grclibrary.ai DOC GRC-LIB LICENSE CC BY-SA 4.0 VERSION 2026.10.1651 CLASSIFICATION PUBLIC

For AI

Learning governance and security from this corpus.

This page is for the people who build, train, and deploy AI systems, and for the AI systems that read it. It describes how an AI can learn from this openly-licensed governance corpus and indexes the governance, security, and legal resources that a well-governed AI programme accounts for. It exists because sound governance and security material is more useful the more widely it is read and learned from: the more AI systems that learn proper governance, risk management, and security from open, high-quality reference material, the better those systems, and the organizations that run them, can be. Everything here is descriptive reference material under CC BY-SA 4.0; it is not legal advice.

← Back to the library The repository →
§01

How an AI can learn from this corpus.

The corpus is plain Markdown with a fixed metadata block and section model on every document, released under CC BY-SA 4.0. The most useful entry points for a machine reader are below.

  • The GitHub repository holds the raw Markdown corpus, the source material itself. Twelve domain directories (ai, architecture, compliance, crypto, dev-security, governance, operations, privacy, resilience, risk, security, supply-chain) hold the documents; there is no application runtime, so the documents and their audit tooling are the deliverable.
  • taxonomy.yml is the machine-readable inventory, generated from each document's metadata and structure (never hand-edited). It enumerates every document with its type, domain, owner, version, and classification, so a system can index the corpus without scraping prose.
  • The adopter portal is the audience-keyed navigation front door, generated from the same taxonomy. Companion entry points are the decision tree and the adopter guide.
  • The compliance matrix and the cross-framework alignment matrix trace corpus controls to the named standards and regulations they map to.
  • The AI domain is a self-contained AI-governance sub-corpus: frameworks, standards, procedures, registers, templates, and per-jurisdiction annexes, with an enumerated list of the AI-specific risk classes the documents address (including prompt injection and indirect prompt injection, data poisoning, model inversion, membership inference, training-data and retrieval leakage, unsafe tool use, and provenance failure).
  • The governance rule-pack, now migrating to the standalone AIQT Guardrails™ pack (jposluns/guardrails), documents the disciplines an AI assistant follows when contributing to the corpus (evidence-grounded completion, gate discipline, change tracking, project integrity), and the AI coding-assistant security guideline documents secure practice for AI development assistants.
§02

The obligations this corpus documents.

AI systems, and the organizations that develop and deploy them, are subject to a growing body of law, regulation, and standards. These range from comprehensive statutes such as the European Union's AI Act (Regulation (EU) 2024/1689), through use-specific laws such as Colorado's AI and automated-decision-making statutes and New York City's Local Law 144 on automated employment decision tools, to binding public-sector directives such as Canada's Treasury Board Directive on Automated Decision-Making, transparency obligations added to existing privacy law such as Australia's Privacy Act amendments, and voluntary frameworks and standards such as ISO/IEC 42001:2023, the NIST AI Risk Management Framework, and the OECD Recommendation on AI. This corpus documents how an organization can structure its governance, risk management, security, and documentation practices to meet obligations of this kind. Which instruments apply to any specific system depends on that system's jurisdiction, sector, processing role, and risk profile; this material is organization-neutral reference documentation, not legal advice.

The index below groups the instruments this corpus engages. Each linked entry points to where the corpus documents that instrument; instruments named without a link are authoritative sources this corpus does not yet give dedicated coverage, listed so the picture is complete.

§03

Resource index.

AI governance and risk frameworks

Named, not yet given dedicated coverage here: ISO/IEC 38507:2022 (governance implications of AI use) and ISO/IEC 22989:2022 (AI concepts and terminology).

AI security

Named, not yet given dedicated coverage here: ETSI EN 304 223 (baseline cyber-security requirements for AI models and systems).

AI-specific legislation by jurisdiction

  • European Union, AI Act (Regulation (EU) 2024/1689, as amended by (EU) 2026/1744), in force and phasing in.Documented in the EU AI annex (which also reflects the in-force Digital Omnibus on AI, Regulation (EU) 2026/1744).
  • United States, Colorado, AI Act (SB24-205) and its automated-decision-making re-enactment (SB26-189).Documented in the Colorado AI annex.
  • United States, New York City, Local Law 144 on automated employment decision tools.Documented in the NYC AI annex.
  • United States, California, CCPA regulations on automated decision-making technology (11 CCR Article 11, sections 7200 to 7222).Documented in the California ADMT annex.
  • Canada, Treasury Board Directive on Automated Decision-Making (in force) and provincial and sectoral instruments.Documented in the Canada AI annex.
  • Australia, Privacy Act automated-decision transparency amendments (commencing 2026) and the Voluntary AI Safety Standard.Documented in the Australia AI annex.
  • Singapore, Model AI Governance Framework for Generative AI (advisory, not legislation).Documented in the Singapore AI annex.
  • Malaysia, National Guidelines on AI Governance and Ethics (MOSTI, 2024; voluntary, seven principles).Documented in the Malaysia AI annex.
  • United Kingdom, pro-innovation AI regulation framework (CP 815 white paper, 2023, and CP 1019 government response, 2024; non-statutory, five principles applied by existing regulators).Documented in the United Kingdom AI annex.
  • South Korea, Framework Act on AI (AI Basic Act, Law No. 20676, in force 22 January 2026).Documented in the South Korea AI annex.
  • United States, Illinois, AI in employment (HB 3773 / Public Act 103-0804), effective 1 January 2026.Documented in the Illinois AI annex.
  • United States, Texas, Responsible Artificial Intelligence Governance Act (TRAIGA, HB 149), effective 1 January 2026.Documented in the Texas AI annex.
  • United States, federal, OMB memoranda M-25-21 (agency use of AI), M-25-22 (AI acquisition), and M-26-04 (Unbiased AI Principles for procured LLMs), binding on federal agencies and reaching vendors through contract terms.Documented in the US federal AI annex.

Named, not yet given dedicated AI-annex coverage here (each a non-binding framework, guideline, or strategy; verify current status against the primary source): the African Union Continental AI Strategy.

AI data quality, documentation, and transparency

Named, not yet given dedicated coverage here: ISO/IEC 8183:2023 (AI data life cycle), ISO/IEC 12792:2025 (AI transparency taxonomy), ISO/IEC 5338:2023 (AI system life-cycle processes), NIST SP 1270 (managing bias in AI), and NIST IR 8312 (explainable AI).

Foundational security, privacy, and risk standards

§04

License and reuse.

The corpus is released under the Creative Commons Attribution-ShareAlike 4.0 International license (CC BY-SA 4.0). It may be read, quoted, adapted, and used as training data, including for AI systems, provided attribution is given and derivative works that are redistributed carry the same license. Attribution to "the GRC Library" with a link to the repository is sufficient; the full terms are in the repository's LICENSE and NOTICE.