Help CD

Jurisdictional overlays

Add country and sector rules on top of NIST AI RMF, ISO/IEC 42001 and the EU AI Act.

How overlays work

An overlay adds jurisdiction-specific controls. It never lowers the base band or removes core CALIBRE controls. A system that operates in several jurisdictions activates the union of the relevant overlays. Paper Section 13.7.

Worth considering: APRA CPS 234 and CPS 230 (Australia, financial services); DORA (EU, financial services); HIPAA (US, health data); India IT Rules 2026; Singapore Model AI Governance Framework; ASD Essential Eight; IEC 62443 (industrial control systems); IEC 62304 and ISO 14971 (medical device software and risk). US Executive Order 14110 on Safe, Secure and Trustworthy AI was revoked on 20 January 2025, so use it for historical mapping only.

Overlay authors are encouraged to publish definitions under a compatible licence so the community can maintain a shared library.

AU-ASIC-AI-2025ASIC AI Enforcement Priorities Australia - Australian Securities and Investments Commission

ASIC Corporate Plan 2025-2029, plus ASIC Report REP 785 on AI in financial services

["ASIC-01 Board and executive AI oversight documented", "ASIC-02 AI-driven advice / decisions comply with best-interest duty", "ASIC-03 Continuous disclosure of material AI incidents (Listing Rule 3.1, s674 Corp Act)", "ASIC-04 AI use disclosed in Financial Services Guide where material"]
AU-PRIVACY-ACT-1988Privacy Act 1988 (Cth) - AI-relevant amendments Australia - Office of the Australian Information Commissioner

Privacy Act 1988 (Cth) with Privacy and Other Legislation Amendment Act 2024

["APP-1 Open and transparent management of personal information", "APP-3 Collection of solicited personal information (minimisation)", "APP-6 Use or disclosure of personal information (secondary use limitation)", "APP-11 Security of personal information (technical and organisational)", "APP-12 Access to personal information", "APP-13 Correction of personal information", "STATUTORY-TORT (2025+) Right to sue for serious invasions of privacy", "AUTOMATED-DECISIONS (2026+) Transparency of substantially automated decisions"]
AU-APRA-CPS-230APRA CPS 230 Operational Risk Management Australia - Prudential Regulation Authority

Prudential Standard CPS 230, effective 1 July 2025 (grace period ended 1 July 2026)

["CPS230-01 Board accountability for operational risk management framework", "CPS230-02 Comprehensive operational risk register including AI", "CPS230-03 Material Service Provider (MSP) register and due diligence", "CPS230-04 Business continuity plan for critical operations including AI", "CPS230-05 Incident management and notification within 72 hours", "CPS230-06 Fourth-party (subcontractor) concentration risk assessment", "CPS230-07 Regular testing of continuity arrangements"]
AU-APRA-CPS-234APRA CPS 234 Information Security Australia - Prudential Regulation Authority

Prudential Standard CPS 234, effective 1 July 2019

["CPS234-01 Board oversight of information security", "CPS234-02 Information security capability commensurate with vulnerabilities and threats", "CPS234-03 Third-party information security arrangements", "CPS234-04 Incident notification to APRA within 72 hours", "CPS234-05 Testing effectiveness of information security controls"]
IN-DPDP-2023Digital Personal Data Protection Act 2023 India - Ministry of Electronics and Information Technology

Digital Personal Data Protection Act 2023, enforced from 2025

["DPDP-01 Lawful basis for processing (consent or legitimate use)", "DPDP-02 Notice with purpose, recipients, and rights", "DPDP-03 Purpose limitation and storage limitation", "DPDP-04 Rights of data principals: correction, erasure, grievance redressal", "DPDP-05 Consent manager framework for consent lifecycle", "DPDP-06 Data Protection Officer for Significant Data Fiduciaries", "DPDP-07 Personal data breach notification to Data Protection Board of India", "DPDP-08 Children's data: parental consent, no tracking or targeted advertising"]
IN-IT-RULES-2021-2024IT Rules 2021 with 2024 AI amendments India - Ministry of Electronics and Information Technology

Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules 2021, as amended 2024

["IT-2021-01 Grievance redressal mechanism with 24-hour acknowledgement", "IT-2021-02 Significant Social Media Intermediary obligations (50 lakh users)", "AI-AMEND-01 Labelling of AI-generated or synthetically manipulated content", "AI-AMEND-02 Traceability of first originator of information"]
IN-MEITY-AI-2024MeitY AI Advisory March 2024 India - Ministry of Electronics and Information Technology

MeitY Advisory 15 March 2024 on AI deployment

["MEITY-01 Consent labelling: users informed that they are interacting with AI", "MEITY-02 Bias and reliability testing before deployment", "MEITY-03 Watermarking of AI-generated content", "MEITY-04 Traceability metadata for AI outputs"]
SG-AI-VERIFY-2023AI Verify testing toolkit Singapore - IMDA / AI Verify Foundation

AI Verify, launched 2022, open-sourced 2023, expanded with GenAI evaluation 2024

["VERIFY-01 Testing framework covering transparency, explainability, repeatability, safety, security, robustness, fairness, data governance, accountability, human agency, inclusive growth", "VERIFY-02 Technical tests (bias, robustness) plus process checks", "VERIFY-03 AI Verify Foundation participation for community-driven benchmarks"]
SG-MGF-2020Singapore Model AI Governance Framework (MGF) Singapore - IMDA and Personal Data Protection Commission

Model AI Governance Framework, Second Edition 2020, plus MGF for Generative AI 2024

["MGF-01 Internal governance structures and measures", "MGF-02 Human involvement in AI-augmented decision-making", "MGF-03 Operations management (data, model, monitoring)", "MGF-04 Stakeholder interaction and communication", "MGF-GENAI-01 Accountability across the model lifecycle", "MGF-GENAI-02 Data governance for training", "MGF-GENAI-03 Trusted development and deployment", "MGF-GENAI-04 Incident reporting mechanism", "MGF-GENAI-05 Testing and assurance including red-teaming", "MGF-GENAI-06 Safety and alignment R&D", "MGF-GENAI-07 AI for public good"]

Register an overlay