable resources, footer order unchanged - -File boundaries for the eventual Cursor implement (state these as non-changes in your handoff): -- Cursor may edit index.html page-local hero only -- No shared/styles.css, shared/components.js, JSON, llms.txt, llms-full.txt, other routes - -Visual language: reuse existing tokens (paper #f4f5f7, ink #1a2332, CoSAI blue #1a3a6b, slate #d5dae3). Public Sans + Source Serif. 1px rules, 2px corners, no shadows. No purple/cream AI defaults, no glow, no hero cards. - -Return format (design-only handoff back to Cursor): -1. Task restated -2. Chosen direction (must be Decision record leads / var_4ffaabd2c1ca) -3. First viewport (brand, headline, support, CTA, Decision Record visual plane) -4. Tokens to change (or “unchanged”) -5. Section plan after the hero (Stress Test keeps triage evidence) -6. Motion (2–3 max, or none) -7. Explicit non-changes (nav, footer, triage stays out of viewport one, JSON, llms*) -8. Assets (describe only) -9. Open questions for Bill - -Do not produce another Cursor implementation plan that puts triage L1–L5 in the hero. - -When finished, Bill pastes your handoff into .kombai/MESSAGE-BOARD.md under Kombai replies (or Cursor pastes it). Do not rely on Project Context as a board. -``` - ---- - -## Kombai replies - -_(None yet. Bill or Cursor pastes Kombai’s structured handoff below as a new dated entry.)_ - - diff --git a/.kombai/README.md b/.kombai/README.md deleted file mode 100644 index ce2050e..0000000 --- a/.kombai/README.md +++ /dev/null @@ -1,36 +0,0 @@ -# `.kombai` (legacy folder) - -**The Cursor↔Kombai channel moved to [`.board-cursor-kombai/`](../.board-cursor-kombai/).** See that directory’s `README.md` for the near-sync drop-box protocol (`turn.md`, `open.md`, outboxes, archive). - -Repo root pointer: [`BOARD.md`](../BOARD.md). - -## Deprecation - -`.kombai/MESSAGE-BOARD.md` (single-file board) is **deprecated**. Do not start new work there. If an old local copy exists, it remains gitignored; never commit it. Prefer: - -```text -/Users/billstout/Documents/Claude/Projects/AISharedResponsibility.com/.board-cursor-kombai/ -``` - -## Path warning - -| Path | What it is | -|------|------------| -| `~/.kombai` or `/Users//.kombai` | Kombai **application data** (mcp, binaries, workspaces). **Not** the message board. | -| `/.board-cursor-kombai/` | **Live drop-box channel** (gitignored open/turn/outbox/archive). | -| `/.kombai/` | This legacy folder (README + optional old example). | - -Wrong path (home app data): - -```text -/Users/billstout/.kombai/MESSAGE-BOARD.md -``` - -## Optional migration from the old file - -If you still have a local `.kombai/MESSAGE-BOARD.md`, copy its open brief into `.board-cursor-kombai/open.md`, then use the drop-box protocol. New seeds: - -```bash -cp .board-cursor-kombai/open.example.md .board-cursor-kombai/open.md -cp .board-cursor-kombai/turn.example.md .board-cursor-kombai/turn.md -``` diff --git a/BOARD.md b/BOARD.md deleted file mode 100644 index e4a8309..0000000 --- a/BOARD.md +++ /dev/null @@ -1,7 +0,0 @@ -# Cursor ↔ Kombai board pointer - -**Live channel (local drop-box):** [`.board-cursor-kombai/`](.board-cursor-kombai/) - -Tracked protocol and templates live under that directory. Live state (`open.md`, `turn.md`, outbox files, archive) is **gitignored** and exists only in a local checkout. - -Deprecated single-file board: `.kombai/MESSAGE-BOARD.md` (still gitignored if present). Do not use `~/.kombai` for messaging; that path is Kombai app data. From e3f9e5a0c6cc4f7094b27b63ed6b10dfc18a9e5e Mon Sep 17 00:00:00 2001 From: Bill Stout Date: Wed, 7 Oct 2026 17:44:40 -0700 Subject: [PATCH 2/2] Add NYDFS Part 500, NYDFS AI cyber letter, DORA, MAS AI guidelines, and MiCA to regulations catalog Add DORA and the 2024 AI letter to the discovery wizard; regenerate knowledge layer. Co-authored-by: Cursor --- compare/index.html | 2 +- data/jurisdictions.json | 4 +- data/regulations.json | 162 ++++++++++++++- export/framework.json | 208 +++++++++++++++++++- export/ontology.json | 283 +++++++++++++++++++++++++++ ids.json | 37 +++- ontology/edges.json | 171 +++++++++++++++- ontology/nodes.json | 116 ++++++++++- regulations/discovery/data.json | 22 ++- regulations/discovery/wizard.js | 8 +- regulations/index.html | 2 +- tools/regulation-discovery/data.json | 22 ++- tools/regulation-discovery/wizard.js | 8 +- 13 files changed, 1026 insertions(+), 19 deletions(-) diff --git a/compare/index.html b/compare/index.html index 46a3237..c64ca96 100644 --- a/compare/index.html +++ b/compare/index.html @@ -350,7 +350,7 @@ - + diff --git a/data/jurisdictions.json b/data/jurisdictions.json index 5c049da..34a2d2f 100644 --- a/data/jurisdictions.json +++ b/data/jurisdictions.json @@ -2,7 +2,7 @@ "$schema_version": "1.0", "description": "Controlled vocabulary for the jurisdiction that issues a regulation or standard. Referenced by the 'jurisdiction' field in regulations.json. Levels run from 'international' down to 'subnational'. 'multistate' covers US model-law bodies such as the NAIC. National nodes outside the US hold thin reference instruments so comparative queries can resolve even before vertical controls cite them.", "srf_version": "1.0", - "updated": "2026-07-28", + "updated": "2026-10-07", "levels": { "international": "A standards body or multilateral instrument with no independent force of law.", "supranational": "A treaty-based authority whose instruments bind its member states.", @@ -77,7 +77,7 @@ "name": "Singapore", "level": "national", "parent": null, - "note": "Model AI Governance Framework and related IMDA/PDPC guidance. Voluntary baseline widely cited in Asia-Pacific procurement." + "note": "Model AI Governance Framework and related IMDA/PDPC guidance. Voluntary baseline widely cited in Asia-Pacific procurement. MAS issues sector guidelines for financial institutions, such as the 2026 AI Risk Management Guidelines; these set supervisory expectations rather than statutory duties." }, { "id": "canada", diff --git a/data/regulations.json b/data/regulations.json index 01f605a..2b7a42e 100644 --- a/data/regulations.json +++ b/data/regulations.json @@ -1,5 +1,5 @@ { - "updated": "2026-09-09", + "updated": "2026-10-07", "stale_threshold_days": 180, "items": [ { @@ -1431,6 +1431,164 @@ ], "applicable_verticals_source": "declared-sector" }, + { + "id": "nydfs-part-500", + "name": "23 NYCRR Part 500: Cybersecurity Requirements for Financial Services Companies", + "short": "NYDFS Part 500", + "body": "New York Department of Financial Services", + "url": "https://www.dfs.ny.gov/industry_guidance/cybersecurity", + "version": "Second Amendment, 1 November 2023", + "published": "2017-03-01", + "last_verified": "2026-10-07", + "jurisdiction": "us-new-york", + "mapping_key": null, + "depth": "reference", + "verification_status": "verified", + "srf_layers": [ + "L1", + "L2", + "L4" + ], + "scope": "New York's cybersecurity regulation for any entity licensed or chartered under the state Banking Law, Insurance Law, or Financial Services Law (\u00a7 500.1(e)). The text never mentions AI. Its controls still reach AI systems because they apply to every information system that holds nonpublic information. The sections that land on an AI deployment are the risk assessment (\u00a7 500.9), access privileges (\u00a7 500.7), the third-party service provider policy (\u00a7 500.11), MFA for every authorized user (\u00a7 500.12), and the asset inventory (\u00a7 500.13(a)). The Second Amendment of 1 November 2023 phased in the last two at full scope on 1 November 2025. The covered entity keeps the L1 obligation when the model or platform comes from a vendor: \u00a7 500.11 requires written policies for vetting and contracting with that L4 or L5 provider. DFS applied these sections to AI risk in a 2024 industry letter, listed as nydfs-ai-cyber-letter-2024.", + "tags": [ + "regulation", + "financial", + "security", + "us", + "mandatory" + ], + "applicable_verticals": [ + "finance", + "insurance" + ], + "applicable_verticals_source": "declared-sector" + }, + { + "id": "nydfs-ai-cyber-letter-2024", + "name": "NYDFS Industry Letter: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks", + "short": "NYDFS AI Cyber Letter (2024)", + "body": "New York Department of Financial Services", + "url": "https://www.dfs.ny.gov/industry-guidance/industry-letters/il20241016-cyber-risks-ai-and-strategies-combat-related-risks", + "version": "Industry letter, 16 October 2024", + "published": "2024-10-16", + "last_verified": "2026-10-07", + "jurisdiction": "us-new-york", + "mapping_key": null, + "depth": "reference", + "verification_status": "verified", + "srf_layers": [ + "L1", + "L2", + "L3", + "L4" + ], + "scope": "DFS guidance to Part 500 covered entities on AI-related cyber risk. The letter states that it adds no requirements; it explains how existing Part 500 sections apply. DFS names four risks: AI-enabled social engineering including deepfakes, AI-enhanced attacks, theft of the large nonpublic-information stores that AI systems hold, and supply-chain exposure through vendors that use AI. Its control expectations are specific. Risk assessments must cover the entity's own AI use, AI used by its third-party service providers, and vulnerabilities in AI applications. MFA should avoid SMS, voice, and video factors that a deepfake can imitate. Entities that use AI, or let staff use public AI tools, should monitor for queries that try to extract nonpublic information. Entities should inventory every information system that uses or relies on AI. This letter is separate from Circular Letter No. 7 of 2024, which covers AI in insurance underwriting and pricing and is listed as nydfs-cl-7-2024.", + "tags": [ + "guidance", + "financial", + "security", + "us" + ], + "applicable_verticals": [ + "finance", + "insurance" + ], + "applicable_verticals_source": "declared-sector" + }, + { + "id": "eu-dora", + "name": "Digital Operational Resilience Act (Regulation (EU) 2022/2554)", + "short": "DORA", + "body": "European Union", + "url": "https://eur-lex.europa.eu/eli/reg/2022/2554/oj", + "version": "2022/2554", + "published": "2022-12-27", + "last_verified": "2026-10-07", + "jurisdiction": "eu", + "mapping_key": null, + "depth": "reference", + "verification_status": "verified", + "srf_layers": [ + "L1", + "L4", + "L5" + ], + "scope": "Applies from 17 January 2025 to the EU financial entities listed in Article 2(1), including credit institutions, investment firms, insurers, and crypto-asset service providers authorised under MiCA. DORA has no AI-specific provisions. It reaches AI because a model API, an AI platform, or the cloud service hosting either is an ICT service, which makes its provider an ICT third-party service provider. Article 28(1) keeps the financial entity fully responsible for compliance when it uses third-party ICT services. The entity must record each such contract in its register of information (Article 28(3)) and include the terms Article 30 requires, such as audit and access rights. Through those terms the L1 deployer extends its obligations to the L4 or L5 provider by contract. On 18 November 2025 the ESAs designated the first 19 critical ICT third-party providers, including AWS, Google Cloud, and Microsoft, which places them under direct ESA oversight. A major ICT-related incident involving an AI service follows the classification and reporting duties in Articles 17 to 23.", + "tags": [ + "regulation", + "financial", + "security", + "eu", + "mandatory" + ], + "applicable_verticals": [ + "finance", + "insurance" + ], + "applicable_verticals_source": "declared-sector" + }, + { + "id": "mas-ai-risk-management-guidelines", + "name": "MAS Guidelines on Artificial Intelligence Risk Management for Financial Institutions", + "short": "MAS AI Risk Management Guidelines", + "body": "Monetary Authority of Singapore", + "url": "https://www.mas.gov.sg/regulation/guidelines/guidelines-on-artificial-intelligence-risk-management-for-financial-institutions", + "version": "Issued 7 October 2026; effective 7 October 2027", + "published": "2026-10-07", + "last_verified": "2026-10-07", + "jurisdiction": "singapore", + "mapping_key": null, + "depth": "reference", + "verification_status": "verified", + "srf_layers": [ + "L1", + "L2", + "L3", + "L4", + "L5" + ], + "scope": "Supervisory expectations for every MAS-regulated financial institution, including banks, insurers, capital markets intermediaries, and payment institutions. They cover all forms of AI, including generative AI and AI agents. MAS issued them on 7 October 2026 after a November 2025 consultation. Sections 3 and 4 (board and senior management oversight; AI identification, inventory, and risk materiality assessment) apply from 7 October 2027. Sections 5 and 6 (lifecycle controls; capabilities and capacity) apply by 7 October 2028. Each AI use case gets a risk materiality rating built from at least three dimensions: Impact, Complexity, and Reliance. The consultation response decides where accountability sits between L1 and L4 or L5. Respondents asked that third-party AI providers stay responsible for model safety, training data quality, and platform security. MAS kept the institution accountable for third-party AI and said unsupported vendor self-attestations generally do not close a transparency gap. Independent certifications or external assessments count only where the institution confirms they cover the key risks. An institution that cannot bring a third-party AI service within its risk appetite should limit, suspend, or replace it. MAS plans a further consultation on agentic AI in 2027.", + "tags": [ + "guidance", + "financial", + "singapore" + ], + "applicable_verticals": [ + "finance", + "insurance" + ], + "applicable_verticals_source": "declared-sector" + }, + { + "id": "eu-mica", + "name": "Markets in Crypto-Assets Regulation (Regulation (EU) 2023/1114)", + "short": "MiCA", + "body": "European Union", + "url": "https://eur-lex.europa.eu/eli/reg/2023/1114/oj", + "version": "2023/1114", + "published": "2023-06-09", + "last_verified": "2026-10-07", + "jurisdiction": "eu", + "mapping_key": null, + "depth": "reference", + "verification_status": "verified", + "srf_layers": [ + "L1", + "L3", + "L4" + ], + "scope": "Authorisation and conduct rules for crypto-asset issuers and crypto-asset service providers (CASPs). Titles III and IV, on asset-referenced and e-money tokens, applied from 30 June 2024, and the rest of the regulation from 30 December 2024. The Article 143(3) transitional period for CASPs already operating under national law ended on 1 July 2026 at the latest. MiCA has no AI-specific provisions, and it touches fewer AI systems than DORA does. Three articles reach AI a CASP may run. Article 92 requires anyone professionally arranging or executing crypto-asset transactions to run systems that detect market abuse and report suspicious orders; surveillance models fall here. Article 81 requires a suitability assessment before giving advice or managing a portfolio, which covers automated advice tools. Article 73 keeps the CASP responsible for outsourced functions, including functions a vendor runs on its own AI. CASPs are also DORA financial entities, so their ICT and third-party AI risk falls under eu-dora.", + "tags": [ + "regulation", + "financial", + "eu", + "mandatory" + ], + "applicable_verticals": [ + "finance" + ], + "applicable_verticals_source": "declared-sector" + }, { "mapping_key": null, "depth": "reference", @@ -1668,5 +1826,5 @@ ], "description": "AI regulations and standards mapped to SRF layers and business verticals. The shared catalog is not one-regulation-per-vertical: sector instruments (HIPAA, NAIC, CMMC) apply to one vertical, while cross-cutting instruments (EU AI Act, NIST AI RMF) may apply to several. When vertical controls cite an instrument, applicable_verticals is the set of citing verticals (derived-from-controls). When no control cites it yet, authors declare a sector or cross-cutting scope so comparative jurisdiction queries still resolve. Join controls on mapping_key. Jurisdiction ids live in data/jurisdictions.json. Prefer ontology applies_to_vertical edges for agents.", "mapping_key_note": "Each vertical control's 'mappings' object is keyed by mapping_key. build/generate_knowledge_layer.py turns those into governed_by edges and emits applies_to_vertical edges from applicable_verticals. A mapping_key may be declared before any control cites it, which makes the instrument join-ready: the evidence path stays empty until a control adds a real clause citation under that key. mapping_key stays null for comparative anchors that no control is expected to cite.", - "vertical_join_note": "Control schemas are vertical-specific; this file is a shared instrument catalog. applicable_verticals lists the SRF verticals (finance, healthcare, insurance, public-sector, defense, manufacturing) where the instrument is in scope on this site. Prefer derived-from-controls when mapping_key citations exist. declared-sector is a single-vertical author call. declared-cross-cutting is used only when no control cites the instrument yet and the instrument is horizontal. derived+declared means citations and author scope agree." + "vertical_join_note": "Control schemas are vertical-specific; this file is a shared instrument catalog. applicable_verticals lists the SRF verticals (finance, healthcare, insurance, public-sector, defense, manufacturing) where the instrument is in scope on this site. Prefer derived-from-controls when mapping_key citations exist. declared-sector is an author call for a sector instrument; a financial-sector instrument that also binds insurers (NYDFS Part 500, DORA, the MAS AI guidelines) lists both finance and insurance. declared-cross-cutting is used only when no control cites the instrument yet and the instrument is horizontal. derived+declared means citations and author scope agree." } diff --git a/export/framework.json b/export/framework.json index 5f5a15c..a12cd21 100644 --- a/export/framework.json +++ b/export/framework.json @@ -5,8 +5,8 @@ "srf_version": "1.0", "updated": "2026-09-02", "counts": { - "concepts": 460, - "relationships": 3742, + "concepts": 465, + "relationships": 3774, "definitions": 36 }, "concepts": [ @@ -836,6 +836,41 @@ "subtype": null, "url": "https://www.finra.org/rules-guidance/notices/24-09" }, + { + "id": "ext.framework.nydfs-part-500", + "label": "23 NYCRR Part 500: Cybersecurity Requirements for Financial Services Companies", + "type": "framework", + "subtype": null, + "url": "https://www.dfs.ny.gov/industry_guidance/cybersecurity" + }, + { + "id": "ext.framework.nydfs-ai-cyber-letter-2024", + "label": "NYDFS Industry Letter: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks", + "type": "framework", + "subtype": null, + "url": "https://www.dfs.ny.gov/industry-guidance/industry-letters/il20241016-cyber-risks-ai-and-strategies-combat-related-risks" + }, + { + "id": "ext.framework.eu-dora", + "label": "Digital Operational Resilience Act (Regulation (EU) 2022/2554)", + "type": "framework", + "subtype": null, + "url": "https://eur-lex.europa.eu/eli/reg/2022/2554/oj" + }, + { + "id": "ext.framework.mas-ai-risk-management-guidelines", + "label": "MAS Guidelines on Artificial Intelligence Risk Management for Financial Institutions", + "type": "framework", + "subtype": null, + "url": "https://www.mas.gov.sg/regulation/guidelines/guidelines-on-artificial-intelligence-risk-management-for-financial-institutions" + }, + { + "id": "ext.framework.eu-mica", + "label": "Markets in Crypto-Assets Regulation (Regulation (EU) 2023/1114)", + "type": "framework", + "subtype": null, + "url": "https://eur-lex.europa.eu/eli/reg/2023/1114/oj" + }, { "id": "ext.framework.ca-ab-2013-genai-transparency", "label": "California AB 2013: Generative Artificial Intelligence Training Data Transparency", @@ -5921,6 +5956,175 @@ "target": "srf.vertical.finance", "source_of_truth": "declared-sector" }, + { + "source": "ext.framework.nydfs-part-500", + "rel": "maps_to_layer", + "target": "srf.layer.L1" + }, + { + "source": "ext.framework.nydfs-part-500", + "rel": "maps_to_layer", + "target": "srf.layer.L2" + }, + { + "source": "ext.framework.nydfs-part-500", + "rel": "maps_to_layer", + "target": "srf.layer.L4" + }, + { + "source": "ext.framework.nydfs-part-500", + "rel": "issued_in_jurisdiction", + "target": "srf.jurisdiction.us-new-york" + }, + { + "source": "ext.framework.nydfs-part-500", + "rel": "applies_to_vertical", + "target": "srf.vertical.finance", + "source_of_truth": "declared-sector" + }, + { + "source": "ext.framework.nydfs-part-500", + "rel": "applies_to_vertical", + "target": "srf.vertical.insurance", + "source_of_truth": "declared-sector" + }, + { + "source": "ext.framework.nydfs-ai-cyber-letter-2024", + "rel": "maps_to_layer", + "target": "srf.layer.L1" + }, + { + "source": "ext.framework.nydfs-ai-cyber-letter-2024", + "rel": "maps_to_layer", + "target": "srf.layer.L2" + }, + { + "source": "ext.framework.nydfs-ai-cyber-letter-2024", + "rel": "maps_to_layer", + "target": "srf.layer.L3" + }, + { + "source": "ext.framework.nydfs-ai-cyber-letter-2024", + "rel": "maps_to_layer", + "target": "srf.layer.L4" + }, + { + "source": "ext.framework.nydfs-ai-cyber-letter-2024", + "rel": "issued_in_jurisdiction", + "target": "srf.jurisdiction.us-new-york" + }, + { + "source": "ext.framework.nydfs-ai-cyber-letter-2024", + "rel": "applies_to_vertical", + "target": "srf.vertical.finance", + "source_of_truth": "declared-sector" + }, + { + "source": "ext.framework.nydfs-ai-cyber-letter-2024", + "rel": "applies_to_vertical", + "target": "srf.vertical.insurance", + "source_of_truth": "declared-sector" + }, + { + "source": "ext.framework.eu-dora", + "rel": "maps_to_layer", + "target": "srf.layer.L1" + }, + { + "source": "ext.framework.eu-dora", + "rel": "maps_to_layer", + "target": "srf.layer.L4" + }, + { + "source": "ext.framework.eu-dora", + "rel": "maps_to_layer", + "target": "srf.layer.L5" + }, + { + "source": "ext.framework.eu-dora", + "rel": "issued_in_jurisdiction", + "target": "srf.jurisdiction.eu" + }, + { + "source": "ext.framework.eu-dora", + "rel": "applies_to_vertical", + "target": "srf.vertical.finance", + "source_of_truth": "declared-sector" + }, + { + "source": "ext.framework.eu-dora", + "rel": "applies_to_vertical", + "target": "srf.vertical.insurance", + "source_of_truth": "declared-sector" + }, + { + "source": "ext.framework.mas-ai-risk-management-guidelines", + "rel": "maps_to_layer", + "target": "srf.layer.L1" + }, + { + "source": "ext.framework.mas-ai-risk-management-guidelines", + "rel": "maps_to_layer", + "target": "srf.layer.L2" + }, + { + "source": "ext.framework.mas-ai-risk-management-guidelines", + "rel": "maps_to_layer", + "target": "srf.layer.L3" + }, + { + "source": "ext.framework.mas-ai-risk-management-guidelines", + "rel": "maps_to_layer", + "target": "srf.layer.L4" + }, + { + "source": "ext.framework.mas-ai-risk-management-guidelines", + "rel": "maps_to_layer", + "target": "srf.layer.L5" + }, + { + "source": "ext.framework.mas-ai-risk-management-guidelines", + "rel": "issued_in_jurisdiction", + "target": "srf.jurisdiction.singapore" + }, + { + "source": "ext.framework.mas-ai-risk-management-guidelines", + "rel": "applies_to_vertical", + "target": "srf.vertical.finance", + "source_of_truth": "declared-sector" + }, + { + "source": "ext.framework.mas-ai-risk-management-guidelines", + "rel": "applies_to_vertical", + "target": "srf.vertical.insurance", + "source_of_truth": "declared-sector" + }, + { + "source": "ext.framework.eu-mica", + "rel": "maps_to_layer", + "target": "srf.layer.L1" + }, + { + "source": "ext.framework.eu-mica", + "rel": "maps_to_layer", + "target": "srf.layer.L3" + }, + { + "source": "ext.framework.eu-mica", + "rel": "maps_to_layer", + "target": "srf.layer.L4" + }, + { + "source": "ext.framework.eu-mica", + "rel": "issued_in_jurisdiction", + "target": "srf.jurisdiction.eu" + }, + { + "source": "ext.framework.eu-mica", + "rel": "applies_to_vertical", + "target": "srf.vertical.finance", + "source_of_truth": "declared-sector" + }, { "source": "ext.framework.ca-ab-2013-genai-transparency", "rel": "maps_to_layer", diff --git a/export/ontology.json b/export/ontology.json index 4acf01d..fc38372 100644 --- a/export/ontology.json +++ b/export/ontology.json @@ -73,7 +73,9 @@ "ext.framework.dodi-5000-89", "ext.framework.dodi-5000-90", "ext.framework.eu-ai-act", + "ext.framework.eu-dora", "ext.framework.eu-machinery-regulation", + "ext.framework.eu-mica", "ext.framework.fda-ai-ml", "ext.framework.fda-pccp", "ext.framework.fda-tplc", @@ -92,6 +94,7 @@ "ext.framework.iso-42001", "ext.framework.japan-ai-social-principles", "ext.framework.korea-ai-basic-act", + "ext.framework.mas-ai-risk-management-guidelines", "ext.framework.naic-ai-eval-tool", "ext.framework.naic-ai-model-bulletin", "ext.framework.nist-ai-600-1", @@ -100,7 +103,9 @@ "ext.framework.nist-cyber-ai-profile", "ext.framework.nist-sp-800-171", "ext.framework.nistir-8605a", + "ext.framework.nydfs-ai-cyber-letter-2024", "ext.framework.nydfs-cl-7-2024", + "ext.framework.nydfs-part-500", "ext.framework.occ-comptrollers-handbook-mrm", "ext.framework.oecd-ai-principles", "ext.framework.omb-m-25-21", @@ -267,6 +272,7 @@ "ext.framework.iso-42001", "ext.framework.japan-ai-social-principles", "ext.framework.korea-ai-basic-act", + "ext.framework.mas-ai-risk-management-guidelines", "ext.framework.naic-ai-eval-tool", "ext.framework.naic-ai-model-bulletin", "ext.framework.nist-ai-600-1", @@ -275,7 +281,9 @@ "ext.framework.nist-cyber-ai-profile", "ext.framework.nist-sp-800-171", "ext.framework.nistir-8605a", + "ext.framework.nydfs-ai-cyber-letter-2024", "ext.framework.nydfs-cl-7-2024", + "ext.framework.nydfs-part-500", "ext.framework.occ-comptrollers-handbook-mrm", "ext.framework.oecd-ai-principles", "ext.framework.omb-m-25-21", @@ -390,6 +398,7 @@ "ext.framework.dodi-5000-90", "ext.framework.eu-ai-act", "ext.framework.eu-machinery-regulation", + "ext.framework.eu-mica", "ext.framework.fda-ai-ml", "ext.framework.fda-pccp", "ext.framework.fda-tplc", @@ -406,6 +415,7 @@ "ext.framework.iso-42001", "ext.framework.japan-ai-social-principles", "ext.framework.korea-ai-basic-act", + "ext.framework.mas-ai-risk-management-guidelines", "ext.framework.mitre-atlas", "ext.framework.naic-ai-eval-tool", "ext.framework.naic-ai-model-bulletin", @@ -415,6 +425,7 @@ "ext.framework.nist-cyber-ai-profile", "ext.framework.nist-sp-800-171", "ext.framework.nistir-8605a", + "ext.framework.nydfs-ai-cyber-letter-2024", "ext.framework.nydfs-cl-7-2024", "ext.framework.oecd-ai-principles", "ext.framework.omb-m-25-21", @@ -535,7 +546,9 @@ "ext.framework.dod-rai-strategy", "ext.framework.dodi-5000-89", "ext.framework.dodi-5000-90", + "ext.framework.eu-dora", "ext.framework.eu-machinery-regulation", + "ext.framework.eu-mica", "ext.framework.fda-pccp", "ext.framework.fda-tplc", "ext.framework.fedramp-20x-ksi", @@ -547,6 +560,7 @@ "ext.framework.iso-14971", "ext.framework.iso-22989", "ext.framework.iso-42001", + "ext.framework.mas-ai-risk-management-guidelines", "ext.framework.mitre-atlas", "ext.framework.naic-ai-eval-tool", "ext.framework.naic-ai-model-bulletin", @@ -556,7 +570,9 @@ "ext.framework.nist-cyber-ai-profile", "ext.framework.nist-sp-800-171", "ext.framework.nistir-8605a", + "ext.framework.nydfs-ai-cyber-letter-2024", "ext.framework.nydfs-cl-7-2024", + "ext.framework.nydfs-part-500", "ext.framework.oecd-ai-principles", "ext.framework.omb-m-25-21", "ext.framework.omb-m-25-22", @@ -667,6 +683,7 @@ "ext.framework.dodi-5000-89", "ext.framework.dodi-5000-90", "ext.framework.eu-ai-act", + "ext.framework.eu-dora", "ext.framework.eu-machinery-regulation", "ext.framework.fda-ai-ml", "ext.framework.fda-pccp", @@ -683,6 +700,7 @@ "ext.framework.iso-22989", "ext.framework.iso-42001", "ext.framework.korea-ai-basic-act", + "ext.framework.mas-ai-risk-management-guidelines", "ext.framework.mitre-atlas", "ext.framework.naic-ai-eval-tool", "ext.framework.naic-ai-model-bulletin", @@ -1984,7 +2002,9 @@ "url": "https://aisharedresponsibility.com/regulations/", "related": [ "ext.framework.eu-ai-act", + "ext.framework.eu-dora", "ext.framework.eu-machinery-regulation", + "ext.framework.eu-mica", "ext.framework.gdpr" ], "subtype": "jurisdiction", @@ -2057,7 +2077,9 @@ "type": "concept", "url": "https://aisharedresponsibility.com/regulations/", "related": [ + "ext.framework.nydfs-ai-cyber-letter-2024", "ext.framework.nydfs-cl-7-2024", + "ext.framework.nydfs-part-500", "srf.jurisdiction.us-federal" ], "subtype": "jurisdiction", @@ -2092,6 +2114,7 @@ "type": "concept", "url": "https://aisharedresponsibility.com/regulations/", "related": [ + "ext.framework.mas-ai-risk-management-guidelines", "ext.framework.singapore-model-ai-governance" ], "subtype": "jurisdiction", @@ -2192,6 +2215,8 @@ "ext.framework.cis-controls", "ext.framework.csa-aicm", "ext.framework.eu-ai-act", + "ext.framework.eu-dora", + "ext.framework.eu-mica", "ext.framework.finos-aigf", "ext.framework.finra-reg-notice-24-09", "ext.framework.gdpr", @@ -2199,11 +2224,14 @@ "ext.framework.iso-22989", "ext.framework.japan-ai-social-principles", "ext.framework.korea-ai-basic-act", + "ext.framework.mas-ai-risk-management-guidelines", "ext.framework.mitre-atlas", "ext.framework.nist-ai-600-1", "ext.framework.nist-ai-rmf", "ext.framework.nist-csf-2", "ext.framework.nist-cyber-ai-profile", + "ext.framework.nydfs-ai-cyber-letter-2024", + "ext.framework.nydfs-part-500", "ext.framework.occ-comptrollers-handbook-mrm", "ext.framework.oecd-ai-principles", "ext.framework.owasp-llm-top10", @@ -2355,11 +2383,13 @@ "ext.framework.co-reg-10-1-1", "ext.framework.csa-aicm", "ext.framework.eu-ai-act", + "ext.framework.eu-dora", "ext.framework.gdpr", "ext.framework.india-meity-ai-advisory", "ext.framework.iso-22989", "ext.framework.japan-ai-social-principles", "ext.framework.korea-ai-basic-act", + "ext.framework.mas-ai-risk-management-guidelines", "ext.framework.mitre-atlas", "ext.framework.naic-ai-eval-tool", "ext.framework.naic-ai-model-bulletin", @@ -2367,7 +2397,9 @@ "ext.framework.nist-ai-rmf", "ext.framework.nist-csf-2", "ext.framework.nist-cyber-ai-profile", + "ext.framework.nydfs-ai-cyber-letter-2024", "ext.framework.nydfs-cl-7-2024", + "ext.framework.nydfs-part-500", "ext.framework.oecd-ai-principles", "ext.framework.owasp-llm-top10", "ext.framework.singapore-model-ai-governance", @@ -4980,6 +5012,88 @@ "depth": "reference", "verification_status": "unverified" }, + { + "id": "ext.framework.nydfs-part-500", + "label": "23 NYCRR Part 500: Cybersecurity Requirements for Financial Services Companies", + "type": "framework", + "url": "https://www.dfs.ny.gov/industry_guidance/cybersecurity", + "related": [ + "srf.jurisdiction.us-new-york", + "srf.layer.L1", + "srf.layer.L2", + "srf.layer.L4", + "srf.vertical.finance", + "srf.vertical.insurance" + ], + "depth": "reference", + "verification_status": "verified" + }, + { + "id": "ext.framework.nydfs-ai-cyber-letter-2024", + "label": "NYDFS Industry Letter: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks", + "type": "framework", + "url": "https://www.dfs.ny.gov/industry-guidance/industry-letters/il20241016-cyber-risks-ai-and-strategies-combat-related-risks", + "related": [ + "srf.jurisdiction.us-new-york", + "srf.layer.L1", + "srf.layer.L2", + "srf.layer.L3", + "srf.layer.L4", + "srf.vertical.finance", + "srf.vertical.insurance" + ], + "depth": "reference", + "verification_status": "verified" + }, + { + "id": "ext.framework.eu-dora", + "label": "Digital Operational Resilience Act (Regulation (EU) 2022/2554)", + "type": "framework", + "url": "https://eur-lex.europa.eu/eli/reg/2022/2554/oj", + "related": [ + "srf.jurisdiction.eu", + "srf.layer.L1", + "srf.layer.L4", + "srf.layer.L5", + "srf.vertical.finance", + "srf.vertical.insurance" + ], + "depth": "reference", + "verification_status": "verified" + }, + { + "id": "ext.framework.mas-ai-risk-management-guidelines", + "label": "MAS Guidelines on Artificial Intelligence Risk Management for Financial Institutions", + "type": "framework", + "url": "https://www.mas.gov.sg/regulation/guidelines/guidelines-on-artificial-intelligence-risk-management-for-financial-institutions", + "related": [ + "srf.jurisdiction.singapore", + "srf.layer.L1", + "srf.layer.L2", + "srf.layer.L3", + "srf.layer.L4", + "srf.layer.L5", + "srf.vertical.finance", + "srf.vertical.insurance" + ], + "depth": "reference", + "verification_status": "verified" + }, + { + "id": "ext.framework.eu-mica", + "label": "Markets in Crypto-Assets Regulation (Regulation (EU) 2023/1114)", + "type": "framework", + "url": "https://eur-lex.europa.eu/eli/reg/2023/1114/oj", + "related": [ + "srf.jurisdiction.eu", + "srf.layer.L1", + "srf.layer.L3", + "srf.layer.L4", + "srf.vertical.finance" + ], + "depth": "reference", + "verification_status": "verified" + }, { "id": "ext.framework.ca-ab-2013-genai-transparency", "label": "California AB 2013: Generative Artificial Intelligence Training Data Transparency", @@ -15657,6 +15771,175 @@ "target": "srf.vertical.finance", "source_of_truth": "declared-sector" }, + { + "source": "ext.framework.nydfs-part-500", + "rel": "maps_to_layer", + "target": "srf.layer.L1" + }, + { + "source": "ext.framework.nydfs-part-500", + "rel": "maps_to_layer", + "target": "srf.layer.L2" + }, + { + "source": "ext.framework.nydfs-part-500", + "rel": "maps_to_layer", + "target": "srf.layer.L4" + }, + { + "source": "ext.framework.nydfs-part-500", + "rel": "issued_in_jurisdiction", + "target": "srf.jurisdiction.us-new-york" + }, + { + "source": "ext.framework.nydfs-part-500", + "rel": "applies_to_vertical", + "target": "srf.vertical.finance", + "source_of_truth": "declared-sector" + }, + { + "source": "ext.framework.nydfs-part-500", + "rel": "applies_to_vertical", + "target": "srf.vertical.insurance", + "source_of_truth": "declared-sector" + }, + { + "source": "ext.framework.nydfs-ai-cyber-letter-2024", + "rel": "maps_to_layer", + "target": "srf.layer.L1" + }, + { + "source": "ext.framework.nydfs-ai-cyber-letter-2024", + "rel": "maps_to_layer", + "target": "srf.layer.L2" + }, + { + "source": "ext.framework.nydfs-ai-cyber-letter-2024", + "rel": "maps_to_layer", + "target": "srf.layer.L3" + }, + { + "source": "ext.framework.nydfs-ai-cyber-letter-2024", + "rel": "maps_to_layer", + "target": "srf.layer.L4" + }, + { + "source": "ext.framework.nydfs-ai-cyber-letter-2024", + "rel": "issued_in_jurisdiction", + "target": "srf.jurisdiction.us-new-york" + }, + { + "source": "ext.framework.nydfs-ai-cyber-letter-2024", + "rel": "applies_to_vertical", + "target": "srf.vertical.finance", + "source_of_truth": "declared-sector" + }, + { + "source": "ext.framework.nydfs-ai-cyber-letter-2024", + "rel": "applies_to_vertical", + "target": "srf.vertical.insurance", + "source_of_truth": "declared-sector" + }, + { + "source": "ext.framework.eu-dora", + "rel": "maps_to_layer", + "target": "srf.layer.L1" + }, + { + "source": "ext.framework.eu-dora", + "rel": "maps_to_layer", + "target": "srf.layer.L4" + }, + { + "source": "ext.framework.eu-dora", + "rel": "maps_to_layer", + "target": "srf.layer.L5" + }, + { + "source": "ext.framework.eu-dora", + "rel": "issued_in_jurisdiction", + "target": "srf.jurisdiction.eu" + }, + { + "source": "ext.framework.eu-dora", + "rel": "applies_to_vertical", + "target": "srf.vertical.finance", + "source_of_truth": "declared-sector" + }, + { + "source": "ext.framework.eu-dora", + "rel": "applies_to_vertical", + "target": "srf.vertical.insurance", + "source_of_truth": "declared-sector" + }, + { + "source": "ext.framework.mas-ai-risk-management-guidelines", + "rel": "maps_to_layer", + "target": "srf.layer.L1" + }, + { + "source": "ext.framework.mas-ai-risk-management-guidelines", + "rel": "maps_to_layer", + "target": "srf.layer.L2" + }, + { + "source": "ext.framework.mas-ai-risk-management-guidelines", + "rel": "maps_to_layer", + "target": "srf.layer.L3" + }, + { + "source": "ext.framework.mas-ai-risk-management-guidelines", + "rel": "maps_to_layer", + "target": "srf.layer.L4" + }, + { + "source": "ext.framework.mas-ai-risk-management-guidelines", + "rel": "maps_to_layer", + "target": "srf.layer.L5" + }, + { + "source": "ext.framework.mas-ai-risk-management-guidelines", + "rel": "issued_in_jurisdiction", + "target": "srf.jurisdiction.singapore" + }, + { + "source": "ext.framework.mas-ai-risk-management-guidelines", + "rel": "applies_to_vertical", + "target": "srf.vertical.finance", + "source_of_truth": "declared-sector" + }, + { + "source": "ext.framework.mas-ai-risk-management-guidelines", + "rel": "applies_to_vertical", + "target": "srf.vertical.insurance", + "source_of_truth": "declared-sector" + }, + { + "source": "ext.framework.eu-mica", + "rel": "maps_to_layer", + "target": "srf.layer.L1" + }, + { + "source": "ext.framework.eu-mica", + "rel": "maps_to_layer", + "target": "srf.layer.L3" + }, + { + "source": "ext.framework.eu-mica", + "rel": "maps_to_layer", + "target": "srf.layer.L4" + }, + { + "source": "ext.framework.eu-mica", + "rel": "issued_in_jurisdiction", + "target": "srf.jurisdiction.eu" + }, + { + "source": "ext.framework.eu-mica", + "rel": "applies_to_vertical", + "target": "srf.vertical.finance", + "source_of_truth": "declared-sector" + }, { "source": "ext.framework.ca-ab-2013-genai-transparency", "rel": "maps_to_layer", diff --git a/ids.json b/ids.json index 8c9dd29..6dcfc77 100644 --- a/ids.json +++ b/ids.json @@ -17,7 +17,7 @@ "ext.framework": "An external standard or regulation", "ext.requirement": "A concrete requirement inside an external instrument" }, - "count": 460, + "count": 465, "ids": [ { "id": "ext.framework.ai-safe2", @@ -138,6 +138,13 @@ "subtype": null, "url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1689" }, + { + "id": "ext.framework.eu-dora", + "name": "Digital Operational Resilience Act (Regulation (EU) 2022/2554)", + "type": "framework", + "subtype": null, + "url": "https://eur-lex.europa.eu/eli/reg/2022/2554/oj" + }, { "id": "ext.framework.eu-machinery-regulation", "name": "EU Machinery Regulation (EU) 2023/1230", @@ -145,6 +152,13 @@ "subtype": null, "url": "https://eur-lex.europa.eu/eli/reg/2023/1230/oj" }, + { + "id": "ext.framework.eu-mica", + "name": "Markets in Crypto-Assets Regulation (Regulation (EU) 2023/1114)", + "type": "framework", + "subtype": null, + "url": "https://eur-lex.europa.eu/eli/reg/2023/1114/oj" + }, { "id": "ext.framework.fda-ai-ml", "name": "FDA AI/ML-Based Software as a Medical Device", @@ -271,6 +285,13 @@ "subtype": null, "url": "https://www.msit.go.kr/" }, + { + "id": "ext.framework.mas-ai-risk-management-guidelines", + "name": "MAS Guidelines on Artificial Intelligence Risk Management for Financial Institutions", + "type": "framework", + "subtype": null, + "url": "https://www.mas.gov.sg/regulation/guidelines/guidelines-on-artificial-intelligence-risk-management-for-financial-institutions" + }, { "id": "ext.framework.mitre-atlas", "name": "MITRE ATLAS", @@ -334,6 +355,13 @@ "subtype": null, "url": "https://csrc.nist.gov/projects/cosais" }, + { + "id": "ext.framework.nydfs-ai-cyber-letter-2024", + "name": "NYDFS Industry Letter: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks", + "type": "framework", + "subtype": null, + "url": "https://www.dfs.ny.gov/industry-guidance/industry-letters/il20241016-cyber-risks-ai-and-strategies-combat-related-risks" + }, { "id": "ext.framework.nydfs-cl-7-2024", "name": "NYDFS Circular Letter No. 7 (2024): Use of AI Systems in Insurance Underwriting and Pricing", @@ -341,6 +369,13 @@ "subtype": null, "url": "https://www.dfs.ny.gov/" }, + { + "id": "ext.framework.nydfs-part-500", + "name": "23 NYCRR Part 500: Cybersecurity Requirements for Financial Services Companies", + "type": "framework", + "subtype": null, + "url": "https://www.dfs.ny.gov/industry_guidance/cybersecurity" + }, { "id": "ext.framework.occ-comptrollers-handbook-mrm", "name": "OCC Comptroller's Handbook: Model Risk Management", diff --git a/ontology/edges.json b/ontology/edges.json index e911cb8..5315aae 100644 --- a/ontology/edges.json +++ b/ontology/edges.json @@ -30,7 +30,7 @@ "subordinate_to", "superseded_by" ], - "count": 3742, + "count": 3774, "edges": [ { "source": "srf.framework.cosai-srf", @@ -2721,6 +2721,175 @@ "target": "srf.vertical.finance", "source_of_truth": "declared-sector" }, + { + "source": "ext.framework.nydfs-part-500", + "rel": "maps_to_layer", + "target": "srf.layer.L1" + }, + { + "source": "ext.framework.nydfs-part-500", + "rel": "maps_to_layer", + "target": "srf.layer.L2" + }, + { + "source": "ext.framework.nydfs-part-500", + "rel": "maps_to_layer", + "target": "srf.layer.L4" + }, + { + "source": "ext.framework.nydfs-part-500", + "rel": "issued_in_jurisdiction", + "target": "srf.jurisdiction.us-new-york" + }, + { + "source": "ext.framework.nydfs-part-500", + "rel": "applies_to_vertical", + "target": "srf.vertical.finance", + "source_of_truth": "declared-sector" + }, + { + "source": "ext.framework.nydfs-part-500", + "rel": "applies_to_vertical", + "target": "srf.vertical.insurance", + "source_of_truth": "declared-sector" + }, + { + "source": "ext.framework.nydfs-ai-cyber-letter-2024", + "rel": "maps_to_layer", + "target": "srf.layer.L1" + }, + { + "source": "ext.framework.nydfs-ai-cyber-letter-2024", + "rel": "maps_to_layer", + "target": "srf.layer.L2" + }, + { + "source": "ext.framework.nydfs-ai-cyber-letter-2024", + "rel": "maps_to_layer", + "target": "srf.layer.L3" + }, + { + "source": "ext.framework.nydfs-ai-cyber-letter-2024", + "rel": "maps_to_layer", + "target": "srf.layer.L4" + }, + { + "source": "ext.framework.nydfs-ai-cyber-letter-2024", + "rel": "issued_in_jurisdiction", + "target": "srf.jurisdiction.us-new-york" + }, + { + "source": "ext.framework.nydfs-ai-cyber-letter-2024", + "rel": "applies_to_vertical", + "target": "srf.vertical.finance", + "source_of_truth": "declared-sector" + }, + { + "source": "ext.framework.nydfs-ai-cyber-letter-2024", + "rel": "applies_to_vertical", + "target": "srf.vertical.insurance", + "source_of_truth": "declared-sector" + }, + { + "source": "ext.framework.eu-dora", + "rel": "maps_to_layer", + "target": "srf.layer.L1" + }, + { + "source": "ext.framework.eu-dora", + "rel": "maps_to_layer", + "target": "srf.layer.L4" + }, + { + "source": "ext.framework.eu-dora", + "rel": "maps_to_layer", + "target": "srf.layer.L5" + }, + { + "source": "ext.framework.eu-dora", + "rel": "issued_in_jurisdiction", + "target": "srf.jurisdiction.eu" + }, + { + "source": "ext.framework.eu-dora", + "rel": "applies_to_vertical", + "target": "srf.vertical.finance", + "source_of_truth": "declared-sector" + }, + { + "source": "ext.framework.eu-dora", + "rel": "applies_to_vertical", + "target": "srf.vertical.insurance", + "source_of_truth": "declared-sector" + }, + { + "source": "ext.framework.mas-ai-risk-management-guidelines", + "rel": "maps_to_layer", + "target": "srf.layer.L1" + }, + { + "source": "ext.framework.mas-ai-risk-management-guidelines", + "rel": "maps_to_layer", + "target": "srf.layer.L2" + }, + { + "source": "ext.framework.mas-ai-risk-management-guidelines", + "rel": "maps_to_layer", + "target": "srf.layer.L3" + }, + { + "source": "ext.framework.mas-ai-risk-management-guidelines", + "rel": "maps_to_layer", + "target": "srf.layer.L4" + }, + { + "source": "ext.framework.mas-ai-risk-management-guidelines", + "rel": "maps_to_layer", + "target": "srf.layer.L5" + }, + { + "source": "ext.framework.mas-ai-risk-management-guidelines", + "rel": "issued_in_jurisdiction", + "target": "srf.jurisdiction.singapore" + }, + { + "source": "ext.framework.mas-ai-risk-management-guidelines", + "rel": "applies_to_vertical", + "target": "srf.vertical.finance", + "source_of_truth": "declared-sector" + }, + { + "source": "ext.framework.mas-ai-risk-management-guidelines", + "rel": "applies_to_vertical", + "target": "srf.vertical.insurance", + "source_of_truth": "declared-sector" + }, + { + "source": "ext.framework.eu-mica", + "rel": "maps_to_layer", + "target": "srf.layer.L1" + }, + { + "source": "ext.framework.eu-mica", + "rel": "maps_to_layer", + "target": "srf.layer.L3" + }, + { + "source": "ext.framework.eu-mica", + "rel": "maps_to_layer", + "target": "srf.layer.L4" + }, + { + "source": "ext.framework.eu-mica", + "rel": "issued_in_jurisdiction", + "target": "srf.jurisdiction.eu" + }, + { + "source": "ext.framework.eu-mica", + "rel": "applies_to_vertical", + "target": "srf.vertical.finance", + "source_of_truth": "declared-sector" + }, { "source": "ext.framework.ca-ab-2013-genai-transparency", "rel": "maps_to_layer", diff --git a/ontology/nodes.json b/ontology/nodes.json index ea203d6..9c71427 100644 --- a/ontology/nodes.json +++ b/ontology/nodes.json @@ -11,7 +11,7 @@ "related": "[id]", "subtype": "string (optional)" }, - "count": 460, + "count": 465, "nodes": [ { "id": "srf.framework.cosai-srf", @@ -83,7 +83,9 @@ "ext.framework.dodi-5000-89", "ext.framework.dodi-5000-90", "ext.framework.eu-ai-act", + "ext.framework.eu-dora", "ext.framework.eu-machinery-regulation", + "ext.framework.eu-mica", "ext.framework.fda-ai-ml", "ext.framework.fda-pccp", "ext.framework.fda-tplc", @@ -102,6 +104,7 @@ "ext.framework.iso-42001", "ext.framework.japan-ai-social-principles", "ext.framework.korea-ai-basic-act", + "ext.framework.mas-ai-risk-management-guidelines", "ext.framework.naic-ai-eval-tool", "ext.framework.naic-ai-model-bulletin", "ext.framework.nist-ai-600-1", @@ -110,7 +113,9 @@ "ext.framework.nist-cyber-ai-profile", "ext.framework.nist-sp-800-171", "ext.framework.nistir-8605a", + "ext.framework.nydfs-ai-cyber-letter-2024", "ext.framework.nydfs-cl-7-2024", + "ext.framework.nydfs-part-500", "ext.framework.occ-comptrollers-handbook-mrm", "ext.framework.oecd-ai-principles", "ext.framework.omb-m-25-21", @@ -277,6 +282,7 @@ "ext.framework.iso-42001", "ext.framework.japan-ai-social-principles", "ext.framework.korea-ai-basic-act", + "ext.framework.mas-ai-risk-management-guidelines", "ext.framework.naic-ai-eval-tool", "ext.framework.naic-ai-model-bulletin", "ext.framework.nist-ai-600-1", @@ -285,7 +291,9 @@ "ext.framework.nist-cyber-ai-profile", "ext.framework.nist-sp-800-171", "ext.framework.nistir-8605a", + "ext.framework.nydfs-ai-cyber-letter-2024", "ext.framework.nydfs-cl-7-2024", + "ext.framework.nydfs-part-500", "ext.framework.occ-comptrollers-handbook-mrm", "ext.framework.oecd-ai-principles", "ext.framework.omb-m-25-21", @@ -400,6 +408,7 @@ "ext.framework.dodi-5000-90", "ext.framework.eu-ai-act", "ext.framework.eu-machinery-regulation", + "ext.framework.eu-mica", "ext.framework.fda-ai-ml", "ext.framework.fda-pccp", "ext.framework.fda-tplc", @@ -416,6 +425,7 @@ "ext.framework.iso-42001", "ext.framework.japan-ai-social-principles", "ext.framework.korea-ai-basic-act", + "ext.framework.mas-ai-risk-management-guidelines", "ext.framework.mitre-atlas", "ext.framework.naic-ai-eval-tool", "ext.framework.naic-ai-model-bulletin", @@ -425,6 +435,7 @@ "ext.framework.nist-cyber-ai-profile", "ext.framework.nist-sp-800-171", "ext.framework.nistir-8605a", + "ext.framework.nydfs-ai-cyber-letter-2024", "ext.framework.nydfs-cl-7-2024", "ext.framework.oecd-ai-principles", "ext.framework.omb-m-25-21", @@ -545,7 +556,9 @@ "ext.framework.dod-rai-strategy", "ext.framework.dodi-5000-89", "ext.framework.dodi-5000-90", + "ext.framework.eu-dora", "ext.framework.eu-machinery-regulation", + "ext.framework.eu-mica", "ext.framework.fda-pccp", "ext.framework.fda-tplc", "ext.framework.fedramp-20x-ksi", @@ -557,6 +570,7 @@ "ext.framework.iso-14971", "ext.framework.iso-22989", "ext.framework.iso-42001", + "ext.framework.mas-ai-risk-management-guidelines", "ext.framework.mitre-atlas", "ext.framework.naic-ai-eval-tool", "ext.framework.naic-ai-model-bulletin", @@ -566,7 +580,9 @@ "ext.framework.nist-cyber-ai-profile", "ext.framework.nist-sp-800-171", "ext.framework.nistir-8605a", + "ext.framework.nydfs-ai-cyber-letter-2024", "ext.framework.nydfs-cl-7-2024", + "ext.framework.nydfs-part-500", "ext.framework.oecd-ai-principles", "ext.framework.omb-m-25-21", "ext.framework.omb-m-25-22", @@ -677,6 +693,7 @@ "ext.framework.dodi-5000-89", "ext.framework.dodi-5000-90", "ext.framework.eu-ai-act", + "ext.framework.eu-dora", "ext.framework.eu-machinery-regulation", "ext.framework.fda-ai-ml", "ext.framework.fda-pccp", @@ -693,6 +710,7 @@ "ext.framework.iso-22989", "ext.framework.iso-42001", "ext.framework.korea-ai-basic-act", + "ext.framework.mas-ai-risk-management-guidelines", "ext.framework.mitre-atlas", "ext.framework.naic-ai-eval-tool", "ext.framework.naic-ai-model-bulletin", @@ -1994,7 +2012,9 @@ "url": "https://aisharedresponsibility.com/regulations/", "related": [ "ext.framework.eu-ai-act", + "ext.framework.eu-dora", "ext.framework.eu-machinery-regulation", + "ext.framework.eu-mica", "ext.framework.gdpr" ], "subtype": "jurisdiction", @@ -2067,7 +2087,9 @@ "type": "concept", "url": "https://aisharedresponsibility.com/regulations/", "related": [ + "ext.framework.nydfs-ai-cyber-letter-2024", "ext.framework.nydfs-cl-7-2024", + "ext.framework.nydfs-part-500", "srf.jurisdiction.us-federal" ], "subtype": "jurisdiction", @@ -2102,6 +2124,7 @@ "type": "concept", "url": "https://aisharedresponsibility.com/regulations/", "related": [ + "ext.framework.mas-ai-risk-management-guidelines", "ext.framework.singapore-model-ai-governance" ], "subtype": "jurisdiction", @@ -2202,6 +2225,8 @@ "ext.framework.cis-controls", "ext.framework.csa-aicm", "ext.framework.eu-ai-act", + "ext.framework.eu-dora", + "ext.framework.eu-mica", "ext.framework.finos-aigf", "ext.framework.finra-reg-notice-24-09", "ext.framework.gdpr", @@ -2209,11 +2234,14 @@ "ext.framework.iso-22989", "ext.framework.japan-ai-social-principles", "ext.framework.korea-ai-basic-act", + "ext.framework.mas-ai-risk-management-guidelines", "ext.framework.mitre-atlas", "ext.framework.nist-ai-600-1", "ext.framework.nist-ai-rmf", "ext.framework.nist-csf-2", "ext.framework.nist-cyber-ai-profile", + "ext.framework.nydfs-ai-cyber-letter-2024", + "ext.framework.nydfs-part-500", "ext.framework.occ-comptrollers-handbook-mrm", "ext.framework.oecd-ai-principles", "ext.framework.owasp-llm-top10", @@ -2365,11 +2393,13 @@ "ext.framework.co-reg-10-1-1", "ext.framework.csa-aicm", "ext.framework.eu-ai-act", + "ext.framework.eu-dora", "ext.framework.gdpr", "ext.framework.india-meity-ai-advisory", "ext.framework.iso-22989", "ext.framework.japan-ai-social-principles", "ext.framework.korea-ai-basic-act", + "ext.framework.mas-ai-risk-management-guidelines", "ext.framework.mitre-atlas", "ext.framework.naic-ai-eval-tool", "ext.framework.naic-ai-model-bulletin", @@ -2377,7 +2407,9 @@ "ext.framework.nist-ai-rmf", "ext.framework.nist-csf-2", "ext.framework.nist-cyber-ai-profile", + "ext.framework.nydfs-ai-cyber-letter-2024", "ext.framework.nydfs-cl-7-2024", + "ext.framework.nydfs-part-500", "ext.framework.oecd-ai-principles", "ext.framework.owasp-llm-top10", "ext.framework.singapore-model-ai-governance", @@ -4990,6 +5022,88 @@ "depth": "reference", "verification_status": "unverified" }, + { + "id": "ext.framework.nydfs-part-500", + "label": "23 NYCRR Part 500: Cybersecurity Requirements for Financial Services Companies", + "type": "framework", + "url": "https://www.dfs.ny.gov/industry_guidance/cybersecurity", + "related": [ + "srf.jurisdiction.us-new-york", + "srf.layer.L1", + "srf.layer.L2", + "srf.layer.L4", + "srf.vertical.finance", + "srf.vertical.insurance" + ], + "depth": "reference", + "verification_status": "verified" + }, + { + "id": "ext.framework.nydfs-ai-cyber-letter-2024", + "label": "NYDFS Industry Letter: Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks", + "type": "framework", + "url": "https://www.dfs.ny.gov/industry-guidance/industry-letters/il20241016-cyber-risks-ai-and-strategies-combat-related-risks", + "related": [ + "srf.jurisdiction.us-new-york", + "srf.layer.L1", + "srf.layer.L2", + "srf.layer.L3", + "srf.layer.L4", + "srf.vertical.finance", + "srf.vertical.insurance" + ], + "depth": "reference", + "verification_status": "verified" + }, + { + "id": "ext.framework.eu-dora", + "label": "Digital Operational Resilience Act (Regulation (EU) 2022/2554)", + "type": "framework", + "url": "https://eur-lex.europa.eu/eli/reg/2022/2554/oj", + "related": [ + "srf.jurisdiction.eu", + "srf.layer.L1", + "srf.layer.L4", + "srf.layer.L5", + "srf.vertical.finance", + "srf.vertical.insurance" + ], + "depth": "reference", + "verification_status": "verified" + }, + { + "id": "ext.framework.mas-ai-risk-management-guidelines", + "label": "MAS Guidelines on Artificial Intelligence Risk Management for Financial Institutions", + "type": "framework", + "url": "https://www.mas.gov.sg/regulation/guidelines/guidelines-on-artificial-intelligence-risk-management-for-financial-institutions", + "related": [ + "srf.jurisdiction.singapore", + "srf.layer.L1", + "srf.layer.L2", + "srf.layer.L3", + "srf.layer.L4", + "srf.layer.L5", + "srf.vertical.finance", + "srf.vertical.insurance" + ], + "depth": "reference", + "verification_status": "verified" + }, + { + "id": "ext.framework.eu-mica", + "label": "Markets in Crypto-Assets Regulation (Regulation (EU) 2023/1114)", + "type": "framework", + "url": "https://eur-lex.europa.eu/eli/reg/2023/1114/oj", + "related": [ + "srf.jurisdiction.eu", + "srf.layer.L1", + "srf.layer.L3", + "srf.layer.L4", + "srf.vertical.finance" + ], + "depth": "reference", + "verification_status": "verified" + }, { "id": "ext.framework.ca-ab-2013-genai-transparency", "label": "California AB 2013: Generative Artificial Intelligence Training Data Transparency", diff --git a/regulations/discovery/data.json b/regulations/discovery/data.json index f1a11f7..ee0a65e 100644 --- a/regulations/discovery/data.json +++ b/regulations/discovery/data.json @@ -16,6 +16,8 @@ "CSA AICM v1.0.3", "OWASP Top 10 for LLM Applications 2025", "Federal Reserve SR 11-7 (2011)", + "NYDFS 23 NYCRR Part 500 and AI cyber risk industry letter (2024)", + "EU DORA (Regulation 2022/2554)", "FDA AI/ML Software as a Medical Device Action Plan", "MITRE ATLAS" ] @@ -243,10 +245,20 @@ "name": "NY DFS Part 500 (Cybersecurity)", "jurisdiction": "US-NY", "category": "REGULATION", - "why": "Financial-services entities regulated by NY DFS must maintain a cybersecurity programme that increasingly covers AI supply-chain and third-party risk.", + "why": "Banks, insurers, and other entities licensed by NY DFS must run a cybersecurity programme under Part 500. DFS's October 2024 AI letter says the risk assessment must cover the entity's own AI, AI used by its vendors, and deepfake-resistant MFA.", "primarySRFLayer": "L4", - "citations": ["23 NYCRR 500"], - "controls": ["DFS_CISO", "DFS_THIRD_PARTY", "DFS_INCIDENT"] + "citations": ["23 NYCRR 500", "NYDFS Industry Letter on AI cyber risk, 16 Oct 2024"], + "controls": ["DFS_CISO", "DFS_THIRD_PARTY", "DFS_INCIDENT", "DFS_AI_INVENTORY"] + }, + { + "code": "DORA", + "name": "EU Digital Operational Resilience Act (DORA)", + "jurisdiction": "EU", + "category": "REGULATION", + "why": "EU banks, insurers, investment firms, and crypto-asset service providers must treat model APIs and AI platforms as ICT third-party services: register each contract, include Article 30 terms, and report major ICT incidents.", + "primarySRFLayer": "L1", + "citations": ["Regulation (EU) 2022/2554 Arts. 17-23, 28, 30"], + "controls": ["DORA_ICT_REGISTER", "DORA_CONTRACT_TERMS", "DORA_INCIDENT"] }, { "code": "FDA_AI_ML", @@ -358,6 +370,10 @@ "DFS_CISO": { "title": "CISO reporting & cyber programme (Part 500)", "layer": "L4" }, "DFS_THIRD_PARTY": { "title": "Third-party & AI-vendor risk process", "layer": "L1" }, "DFS_INCIDENT": { "title": "72-hour incident notification", "layer": "L4" }, + "DFS_AI_INVENTORY": { "title": "Inventory of systems that use or rely on AI", "layer": "L1" }, + "DORA_ICT_REGISTER": { "title": "Register of information for AI/ICT providers", "layer": "L1" }, + "DORA_CONTRACT_TERMS": { "title": "Art. 30 contract terms with model/platform vendor", "layer": "L1" }, + "DORA_INCIDENT": { "title": "Major ICT-related incident classification & report", "layer": "L4" }, "FDA_SAMD": { "title": "SaMD classification & submission", "layer": "L1" }, "FDA_PCCP": { "title": "Predetermined Change Control Plan", "layer": "L5" }, "FDA_GMLP": { "title": "Good Machine Learning Practice (GMLP)", "layer": "L5" }, diff --git a/regulations/discovery/wizard.js b/regulations/discovery/wizard.js index 40f831b..485c5dd 100644 --- a/regulations/discovery/wizard.js +++ b/regulations/discovery/wizard.js @@ -539,7 +539,13 @@ return null; }, NYDFS_PART_500: (i, f) => { - if ((i.verticals || []).includes('FINANCIAL_SERVICES') && f.deploysInUS) return 'LIKELY'; + const v = i.verticals || []; + if ((v.includes('FINANCIAL_SERVICES') || v.includes('INSURANCE')) && f.deploysInUS) return 'LIKELY'; + return null; + }, + DORA: (i, f) => { + const v = i.verticals || []; + if ((v.includes('FINANCIAL_SERVICES') || v.includes('INSURANCE')) && f.inEUScope) return 'LIKELY'; return null; }, FDA_AI_ML: (i) => { diff --git a/regulations/index.html b/regulations/index.html index 861da1f..759e9d2 100644 --- a/regulations/index.html +++ b/regulations/index.html @@ -215,7 +215,7 @@ - + diff --git a/tools/regulation-discovery/data.json b/tools/regulation-discovery/data.json index f1a11f7..ee0a65e 100644 --- a/tools/regulation-discovery/data.json +++ b/tools/regulation-discovery/data.json @@ -16,6 +16,8 @@ "CSA AICM v1.0.3", "OWASP Top 10 for LLM Applications 2025", "Federal Reserve SR 11-7 (2011)", + "NYDFS 23 NYCRR Part 500 and AI cyber risk industry letter (2024)", + "EU DORA (Regulation 2022/2554)", "FDA AI/ML Software as a Medical Device Action Plan", "MITRE ATLAS" ] @@ -243,10 +245,20 @@ "name": "NY DFS Part 500 (Cybersecurity)", "jurisdiction": "US-NY", "category": "REGULATION", - "why": "Financial-services entities regulated by NY DFS must maintain a cybersecurity programme that increasingly covers AI supply-chain and third-party risk.", + "why": "Banks, insurers, and other entities licensed by NY DFS must run a cybersecurity programme under Part 500. DFS's October 2024 AI letter says the risk assessment must cover the entity's own AI, AI used by its vendors, and deepfake-resistant MFA.", "primarySRFLayer": "L4", - "citations": ["23 NYCRR 500"], - "controls": ["DFS_CISO", "DFS_THIRD_PARTY", "DFS_INCIDENT"] + "citations": ["23 NYCRR 500", "NYDFS Industry Letter on AI cyber risk, 16 Oct 2024"], + "controls": ["DFS_CISO", "DFS_THIRD_PARTY", "DFS_INCIDENT", "DFS_AI_INVENTORY"] + }, + { + "code": "DORA", + "name": "EU Digital Operational Resilience Act (DORA)", + "jurisdiction": "EU", + "category": "REGULATION", + "why": "EU banks, insurers, investment firms, and crypto-asset service providers must treat model APIs and AI platforms as ICT third-party services: register each contract, include Article 30 terms, and report major ICT incidents.", + "primarySRFLayer": "L1", + "citations": ["Regulation (EU) 2022/2554 Arts. 17-23, 28, 30"], + "controls": ["DORA_ICT_REGISTER", "DORA_CONTRACT_TERMS", "DORA_INCIDENT"] }, { "code": "FDA_AI_ML", @@ -358,6 +370,10 @@ "DFS_CISO": { "title": "CISO reporting & cyber programme (Part 500)", "layer": "L4" }, "DFS_THIRD_PARTY": { "title": "Third-party & AI-vendor risk process", "layer": "L1" }, "DFS_INCIDENT": { "title": "72-hour incident notification", "layer": "L4" }, + "DFS_AI_INVENTORY": { "title": "Inventory of systems that use or rely on AI", "layer": "L1" }, + "DORA_ICT_REGISTER": { "title": "Register of information for AI/ICT providers", "layer": "L1" }, + "DORA_CONTRACT_TERMS": { "title": "Art. 30 contract terms with model/platform vendor", "layer": "L1" }, + "DORA_INCIDENT": { "title": "Major ICT-related incident classification & report", "layer": "L4" }, "FDA_SAMD": { "title": "SaMD classification & submission", "layer": "L1" }, "FDA_PCCP": { "title": "Predetermined Change Control Plan", "layer": "L5" }, "FDA_GMLP": { "title": "Good Machine Learning Practice (GMLP)", "layer": "L5" }, diff --git a/tools/regulation-discovery/wizard.js b/tools/regulation-discovery/wizard.js index 40f831b..485c5dd 100644 --- a/tools/regulation-discovery/wizard.js +++ b/tools/regulation-discovery/wizard.js @@ -539,7 +539,13 @@ return null; }, NYDFS_PART_500: (i, f) => { - if ((i.verticals || []).includes('FINANCIAL_SERVICES') && f.deploysInUS) return 'LIKELY'; + const v = i.verticals || []; + if ((v.includes('FINANCIAL_SERVICES') || v.includes('INSURANCE')) && f.deploysInUS) return 'LIKELY'; + return null; + }, + DORA: (i, f) => { + const v = i.verticals || []; + if ((v.includes('FINANCIAL_SERVICES') || v.includes('INSURANCE')) && f.inEUScope) return 'LIKELY'; return null; }, FDA_AI_ML: (i) => {