AI Frameworks → Business Frameworks

Web Content Accessibility Guidelines

W3C standards for making web content accessible to people with disabilities — covering perceivable, operable, understandable, and robust design principles. Relevant to AI systems with user-facing interfaces.

AI interfaces must be accessible. Screen readers need to work with AI-generated content. Voice interfaces need alternatives. Section 508 (government) mandates WCAG compliance.

Health Information Trust Alliance Common Security Framework

A certifiable security framework that harmonizes requirements from HIPAA, NIST, ISO 27001, and other standards — widely used in healthcare and by organizations handling health data.

Healthcare AI systems handling PHI often need HITRUST certification. HITRUST provides the bridge between HIPAA requirements and operational security controls.

NIST Special Publication 800-53 — Security and Privacy Controls

The comprehensive catalog of security and privacy controls used by U.S. federal agencies and many private sector organizations — over 1,000 controls organized into 20 families.

Federal AI systems must comply with NIST 800-53 controls. The control catalog includes AI-relevant controls for system integrity, audit, access control, and risk assessment.

Federal Risk and Authorization Management Program

The U.S. government's standardized approach to security assessment, authorization, and monitoring for cloud services used by federal agencies — based on NIST 800-53 controls.

Cloud-based AI services sold to federal agencies must be FedRAMP authorized. The authorization process evaluates the AI system's security posture against NIST 800-53 controls.

System and Organization Controls 2

An audit framework assessing an organization's controls against five Trust Services Criteria: security, availability, processing integrity, confidentiality, and privacy. The de facto standard for SaaS vendor security assurance.

AI SaaS vendors need SOC 2 reports for enterprise sales. AI systems that process customer data must be included in the SOC 2 scope — covering data handling, model security, and access controls.

Payment Card Industry Data Security Standard

Security standard for organizations that handle credit card data — covering network security, encryption, access control, monitoring, and testing requirements.

AI systems that process, store, or transmit payment card data must comply with PCI DSS. Fraud detection models, payment processing AI, and customer-facing payment interfaces are all in scope.

Section 508 of the Rehabilitation Act

U.S. federal law requiring that electronic and information technology developed, procured, or maintained by federal agencies be accessible to people with disabilities — referencing WCAG standards.

Federal AI systems with user interfaces must be Section 508 compliant. This includes chatbots, dashboards, decision support tools, and any AI-powered interface used by federal employees or the public.

General Data Protection Regulation

The EU's comprehensive data protection regulation governing the collection, processing, and storage of personal data — including rights to explanation for automated decision-making (Article 22).

GDPR Article 22 gives individuals the right not to be subject to decisions based solely on automated processing, including profiling. AI systems making decisions about EU residents must provide meaningful information about the logic involved.

California Consumer Privacy Act / California Privacy Rights Act

California's comprehensive privacy law giving consumers rights over their personal data — including the right to opt out of automated decision-making technology (CPRA addition).

CPRA added specific provisions for automated decision-making that affect AI deployments. Businesses must disclose when they use automated decision-making and honor opt-out requests.

Basel Committee on Banking Supervision — Principles for Risk Data Aggregation and Risk Reporting

International banking standard requiring systemically important banks to have strong data governance, accurate risk data aggregation, and timely risk reporting capabilities.

AI models used for risk management in banking must be built on data infrastructure that meets BCBS 239 principles. Data quality, lineage, and aggregation capabilities are prerequisites for reliable AI risk models.

National Association of Insurance Commissioners Model Laws and AI Guidance

NAIC model laws and bulletins governing the use of AI/ML in insurance — including requirements for transparency, fairness testing, and governance of predictive models used in underwriting, rating, and claims.

State insurance regulators are adopting NAIC guidance on AI governance. Insurers using AI in rating, underwriting, or claims must demonstrate fairness, transparency, and appropriate governance.

Colorado Automated Decision-Making Technology Act

Colorado's 2024 AI Act (SB 24-205) never took effect. It was repealed and replaced by SB 26-189, signed 14 May 2026, which regulates automated decision-making technology used in consequential decisions through notice, disclosure, and consumer rights rather than the earlier duty-of-care and impact-assessment regime. Takes effect 1 January 2027, with Attorney General rulemaking still pending.

The 2024 act's enforcement had already been stayed by a federal court in April 2026 in litigation brought by xAI, in which the Department of Justice intervened. If you built a compliance program against the original high-risk framework, the obligations it was built for were dropped, not merely delayed.

Texas Responsible Artificial Intelligence Governance Act

Signed 22 June 2025, effective 1 January 2026. An intent-based prohibition statute rather than an EU-style risk-tier compliance regime — it bans developing or deploying AI with intent to discriminate, manipulate behavior, or infringe constitutional rights. Disparate impact alone is expressly not a violation.

No private right of action — enforcement is exclusive to the Attorney General, with a 60-day cure period. It preempts conflicting local ordinances and offers a safe harbor for organizations aligned to the NIST AI RMF.

California SB 53, AB 2013, SB 942/AB 853, and SB 243

Four separate laws, not one. SB 53 (frontier AI transparency) binds developers training above 10^26 FLOPs, with the published-framework duty falling only on those above $500M revenue; obligations began 1 January 2026. AB 2013 requires training-data disclosure for any generative system made publicly available in California and has no size threshold. SB 942, as amended by AB 853, requires AI content provenance from large generative providers and became operative 2 August 2026. SB 243 governs companion chatbots.

SB 53 draws the headlines but binds very few companies. AB 2013 has no size threshold and reaches far more organizations, and SB 243 carries a private right of action — the greater of actual damages or $1,000 per violation. Check scope before assuming which of the four applies to you.

Illinois Human Rights Act Amendment on Artificial Intelligence

Effective 1 January 2026. Amends the Illinois Human Rights Act to cover AI used in recruitment, hiring, promotion, discipline, and discharge. Bans using zip code as a proxy for a protected class, and requires employers to notify employees when AI is used in these decisions.

Effects-based, not intent-based — it reaches AI that has the effect of discriminating, which is the opposite posture from Texas TRAIGA. An employer operating in both states cannot run one compliance standard.

New York City Automated Employment Decision Tools Law

Enforcement began 5 July 2023. Employers using an automated employment decision tool for hiring or promotion in New York City must commission an independent bias audit within the prior year, publish a summary of the results, and give candidates at least 10 business days' notice.

The first US law to require a published bias audit, and the operational template several later proposals follow. Penalties run $500 to $1,500 per violation per day, and each day a non-compliant tool is used is a separate violation.