Reference materials
AISGRC reference materials explain the laws, standards, risks and controls that govern AI systems, written for the people who have to implement them. Each page defines its topic, sets out what the main frameworks and regulators require, and cites primary sources. Time-sensitive facts such as deadlines, court rulings and standard versions are labelled with the date they were last confirmed.
Frameworks and regulation
The laws and standards that set requirements for AI systems, and how they fit together.
AI security frameworks compared
EU AI Act, NIST AI RMF, ISO/IEC 42001, MITRE ATLAS and OWASP side by side: what each is, whether it binds, whether it can be certified.
What is AI security?
AI security protects models, training data and AI pipelines from attack. It covers adversarial inputs, data poisoning, model theft and prompt injection.
Choosing an AI security assessment framework
Compare AI security assessment frameworks: NIST AI RMF, ISO/IEC 42001, MITRE ATLAS and OWASP each answer a different question. Pick by what you need.
EU AI Act
The EU AI Act has applied in general since 2 August 2026, and the Digital Omnibus pushed high-risk duties to December 2027. Here is what binds now.
NIST AI RMF
The NIST AI Risk Management Framework organizes AI risk into four functions: Govern, Map, Measure and Manage. Voluntary, not certifiable, widely adopted.
ISO/IEC 42001
ISO/IEC 42001:2023 sets requirements for an AI management system. Unlike the NIST AI RMF it can be independently audited and certified by a third party.
MITRE ATLAS
MITRE ATLAS catalogs how AI systems are attacked in the real world, mapping tactics, techniques and documented case studies in the style of ATT&CK.
OWASP Top 10 for LLM Applications
The OWASP Top 10 for LLM Applications names the failure modes that break AI in production, from prompt injection to excessive agency and unbounded consumption.
How to use the NIST AI Risk Management Framework, step by step
A practical walkthrough of the NIST AI Risk Management Framework: running Govern, Map, Measure and Manage on a real AI system, and using its profiles.
AI Governance
Operating models, ownership, policies, audit, and oversight for running AI responsibly. All AI Governance references →
What is AI governance?
AI governance explained: the policies, owners, controls and evidence that show what your AI does and prove it under the EU AI Act, NIST AI RMF and ISO 42001.
What is an AI acceptable use policy?
An AI acceptable use policy sets which AI tools staff may use, what data they may enter, how outputs are checked and what AI agents may do. Rules and template.
What is an AI audit?
An AI audit tests whether AI systems are secure, reliable, fair and compliant, and whether the organization can prove it. Types, criteria, evidence, mandates.
What IT auditors should know and do about AI audit
What IT auditors need for AI audit in 2026: which ITGCs still apply, new controls for data, drift and oversight, a work program, IIA standards and credentials.
AI in risk, audit and compliance
How AI is changing risk, audit and compliance in 2026: real adoption data, PCAOB, FRC and CPAB positions, EU and US mandate shifts, and the enforcement record.
What is AI safety?
AI safety keeps AI systems from causing harm without an attacker: alignment, robustness, evaluation and oversight, plus 2026 frontier AI laws and frameworks.
What is AI privacy?
AI privacy covers how AI systems collect, infer and retain personal data: memorization, inference, consent, GDPR, PIPEDA, Law 25 and CCPA rules in 2026.
Human-in-the-loop: oversight as a governance control
Human oversight of AI needs authority, information, time, competence and safety to dissent. EU AI Act Article 14, GDPR Article 22 and automation bias explained.
AI oversight at board level
Board oversight of AI in 2026: the inventory, owners, risk tiers and evidence directors should see, plus SEC, Caremark and EU AI Act duties.
Managing AI-specific cybersecurity risks in financial services
AI risk in financial services in 2026: OSFI E-23, the AMF AI guideline, SR 26-2, DORA, the EU AI Act and what firms must inventory, validate and evidence.
AI lawsuits explained: who is getting sued?
AI lawsuits as of October 2026: the $1.5B Anthropic settlement, the first appellate fair-use ruling, NYT v. OpenAI, Getty, chatbot harm and hiring bias.
What is an AI strategy?
An AI strategy sets where AI will create value, where it will not be used, and how return and risk are measured. Components, steps and governance.
What is AI accountability?
AI accountability means a named person answers for each AI system, can explain it, and carries the consequences. Who is liable, and how to evidence it.
What is AI transparency?
AI transparency means disclosing when AI is used, how it works and its limits. EU AI Act Article 50, California SB 942, model cards and Canadian rules.
What is explainable AI (XAI)?
Explainable AI makes model outputs understandable enough to check or challenge. SHAP, LIME, counterfactuals, NIST's four principles and the law.
AI Risks
The main AI risks, bias, and AI-enabled fraud, and how to assess them. All AI Risks references →
The top 8 AI risks
The eight AI risks that matter most: bias, data poisoning, privacy leakage, model theft, hallucination, opacity, misuse and supply chain exposure.
What is bias in AI systems?
Bias in AI systems comes from training data, labelling choices and proxy variables, and shows up as systematically different outcomes between groups.
AI identity fraud
How generative AI changed identity fraud: synthetic identity documents, deepfake video calls, cloned voices defeating authentication, and what still works.
Attacks & Defences
Adversarial threats to AI systems and the controls that counter them. All Attacks & Defences references →
How these references are maintained
Reference pages are reviewed when the underlying law, standard or case changes. Statements that can go out of date carry an "as of" label or a status column, and each page cites the primary source so the current position can be checked directly.