Frameworks · By region
AI regulations by region.
AI rules arrive through existing regulators before they arrive as statutes. This page groups the frameworks Meilynx maps to by where they apply, so a firm with operations in more than one place can see the full set at once.
United States · federal
Interagency guidance and self-regulatory notices that apply through existing rules rather than an AI statute.
- FINRA 24-09PresetSupervision and recordkeeping obligations for generative AI at broker-dealers.FINRA
- SR 26-2PresetThe interagency model risk guidance that replaced SR 11-7 in April 2026.Federal Reserve · OCC · FDIC
- HIPAAPresetPHI detection with in-flight redaction, audit controls, transmission security, and business-associate coverage of LLM providers for the AI-traffic slice.US Department of Health and Human Services (OCR)
- HHS §1557PresetThe duty, in force since 1 May 2025, to identify decision support tools that use protected-class inputs and to mitigate discrimination risk.HHS Office for Civil Rights
- ONC HTI-1PresetSource attributes and risk management for the predictive decision support tools a provider or payer deploys through certified health IT.HHS Assistant Secretary for Technology Policy / ONC
- FDA AI LifecyclePresetReadiness evidence for organizations operating AI-enabled device functions: the sponsor's change control plan, version-change detection, and post-market monitoring inputs.US Food and Drug Administration (CDRH)
- NIST 800-53PresetControl-by-control evidence for the AI traffic in a system assessed against 800-53.National Institute of Standards and Technology
- NIST AI RMFPolicy engineGovern, map, measure, and manage functions the policy engine can evidence today.NIST
United States · state
State regulators and legislatures move first: New York on cybersecurity, insurance departments on AI programs, and Illinois, NYC, and Colorado on employment AI.
- NYDFS 500PresetCybersecurity requirements for New York financial services companies, applied to AI systems.New York Department of Financial Services
- NAIC AI BulletinPresetThe insurer AI program expectations adopted in 27 states, DC and Puerto Rico, with the Colorado, New York, Texas, and Connecticut layers.NAIC and state insurance departments
- Healthcare AIPresetTexas SB 1188 and HB 149, California AB 3030, Colorado HB 26-1139 (readiness), and the Joint Commission / CHAI Responsible Use of AI in Healthcare guidance.Texas, California, and Colorado legislatures; the Joint Commission and CHAI
- Illinois HB 3773PresetDiscriminatory-effect liability, the zip-code proxy ban, and notice for AI in employment decisions, in force since 1 January 2026.State of Illinois
- NYC Local Law 144PresetAnnual independent bias audit, published summary, and candidate notice for automated employment decision tools, enforced since 5 July 2023.New York City
- Colorado SB 26-189PresetInventory, disclosure, correction, and human-review duties for consequential decisions including employment, effective 1 January 2027; covered as readiness.State of Colorado
European Union
The AI Act phases in through 2027 alongside DORA for financial entities. Both expect records that show the controls operating.
United Kingdom
No AI statute. Sector regulators apply existing rules instead — and the PRA's model risk management principles reach AI through a model definition that covers vendor-supplied models, without ever naming it.
Asia-Pacific
Singapore, South Korea, and Australia each took a different route: voluntary frameworks with sector regulators behind them, a national AI statute, and operational-risk rules that reach AI through the banks. Meilynx maps them today and packages presets next.
- PDPC Model AI FrameworkPreset in preparationVoluntary, accountability-based guidance from PDPC and IMDA (second edition January 2020; generative-AI framework May 2024) built on explainable, fair, human-centric AI.PDPC and IMDA (Singapore)
- MAS FEAT PrinciplesPreset in preparationFairness, ethics, accountability, and transparency guidance for Singapore financial institutions (November 2018), operationalised through the Veritas assessment methodology.Monetary Authority of Singapore
- Korea AI Basic ActPreset in preparationBinding statute in force since 22 January 2026: notice and labeling for generative AI, risk management, human oversight, and impact assessment for high-impact AI, with fines deferred for at least a year.Ministry of Science and ICT (South Korea)
- AU Voluntary AI Safety StandardPreset in preparationTen voluntary guardrails from the Department of Industry, Science and Resources (September 2024) covering accountability, risk management, and transparency across the AI supply chain.Department of Industry, Science and Resources (Australia)
- APRA CPS 230 / 234Preset in preparationBinding on APRA-regulated entities: operational-risk and material-service-provider duties in force since 1 July 2025, and information-security duties since 2019, which reach AI through the systems and vendors that run it.Australian Prudential Regulation Authority
- AU Privacy Act ADM transparencyPreset in preparationFrom 10 December 2026, privacy policies must disclose the personal information used by, and the kinds of decisions made by, computer programs that significantly affect individuals.Parliament of Australia; regulator OAIC
International standards
ISO/IEC 42001 and SOC 2 travel across borders and are what auditors ask for when no local rule names AI.
- ISO/IEC 42001PresetThe international AI management-system standard, with operating evidence behind each clause.ISO / IEC
- SOC 2PresetTrust Services Criteria evidence for the AI path, and the report Meilynx holds itself.AICPA
- NIST AI RMFPolicy engineGovern, map, measure, and manage functions the policy engine can evidence today.NIST
Presets and policy-engine coverage.
A preset is a curated control bundle that ships in the product today. Policy-engine coverage means the engine enforces the underlying controls and your compliance team scopes them.
See exactly what an examiner receives
Request a sample examination package: model inventory, control coverage, a governance policy snapshot, and a SHA-256 integrity hash.