Compliance Frameworks

Title 21 Code of Federal Regulations Part 211 establishes the minimum current good manufacturing practice (cGMP) requirements for the preparation of drug products (finished pharmaceuticals) for administration to humans or animals. Covers all aspects of pharmaceutical manufacturing from personnel and facilities to production controls and record keeping. Enforced by the FDA.

Title 21 Code of Federal Regulations Part 58 establishes Good Laboratory Practice (GLP) regulations for nonclinical laboratory studies supporting applications for research or marketing permits for FDA-regulated products. Covers organization, facilities, equipment, testing operations, records, and reporting requirements to ensure the quality and integrity of safety data.

3GPP Technical Specification 33.501 defines the security architecture and procedures for 5G systems, including authentication (5G-AKA and EAP-AKA'), key management, security between network functions, user plane integrity protection, and subscriber privacy through SUPI/SUCI encryption to prevent tracking and IMSI catching.

The 6th Anti-Money Laundering Directive (AMLD6, Directive (EU) 2018/1673) strengthens the EU's criminal law framework for combating money laundering. It harmonises the definition of money‑laundering offences, extends criminal liability to legal persons, introduces minimum sanctions, expands the scope of predicate offences, and requires member states to criminalise the facilitation of money laundering. AMLD6 was later superseded by AMLD7, which further expands the scope and introduces new obligations.

The Australian adoption of IFRS 10: when a parent must present consolidated statements and the Australian exemption rules, the three-element control model (power over relevant activities, exposure to variable returns, and the link between them, including principal and agent analysis), consolidation procedures, non-controlling interests, loss of control, the investment entity exception, and guidance for not-for-profit entities.

Sets the minimum structure and general features of a complete set of general-purpose financial statements: fair presentation through compliance, going concern assessment, accrual accounting, materiality, no offsetting, comparatives, and the minimum content of the statement of financial position, the statement(s) of profit or loss and other comprehensive income, the statement of changes in equity and the notes, including capital management and estimation uncertainty disclosures. Superseded by AASB 18 from 1 January 2027.

The Australian standard for the concise financial report a company, scheme or disclosing entity may send members instead of the full financial report: everything derived from the audited report on the same policies, the four primary statements unchanged, discussion and analysis for unlisted entities, the specific disclosures (segments, revenue, dividends, earnings per share, currency, subsequent events, policy changes, first-time adoption, going concern), comparatives and the first-page advice that the full report is available free on request.

The Australian-only disclosures layered on IFRS: the explicit and unreserved compliance statement, the reporting framework and for-profit or not-for-profit status, general purpose versus special purpose statements and the disclosures special purpose statements must carry, auditor and network firm fees split between audit and other services, franking credits available, the direct-method operating cash flow reconciliation, and the disclosure about IFRS Standards the AASB has not yet issued, with the 2027 to 2029 AASB 2026-2 and 2026-4 changes noted on the affected leaves.

The Australian adoption of IAS 7: the duty to present a statement of cash flows, what counts as cash and cash equivalents, classification into operating, investing and financing activities, the direct and indirect methods, gross versus net reporting, foreign currency, interest, dividends and tax flows, business acquisitions and disposals, non-cash transactions, and the disclosures of financing liability movements, supplier finance arrangements, cash components and restricted balances, with the 2027 AASB 18 and 2028 AASB 2026-4 changes noted on the affected leaves.

The Australian adoption of IAS 21: determining functional currency, recording and remeasuring foreign currency transactions, recognising exchange differences including on net investments in foreign operations, translating into a presentation currency and from hyperinflationary currencies, disposal of foreign operations, currencies that are not exchangeable, and the related disclosures.

The Australian adoption of IFRS 18, replacing AASB 101 from 2027: what a complete set of financial statements must contain, how to decide what goes on the face and what goes in the notes, the five profit or loss categories and the operating profit and profit before financing and income taxes subtotals, operating expenses by nature or function, the statement of financial position and changes in equity minimums, the notes structure, and the single-note disclosure and reconciliation of management-defined performance measures.

Australian Accounting Standards Board Standard S2 requires entities to disclose climate-related risks and opportunities. Based on IFRS S2 issued by the ISSB. Structured around four pillars: Governance, Strategy, Risk Management, and Metrics and Targets. Commenced as a legislative instrument on 31 December 2024.

The ACCME's accreditation requirements for US continuing medical education providers: the eight core criteria that tie activities to practice gaps and measured change, the Standards for Integrity and Independence that exclude ineligible companies, require 24-month disclosure, pre-role mitigation and learner disclosure, and control commercial support and marketing separation, and the policies on the accreditation statement, records and joint providership.

ASD's Essential Eight Maturity Model (November 2023): the eight mitigation strategies at Maturity Levels One to Three, each requirement as ASD states it with its ISM control and the levels it applies at, including the requirements that unsupported applications, online services and operating systems are removed or replaced.

The ACT Child Safe Standards Scheme (from 1 August 2024): every provider of a service for children and young people in the ACT must implement ten prescribed child safe standards that mirror the National Principles, overseen by the Children and Young People Commissioner, with a complaints route to the ACT Human Rights Commission.

Duties of ACT lessors, agents and tenancy database operators under the Residential Tenancies Act 1997, its Schedule 1 standard terms and the Residential Tenancies Regulation 1998: advertising, disclosure, minimum housing standards, bonds, rent increases, repairs, consents, access, termination grounds, family violence and databases.

The ACT's current veterinary regulation Act and its code of professional conduct: scope-of-practice and title-protection offences, registration renewal and residence duties, the full code of conduct (including the 4-year clinical record-keeping duty), and registered-premises duties.

Australian Capital Territory law on workplace surveillance of workers (employees, contractors, labour hire and volunteers): written notice 14 days ahead with its eight required items, good faith consultation, visible cameras and signs, a data surveillance policy, tracking notices, limits on blocking email and websites and on using records for adverse action, worker access to records, covert surveillance only with a court authority, prohibited non-work areas, and record security and destruction.

The AICPA Privacy Management Framework (PMF) provides a comprehensive framework for CPA practitioners and organisations to manage and report on privacy risk. It builds on the Generally Accepted Privacy Principles (GAPP) and SOC 2 Trust Services Criteria for Privacy. The PMF includes nine privacy components: management, agreement/notice/communication, collection, use/retention/disposal, access, disclosure to third parties, security, quality, and monitoring/enforcement. Used in SOC 2 privacy engagements and privacy programme assessments.

SOC 3 is the AICPA's general-use report on an examination of controls against the Trust Services Criteria: the same work as a SOC 2 type 2 examination, reported as only management's assertion and the service auditor's opinion, without the system description or test results. The framework holds the SOC 3-specific requirements; the criteria sit under SOC 2.

The Australian Meat Industry Council's industry standard for the welfare of cattle, sheep, pigs, goats, buffalo, deer and horses at Australian processing establishments, from receival through to slaughter, at Edition 4 (approved November 2024, effective 1 January 2026): a welfare management system with audit, corrective action and management review; competent, named welfare personnel; fit infrastructure, lairage, emergency killing equipment and, new in this edition, video surveillance of the welfare-critical steps; receival scheduling and supplier feedback; low-stress handling with numeric falls, vocalisation and goad targets; water, feed, inspection and care of compromised animals; restraint, permitted stunning methods and effectiveness targets, bleedline insensibility, sticking and no dressing before death. Voluntary and certifiable under the AAWCS. Built from the complete Edition 4 text, read in full.

Australia's AML/CTF law as reformed by the 2024 Amendment Act: every duty a reporting entity carries under the Act and the AML/CTF Rules 2025, from the ML/TF risk assessment, AML/CTF policies, governing body oversight and compliance officer, through customer due diligence, beneficial ownership, PEP and sanctions checks, enhanced and simplified CDD and reliance, to suspicious matter, threshold and international transfer reporting, enrolment, the travel rule, remittance and virtual asset registration, correspondent banking and record-keeping, including the tranche 2 professions and dealers regulated from 1 July 2026. Built from the authorised compilations of the Act and Rules read in full.

The AUSTRAC rules that turn the AML/CTF Act's duties into specific steps: what an AML/CTF program must contain and who approves what, the minimum KYC for each customer type, when verification can be delayed and for how long, enhanced checks for PEPs and unusual requests, nested services and correspondent banking reviews, reliance and real estate KYC sharing arrangements, travel rule information for payments and virtual assets, report contents and deadlines, enrolment and registration, plus the transitional dates and class exemptions that apply during the tranche 2 rollout.

How to run physical security as a management system: a top-management policy and accountable owner, documented context and scope, a security survey and risk assessment that drive countermeasure choice, layered protection in depth, designed and commissioned physical protection systems with a maintenance and replacement life cycle, emergency command and control, exercises, audit and review, and element guidance on CPTED, site hardening, lighting, barriers, intrusion detection, access control, video surveillance, alarm monitoring and security staffing. 74 leaves read against the complete standard.

How an organization prevents, intervenes in and responds to workplace violence: a scoped working definition, legal and labor obligations, top management and multidisciplinary roles, a needs assessment, a WVPI policy without zero-tolerance wording, a trained Threat Management Team with incident protocols, training and confidential records, warning signs and threat assessment, intimate partner violence, law enforcement liaison, immediate response and post-incident recovery, plus the informative active assailant annex (plan, kits, mass notification, staging areas, exercises, crisis communications, reunification, recovery phases). Leaves read against the complete ANSI/ASIS WVPI AA-2020.

ANSSI Guide d'hygiene informatique, the French national cybersecurity agency baseline of 42 measures across 10 themes for strengthening the security of an information system.

The APEC Cross-Border Privacy Rules (CBPR) System is a voluntary accountability-based framework for facilitating cross-border data flows among APEC economies while protecting personal information. Participating companies self-certify compliance with programme requirements, verified by APEC-recognised accountability agents. Based on the APEC Privacy Framework. Participating economies include US, Japan, Canada, South Korea, Australia, Singapore, and others. Being transitioned to the Global CBPR Forum.

Pipeline SCADA Security for petroleum and natural gas

Act on Protection of Personal Information (Japan)

Australian Prudential Regulation Authority Prudential Standard CPS 220 sets out requirements for APRA-regulated entities to have an effective risk management framework, including the Board's responsibility for risk oversight, a Chief Risk Officer, and the 'three lines of defence' model. Applies to ADIs, insurers, and RSE licensees.

APRA Prudential Standard CPS 230 Operational Risk Management (July 2026 issue, commenced 1 July 2026): duties on APRA-regulated banks, insurers, private health insurers and RSE licensees to manage operational risk, keep critical operations within tolerance through severe disruption with a credible and tested BCP, and manage service provider risk, including the annual material service provider register submission, the 72-hour, 24-hour and 20-business-day APRA notifications, and the para 57 and 58 exemptions for Attachment-category providers.

APRA's prudential standard on information security for banks, insurers, private health insurers and superannuation trustees: Board accountability, defined roles, a capability scaled to threats, policy framework, asset classification, proportionate controls, incident detection and response plans, systematic control testing, internal audit assurance including third parties, and APRA notification within 72 hours (incidents) or 10 business days (control weaknesses).

Australian Prudential Regulation Authority Prudential Standard SPS 220 sets out risk management requirements specifically for RSE licensees (superannuation trustees). It requires RSE licensees to maintain a Board-approved risk management framework covering material risks to the business operations and to the interests of beneficiaries.

AS 1428.1:2021, the Australian Standard for access and mobility in new building work: continuous accessible paths of travel, widths and turning spaces, floor surfaces and grates, signage and tactile indicators, walkways, ramps, landings, stairs and handrails, doorways, door hardware and circulation space, switches, accessible and ambulant sanitary facilities, grabrails and wheelchair seating.

AS 1684.2:2021, the Australian Standard for residential timber-framed construction in non-cyclonic areas: scope limits and wind classes, durability, bearing and timber grading, lamination and load widths, site preparation and footings, floor framing and flooring, wall framing, lintels and plates, roof framing and trusses, racking forces and bracing, and fixings, tie-down and shear connections.

Australian Standard for the routine servicing of fire protection systems and equipment: inspection, testing, preventive maintenance and survey frequencies and tolerances for sprinklers, fire pumps, hydrants, tanks, detection and alarm, special hazard systems, hose, hose reels, extinguishers, blankets, fire doors and passive systems, smoke control and emergency planning, with logbooks, tags, defect reporting and the yearly condition report.

AS 3740:2021, the Australian Standard for waterproofing domestic wet areas: risk categories for showers, bathrooms and laundries, falls to wastes, approved waterproof and water-resistant materials, membrane installation and curing, termination heights, waterstops, door openings, bond breakers, junctions, penetrations, baths, spas, shower bases and screens, vinyl, polished concrete and floor heating, and membrane continuity testing.

The Australian Standard for planning for emergencies in a building, structure or workplace: forming an emergency planning committee, writing the emergency plan and evacuation diagrams, response procedures, the wardens' emergency control organization, training and skills retention, evacuation exercises and maintenance.

Australian Standard giving design, construction and fit-out criteria for permanent food premises (food service, retail and small manufacturers): food flow and separation, space, pest proofing, water, drainage, waste areas, ventilation, lighting, floor, wall and ceiling finishes, sinks and dishwashers, equipment design, materials and installation, hand basins, storage and toilets. Supports Food Standards Code Standard 3.2.3.

Australian and New Zealand Standard on selecting, using and maintaining harness-based fall-arrest systems: fall type classification, 6 kN arrest force, compatibility, rescue planning, restraint technique, training and competency, moveable platforms, anchorage strengths and certification, harnesses, lanyards, fall-arrest devices, horizontal lifelines, fall clearance and inspection.

The Australian and New Zealand Wiring Rules: the safety principles and deemed-to-comply installation practices for low voltage electrical installations, including RCD protection, switchboards, cable installation, earthing and bonding, bathrooms and pools, generators and solar, safety services and testing before energising.

The Australian and New Zealand rules for connecting generators to electrical installations: siting and guarding, isolation for maintenance, MEN earthing, changeover devices that prevent back-feed, and extra rules for permanently connected and plug-in sets.

The Australian and New Zealand plumbing standard for cold and non-drinking water services: materials, pipe sizing, pressure and velocity limits, cross-connection control and backflow devices, installation and separation from other services, tanks, recycled and rainwater systems, flushing, pumps, meters, testing and disinfection.

The Australian and New Zealand test and tag standard: how cord-connected electrical equipment, extension leads, power boards, RCDs and portable inverters at workplaces and in hire fleets are inspected, tested, tagged and recorded by a competent person at risk-based intervals.

The 2001 joint Australian and New Zealand specification for an occupational health and safety management system: policy, planning, implementation, measurement and evaluation, and management review, written as auditable criteria for certification. Superseded by AS/NZS ISO 45001:2018 and kept here as a historical edition for legacy certificates and contract clauses, with every requirement mapped to its ISO 45001:2018 successor.

Australian and New Zealand Standard for safe work on or near low-voltage and extra-low voltage electrical installations: risk management and work zones, isolation, lock out tag out and test-before-touch, fault-finding and live work conditions, safety observers, capacitors, batteries, asbestos, cutting cables, overhead and underground work, energization, tools and test instruments, supervision, arc-rated PPE selection and incident reporting.

AS9100 Revision D (SAE International, September 2016; IAQG 9100:2016, EN 9100:2016, JIS Q 9100:2016) is the aviation, space and defense quality management system standard. It reprints ISO 9001:2015 in full and adds the aerospace requirements in bold, including operational risk management, configuration management, product safety, prevention of counterfeit parts, special processes and first article inspection. The graph models its 63 requirement clauses on the ISO 9001:2015 leaf convention, each marked with whether it carries an aerospace addition; the IA9100 revision is planned for 2026.

Requires the auditor to build understanding of the entity, its environment and its system of internal control (control environment, risk assessment process, information system, control activities, monitoring) in order to identify and assess the risks of material misstatement at the financial report and assertion levels, determine significant risks, and document the basis for the risk assessment that drives the rest of the audit.

Requirements of AUASB ASAE 3100 Compliance Engagements (December 2022) for limited and reasonable assurance engagements on an entity's compliance with stated requirements, paraphrased.

A prioritised list of 37 mitigation strategies published by the Australian Signals Directorate to help organisations protect themselves against cyber threats. The Essential Eight is a subset of these strategies.

The ASEAN Data Management Framework provides a common framework for ASEAN member states to harmonize data governance across the region. It covers data lifecycle management, cross-border data flows, data protection measures, and organizational accountability. Designed to facilitate trusted data flows within ASEAN while maintaining appropriate safeguards.

The ASEAN Guide on AI Governance and Ethics provides a practical framework for ASEAN member states and organizations to deploy AI responsibly. Based on principles of transparency, fairness, security, accountability, and human-centricity, it provides guidance for both AI developers and deployers. Complements existing national AI strategies across ASEAN member states.

Selected mandatory provisions (apply under either the prescriptive or the performance compliance path) from Sections 5 (building envelope), 6 (HVAC), 7 (service water heating), 8 (power), 9 (lighting) and 10 (other equipment) of ANSI/ASHRAE/IES Standard 90.1-2022, the US model commercial building energy code. Section 4 (Administration), Section 11 (Energy Cost Budget) and the prescriptive compliance paths are not built.

The Australian Securities and Investments Commission sets expectations for cyber resilience of regulated entities in the financial services sector. Based on ASIC Report 429 (2015) and Report 716 (2022), it outlines good practices for boards and management in managing cyber security risks. Applies to Australian financial services licensees, credit licensees, and market operators.

ASIC's binding conduct rules for participants in Australian securities markets: supervision and fit and proper staff, client agreements, confirmations and client money, best execution, trading records, order handling, automated trading controls, manipulation and suspicious activity reporting, transparency, regulatory data and operational resilience.

ASIC Regulatory Guide 166 (July 2022), the financial requirements that Australian financial services licensees must meet under their licence conditions: solvency and positive net assets, the cash needs requirement met by one of five options with a projection the governing body approves, the annual audit report on compliance, surplus liquid funds where client money or property is held, adjusted surplus liquid funds with monthly certification and ASIC reporting triggers where the licensee deals as principal, the definitions of adjusted assets, adjusted liabilities, net tangible assets, eligible undertakings and excluded assets, and the tailored requirements for market participants, responsible entities, IDPS operators, custodians, margin lenders, foreign exchange dealers, retail OTC derivative issuers, crowd-sourced funding intermediaries and corporate directors of retail CCIVs.

ASIC Regulatory Guide 209 (December 2019), the regulator's guidance on the responsible lending obligations of the National Consumer Credit Protection Act: how licensees scale their inquiries into a consumer's requirements, objectives and financial situation, verify income and expenses, use benchmarks such as the Household Expenditure Measure only as a check, respond to red flags, divide responsibility between lenders and brokers, assess whether a product is unsuitable because the consumer cannot repay without substantial hardship or because it does not meet their objectives, apply the credit card, small amount credit contract and reverse mortgage presumptions, handle refinancing and switching, give the written assessment on request, and keep records that show the obligations were met.

ASIC's regulatory guide on the design and distribution obligations: how issuers and distributors of financial and credit products should run product governance, prepare and publish target market determinations, take reasonable steps, review TMDs, notify significant dealings, report to issuers and keep records.

ASIS SPC.1-2009 (Organizational Resilience: Security, Preparedness, and Continuity Management Systems - Requirements with Guidance for Use) is an American National Standard that establishes requirements for a management system to enhance organizational resilience. Published by ASIS International, it integrates security management, emergency management, and business continuity into a unified resilience management system. Certifiable standard used primarily in North America.

The Australian Taxation Office's security framework for software developers whose products send tax, accounting, payroll, business registry or superannuation data to the ATO: audit logging, multi-factor authentication and session limits, onshore hosting, key management, encryption at rest and TLS 1.3 in transit, customer entity validation, personnel security, security monitoring, supply chain and add-on marketplace controls, independent certification or self-assessment by risk category, annual reviews, change notices and reporting data breaches to the ATO within one business day, as a condition of access to ATO APIs and digital services.

Amazon Web Services security best practices framework

AWWA's cybersecurity guidance for drinking water and wastewater systems in its 2025 fourth edition: 100 recommended controls in 17 families for OT and enterprise IT, from awareness training, governance and continuity planning through access control, MFA and remote access, incident response, physical security, asset management and logging, to network segmentation, wireless and encryption, each cross-referenced to NIST CSF 2.0 and flagged where it is one of the small-system baseline controls. Built from the complete guidance, which supports Safe Drinking Water Act §1433 risk and resilience assessments.

The Act on the Implementation of the General Data Protection Regulation (Zakon o provedbi Opće uredbe o zaštiti podataka, OG 42/2018) provides national provisions supplementing the EU GDPR in Croatia. It defines specific conditions for lawful processing, the rights of data subjects, and the powers of the Croatian Personal Data Protection Agency (AZOP). The act has been amended by OG 71/2020 and OG 115/2022 to align with subsequent EU legislative updates.

Regulations governing algorithmic recommendation services (2022) and security assessment of generative AI services (2023), with amendments introduced in 2024 expanding oversight of AI‑generated content and recommendation algorithms.

The African Union Convention on Cyber Security and Personal Data Protection (Malabo Convention, 2014) is the first continental framework addressing cybersecurity and data protection in Africa. It establishes obligations for AU member states in electronic commerce, personal data protection, cybersecurity, and cybercrime. Entered into force June 2023 after achieving 15 ratifications.

The Aged Care Act 2024, in force from 1 November 2025, and the Aged Care Rules 2025: the conditions of registration and obligations every Australian registered aged care provider must meet, from the Code of Conduct, worker screening, service agreements, care plans, security of tenure and restrictive practices to incident management, the Serious Incident Response Scheme, complaints and whistleblowing, quality indicators, financial and prudential reporting, 24/7 registered nurses and care minutes, plus the statutory duty, officers' due diligence and the duties of aged care digital platform operators. Built from the Act's own sections.

How an aged care organisation sets up and runs infection prevention and control: governance and the IPC lead, policies, training, audits, risk management, standard and transmission-based precautions, invasive devices, cleaning, staff health, monitoring and antimicrobial stewardship. National guidance from the Australian Commission on Safety and Quality in Health Care, not law.

The strengthened Aged Care Quality Standards (Australia), in force from 1 November 2025 under the Aged Care Act 2024 and set out in Chapter 1 Part 6 of the Aged Care Rules 2025: seven Standards (the individual, the organisation, care and services, the environment, clinical care, food and nutrition, the residential community), 36 outcomes and 66 legal obligations for registered aged care providers. They replace the 2019 Standards.

The 2019 edition of Australia's Aged Care Quality Standards (Schedule 2 of the Quality of Care Principles 2014), in force from 1 July 2019 until their repeal on 1 November 2025: eight standards (consumer dignity and choice, assessment and planning, personal and clinical care, daily living, service environment, feedback and complaints, human resources, organisational governance) with 42 requirements that approved providers of residential, home, short-term restorative and transition care had to demonstrate. Kept as the reference for assessments and policy libraries written against it and as the source side of the transition to the strengthened Standards. Built from the final compilation of the Principles, read in full.

What an aged care registered provider must do under the Serious Incident Response Scheme as it applies since the Aged Care Act 2024 commenced: the incident management system, learning from incidents, the eight reportable incident types, Priority 1 and 2 classification and notification to the Commissioner. Regulator guidance explaining binding Aged Care Rules, not law.

What Ahpra and the National Boards expect of anyone advertising a regulated health service: identifying the advertiser, avoiding misleading claims, holding evidence for effectiveness claims, accurate titles and qualifications, offers, testimonials and reviews, unreasonable expectations, images and unnecessary use. Guidance explaining section 133 of the National Law, not law.

The shared Code of conduct of Ahpra and 12 National Boards (June 2022): the conduct expected of registered dental practitioners, pharmacists, physiotherapists, paramedics, optometrists, occupational therapists and six other professions, from patient-centred care, cultural safety, consent, privacy and open disclosure to boundaries, advertising, conflicts of interest, records, insurance, supervision and research. Guidance a Board uses as evidence of professional conduct, not law.

Albania's GDPR-aligned Law No. 124/2024 On Personal Data Protection, in force since 1 February 2025 and replacing Law 9887/2008: principles, lawful bases, consent (age 16 for online services), sensitive data and criminal records, 30-day responses to rights requests, access, erasure, the right to be forgotten including search engine delisting, restriction, portability, objection and automated decisions, accountability, privacy by design, a representative for foreign businesses, processor contracts, records of processing, security, 72-hour breach notification, confidentiality, impact assessments and prior consultation (in force 17 January 2027), DPOs, transfers under Commissioner adequacy decisions, clauses and binding company rules, journalism, research and direct marketing rules, the law enforcement regime of Part III, and fines up to ALL 2 billion or 4 percent of worldwide turnover. Built from the Commissioner's English version of the Law.

Angola's Law No. 22/11 on the Protection of Personal Data (2011) establishes the country's data protection framework. The Agência de Protecção de Dados (APD) serves as the supervisory authority. The law establishes data processing principles, individual rights, controller obligations, and provisions for cross-border transfers. Applies to processing of personal data by controllers established in Angola.

Annex 11 (revised 2022) provides guidance on the application of Good Manufacturing Practice (GMP) to computerised systems used throughout the pharmaceutical lifecycle, including manufacturing, quality control, laboratory testing, and distribution. It addresses system validation, data integrity, security, change control, backup and recovery, and the overall lifecycle management of computerised systems. Published by the European Commission as part of EudraLex Volume 4.

Argentina Personal Data Protection Law (Law 25.326) together with its implementing regulation Decree 1558/2001, the AAIP oversight provisions, and the 2020 amendment (Law 27.401) that added data breach notification requirements.

Chris Argyris's theory of action: why organizations correct errors within their existing assumptions (single-loop learning) but rarely question the assumptions themselves (double-loop learning), how espoused theories differ from the Model I theory-in-use that produces defensive routines, and how Model II, productive reasoning and action-science interventions build learning that persists. Rebuilt from Argyris's own articles of 1977 to 2002.

Arizona's stationary-source air quality program under A.R.S. Title 49 Chapter 3 and A.A.C. Title 18 Chapter 2: Class I (Title V) and Class II permits and registrations, applications and responsible official certification, voluntary limits, monitoring, records and semiannual or annual reports, compliance certification, 24-hour and 72-hour excess emission reporting and affirmative defences, performance tests, continuous monitoring, permit changes, revisions, renewal and transfers, fees and emissions inventories, minor new source review, hazardous air pollutant technology requirements, fugitive dust and opacity rules, and the federal NSPS and NESHAP incorporations. Built from the statute's and rules' own sections; the remaining rule Articles are listed and not yet modelled at leaf level.

Armenia's Law on Protection of Personal Data (2015) establishes the data protection framework. The Agency for Protection of Personal Data (subsequently integrated into the Human Rights Defender's Office) oversees compliance. The law establishes processing principles, consent requirements, data subject rights, and cross-border transfer provisions. Armenia has been working to strengthen alignment with European standards through Council of Europe Convention 108+ ratification.

The Article 29 Working Party's opinion on employee monitoring under EU data protection law: consent almost never works at work, legitimate interest needs a necessary, least intrusive and time, place and data-limited method, workers must be told what is monitored and why, and nine scenarios from social media screening and TLS inspection to keystroke logging, BYOD, wearables, CCTV analytics and vehicle tracking with a private-use switch. Guidance, not law; the EDPB has said it remains valid. Built from the complete English text.

Australia's eight voluntary AI Ethics Principles (7 November 2019): wellbeing, human-centred values, fairness, privacy protection and security, reliability and safety, transparency and explainability, contestability and accountability. Evolved for industry into the Guidance for AI Adoption on 21 October 2025; still the basis of government AI assurance frameworks.

The Commonwealth Child Safe Framework (second edition, 2020): four core requirements for Australian Government entities, annual child safety risk assessment, a training and screening compliance system, adoption of the National Principles, and a published annual child safety statement by 31 October, with recommended child safety clauses for funded third parties.

The Finance Minister's rules for how Australian Government entities buy goods and services: value for money, ethics and conflicts, Australian business and SME participation, AusTender publishing and reporting, records, risk, value estimation, limited tender conditions and the open tender process rules above the procurement thresholds.

Australia's competition law: Part IV cartel conduct, anti-competitive agreements and concerted practices, boycotts, misuse of market power, exclusive dealing, resale price maintenance and anti-competitive acquisitions, the mandatory merger notification regime of Part IVA and Division 1A, and the authorisation and notification routes in Part VII.

The 13 CDR privacy safeguards (Competition and Consumer Act 2010 sections 56ED to 56EP) and the 11 information security obligations imposed by Schedule 2 of the CDR Rules 2020, being the 5 mandatory Steps and the 6 minimum control requirements. Broader operational obligations under the CDR Rules are tracked separately in the companion framework and are not claimed as complete here.

The core compliance duties of Australia's Corporations Act 2001, scoped: directors' and officers' duties (care and diligence, good faith, use of position and information, material personal interests, indemnities, insolvent trading and the safe harbour, employee entitlements), financial and sustainability reporting and audit, continuous disclosure, and the core financial services obligations of AFS licensees (licensing, efficiently honestly and fairly, breach reporting and remediation, FSG, SOA, best interests, conflicted remuneration, client money, hawking, design and distribution, PDS and product intervention). The rest of the Act is not built.

Australia's Disability Discrimination Act: no disability discrimination in work, education, premises, goods and services, accommodation, clubs, sport and Commonwealth programs, reasonable adjustments unless unjustifiable hardship, compliance with the disability standards, and no harassment or victimisation.

Australia's Disability Standards for Education: how schools, training and higher education providers, and from August 2026 early childhood services, must enable students with disability to enrol, participate, access curriculum and support services through consultation and reasonable adjustments, and prevent harassment.

The modern award setting minimum employment conditions for electrical, electronic and communications contracting in Australia: coverage, employment types, apprentices, classifications, ordinary hours and rostered days off, minimum rates, allowances (tools, travel, fares, distant work, licences), overtime, shiftwork, leave, consultation, disputes, termination and redundancy. Rates are named, not quoted: the figures change every 1 July.

The employer duties of Australia's Fair Work Act 2009: the National Employment Standards (hours, flexible work, casual conversion, parental, annual, personal, compassionate, family and domestic violence and community service leave, public holidays, superannuation, notice and redundancy pay), award and agreement compliance, individual flexibility arrangements and bargaining, wages and deductions, pay secrecy, fixed term contract limits, the right to disconnect, general protections and sham contracting, sexual harassment, mass dismissal notices, record-keeping and pay slips, and the personal liability of directors, managers and advisers involved in contraventions, with franchisor and holding company responsibility. Scoped to employer duties; the rest of the Act is not built.

Australia's Food Standards Australia New Zealand Act 1991: how FSANZ develops and varies the Food Standards Code and the duties of anyone who applies to change a standard, from the application format, justification, safety data and confidentiality claims to the cost-recovery charge and FSANZ's information requests. The Code's standards themselves bind food businesses through State, Territory and New Zealand food laws.

The Food Standards Code's gateway standard: how the Code applies and is enforced, and the basic requirements every food for sale must meet, including composition, prohibited and pre-approval foods, permitted additives and processing aids, the 2026 retail caffeine rules, labelling, packaging safety, microbiological limits, imported food, named foods, handling, records and ingredient purity.

Standard 1.2.1 of the Food Standards Code: when packaged and unpackaged food for sale must carry a label or have information provided, the content that retail, caterer and other sales labels must show, the ban on defacing labels and on advertising what a label cannot say, and the English, legibility and minimum type size rules.

Standard 1.2.10 of the Food Standards Code: declaring the proportion of characterising ingredients and components on food labels.

Standard 1.2.2 of the Food Standards Code: how to name a food on its label, when lot identification may be left off, and what supplier details are required.

Standard 1.2.3 and Schedule 9 of the Food Standards Code: mandatory advisory statements, the laxative effect statement, the royal jelly warning and the plain English allergen declaration rules.

Standard 1.2.4 of the Food Standards Code: the rules for the statement of ingredients on packaged food labels.

Standard 1.2.5 of the Food Standards Code: date marking of packaged food, the use-by sale ban, and the wording and format of dates.

Standard 1.2.6 of the Food Standards Code: storage condition statements and directions for use required on food labels.

Standard 1.2.7 of the Food Standards Code: the rules for nutrition content claims, health claims and endorsements on food labels and in advertising.

Standard 1.2.8 of the Food Standards Code: nutrition information panel requirements for packaged food.

The Australian food standard that obliges priority-classified food businesses to run a written, HACCP-based food safety program: hazard examination of every operation, a program kept on site and followed, annual review, approved-auditor audits at the assigned frequency, records available to auditors and four years of audit reports retained.

Australian food safety standard setting what every food business and food handler must do: skills and knowledge, notifying the enforcement agency, safe receipt, storage, cooking, cooling, reheating, display, packaging, transport, disposal and recall of food, food handler health and hygiene, handwashing facilities, cleaning and sanitising, maintenance, thermometers, single use items, and animals and pests. Applies in Australia only.

Australian food safety standard, in force from 8 December 2023, requiring caterers, food service and retail businesses that handle unpackaged, potentially hazardous, ready-to-eat food to train food handlers, appoint a certified food safety supervisor, and (for category one businesses) keep 3 months of records, or be able to demonstrate, their temperature control, cooking, cooling, reheating and sanitising. Applies in Australia only.

Australian food safety standard for food premises, equipment and food vehicles: design and space, pest proofing, potable water, sewage, garbage storage, ventilation, lighting, cleanable floors, walls and ceilings, food grade equipment, connected services, handwashing basins, storage for chemicals and personal items, staff toilets and cleanable food vehicles. Applies in Australia only.

The Australian food standard that makes hospitals, aged care, hospices, dialysis and chemotherapy day centres, child care centres and delivered meals organisations serving six or more vulnerable persons run a written, audited HACCP-based food safety program under Standard 3.2.1.

Australia's mandatory Franchising Code of Conduct (2024 Regulations, in force from 1 April 2025): good faith, disclosure documents and the consideration period, materially relevant facts, prohibited and required agreement terms, capital expenditure, transfer, cooling off and termination, marketing funds, dispute resolution and the Franchise Disclosure Register.

The Insurance Council of Australia's General Insurance Code of Practice (2020 Code as updated): the subscriber's commitment to honest, efficient, fair, transparent and timely dealing, conduct and training standards for employees, distributors and service suppliers, plain language, target market and no-pressure selling, renewal reminders and premium comparisons, refunds and instalment cancellation notices, the claims process with its ten-business-day, twenty-business-day, four-month and twelve-month timeframes, fast-tracking for urgent financial need, expert and investigator appointments, written denial reasons and access to information, catastrophe response and review rights, support for customers experiencing vulnerability including family violence, interpreters and mental health, financial hardship with recovery on hold and twenty-one-day decisions, complaints handling within forty-five days with AFCA, Code Governance Committee monitoring, sanctions and significant breach reporting, and the claims investigation, interview and surveillance standards.

The modern award setting minimum employment conditions in Australian general retail: coverage, employment types, part-time guaranteed hours, casual loading, classifications, hours and rostering, breaks, minimum rates, allowances, overtime, penalty rates, shiftwork, leave, workplace delegates, consultation, disputes and termination. Rates are named, not quoted: the figures change every 1 July.

Australia's national guidance for responsible AI governance and adoption (National AI Centre, October 2025): six essential practices (decide who is accountable, understand impacts, measure and manage risks, share essential information, test and monitor, maintain human control) set out as 74 implementation practices for developers and deployers. It replaces the Voluntary AI Safety Standard and evolves the 2019 AI Ethics Principles.

Australia's Approval Principles for accredited pathology laboratories under the Health Insurance Act 1973: the conditions for Medicare-eligible laboratory approval, the GX, GY, B, M and S categories, the designated person's direction, control and supervision duties, and the NPAAC accreditation materials incorporated as relevant standards.

Australia's national law for the 16 regulated health professions: who may register and use protected titles, what practitioners must do to stay registered (CPD, insurance, recency, notices to the Board), advertising limits including the testimonial ban, and the mandatory notification, prohibition order, anti-reprisal and non-disclosure agreement duties that fall on practitioners, employers and education providers. NSW and Queensland replace or modify the complaints part.

The modern award for allied health professionals and health support services staff in Australia: coverage, part-time and casual terms, the October 2026 Health Professional classification by AQF level and experience, practice-specific hours, rostering, breaks, minimum rates, annualised wages, allowances, on-call, overtime, weekend and shift penalties, leave, consultation and termination. Rates are named, not quoted.

The chain-of-responsibility primary duty, the driver's duty not to drive while fatigued or unfit, the standard/alternative-compliance/exemption work and rest hours options, the duty of employer, prime contractor, operator and scheduler on an option change, and the work diary duty, from Chapter 6 (and the Chapter 1A primary duty) of the Heavy Vehicle National Law, the schedule to the Heavy Vehicle National Law Act 2012 (Qld), applied nationally except Western Australia and the Northern Territory. The Heavy Vehicle (Fatigue Management) National Regulation and the National Heavy Vehicle Accreditation Scheme's Basic/Advanced Fatigue Management business rules provide the detailed means of compliance and are not built as separate leaves this run.

The modern award setting minimum employment conditions in Australian hotels, accommodation, catering, bars and casinos: part-time guaranteed hours and availability, casual loading, rostering limits, meal breaks and the missed-break penalty, minimum rates, annualised wages and loaded rates, allowances, overtime, penalty rates, public holidays, deductions for meals and accommodation, consultation and termination. Rates are named, not quoted: the figures change every 1 July.

The Australian Signals Directorate's requirements for IRAP assessments: the 46 IRAP Assessment Requirements of the IRAP Common Assessment Framework, grouped under the seven quality standards ASD appraises reports against (report quality and terminology, assessment process and frameworks, evidence gathering, coverage, objectivity, technical accuracy and completeness, assessment integrity), and the assessment-conduct duties of IRAP Policy and Procedures (June 2026). IRAP assessments of cloud services, outsourced ICT and gateways are mandatory under the PSPF; the requirements bind the endorsed assessor who performs them.

The entity duties of a general insurer authorised under Australia's Insurance Act 1973 (Cth): authorisation and its conditions, fit and proper directors, senior managers, auditors and actuaries, auditor and actuary appointment and non-interference, compliance with APRA's prudential standards and directions, actuarial investigation of liabilities, accounting records, and notification and lodgement duties to APRA.

The duties in Australia's Insurance Contracts Act 1984 for insurers and insureds: utmost good faith (a civil penalty for insurers, including claims handling), the consumer duty to take reasonable care not to misrepresent, the business duty of disclosure and the insurer's notice of it, the statutory remedies for misrepresentation and non-disclosure, Key Facts Sheets, the ban on genetic test information in life underwriting from 8 October 2026, void terms, standard cover, unusual terms and flood notices, claims rules, claims interest, renewal and cancellation, subrogation limits, policy documents and written reasons.

The Australian life insurance industry's conduct code: product design and medical definition reviews, honest advertising and documented sales rules, plain-language documents and notices, proportionate underwriting with mental health, genetic and HIV safeguards, claims decided in two or six months with controlled interviews and surveillance, support for vulnerable and hardship-affected customers, thirty-day complaint responses, and compliance reporting and significant breach notification to the Life Code Compliance Committee.

Medicare Benefits Schedule rules for allied health assessment and treatment of under-25s with autism or another complex neurodevelopmental disorder or an eligible disability (items 82000 to 82035 and telehealth equivalents), from the provider's side.

The Safe Work Australia model code of practice for construction work: principal contractors, designers and commissioning clients, safe work method statements for high risk construction work, WHS management plans, white card and site induction, site security, excavation and general workplace arrangements. Guidance, not law: once a jurisdiction approves it under WHS Act s 274 it is admissible evidence of what is reasonably practicable (s 275).

Safe Work Australia's model code for excavation work: planning and consultation, managing risks of ground collapse, trenches and shoring, underground and overhead essential services, falls into excavations, plant near the edge, hazardous atmospheres, safe work method statements and emergency plans.

The Safe Work Australia model code of practice on hazardous manual tasks: managing the risk of musculoskeletal disorders from force, repetitive movement, awkward or sustained posture and vibration, through identification, assessment, controls (purchasing, workstation design, mechanical aids, people and animal handling, workload, environment, rotation and breaks), review and the duties of designers, manufacturers, importers and suppliers. Guidance, not law: once a jurisdiction approves it under WHS Act s 274 it is admissible evidence of what is reasonably practicable (s 275).

The Safe Work Australia model code of practice for the healthcare and social assistance industry: who holds WHS duties (including contracted, platform and sole trader arrangements), the priority of worker safety over patient or client preference, the risk management process, and the hazard groups of hazardous manual tasks and people handling, fatigue, psychosocial hazards, violence and aggression, biological hazards, hazardous chemicals and cytotoxic drugs, the work environment and private homes, slips, trips and falls, equipment, vehicles and electrical hazards. Guidance, not law: once a jurisdiction approves it under WHS Act s 274 it is admissible evidence of what is reasonably practicable (s 275).

The Safe Work Australia model code of practice on managing work health and safety risks at any workplace: duty holders, consultation, the four step process (identify hazards, assess risks, control risks, review controls), the hierarchy of control measures, implementation and record keeping. Guidance, not law: once a jurisdiction approves it under WHS Act s 274 it is admissible evidence of what is reasonably practicable (s 275).

The Safe Work Australia model code of practice on managing psychosocial hazards at work: the PCBU's duty to eliminate or minimise psychosocial risks, officer due diligence, consultation, hazard identification (job demands, control, support, role clarity, change, recognition, organisational justice, trauma, remote work, environment, violence, bullying, harassment, conflict), risk assessment, controls, review, records and investigations. Guidance, not law: once a jurisdiction approves it under WHS Act s 274 it is admissible evidence of what is reasonably practicable (s 275).

The Safe Work Australia model code of practice on managing risks of hazardous chemicals in the workplace: the PCBU's duties under Part 7.1 of the WHS Regulations, the register and manifest, safety data sheets and labels, health and physical risk assessment, the hierarchy of control, health monitoring, emergency planning and fire protection, and storage guidance for gases, flammable liquids, oxidisers, organic peroxides and corrosives. Guidance, not law: once a jurisdiction approves it under WHS Act s 274 it is admissible evidence of what is reasonably practicable (s 275).

The Safe Work Australia model code of practice on preventing falls from height at any workplace: duty holders, consultation, training, safe design, hazard identification, the ordered controls (ground or solid construction, fall prevention devices, work positioning, fall arrest, administrative controls), ladders and rescue. Guidance, not law: once a jurisdiction approves it under WHS Act s 274 it is admissible evidence of what is reasonably practicable (s 275).

The Safe Work Australia model code of practice on managing the risks of plant in the workplace: duty holders and consultation, hazard identification and assessment, the hierarchy of control, and controls from purchase or hire through installation, use, change, inspection, maintenance, storage and disposal, with guarding, emergency stops, warning devices, energy isolation, roll-away prevention, plant registration and records. Guidance, not law: once a jurisdiction approves it under WHS Act s 274 it is admissible evidence of what is reasonably practicable (s 275).

The Safe Work Australia model code of practice on managing the work environment and facilities: entry and exit, work areas, workstations, floors, lighting, ventilation, heat and cold, toilets, drinking water, washing, eating, storage, change rooms, showers, remote and isolated work, accommodation and emergency plans. Guidance, not law: once a jurisdiction approves it under WHS Act s 274 it is admissible evidence of what is reasonably practicable (s 275).

The Safe Work Australia model code of practice on safe design of structures: duties of designers and clients, designing out hazards across the structure's lifecycle (construction, use, maintenance, modification, demolition), consultation and information transfer, and integrating risk management into each design phase. Guidance, not law: once a jurisdiction approves it under WHS Act s 274 it is admissible evidence of what is reasonably practicable (s 275).

The Safe Work Australia model code of practice on consulting workers and their representatives on work health and safety, and on consulting, cooperating and coordinating with other duty holders who share responsibility for the same matter: when to consult, what effective consultation is, health and safety representatives and committees, contractors and labour hire. Guidance, not law: once a jurisdiction approves it under WHS Act s 274 it is admissible evidence of what is reasonably practicable (s 275).

Safe Work Australia's model Work Health and Safety Regulations (as at 5 December 2025), the regulations every harmonised Australian jurisdiction adopts under its WHS Act: risk management and the hierarchy of controls, psychosocial risks, facilities, first aid and emergency plans, noise, manual tasks, confined spaces, falls, high risk work licences, electrical safety, diving, plant, construction work and SWMS, hazardous chemicals, engineered stone, lead, asbestos and major hazard facilities. A model law, effective through each jurisdiction's regulations.

The My Health Records Act 2012 establishes the legal framework for Australia's national digital health record system (My Health Record). Managed by the Australian Digital Health Agency, it enables individuals and healthcare providers to access a summary of health information online. The system operates on an opt-out basis (since 2018). The Act establishes strict access controls, penalties for misuse, and governance by the System Operator.

The NDIS Code of Conduct: the conduct rules that bind every NDIS provider, registered or not, and every worker and key person, covering rights, privacy, safe and competent supports, integrity, raising concerns, preventing abuse and sexual misconduct, and fair pricing of goods.

The NDIS rules that set what a registered NDIS provider's complaints management and resolution system must provide, and how the NDIS Quality and Safeguards Commission receives, triages, resolves and reconsiders complaints about NDIS providers.

The NDIS rules that set what a registered NDIS provider's incident management system must contain and how reportable incidents are notified to the NDIS Quality and Safeguards Commission (24 hours for deaths, serious injury, abuse, neglect, assault and sexual misconduct; 5 business days for others), updated, reported on and recorded.

The NDIS Practice Standards and every quality indicator registered NDIS providers are audited against: the Core module and the supplementary modules for high intensity supports, behaviour support, early childhood, support coordination, SDA and supported independent living (new from 1 July 2026), plus verification, one leaf per indicator with what an approved quality auditor asks to see.

NDIS pricing obligations for providers and plan managers in 2026-27: the maximum amounts made binding by the 2026 Pricing Determination, claim periods and records, and the claiming rules for items, time bands, travel, cancellations, reports, groups, fees and prepayments.

NDIS provider registration: when registration is mandatory (including supported independent living and digital platforms from 1 July 2026), suitability, audits, conditions of registration, notices of change and ownership events, platform duties, records, complaints, incidents, whistleblowers and banning orders.

The NDIS Commission's list of qualifications, registrations and professional memberships providers must evidence for each profession delivering NDIS supports, including every therapy profession.

NDIA and NDIS Commission guidance on what quality early childhood intervention, therapy and behaviour support for children looks like, and what providers must never do: checks, registration, code of conduct, family-centred practice and positive behaviour support.

Australia's 2016 NDIS Quality and Safeguarding Framework: the intergovernmental policy behind the NDIS Commission, the code of conduct, worker screening, incident and complaints systems and tiered provider registration. Policy, not law.

The NDIS registration conditions on providers that use regulated restrictive practices (seclusion and chemical, mechanical, physical and environmental restraint) and on specialist behaviour support providers who write and lodge behaviour support plans.

NDIS worker screening rules for registered providers: identify risk assessed roles, only cleared workers and agency staff in those roles, supervised exceptions and no card, no start, a risk management plan for pending applicants, and seven-year screening records.

The Australian National Health and Medical Research Council (NHMRC) National Statement on Ethical Conduct in Human Research (2007, updated 2018) sets out the ethical framework for research involving humans. It covers consent, privacy, data management, governance, and the role of Human Research Ethics Committees (HRECs). Compliance is mandatory for NHMRC-funded research and widely adopted across Australian research institutions. Key principles: research merit, justice, beneficence, and respect for persons. Specifically addresses data governance, biobanks, genetic research, and Aboriginal and Torres Strait Islander research.

The two registration standards shared by Australia's National Boards: the Criminal history standard in force from 15 July 2026 and the English language skills standard in force from 18 March 2025, as duties for applicants and registered practitioners.

The Building Code of Australia volume for houses and other Class 1 buildings, garages, sheds, fences, retaining walls, swimming pools and private bushfire shelters (Class 10): the Performance Requirements for structure, damp and weatherproofing, fire safety, health and amenity, safe movement, energy efficiency, pools, heating appliances, alpine and bushfire construction and livable housing, how each is met by a Deemed-to-Satisfy route or a Performance Solution, the evidence of suitability required, and every State and Territory variation. NCC 2022 with Amendments 1 and 2; NCC 2025 replaces it from 1 May 2026 in some jurisdictions and 1 May 2027 in others.

NCC 2025 Volume One, Building Code of Australia, Class 2 to 9 Buildings: the Governing Requirements (Section A, 7 leaves), the Performance Requirements of Sections B (structure), C (fire resistance), D (access and egress), E (services and equipment), F (health and amenity), G (ancillary provisions) and J (energy efficiency), headline Deemed-to-Satisfy clauses where the Deemed-to-Satisfy provision is the de facto obligation (Parts B1, C2, D2, E1 to E3, F1, F2, F8, I1 to I3 and J4 to J9), and the State and Territory Performance Requirement additions and substitutions of Schedules 4 to 11. Section I has no national Performance Requirements; there is no Section H in Volume One.

The Plumbing Code of Australia, 2025 edition: Performance Requirements and Deemed-to-Satisfy routes for cold, heated, non-drinking, fire-fighting and rainwater services, cross-connection control, sanitary plumbing and drainage, on-site wastewater management, plumbing noise and facilities for people with disability, the evidence of suitability for plumbing products (WaterMark) and every State and Territory variation. Replaces NCC 2022 Volume Three as each jurisdiction adopts it.

The Building Code of Australia volume for houses and other Class 1 buildings, garages, sheds, fences, retaining walls, swimming pools and private bushfire shelters (Class 10), 2025 edition: the Performance Requirements for structure (now including component reliability), damp and weatherproofing, fire safety, health and amenity, safe movement, energy efficiency, pools, heating appliances, alpine and bushfire construction and livable housing, how each is met by a Deemed-to-Satisfy route or a Performance Solution, the evidence of suitability required, and every State and Territory variation. Replaces NCC 2022 Volume Two as each jurisdiction adopts it.

Australia's National Consumer Credit Protection Act: the licensing and general conduct obligations of credit licensees, breach reporting, responsible lending assessments by brokers and lenders, disclosure, mortgage broker best interests, and the key National Credit Code duties on precontractual disclosure, statements, hardship and default.

The Code that governs every regulated consumer credit contract, consumer lease, mortgage and guarantee in Australia: how contracts are formed and what they must disclose, what fees and interest can be charged, statements of account, change notices, the hardship process, default notices and the steps a lender must take before and after enforcing or repossessing, linked credit and insurance protections, advertising and comparison rates, and the parallel rules for consumer leases.

The NDIS Act's duties on NDIS providers and registered NDIS providers: registration and its conditions, the Practice Standards and Code of Conduct, complaints and incident management, reportable incidents under s 73Z, discloser protection, worker screening links with aged care, record keeping, and compliance with NDIS Commission notices, banning and anti-promotion orders.

The joint framework of the Australian, state and territory governments for assuring AI used in government (version 1.0, June 2024): five cornerstones (governance, data governance, a risk-based approach, standards, procurement) and 27 practices that put Australia's eight AI Ethics Principles into practice across the development, procurement and deployment of AI.

Australia's National Pathology Standards, First Edition 2027: the eleven accreditation standards and eighty-eight actions a pathology practice must meet under the National Pathology Accreditation Scheme, from clinical governance and supervision by laboratory category to specimen collection, testing quality, medical devices including AI, and point of care testing.

The National Principles for Child Safe Organisations: ten principles and 42 key action areas for any organisation engaging with children, from leadership, participation and family involvement to screening, complaints, training, safe environments, review and policies.

The 40 elements of the National Quality Standard across 7 quality areas for approved education and care services, as revised from 1 January 2026, with the National Law and Regulations the ACECQA Guide links to each element. ACECQA guidance, not law.

Australia's mandatory hospital and day procedure accreditation standards: the eight NSQHS Standards (second edition) and their 148 actions on clinical governance, partnering with consumers, infection prevention and control and antimicrobial stewardship, medication safety, comprehensive care including pressure injury, falls, nutrition, cognitive impairment, self-harm, aggression, restraint and end-of-life care, communicating for safety, blood management, and recognising and responding to acute deterioration.

Australia's National Vocational Education and Training Regulator Act 2011, the law under which ASQA registers and regulates training providers and accredits courses: the conditions of registration every NVR registered training organisation must meet, the offences on scope, advertising, misleading claims and issuing qualifications, executive officer liability, student records at closure, and the data provision and financial viability requirements of the VET Quality Framework, including the quarterly data reporting that begins with the 2026 amendments.

Registration standards of the Occupational Therapy Board of Australia for CPD, professional indemnity insurance and recency of practice (from 1 December 2019).

Australia's Online Safety Act 2021 as in force from 12 September 2026: the duties it places on social media, messaging, gaming, website, hosting, search, app store and internet service providers and on end-users, from the basic online safety expectations and their reporting notices, the under-16 social media minimum age obligation with its privacy limits, and the 24-hour removal notices for cyber-bullying, intimate images, adult cyber-abuse and class 1 and 2 material, to blocking, link deletion and app removal notices, the registered industry codes and standards, and the Commissioner's information and examination powers. 35 leaves read against the authorised compilation.

The Finance Minister's delegations under section 107 of Australia's PGPA Act to the accountable authorities of non-corporate Commonwealth entities and to the Finance Secretary, with the binding directions on banking, overseas accounts and overdrafts, credit cards, investment, indemnities, guarantees and warranties, debt waivers, postponement and instalments, act of grace payments and gifts of relevant property.

Registration standards of the Physiotherapy Board of Australia: CPD, professional indemnity insurance, recency of practice and the three limited registration standards.

The modern award setting minimum employment conditions for plumbing and fire sprinkler work in Australia: coverage, employment types, apprentices, classifications, ordinary hours and rostered days off, minimum rates, allowances (tools, travel, fares, distant work, licences, special allowances), overtime, shiftwork, leave, consultation, disputes, termination and redundancy. Rates are named, not quoted: the figures change every 1 July.

The Digital Transformation Agency's mandatory policy for Australian Government agencies' use of AI, version 2.0: a public transparency statement, accountable officials and use case owners, an internal use case register shared with the DTA, an operationalisation approach with incident pathways, mandatory staff training, design-stage scoping and impact assessment of every AI use case, and board-level governance with DTA reporting for high-risk uses.

The binding code that particularises Part IIIA of the Privacy Act for Australia's credit reporting system: what credit providers must tell people at collection, how repayment history, hardship, default and serious credit infringement information must be calculated, notified and reported, the fraud ban and ban notification service, free access and credit ratings, the correction and complaints timetables, record keeping, and the credit reporting bodies' monitoring, audit, reporting and review duties.

Registration standards of the Psychology Board of Australia: general and provisional registration (from 1 December 2025), area of practice endorsement, CPD, professional indemnity insurance and recency of practice, as duties for psychologists.

The Commonwealth instrument that makes the Defence Delivery Agency a listed entity from 1 July 2027, names the National Armaments Director as accountable authority, lists four classes of official and sets six purposes. The duties that follow come from the PGPA Act and the PGPA Rule.

Australia's PGPA Rule, the Finance Minister's rules under the PGPA Act: fraud and corruption control, debt recovery, disclosure of material personal interests, corporate plans and performance measures, annual performance statements, audit committees, annual report content and executive remuneration disclosure for Commonwealth entities and companies, commitments and banking of relevant money, corporate entity indemnity and insurance limits, ministerially approved CCE grants, and other CRF money arrangements.

Australia's R&D Tax Incentive: who can claim, what counts as core and supporting R&D and what is excluded, annual registration with AusIndustry within 10 months of year end, overseas and core technology findings, which expenditure and assets count, how the refundable and non-refundable offsets are worked out, the integrity and clawback rules for related parties, grants, feedstock and asset disposals, and the records a claimant must keep; with the September 2026 reform exposure draft recorded as pending.

The ACMA-registered industry code that obliges Australian carriers and carriage service providers to identify, trace, block and report scam voice calls and scam SMs: CLI accuracy and anti-spoofing, Sender ID vetting, network monitoring, the inter-provider notification chain with the ACMA copied, blocking and unblocking, device restriction, engaging international operators, stopping call-back scams and quarterly reporting.

Australia's Scams Prevention Framework in Part IVF of the Competition and Consumer Act: governance, prevent, detect, report, disrupt and respond duties on banks, telecommunications carriers and large digital platforms, with the regulated entity tests, safe harbour, dispute resolution and phased start.

Australia's law on commercial email and SMS: consent before sending, no messages to non-existent addresses, clear sender identity and contact details, a free, login-free unsubscribe facility that works for 30 days, opt-outs honoured within 5 business days, no address harvesting, and liability for anyone knowingly involved.

The Standards for Registered Training Organisations (RTOs) 2015, the prior edition repealed on 1 July 2025: every clause of the eight Standards with what an ASQA or VRQA auditor asked to see, each linked to its successor in the Standards for RTOs 2025 for RTOs whose policies and evidence were written to the 2015 clauses.

Australia's standards every registered training organisation must meet from 1 July 2025: the Outcome Standards for training, assessment, validation, student support, workforce and governance; the Compliance Requirements for marketing, certification, records, notifications, third parties, fee protection and insurance; the fit and proper person checks on the RTO and its governing persons; the NRT logo rules; and the Credential Policy setting which training credentials trainers, assessors, directing staff and validators must hold.

The Standards for VET Accredited Courses 2021: the rules an accredited course must meet to be accredited, renewed and kept by ASQA (and by VRQA and TAC), binding the course owner as a condition of accreditation: no duplication of Training Packages, an established need, units of competency, AQF alignment, assessment and delivery requirements, resourcing, and ongoing monitoring.

The entity and trustee duties under Australia's Superannuation Industry (Supervision) Act 1993 (Cth): the full trustee and director covenant set including the best financial interests, investment, insurance and risk management duties and the retirement income strategy; the sole purpose test; related-party dealing, borrowing and in-house asset limits; arm's length dealing; RSE licence conditions and MySuper authority; governance structure; and notification to APRA and the Commissioner of Taxation.

The Commonwealth law that registers and regulates tax agents and BAS agents: registration requirements, the Code of Professional Conduct and its 2024 Determination (integrity, conflicts, confidentiality, competence, records, quality management, client disclosure), breach and change notifications, disqualified entities and prohibited unregistered conduct.

The ACMA standard that prescribes how Australian telecommunications providers handle consumer complaints: an executive-approved, accessible complaints process, acknowledgement and resolution time limits, escalation and TIO rights, a separate network outage complaints regime added in 2025, quarterly analysis, two-year records, and reasonable assistance duties on wholesale providers and carriers.

The ACMA standard that obliges Australian telecommunications providers to help residential, small business and not-for-profit customers in financial hardship: a published payment assistance policy, early identification, evidence-light assessment within five business days, at least six tailored options, written arrangements, no charges, and a bar on disconnection and debt sale while a customer is protected.

The ACMA-registered industry code that binds Australian telecommunications providers in their dealings with residential and small business consumers: advertising and the Critical Information Summary, responsible selling and contracts, bill content and accuracy, direct debit, credit assessment, usage notifications, restriction and disconnection notices, fair debt collection, changing suppliers, and the annual compliance attestation to Communications Compliance.

Australia's Therapeutic Goods (Medical Devices) Regulations 2002: the essential principles, classification rules and conformity assessment procedures for medical devices and IVDs, the automatic conditions on ARTG entries (adverse event reporting periods, complaint and distribution records, annual reports), exemption and clinical trial conditions, mandatory healthcare facility reporting and the unique device identification rules.

Australia's Therapeutic Goods Act 1989, built around medical devices, sponsor obligations and advertising: ARTG inclusion and certification, automatic and imposed conditions, conformity assessment, adverse event, tampering and medicine shortage reporting, recalls, manufacturing licences, advertising controls, counterfeit goods and the offences, civil penalties and executive officer liability that enforce them.

Australia's Commonwealth Work Health and Safety Act 2011, the enactment of the model WHS Act: the primary duty of care of every person conducting a business or undertaking, the upstream duties of designers, manufacturers, importers, suppliers and installers, officers' due diligence, incident notification, consultation, health and safety representatives and committees, issue resolution, protection from discrimination, and compliance with notices. The same duties sit under the same section numbers in the mirror Acts of NSW, Queensland, SA, Tasmania, the ACT, the NT and WA.

The Australian eSafety Commissioner, established under the Online Safety Act 2021, has regulatory powers to protect Australians from online harms. Key instruments include: Basic Online Safety Expectations (BOSE) for online services, mandatory industry codes and standards, cyberbullying schemes, image-based abuse schemes, and online content schemes. The eSafety Commissioner can issue removal notices for seriously harmful content, conduct investigations, and impose penalties. BOSE requires services to take reasonable steps to ensure safety, implement reporting mechanisms, and provide transparency about safety measures. Specific focus on child safety online.

Australia's national welfare and security standard for animals kept for exhibition (zoos, wildlife parks and display facilities): the General standard's duties on operators for staffing and proficient keepers, perimeter and enclosure security, escapes and emergencies, enclosure design and space, holding enclosures, diet and water, health programs, enrichment and quarantine, breeding plans, euthanasia, capture, training, interactive programs, transport and records, plus the taxon standards for crocodilians, koalas, macropods, ratites and wombats (enclosure dimensions, diet, handling and interaction limits, transport). Implementation into law is for each state and territory.

The national welfare standard for goats across every Australian enterprise type, from harvested rangeland goats to intensive, dairy and fibre systems, developed by the Goat Industry Council of Australia with Animal Health Australia and current at Version 4 (May 2026): duty of care, feed and water, risk management and inspection, facilities, handling and prodder restrictions, castration, disbudding and horn tipping with vet-prescribed pain relief, breeding, dairy and intensive-system duties, annual shearing and humane killing. Built from the complete current text, read in full. Implementation into law is for each state and territory.

Australia's national welfare standard for the land transport of livestock by road, rail and ship, built in full: the cross-species general standards (Part A: chain of responsibility, competence, vehicle and facility construction, fitness for the intended journey, time off water and loading density, handling restrictions, in-journey inspection, extreme weather, humane destruction) and the species standards (Part B: water-deprivation ceilings, spells and extended-journey conditions, late-pregnancy and young-animal rules, and species handling, vehicle and container requirements for alpacas, buffalo, camels, cattle, deer, emus and ostriches, goats, horses, pigs, poultry and sheep). Built from the complete current text, read in full. Adopted into law by states and territories to varying degrees; Tasmania's adopting regulations are confirmed.

Australia's national welfare standard for poultry (chickens, ducks, emus, geese, guinea fowl, ostriches, partridges, pheasants, pigeons, quail and turkeys): the general duties on everyone keeping or rearing poultry (feed and water, inspection and health, fire and contingency planning, housing, outdoor areas, lighting, ventilation, litter, handling and physical alterations, hatchery practice, humane killing) and the species chapters' housing, nest, perch, carrying and stocking-density requirements, including the dated phase-in obligations for lighting, ammonia, substrate, range use and the layer cage system. Built from the complete DAFF text, read in full. Transport and slaughter are covered by separate instruments. Implementation into law is for each state and territory.

Australia's national consumer protection law, Schedule 2 to the Competition and Consumer Act 2010: misleading and unconscionable conduct, unfair contract terms, false representations and pricing rules, consumer guarantees and their remedies, door-to-door and telephone sales, lay-by, gift cards, receipts, warranty and repair notices, product safety standards, bans, recalls and 2-day serious injury reporting.

Obligations and conditions in the Copyright Act 1968 (Cth) that bind educational institutions and the bodies administering them: the statutory licence, remuneration notices, the s 200AB special case exception, classroom performance, orphan works and online service provider conditions. Scoped; the rest of the Act is not built.

The consignor and transport duties of the Australian Dangerous Goods Code: classification and shipping name selection, packing in tested compatible packagings, package marking and hazard labelling, placarding of vehicles and bulk units at the Table 5.3 thresholds, stowage and segregation, bulk transfer safeguards, the transport document and emergency information carried in the cabin, vehicle fire extinguishers and PPE, and the rules for breakdowns, parking, unloading, trailers and routes.

The Australian Education Act's conditions of Commonwealth school funding: what approved authorities, block grant authorities, non-government representative bodies and States and Territories must do on approval, curriculum, national assessment, information and census, use of funding, compliance monitoring, needs-based funding arrangements and State contributions.

Commonwealth regulations setting the conditions and reporting duties for school funding under the Australian Education Act 2013: eligibility of approved authorities, spending rules, annual certificates and reports, records, access for authorised persons, curriculum, national assessments, census and data returns, student reports and public information.

Obligations on registered CRICOS providers under the Education Services for Overseas Students Act 2000 (Cth) and Standards 1 to 11 of the National Code 2018, including the Overseas Student Transfers amendment in force from 2 October 2026. Registration, TPS governance and enforcement machinery are not built.

The Australian Energy Sector Cyber Security Framework (AESCSF), maintained by AEMO with the ACSC, is the energy sector's cyber security maturity model for electricity, gas, liquid fuels and distributed energy participants. Version 2 (2023) has 354 practices and anti-patterns in 11 domains built on the US DOE C2M2 V2.1 with an Australian privacy domain, scored by Maturity Indicator Level and by ACSC Security Profiles set from an organisation's criticality, and is named in SOCI Act risk management program rules as a recognised cyber framework.

The Australian Government's data governance framework for public service agencies (Department of Finance, September 2025): seven key aspects of data governance (strategy and planning, privacy and safeguarding, organisational structures and the four key data roles, leadership, culture, technology, data utilisation) and a 20-item checklist for an agency's data governance strategy or statement.

ACSC Information Security Manual. Australian Government cybersecurity controls baseline.

The 13 Australian Privacy Principles form the cornerstone of the privacy protection framework in the Privacy Act 1988, regulating how organisations and agencies handle personal information.

Austria's Data Protection Act (Datenschutzgesetz, DSG) as amended in 2018 supplements the EU GDPR with national provisions. The Datenschutzbehörde (DSB - Austrian Data Protection Authority) oversees enforcement. The DSG retains a constitutional right to data protection (Section 1 DSG has constitutional rank). Notable provisions include the age of digital consent (14 years), broad research derogations, specific rules for image processing (Bildaufnahme), and administrative and criminal penalties. Austria's data protection has constitutional status since 2000.

Authorised Economic Operator (AEO) programmes are globally implemented supply chain security and trade facilitation initiatives based on the WCO SAFE Framework. Over 97 countries operate AEO programmes. AEO status is granted to economic operators (importers, exporters, customs brokers, carriers, warehouse operators) that demonstrate compliance with customs requirements, financial solvency, and supply chain security standards. Mutual recognition arrangements (MRAs) between countries provide reciprocal AEO benefits. Key programmes include EU AEO, US C-TPAT, Japan AEO, China AEO, and Australia Trusted Trader.

Automotive SPICE is the VDA Quality Management Center's process reference and assessment model for automotive system, software, hardware and machine learning engineering, built on the ISO/IEC 33020 measurement framework and assessed by intacs certified assessors. Version 4.1 (released 24 August 2026) revises 4.0 (2023) by removing MLE.2 BP5 with editorial changes. The graph models the 195 base practices of the 32 processes across 11 process groups and the 34 generic practices of the nine process attributes that carry capability levels 1 to 5.

The VDA's cybersecurity supplement to Automotive SPICE: six processes (ACQ.2, MAN.7, SEC.1 to SEC.4) whose 31 base practices an intacs assessor rates, from supplier selection and TARA-based risk management through cybersecurity goals, requirements, implementation, verification and validation, every leaf read in the complete free VDA document.

Azerbaijan's Law on Personal Data (No. 998-IIIQ of 11 May 2010, amended through 2024) governs collection, processing and protection of personal data by state bodies, companies and individuals. It requires written consent with prescribed content (since 2024 also through the Electronic Government Information System), declared purposes, special category and biometric safeguards, security measures and audit journals, answers to subject requests within 7 working days, registration of personal data information systems with the competent authority before processing, a licence to create such systems, and limits cross-border transfer to countries with equivalent protection unless the subject consents.

Microsoft Azure cloud security best practices and controls

The Basel Committee's Principles for effective risk data aggregation and risk reporting (BCBS 239, January 2013; Basel Framework chapter SRP36): governance of risk data with independent validation and board oversight, data architecture and IT infrastructure that work in stress, accurate, complete, timely and adaptable risk data aggregation, and accurate, comprehensive, clear, timely and well-distributed risk reports, for systemically important banks. 11 bank-facing Principles as leaves; the three supervisory Principles, scope and the Committee's 2023 finding that only two of 31 G-SIBs fully comply are recorded as context.

BIMCO's cyber security guidelines for ships (version 5, November 2024), produced with shipping industry associations, insurers, class and companies, help shipowners and managers build cyber risk management into the Safety Management System in line with IMO resolution MSC.428(98) and MSC-FAL.1/Circ.3, drawing on the NIST Cybersecurity Framework. They cover governance and roles (senior management, IT and OT differences, SMS and Ship Security Plan procedures, relationships with managers, agents and vendors), identifying threats and vulnerabilities, assessing likelihood and impact, a four-phase ship risk assessment, protection (defence in depth and breadth, technical and procedural measures), detection, contingency planning including disconnecting OT from shore, and response, recovery, investigation, insurance and incident reporting. They are guidance and expressly not a basis for external audit.

The BRCGS (Brand Reputation Compliance Global Standards) Global Standard for Food Safety Issue 9 (2022) is a GFSI-benchmarked food safety certification standard for food manufacturers. Originally developed by the British Retail Consortium. Over 30,000 certified sites in 130+ countries. Covers senior management commitment, HACCP, food safety and quality management systems, site standards, product control, process control, and personnel. Grades: AA, A, B, C, D (unannounced option gives higher grade). Published and managed by BRCGS (LGC ASSURE).

BREEAM (Building Research Establishment Environmental Assessment Method) is the world's oldest green building certification scheme, established in 1990 by BRE Global. It assesses and certifies the sustainability performance of buildings across their lifecycle. Categories include management, health and wellbeing, energy, transport, water, materials, waste, land use and ecology, and pollution. Rating levels: Pass, Good, Very Good, Excellent, and Outstanding. Over 590,000 buildings certified in 90+ countries.

BS 65000:2014, published by BSI (British Standards Institution), provides guidance on organizational resilience encompassing an organisation's ability to anticipate, prepare for, respond and adapt to incremental change and sudden disruptions in order to survive and prosper. It provides a holistic approach integrating business continuity, risk management, crisis management, and security management. Describes the resilience journey from awareness through to adaptive resilience. Predecessor to ISO 22316.

German Federal Office for Information Security baseline protection

How to design and assess the control system of an automated vehicle: define the mission and the operational design domains, then design four operations (sensing, planning, control, monitoring) that each check themselves, report to an independent monitor and bring the vehicle to a controlled or emergency stop when they cannot be trusted; handle the four general vehicle hazards, resist cyber attack, stay effective, and evidence every objective. 51 guidance leaves read against the complete BSI/CCAV publication.

Building Security In Maturity Model

Bahrain Personal Data Protection Law

The Bank Secrecy Act (31 U.S.C. 5311-5332) and implementing regulations (31 CFR Chapter X) establish requirements for financial institutions to detect and prevent money laundering, terrorist financing, and other financial crimes. Key components include AML compliance programs, customer identification/due diligence, suspicious activity reporting, currency transaction reporting, and recordkeeping. Amended by USA PATRIOT Act (2001), CDD Rule (2016), and AML Act (2020).

The Barbados Data Protection Act 2019 (Cap. 380A) establishes a data protection framework for Barbados. The Data Protection Commissioner oversees compliance. The Act establishes processing principles, individual rights, and provisions for cross-border transfers. Modelled on Caribbean Community (CARICOM) model data protection legislation. Applies to the processing of personal data by controllers in Barbados.

The Basel Committee's Core Principles for effective banking supervision as revised in April 2024 (Basel Framework chapters BCP01 to BCP99): the 29 principles and their essential and additional criteria. Built for the bank side: the 16 principles on prudential regulations and requirements for banks (corporate governance, risk management, capital, credit, problem exposures and provisioning, concentrations and large exposures, related parties, country, market, banking book interest rate, liquidity and operational risk and resilience including ICT and third parties, internal control and audit, financial reporting, disclosure, and abuse of financial services) plus the reporting, notification and approval duties inside the supervisory principles; the supervisors' own powers and functions (Principles 1 to 13) are recorded as context.

The Basel III standards of the Basel Committee on Banking Supervision as consolidated in the Basel Framework (current text generated from bis.org on 26 September 2026): scope and G-SIB assessment (SCO), the definition of capital (CAP), minimum risk-based capital of 4.5% CET1, 6% Tier 1 and 8% total capital with the 72.5% output floor phased in to 2028 and the conservation, countercyclical and systemic buffers (RBC), credit risk under the standardised and IRB approaches, securitisation and counterparty credit risk (CRE), market risk and CVA (MAR), operational risk (OPE), the 3% leverage ratio (LEV), the liquidity coverage and net stable funding ratios (LCR, NSF), large exposures (LEX), margin for non-centrally cleared derivatives (MGN), the supervisory review process (SRP) and Pillar 3 disclosure (DIS). 56 leaves, one per requirement-bearing chapter or chapter group, each citing the Basel Framework paragraphs it restates; national implementation dates differ by jurisdiction.

Belgian Centre for Cybersecurity CyberFundamentals Framework

Belgium's Data Protection Act of 30 July 2018 supplements the EU GDPR with national provisions. The Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données, GBA/APD) oversees enforcement. The Act includes provisions for the age of digital consent (13 years), processing of national identification numbers (Rijksregisternummer/Numéro de registre national), journalistic exemptions, employment data, and administrative penalties. Belgium's DPA is notable for its Litigation Chamber and significant fine decisions.

The Bermuda Monetary Authority (BMA) Cyber Risk Management Code of Conduct (2020) establishes cybersecurity expectations for BMA-regulated entities including insurers, reinsurers, banks, and trust companies. Bermuda is a major international insurance and reinsurance hub. The Code covers cyber risk governance, risk management, incident response, third-party management, and reporting. Proportionate approach based on entity size, complexity, and cyber risk profile. Compliance monitored through BMA supervisory reviews and examinations.

Bermuda's Personal Information Protection Act 2016 (PIPA, substantially in force January 1, 2025) establishes a comprehensive privacy framework. The Privacy Commissioner for Bermuda oversees compliance. PIPA establishes processing principles, individual rights, mandatory breach notification, and provisions for cross-border transfers. Designed to support Bermuda's EU adequacy application for the insurance/reinsurance sector.

Bosnia and Herzegovina's Law on Protection of Personal Data (Official Gazette BiH No. 49/06, 76/11) establishes the data protection framework. The Personal Data Protection Agency of Bosnia and Herzegovina (AZLP) oversees enforcement. The law was modelled on the EU Data Protection Directive (95/46/EC). It covers processing principles, consent, data subject rights, cross-border transfers, and registration obligations. Amendments and alignment with GDPR have been under discussion as part of EU accession negotiations.

The Botswana Data Protection Act provides a comprehensive framework for the protection of personal data in Botswana. It establishes data protection principles, individual rights, obligations for data controllers and processors, and provisions for cross-border data transfers. Creates the Data Protection Commissioner to oversee implementation and enforcement.

Brazilian AI regulatory framework

Brazil's Open Finance framework, established by the Central Bank of Brazil (BCB) through Resolução Conjunta No. 1/2020 and subsequent regulations, creates one of the world's most comprehensive open financial data ecosystems. Mandatory for regulated financial institutions, it covers banking, insurance, investments, pensions, and foreign exchange data sharing. Phases implemented from 2021-2023. Uses standardised APIs managed by the Open Finance Brasil governance structure.

The Personal Data Protection Order (PDPO) 2022, issued under the Emergency (Prohibition of Certain Acts) Order, establishes a comprehensive data protection framework for Brunei Darussalam. The Authority for Info-communications Technology Industry (AITI) is designated as the data protection authority responsible for enforcement and compliance. The PDPO aligns with the APEC Privacy Framework, setting out obligations for data controllers, rights for data subjects, and enforcement mechanisms.

Bulgaria's minimum network and information security measures for public administration, essential service operators and digital service providers under the Cybersecurity Act: governance, policy, risk, asset, HR, supplier, change, access, hardening, web and DNS, logging, incident notification, backup, continuity and yearly internal audit duties, with the compliance inspection regime and the register of essential services.

The program’s security criteria were last updated in 2023, adding new supply‑chain security requirements and enhanced validation processes.

Cybersecurity Capability Maturity Model for energy sector

Cloud Computing Compliance Criteria Catalogue by BSI Germany

California's consumer privacy law (CCPA as amended by the CPRA) and the CPPA regulations in force from 1 January 2026: what a covered business must do on notice at collection, purpose limitation, security, privacy policies, requests to know, delete and correct, opt-out of sale or sharing, limits on sensitive data, opt-out preference signals, minors, non-discrimination, vendor contracts, training, records and metrics, plus the newer cybersecurity audit, risk assessment and automated decisionmaking technology duties. Applies to a for-profit entity doing business in California that decides how consumers' personal information is processed and meets any ONE of: annual gross revenue above the CPI-adjusted threshold (currently USD 26,625,000); buying, selling or sharing data on at least 100,000 consumers or households a year; or earning 50 percent or more of annual revenue from selling or sharing personal information (Civ. Code 1798.140(d)). Cybersecurity audits, risk assessments and ADMT duties carry their own applicability tests and staged dates.

The Consultative Committee for Space Data Systems (CCSDS) 350.0-G-3 (The Application of Security to CCSDS Protocols) provides security guidance for space mission communications. CCSDS is the international standardisation body for space data systems with all major space agencies as members (NASA, ESA, JAXA, ROSCOSMOS, etc.). The security framework covers authentication, encryption, and access control for space-ground communications, telemetry, telecommand, and space data links. Key standards include CCSDS 352.0-B (Space Data Link Security Protocol) and CCSDS 355.0-B (Space Missions Key Management). Applicable to all civilian and scientific space missions.

The CDP full corporate questionnaire as disclosers answered it in 2025, section by section across all 13 modules: governance and incentives, risk processes, transition plans, the full GHG inventory with Scope 3 and verification, energy and targets, deforestation-free sourcing and traceability, water accounting, plastics, biodiversity and financed emissions, each with what CDP expects to see and what earns leadership points, with the 2026 additions on adaptation and ocean recorded.

The Commodity Futures Trading Commission (CFTC) System Safeguards rules (17 CFR Parts 37, 38, 39, and 49) establish comprehensive cybersecurity, business continuity, incident reporting, system integrity, and risk management requirements for designated contract markets (DCMs), swap execution facilities (SEFs), derivatives clearing organizations (DCOs), and swap data repositories (SDRs).

The Cyber Incident Reporting for Critical Infrastructure Act of 2022 (Pub.L. 117‑103, Division Y) requires covered critical infrastructure entities to report covered cyber incidents to the Cybersecurity and Infrastructure Security Agency (CISA) within 72 hours of discovery and to report ransom payments within 24 hours. The act establishes reporting requirements, defines covered entities, and mandates the Secretary of Homeland Security to issue guidance and maintain a public database of reported incidents.

Center for Internet Security Critical Security Controls - prioritized set of actions to protect organizations and data from known cyber attack vectors

CIS Critical Security Controls v8.1 (Center for Internet Security, June 2024): 153 prioritised Safeguards in 18 Controls, from asset and software inventory through data protection, secure configuration, accounts and access, vulnerability, log, email, malware, recovery, network, awareness, service provider, application security, incident response and penetration testing. Each Safeguard is tagged with an asset type, one of six security functions (Govern, newly added in v8.1, Identify, Protect, Detect, Respond, Recover) and its Implementation Groups: IG1 is essential cyber hygiene (57 Safeguards in the CIS workbook), IG2 adds 73 for enterprises with more complexity (130), IG3 adds 23 for those facing sophisticated attackers (153).

CISA's Cross-Sector Cybersecurity Performance Goals (CPGs) are a prioritized subset of IT and OT cybersecurity practices aimed at meaningfully reducing risk to critical infrastructure operations. Aligned with the NIST Cybersecurity Framework, CPGs provide a common set of protections that all critical infrastructure owners and operators can implement.

CISA, through its Industrial Control Systems Cyber Emergency Response Team (ICS‑CERT), publishes a continuous set of security resources for operational technology. This includes ICS‑CERT Advisories (vulnerability disclosures), Recommended Practices (RP‑1, RP‑2, etc.), Vulnerability Reports, Technical Documents, and Security Alerts, all aimed at improving the security of industrial control and SCADA systems.

CISA Zero Trust Maturity Model for federal agencies

Cybersecurity Maturity Model Certification for defense industrial base

Cybersecurity Maturity Model Certification version 2.0 Level 1 (Foundational). 17 practices mapped to FAR 52.204-21.

The CNCF Security Technical Advisory Group (TAG) publishes security guidance for cloud‑native ecosystems, including the CNCF Cloud Native Security Whitepaper (v2, 2022), the Software Supply Chain Best Practices guide, and the CNCF Security Assessment process. These resources are best‑practice documents rather than a formal framework with defined domains or controls.

The French data protection authority's guidance on monitoring staff: any control device must be justified and proportionate, presented to the works council beforehand and disclosed to staff; no constant surveillance, hidden purposes or keyloggers; where cameras may and may not point, one-month retention and signage; no biometric or photo time clocks; limits on vehicle tracking outside working hours; call recording, screen capture, email and telework monitoring limits. Official guidance, not law.

ISACA's framework for the governance and management of enterprise information and technology: 40 governance and management objectives in five domains, each detailed as practices with activities, capability levels, metrics and related guidance, tailored to the enterprise through design factors. Built from the complete ISACA core publications; leaves are the 231 practices.

The US Children's Online Privacy Protection Act and the FTC's COPPA Rule (16 CFR Part 312) as amended in 2025, in force since June 23, 2025 with compliance required by April 22, 2026: for operators of child-directed services, or those that know they collect from children under 13, the duties of notice, verifiable parental consent (with separate consent for third-party disclosure), parental review and deletion, data minimisation, a written information security program, a written retention policy, and the obligations of FTC-approved safe harbor programs. Built from the eCFR text and the statute.

Enterprise Risk Management, Integrating with Strategy and Performance (COSO, June 2017) is the Committee of Sponsoring Organizations of the Treadway Commission's enterprise risk management framework, replacing the 2004 framework's cube with five components carried by twenty principles: Governance and Culture, Strategy and Objective-Setting, Performance, Review and Revision, and Information, Communication and Reporting, positioned within strategy-setting and performance rather than as a separate function. It is principles-based and not certifiable, designed to be used with COSO's Internal Control, Integrated Framework, and applied by COSO to compliance risk (2020) and ESG-related risk (2018). The graph models the twenty principles from Volume I of the framework.

Internal Control, Integrated Framework (COSO, May 2013) is the Committee of Sponsoring Organizations of the Treadway Commission's framework for designing, implementing and assessing internal control over operations, reporting and compliance objectives, the reference most US registrants use for management's assessment of internal control over financial reporting under Sarbanes-Oxley section 404. It updates the 1992 framework with seventeen explicit principles across the five components (control environment, risk assessment, control activities, information and communication, monitoring activities), each with points of focus, and requires every component and relevant principle to be present and functioning and the components to operate together. The graph models the seventeen principles with their points of focus.

The 24 international principles for payment systems, central securities depositories, securities settlement systems, central counterparties and trade repositories: legal basis, governance, risk management, credit, collateral, margin, liquidity, settlement finality, money settlements, default management, business and operational risk, access, efficiency and disclosure.

The Cloud Security Alliance STAR programme: the requirements a cloud service provider meets to list on the STAR Registry at Level 1 (annual CAIQ self-assessment, Valid-AI-ted, the GDPR code of conduct variant) and Level 2 (STAR Certification on an accredited ISO/IEC 27001:2022 certificate with the CCM assessed against a capability model over the three-year cycle, STAR Attestation on SOC 2, C-STAR), the requirements on certification bodies and auditors, STAR for AI (AI-CAIQ, ISO/IEC 42001) and the Trusted Cloud Provider trustmark. 15 leaves; the controls themselves are those of the CCM.

The EU directive that requires large undertakings, groups and listed issuers to publish a double-materiality sustainability statement in their management report under the European Sustainability Reporting Standards, with limited assurance by an approved auditor or provider, now limited to undertakings above EUR 450 million turnover and 1 000 employees and with protections for smaller value chain suppliers.

The 2024 CWE Top 25 Most Dangerous Software Weaknesses published by MITRE Corporation and supported by CISA. Based on analysis of 31,770 CVE records scored by frequency multiplied by severity (CVSS). Identifies the most common and impactful software weaknesses that developers and organizations should prioritize. Released November 19, 2024.

California's residential security deposit law for landlords and property managers: the deposit cap, service member rules, permitted deductions, the pre-move-out inspection, photographs at move-in and move-out, the itemised return within 21 days with invoices and photographs, electronic refunds from 2026, joint tenants, and what happens to deposits when a property is sold.

California's Security of Connected Devices law (Civil Code 1798.91.04 to 1798.91.06, SB 327 and AB 1906 of 2018, amended by AB 2392 of 2022) requires every manufacturer of an internet- or Bluetooth-addressable device sold in California to equip it with reasonable security features appropriate to its function and data; a device reachable outside the local network is deemed compliant with a unique preprogrammed password or a forced new credential at first access, and since 2023 a manufacturer may instead rely on a NIST conforming label with third-party conformity assessment. Enforced by the Attorney General and local prosecutors, no private right of action; operative since 1 January 2020.

California's ban on recording employees in restrooms, locker rooms and changing rooms (Labor Code s. 435) and the new Part 5.8 workplace-bathroom surveillance rules added by AB 1331, operative 1 January 2027.

California's wiretapping section: no tapping of phone lines, no reading or learning the contents of communications in transit without all parties' consent, no use of what is obtained, and no aiding others to do it. Penal Code s. 631.

California's all-party consent rule: no recording or electronic eavesdropping on a confidential conversation, in person or by phone, and no recording of calls involving a cellular or cordless phone, without the consent of every party; civil actions of 5,000 dollars per violation. Penal Code ss. 632 and 632.7.

Gives every person a right to inspect and copy California state and local agency records, subject to specific exemptions, with duplication cost limits, a 10-day/14-day determination timeline, a duty to assist requesters, electronic-records rules, a critical-incident video/audio recording disclosure regime, and judicial enforcement by writ of mandate.

Cambodia's Law on Electronic Commerce of 2019, in force since May 2020: the only enacted Cambodian law with a general duty to protect personal information held electronically (Article 32, criminally penalised), alongside intermediary takedown and reporting duties, e-commerce licensing under Sub-Decree No. 134, consumer information and opt-out rules, and payment service duties. Cambodia has no personal data protection law yet; the draft Law on Personal Data Protection (July 2026 version) is pending and recorded, not built. Built from the Law's own articles.

ITSG-33, the Canadian Centre for Cyber Security's IT security risk management lifecycle for Government of Canada departments: the departmental activities of Annex 1 (categorization, threat assessment, control profiles, monitoring, authorization maintenance) and the information system security implementation process of Annex 2 from project start to authorization to operate, operations and disposal. Its 2012 control catalogue and PBMM profile were superseded in 2026 by ITSP.10.033 and ITSP.10.033-01, modelled as their own framework.

The Canadian Centre for Cyber Security's 2026 security and privacy control catalogue, ITSP.10.033, which replaced the ITSG-33 Annex 3A catalogue on 31 March 2026: NIST SP 800-53 Rev. 5 adapted to Canadian law and policy, with Privacy Act controls and Canada-specific controls such as sovereignty and jurisdiction risk assessment, each control marked with its status in the ITSP.10.033-01 medium (Protected B) profile. Built from the catalogue's own base statements.

Canada's Anti-Spam Legislation (CASL, S.C. 2010, c. 23) regulates the sending of commercial electronic messages (CEMs), the installation of computer programs, and the unauthorized collection of electronic addresses. It is enforced by the Canadian Radio‑television and Telecommunications Commission (CRTC) for electronic messages, the Competition Bureau for false or misleading representations, and the Office of the Privacy Commissioner of Canada for privacy‑related aspects.

Personal Information Protection and Electronic Documents Act. Federal Canadian private-sector privacy law.

The Cayman Islands Data Protection Act 2017 (as amended) establishes a comprehensive data protection framework for the Cayman Islands. The Office of the Ombudsman serves as the Data Protection Authority. The Act is modelled on the EU GDPR and includes data processing principles, individual rights, breach notification, and cross-border transfer provisions. Important for the Cayman Islands' significant financial services sector.

Cefic's Responsible Care Management Framework for the European chemical industry: what companies, national associations, Cefic and ICCA each do, the six Global Charter elements turned into management processes with four maturity levels, and the Responsible Care KPI set, mapped to ISO 9001, 14001, 45001, 50001, EMAS and RC 14001.

Chile's reformed Personal Data Protection Law (Law No. 21.719, enacted December 2024) replaces the outdated Law 19.628 of 1999. It creates an autonomous Data Protection Agency, establishes GDPR-aligned data protection principles, introduces mandatory breach notification, cross-border transfer restrictions, and significant penalties. Chile becomes the first Latin American country with EU adequacy recognition potential under the new framework. Two-year transition period.

The Cybersecurity Law of the People's Republic of China (in force 1 June 2017, amended by the NPC Standing Committee's Decision of 28 October 2025 with effect from 1 January 2026) is China's foundational cybersecurity statute. It binds network operators to ranked cybersecurity protection (MLPS) with six-month log retention, incident plans and reporting, real-identity checks, lawful and consented collection of personal information with breach notice, and content management; binds product and service providers to defect remediation and continuous security maintenance and key equipment to certification; and binds critical information infrastructure operators to built-in security, vetted security bodies, backups and drills, procurement security review, domestic storage with assessed outbound transfer and annual assessment. The 2025 amendment left the obligations unchanged but renumbered the Law, added articles on artificial intelligence and minors, tied personal information processing to the PIPL and the Civil Code, raised fines in tiers up to RMB 10 million with personal fines up to RMB 1 million, and extended liability to any overseas activity endangering China's cybersecurity. 20 leaves at 90.

The Data Security Law of the People's Republic of China (effective September 1, 2021) establishes a comprehensive framework for data security governance. It introduces a data classification and grading system, cross‑border data transfer restrictions, security assessment mechanisms, government data security obligations, and a national security assessment system for data handling.

China's comprehensive personal information protection statute (effective 1 November 2021), administered by the Cyberspace Administration of China. Establishes legal bases for handling personal information, sensitive-PI and minors' rules, cross-border transfer mechanisms, individual rights, handler obligations (PIPIA, DPO, breach notification, audits) and legal liability.

The Cloud Security Alliance's Cloud Controls Matrix version 4.0.1: 197 control objectives in 17 domains (audit and assurance, application and interface security, business continuity and operational resilience, change control, cryptography and key management, datacenter security, data security and privacy, governance risk and compliance, human resources, identity and access management, interoperability and portability, infrastructure and virtualization security, logging and monitoring, security incident management and cloud forensics, supply chain management and the shared security responsibility model, threat and vulnerability management, universal endpoint management), the control set behind CSA STAR Level 1 self-assessments (CAIQ) and Level 2 certification and attestation. Superseded by CCM v4.1 (published January 2026, 207 controls: 11 added, one removed, IVS renamed I&S); CSA accepts v4.0.x for STAR submissions until December 2027 and withdraws it in January 2028. Every control is read against the CAIQ v4.0.1 control specification.

CSA CCM v4.1 (matrix release 4.1.1), the cloud control framework of the Cloud Security Alliance: 207 control objectives in 17 domains (audit and assurance, application and interface security, business continuity and operational resilience, change control and configuration, cryptography and key management, datacenter security, data security and privacy lifecycle, governance risk and compliance, human resources, identity and access management, interoperability and portability, infrastructure security, logging and monitoring, incident management and cloud forensics, supply chain management, threat and vulnerability management, universal endpoint management), the control set behind CSA STAR Level 1 self-assessment (CAIQ v4.1, 283 questions) and Level 2 certification and attestation. What changed from v4.0.1: eleven controls added (AIS-08 API security; DCS-01 physical and environmental security policy, DCS-17 datacenter metrics, DCS-18 datacenter operations resilience; LOG-08 sanitising sensitive data in logs; SEF-07 incident response by category and severity, SEF-09 incident records repository and trend review; STA-01 supply chain risk management policy, STA-09 service bill of materials; TVM-04 threat analysis and modelling, TVM-10 risk-based threat response); one removed (v4.0.1 IAM-12, safeguarding log integrity); Infrastructure and Virtualization Security (IVS) renamed Infrastructure Security (I&S); controls renumbered in DCS, IAM, LOG, SEF, STA and TVM; policy reviews now also triggered by significant change; supply chain controls reworded from cloud provider and customer to service provider and customer. Matrix 4.1.1 (October 2026) adds NIST SP 800-171 rev2, MITRE ATT&CK and DORA mappings and corrects two typographic errors. CSA keeps v4.0.x acceptable for STAR during its transition period.

The Codex Alimentarius international code for food hygiene: good hygiene practices across the food chain (primary production, premises and equipment, training, cleaning and pest control, personal hygiene, control of operation, allergens, recall, labelling and transport) and the HACCP system applied in 12 steps, as revised in 2022 with CCP decision tools.

Colombia's Law 1581 of 2012 establishes the general framework for the protection of personal data, regulated by Decree 1377 of 2013. It defines principles for lawful processing, requirements for consent, data subject rights, security obligations, and the role of data controllers and processors. Oversight is currently exercised by the Superintendence of Industry and Commerce (SIC), though legislative efforts are underway to establish an independent data protection authority.

The Colorado Artificial Intelligence Act (SB 24-205), enacted 17 May 2024 and codified at C.R.S. 6-1-1701 et seq, requires developers and deployers of high-risk AI systems to use reasonable care to protect consumers from algorithmic discrimination through documentation, risk-management programs, impact assessments, consumer notices and Attorney General disclosures. Effective date originally 1 February 2026, subsequently amended/delayed.

The Colorado Privacy Act (CPA) grants Colorado residents rights over their personal data, including the right to access, correct, delete, and opt‑out of processing for targeted advertising, profiling, or other discriminatory purposes. It applies to controllers and processors that (a) conduct business in Colorado or target Colorado residents, (b) process personal data of at least 100,000 Colorado residents annually, or (c) derive revenue of $25 million or more from the personal data of Colorado residents. The CPA also requires covered entities to implement data minimization, purpose limitation, reasonable security measures, and to appoint a data protection officer (or designate a responsible individual).

The NSA's Commercial National Security Algorithm Suite 2.0 for US National Security Systems, as announced in September 2022 and formalised in CNSSP 15 (released March 2025): AES-256, SHA-384 or SHA-512, ML-KEM-1024 for key establishment and ML-DSA-87 for signatures up to TOP SECRET, LMS or XMSS for software and firmware signing, SHA3-384 or SHA3-512 only for internal hardware integrity, nothing else without NSA approval; validation under NIAP and CAVP; the CNSSP 15 dates (CNSA 1.0 acceptable through 2025, CNSA 2.0 required in new products and services protecting users or updates from 1 January 2027, non-capable equipment replaced by the end of 2030, mandated for all protocol use by the end of 2031, complete by 2035); NIAP Policy Letter 33; reporting and waivers. 18 requirement leaves.

The Australian consumer data rules in full: what data holders, accredited data recipients, CDR representatives, sponsors and secondary data holders must do to share banking, non-bank lending and energy data at the consumer's direction, from request services, consent and authorisation flows, dashboards and joint accounts to accreditation, dispute resolution, the operational privacy rules, records, reporting and audit. Built from the authorised compilation No. 10 read in full; the Schedule 2 security steps and the thirteen privacy safeguards sit in the companion 'Australia Consumer Data Right - Banking (CDR)' framework.

The Act layer of Australia's consumer data right: the duties Part IVD of the Competition and Consumer Act 2010 places directly on data holders, accredited persons, action initiators and action service providers outside the thirteen privacy safeguards, from misleading conduct, fees and holding out to notifiable breaches of CDR data and binding data standards, with the Part's designation, accreditation, standards and enforcement machinery described. Read against compilation No. 167; the safeguards and the consumer data rules are carried in the two companion frameworks.

Commonwealth Act that inserts Part 2-4 (unfair trading practices) into the Australian Consumer Law, adds a transaction based charge display duty in section 48A, and inserts Division 4A on subscription contracts (sections 48B to 48H). Commences 1 July 2027.

The Connecticut Data Privacy Act (CTDPA), signed into law in June 2022 and effective July 1, 2023, establishes comprehensive consumer privacy rights for Connecticut residents. It provides rights to access, delete, correct, and opt out of the sale of personal data and targeted advertising. The law applies to any entity that conducts business in Connecticut or processes the personal data of Connecticut residents, regardless of where the entity is located.

Connecticut's limits on workplace surveillance: no electronic surveillance of employees in rest rooms, locker rooms, lounges or similar areas, and no recording of employment contract negotiations without all parties' consent. CGS 31-48b.

Connecticut's rule that employers give prior written notice of the types and locations of electronic monitoring, post it where monitoring occurs, give new hires a plain-language statement, and monitor without notice only on reasonable grounds of misconduct. Conn. Gen. Stat. s. 31-48d as substituted by Public Act 26-73 from 1 October 2026.

Connecticut's telephone recording rule: record a private call only with all parties' prior consent (written or on the recording), a recorded verbal notice, or a repeating warning tone; civil damages otherwise. CGS 52-570d.

Connecticut's professional conduct rules for lawyers: the client-lawyer relationship from competence and written fee terms through confidentiality, every class of conflict, entity and impaired clients, the trust account and IOLTA regime with seven-year records, and withdrawal; advocacy and third-party dealings; firm supervision, independence and multijurisdictional practice; advertising, solicitation and specialist claims; and the integrity rules including the harassment and discrimination prohibition.

Costa Rica's Law for the Protection of Persons Regarding the Processing of Their Personal Data (Law No. 8968 of 2011), as amended by Executive Decree No. 42089-MGP (2023), establishes a comprehensive data protection framework. The Data Protection Agency (Agencia de Protección de Datos, APD) oversees and enforces compliance, issues guidelines, and handles complaints.

Made under Part 2A of the Security of Critical Infrastructure Act 2018, the Critical Infrastructure Risk Management Program (CIRMP) Rules 2023 require responsible entities to develop, implement and maintain a risk management program that addresses cyber security, personnel security, supply chain security, physical security and other hazards. Entities must also report their risk management program and any significant incidents to the Australian Government in accordance with the Act.

EU Regulation (EU) 2024/1252 (Critical Raw Materials Act), in force 23 May 2024, establishing a framework for a secure and sustainable supply of critical raw materials: strategic and critical raw materials lists; 2030 Union benchmarks (extraction 10 percent, processing 40 percent, recycling 25 percent, single third country no more than 65 percent); Strategic Projects and accelerated permitting; national exploration programmes; supply monitoring and stress testing; company risk preparedness; strategic stocks and joint purchasing; circularity and recycling (incl permanent magnets); sustainability schemes; and the European Critical Raw Materials Board.

UK government-backed scheme to protect against common cyber attacks

Australia's Cyber Security Act 2024 (No. 98 of 2024) with its three 2025 rules: mandatory security standards for consumer smart devices (no universal default passwords, a published security-issue reporting channel, a published defined support period for security updates, statements of compliance kept five years, compliance, stop and recall notices), 72-hour ransomware payment reporting for businesses above AUD 3 million turnover and SOCI Part 2B entities, voluntary provision of significant-incident information to the National Cyber Security Coordinator under limited-use protection, and the Cyber Incident Review Board's no-fault reviews with document production powers. 31 leaves at 90 on the authorised Act and the registered rules.

The Czech Republic's Act on the Protection of Personal Data (Act No. 110/2019 Coll.) implements and complements the EU GDPR with national provisions. The Office for Personal Data Protection (Úřad pro ochranu osobních údajů, ÚOOÚ) oversees enforcement. The Act sets the age of digital consent at 15 years and includes specific rules on processing for employment, public health, and research purposes, among others.

DAMA International's data management body of knowledge, built to the numbered activities of its eleven knowledge areas.

DFARS clause 252.204-7012 (48 CFR 252.204-7012, clause edition MAY 2024). Requires DoD contractors to provide adequate security on covered contractor information systems by implementing NIST SP 800-171, to rapidly report cyber incidents (within 72 hours of discovery) to DoD via dibnet.dod.mil using a DoD-approved medium assurance certificate, to submit isolated malicious software to the DoD Cyber Crime Center (DC3), to preserve affected media and monitoring data for at least 90 days, to support forensic analysis and damage assessment, and to flow the clause down to in-scope subcontracts. External cloud service providers must meet a FedRAMP Moderate-equivalent baseline.

DISA Security Technical Implementation Guides (STIGs) and Security Requirements Guides (SRGs), published by the Defense Information Systems Agency via the DoD Cyber Exchange. SRGs are technology-family security-requirement sets derived from NIST SP 800-53 (via Control Correlation Identifiers); STIGs are product-specific hardening guides implementing the applicable SRG, each comprising findings categorised CAT I/II/III, assessed using STIG Viewer and SCAP-validated tools and tracked in eMASS. This node represents the STIG/SRG program structure (technology families, severity categories, assessment tooling and governance lifecycle); the per-product STIG findings are a catalog (hundreds of STIGs) and are not enumerated here.

RTCA DO-178C / EUROCAE ED-12C (December 2011 / January 2012), Software Considerations in Airborne Systems and Equipment Certification, the means of compliance the FAA (AC 20-115D), EASA (AMC 20-115D) and other authorities accept for airborne software: 71 objectives in ten Annex A tables covering planning, development, verification of requirements, design, code and integration, testing, verification of the verification (requirements coverage and structural coverage up to MC/DC), configuration management, quality assurance and certification liaison, each applied by software level A to D from the system safety assessment, with independence for the more critical objectives.

RTCA DO-254 / EUROCAE ED-80 design assurance guidance for airborne electronic hardware.

RTCA DO-326A / EUROCAE ED-202A (2014), Airworthiness Security Process Specification: the process an applicant integrates with ARP 4754A to protect the airworthiness of aircraft, engines and propellers from intentional unauthorised electronic interaction. Seven steps (plan, security scope, security risk assessment, risk acceptability, security development, security effectiveness assurance, communication of evidence) in fourteen aircraft-level and system-level activities from the PSecAC to the PSecAC Summary, with threat conditions, threat scenarios, security measures and levels of threat assessed against the safety severity, and security assurance levels grading the assurance. Recognised by EASA AMC 20-42, FAA policy and the UK MAA; methods in DO-356A / ED-203A, in-service guidance in DO-355A / ED-204A. DO-326B / ED-202B, a limited update on change impact analysis, has since been completed.

The Digital Operational Resilience Act (DORA), Regulation (EU) 2022/2554, establishing uniform requirements for the security of network and information systems of EU financial entities and critical ICT third-party providers. Covers ICT risk management (governance, framework, identification, protection, detection, response/recovery, backup, learning), ICT-related incident management and major-incident reporting to competent authorities, digital operational resilience testing (including threat-led penetration testing), ICT third-party risk management (Register of Information, key contractual provisions, concentration risk) with a Union Oversight Framework for critical ICT third-party providers, and cyber threat information sharing. Applies from 17 January 2025.

DORA Level 2 implementing technical standards prescribing the templates, data glossary, secure channels, reclassification, outsourced and aggregated reporting rules for major ICT-related incident reports and voluntary cyber threat notifications.

DORA Level 2 implementing technical standards prescribing the register of information templates (B_01 to B_99) for all ICT third-party contractual arrangements, provider ranking in the supply chain, LEI and EUID identifiers, data quality and group scope.

DORA Level 2 regulatory technical standards setting the criteria, materiality thresholds and tests that decide whether an ICT-related incident is major and reportable, and when a cyber threat is significant.

DORA Level 2 regulatory technical standards detailing the ICT security policies, asset, cryptography, operations, network, change, access, incident detection and continuity requirements for EU financial entities, plus the simplified ICT risk management framework for small and non-interconnected entities.

DORA Level 2 regulatory technical standards on subcontracting of ICT services supporting critical or important functions: pre-contract decision and conditions, periodic reassessment, flow-down contract terms, material change notice and objection, and termination rights.

DORA Level 2 regulatory technical standards on the policy for using ICT third-party services that support critical or important functions: governance, lifecycle, ex-ante risk assessment, due diligence, conflicts, contract and audit clauses, reliance on certifications, monitoring and exit plans.

DORA Level 2 regulatory technical standards on what the initial notification, intermediate report and final report of a major ICT-related incident must contain, their deadlines (four hours from classification and 24 hours from awareness, 72 hours, one month) and the content of voluntary cyber threat notifications.

DORA Level 2 regulatory technical standards on threat-led penetration testing: which entities must test, control team and secrecy arrangements, tester and threat intelligence provider qualifications, the preparation, threat intelligence, red team (at least 12 weeks) and closure phases, remediation plans and internal testers.

Denmark's Data Protection Act (Databeskyttelsesloven) implements the EU GDPR and adds national provisions. It is enforced by the Danish Data Protection Agency (Datatilsynet). The Act contains specific rules for processing sensitive data, including health and biometric data, and governs the use of the national civil registration number (CPR). The 2022 amendment incorporated EU Court of Justice rulings (e.g., Schrems II) and clarified data protection impact assessments and cross‑border data transfer requirements.

The United Kingdom's Data (Use and Access) Act 2025 as an amending Act: the duties it places on organisations in its own right (smart data schemes, digital verification services, the National Underground Asset Register, registration equipment, the PECR cookie, soft opt-in, breach and enforcement changes, health IT standards, online-safety retention), each with its commencement status, and short pointers to the UK GDPR and Data Protection Act 2018 duties it amended, with the Information Commission taking over on 30 September 2026.

The Defence Industry Security Program (DISP) is a risk‑management and assurance framework administered by the Australian Department of Defence. It enables industry partners to understand and meet their security obligations when working with or for Defence. DISP membership requires compliance across 13 security domains and 41 controls, covering governance, personnel, physical security, information security, cyber security, and other critical areas.

The Defence Security Principles Framework sets out security principles and controls for the Australian Department of Defence and its industry partners. It is a principles-based framework supporting a progressive protective security culture. All Defence personnel, contractors, consultants and outsourced service providers must adhere to the DSPF.

Delaware's rule that employers may monitor or intercept employees' telephone, email or internet use only after a daily electronic notice on each day of access or a one-time notice the employee acknowledges; 100 dollars per violation. 19 Del. C. s. 705.

The Delaware Online Privacy and Protection Act (DOPPA), Delaware Code Title 6 Chapter 12C (enacted 2015, effective 2016) - ENACTED, not proposed. Requires operators of commercial online services that collect personal information from Delaware residents to conspicuously post a privacy policy with prescribed content and a Do Not Track disclosure; prohibits marketing of specified age-restricted products to minors and the use of a minor's personal information for such marketing; protects the privacy of digital book service users; enforced as a deceptive trade practice by the Delaware Attorney General. (The comprehensive Delaware Personal Data Privacy Act / DPDPA 2023, Title 6 Ch. 12D, is a separate instrument and is not this node.)

Delaware's interception law: a person may intercept a call, conversation or electronic communication only as a party or with one party's consent, though a separate privacy offence (1335(a)(4)) uses all-party wording. 11 Del. C. ch. 24.

What the Dental Board of Australia expects of dental practitioners on infection prevention and control since it retired its Guidelines on infection control on 1 July 2022: risk-based safe practice, the Code of conduct, blood-borne virus rules, CPD, insurance and the relevant state and federal laws, and 24 practice components from screening, cleaning and water lines to reprocessing with traceability, sharps, antimicrobial stewardship and immunisation. Guidance, not law.

The Digital Economy Partnership Agreement (DEPA), a plurilateral digital-trade agreement between Chile, New Zealand and Singapore signed 11 June 2020 (open to accession). Organised in 16 Modules covering business and trade facilitation (paperless trading, e-invoicing, e-payments, logistics), treatment of digital products (no customs duties on electronic transmissions, non-discriminatory treatment, cryptography), data issues (personal information protection, cross-border data flows, no forced data localisation), wider trust environment (cybersecurity cooperation, online safety), business and consumer trust (anti-spam, online consumer protection, internet access principles), digital identities, emerging technologies (fintech, AI, government procurement, competition policy), innovation (public domain, data innovation, open government data), SME cooperation, digital inclusion, and institutional/transparency/dispute-settlement/exceptions/final provisions.

The Digital Services Act (DSA), Regulation (EU) 2022/2065 of 19 October 2022. Establishes harmonised rules for intermediary services in the EU: conditional liability exemptions and no general monitoring obligation (Chapter II); and tiered due-diligence obligations (Chapter III) for all intermediaries (points of contact, legal representatives, terms and conditions, transparency reporting), hosting services (notice-and-action, statement of reasons, criminal-offence notification), online platforms (internal complaints, out-of-court dispute settlement, trusted flaggers, anti-misuse, advertising and recommender-system transparency, dark-pattern prohibition, protection of minors), online marketplaces (trader traceability/KYBC, compliance by design), and very large online platforms and search engines (systemic risk assessment and mitigation, crisis response, independent audit, ad repository, researcher data access, compliance function, supervisory fee).

Directive (EU) 2019/1937 of 23 October 2019 on the protection of persons who report breaches of Union law. Requires legal entities with 50 or more workers and public sector bodies to establish secure, confidential internal reporting channels with prescribed procedures (7-day acknowledgement, impartial follow-up, 3-month feedback); requires Member States to designate competent authorities operating external reporting channels; sets the conditions for protected public disclosure; mandates confidentiality of the reporting person's identity, GDPR-compliant data processing and record-keeping; prohibits retaliation and provides protective measures including reversal of the burden of proof, support measures and remedies; and requires effective, proportionate and dissuasive penalties.

Directive (EU) 2023/970 of 10 May 2023 strengthening equal pay for equal work or work of equal value between men and women through pay transparency and enforcement. Requires gender-neutral pay structures and job evaluation; pay transparency before employment (pay range, ban on pay-history questions); accessible pay-setting and progression criteria; a worker right to comparative pay information; gender pay-gap reporting on size-based thresholds; joint pay assessment where an unjustified gap of at least 5% persists; and a strong enforcement regime (full compensation, reversed burden of proof, access to evidence, three-year minimum limitation periods, penalties, protection against victimisation). To be transposed by 7 June 2026.

The U.S. Department of Defense Zero Trust Reference Architecture and Zero Trust Capabilities/Activities. Defines the DoD zero-trust target state across 7 pillars (User; Device; Application & Workload; Data; Network & Environment; Automation & Orchestration; Visibility & Analytics), 45 capabilities and 152 Target-Level / Advanced-Level activities, supporting the DoD Zero Trust Strategy goal of a target-level zero-trust architecture. Aligned with NIST SP 800-207 zero-trust tenets and implemented over NIST SP 800-53 controls.

The U.S. Export Administration Regulations (15 CFR Parts 730-774), administered by the Bureau of Industry and Security: what is subject to U.S. export controls (including deemed exports, de minimis content and the foreign direct product rules), the ten General Prohibitions, classification on the Commerce Control List and licence determination, the licence exceptions, end-use and end-user controls (Entity List, military and military-intelligence end users, advanced computing and semiconductor end uses), embargoes and Russia and Belarus sanctions, licence applications, export clearance and the Destination Control Statement, antiboycott rules, recordkeeping, and enforcement and voluntary self-disclosure. Built section by section from the eCFR text current to 28 August 2026.

EASA (European Union Aviation Safety Agency) Part‑IS (Information Security) regulation establishes mandatory information security requirements for aviation organisations. It requires the implementation of an Information Security Management System (ISMS) aligned with ISO/IEC 27001, covering 15 security domains and 34 controls, to protect the confidentiality, integrity and availability of aviation‑related information. The regulation (Commission Regulation (EU) 2022/xxxx) becomes fully effective in 2025.

The European Banking Authority Guidelines on ICT and security risk management (EBA/GL/2019/04, applied from 30 June 2020), as amended by EBA/GL/2025/02 from 20 May 2025: with DORA governing the ICT risk of EU financial entities from 17 January 2025, sections 3.1 to 3.7 (governance and strategy, the risk management framework, information security, ICT operations, project and change management, business continuity) were repealed and only section 3.8, payment service user relationship management, remains, addressed to payment service providers. The repealed sections are kept here with their text and their mappings to DORA as the historical baseline.

The ECB TIBER-EU Framework for Threat Intelligence-based Ethical Red Teaming, the European framework for controlled, intelligence-led red-team testing of the live production systems of financial entities. Defines a three-phase process (Preparation, Testing, Closure) supported by an optional jurisdiction-level Generic Threat Landscape, the roles of the White/Control Team, Blue Team, Red Team, threat-intelligence provider and the authority TIBER Cyber Team, and the deliverables (Targeted Threat Intelligence Report, Red Team Test Plan and Report, Blue Team Report, replay/purple teaming, Test Summary Report, Remediation Plan and attestation). TIBER-EU underpins mutual recognition of threat-led penetration testing under DORA.

ECSS-E-ST-40C, the European Cooperation for Space Standardization standard for software engineering in space systems. Defines the software engineering processes across the life cycle (software-related system requirements, management, requirements and architecture, design and implementation, validation, delivery and acceptance, verification, operation, maintenance) and special requirements tailored by software criticality (categories A-D), including dependability and safety, reuse and tool qualification, with an interface to software product assurance (ECSS-Q-ST-80C). Freely published by the ECSS at ecss.nl.

The EDM Council's best-practice framework for managing and controlling data, above all sensitive data, in single, multi and hybrid cloud: six components, fourteen capabilities and 37 assessable sub-capabilities covering business cases and ownership, authoritative sourcing, sovereignty and cross-border movement, cataloging and classification, entitlements and data ethics, encryption, obfuscation, data loss prevention and privacy, lifecycle and data quality, cost, resilience, backup, portability and lineage, plus 14 key controls with certification tests that cloud consumers and providers are certified against. Built from the complete v1.1.1 text.

The EDM Association's (formerly EDM Council) industry model of the capabilities an organization needs to run a sustainable data management and analytics program, scored from Not Initiated to Enhanced: in its current v3 (July 2025) eight components and 34 capabilities covering data and data management strategy and business case, program, funding, roadmaps, change and communications, business, data and technology architecture, education, glossary and metadata, data quality, governance, data operations, risk and control, and analytics. Built at capability level from the EDM Association's own published statements.

The European Data Protection Board's guidelines on how the GDPR applies to processing personal data for scientific research: when an activity counts as scientific research (six key-indicative factors), the presumption of compatibility for further research use and storage for future research, freely given, broad and dynamic consent, public and legitimate interest and the Article 9 derogations, information duties over long research and the Article 14(5) exemptions, erasure and objection in research, controller, processor and joint-controller roles in research collaborations, and the Article 89(1) safeguards from risk analysis and pseudonymisation to secure processing environments. Built from the version adopted for public consultation on 15 April 2026, read in full; the post-consultation version has not yet been adopted.

The EDPB's guidelines on CCTV and other video devices under the GDPR: specify each camera's purpose, prove a real legitimate interest, try less intrusive means first, keep cameras out of places where people expect privacy (washrooms, rest areas, most of the workplace), do not rely on staff consent, post an eye-level first-layer sign with a full second-layer notice, keep footage a few days, switch off audio and analytics, and meet strict conditions for facial recognition. Guidance, not law. Built from the complete text.

EIOPA Guidelines (EIOPA-BoS-20/600, issued 12 October 2020, applied from 1 July 2021) on how insurance and reinsurance undertakings should apply the Solvency II governance requirements (Directive 2009/138/EC and Delegated Regulation (EU) 2015/35) to information and communication technology (ICT) security and governance. 25 guidelines covering ICT governance and strategy, ICT and security risk management, information security, ICT operations and change management, business continuity, and outsourcing of ICT services. WITHDRAWN from 17 January 2025, superseded by the Digital Operational Resilience Act (DORA, Regulation (EU) 2022/2554) for EU financial entities.

EIOPA guidance on how insurers and reinsurers apply Solvency II outsourcing rules to cloud providers: governance, notification, register, pre-outsourcing analysis, risk assessment, due diligence, contract terms, audit rights, security, sub-outsourcing, monitoring and exit.

EMVCo's EMV 3-D Secure protocol for authenticating cardholders in card-not-present payments and non-payment identity checks: the three-domain model, the 3DS Server, Directory Server, Access Control Server and 3DS SDK, the AReq/ARes, CReq/CRes, RReq/RRes, PReq/PRes and OReq/ORes messages, app-based, browser-based and 3RI flows, frictionless, challenge and decoupled authentication, user interface, message handling, timeouts and the secure links and functions, from the complete v2.0.0 specification; and the features 2.1 to 2.3.1 added (3RI and decoupled fallback, exemptions, Trust List, device binding, Secure Payment Confirmation, out-of-band app switching, message extensions, the Split-SDK, operation messages) read against the complete v2.3.1.1 core specification.

EN 301 549 is the harmonised European Standard, published jointly by ETSI, CEN and CENELEC, setting functional accessibility requirements for ICT products and services. Version 3.2.1 (2021-03), modelled here, was prepared as the harmonised standard for the Web Accessibility Directive (EU) 2016/2102 and incorporates WCAG 2.1 Level A and AA. Clauses 5 to 13 hold the requirements: generic and closed functionality, two-way voice and real-time text, video, hardware and stationary ICT, web pages, non-web documents, non-web software with platform accessibility services and authoring tools, documentation and support services, and relay and emergency service access; clause 4's user-need statements are informative. ETSI published V4.1.1 (2026-09), on WCAG 2.2 and with an annex for the European Accessibility Act (EU) 2019/882, which is modelled as its own framework; V3.2.1 remains the cited edition until V4.1.1 is cited in the Official Journal.

EN 301 549 V4.1.1 (2026-09) is the revised harmonised European Standard for the accessibility of ICT products and services, prepared to support the European Accessibility Act (Directive (EU) 2019/882) as well as the Web Accessibility Directive (EU) 2016/2102. It makes the eleven functional performance criteria testable, aligns web, document and software requirements with WCAG 2.2 Level AA, rebuilds real-time text and adds total conversation and emergency scenarios, moves authoring tools into the generic requirements, adds user-preference, hardware contrast, standard connection and programme guide requirements, and maps its clauses to the Act in Annex A.2 and Annex ZB. Not yet cited in the Official Journal on 2026-09-27; V3.2.1 remains the cited edition until it is.

The CENELEC railway RAMS family: EN 50126-1:2017 (the generic RAMS process: a twelve-phase life cycle from concept to decommissioning with risk assessment on three risk acceptance principles, RAM and safety plans, hazard log, verification, validation, independent safety assessment and the safety case), EN 50126-2:2017 (the systems approach to safety: safety demonstration, independence of roles, risk assessment methods, safety requirements, SIL apportionment), EN 50128:2011 (software for railway control and protection; superseded by EN 50716:2023, conflicting national standards withdrawn by 2026-10-30) and EN 50129:2018 (safety-related electronic systems for signalling; EN 50129:2026 published, withdrawal of the 2018 edition by 2029-05-31). Referenced by the EU CSM for risk assessment (Regulation 402/2013) and applied under the Interoperability Directive.

The CENELEC cross-sector standard for railway software (November 2023), which replaces EN 50128:2011 for command, control and signalling and EN 50657:2017 for software on board rolling stock, with conflicting national standards withdrawn by 2026-10-30. Five software integrity levels from Basic Integrity to SIL 4 decide which techniques and documents apply; it sets role independence and competence, lifecycle documentation, testing, verification, validation, independent assessment, quality assurance, change control and tool classes T1 to T3, the development phases from requirements to final validation, application data for configurable systems, and deployment and maintenance, with normative technique tables (Annex A) and role specifications (Annex B). Built from the complete English text.

ENISA's primary report on the practical engineering of data protection (the umbrella PET / privacy-enhancing-technology document for the EU). 'Data Protection Engineering - From Theory to Practice' (January 2022) sets the connection from Data Protection by Design (GDPR Art.25) to engineering practice via the DPIA process, and surveys the main PETs and their applicability to data protection principles: anonymisation and pseudonymisation, differential privacy, homomorphic encryption, secure multiparty computation, trusted execution environments, private information retrieval, synthetic data, end-to-end encryption, proxy/onion routing, privacy-preserving storage, attribute-based credentials, zero-knowledge proofs, privacy policies/icons/sticky policies, privacy preference signals, privacy dashboards, consent management, and mechanisms for exercising data subject rights of access, erasure and rectification. Complementary ENISA PET works are referenced in the report (Pseudonymisation techniques 2019, Advanced Pseudonymisation 2021, Engineering Personal Data Sharing 2023, Engineering Personal Data Protection in EU Data Spaces 2023).

Emergency Planning and Community Right-to-Know Act (EPCRA), 42 U.S.C. §§ 11001-11050, also known as SARA Title III. Four distinct programs: Section 302/303 emergency planning (40 CFR Part 355 Subpart B), Section 304 emergency release notification (40 CFR Part 355 Subpart C), Sections 311/312 hazardous chemical inventory reporting / Tier II (40 CFR Part 370), and Section 313 Toxic Release Inventory / Form R (40 CFR Part 372).

The federal hazardous waste rules under RCRA Subtitle C (40 CFR Parts 260 to 273): how a generator determines its waste and its monthly category, the conditions for accumulating without a permit, manifests and e-Manifest, reports and exports; transporter duties; the standards, permits, closure and financial assurance for treatment, storage and disposal facilities; hazardous waste pharmaceuticals at healthcare facilities; land disposal restrictions; and universal waste. Built from the eCFR text current to September 22, 2026.

EPA's Risk Management Program rule under Clean Air Act section 112(r)(7) (40 CFR Part 68): for facilities holding more than a threshold quantity of a listed toxic or flammable substance, the program levels, management system, worst-case and alternative release analyses and accident history, the Program 2 and Program 3 prevention programs (process safety information, hazard analysis with safer technology analysis, procedures, training, mechanical integrity, change management, audits including third-party audits, incident investigation with root cause analysis, employee participation, hot work, contractors), emergency response coordination, programs and exercises, the risk management plan submitted to EPA, and public information duties. Built from the eCFR text current to September 22, 2026, which carries the 2024 amendments; EPA's 2026 proposal to roll some of them back is not final.

ESRB Privacy Certified is the Entertainment Software Rating Board's children's privacy certification program and an FTC-approved COPPA safe harbor (16 CFR 312.11), whose members are deemed to comply with the COPPA Rule when they meet its requirements. Built from the program's own requirements, published as Exhibit A to the FTC's 2018 approval letter: compliance reports and monitoring, the site coordinator, notice of changes, complaint handling and dispute resolution, the general and children's privacy statement disclosures and seal placement, direct notice and verifiable parental consent with its exceptions, parental access and deletion, and data collection, security and accuracy. A second layer sets out what the amended COPPA Rule (2025) now requires the program to carry: separate consent for third-party disclosure, a written information security program, a written retention policy and an expanded online notice.

The revised European Sustainability Reporting Standards that undertakings in the scope of the EU Accounting Directive apply from financial years beginning in 2027: how double materiality decides what is reported, how the sustainability statement is prepared, structured and connected to the accounts, the cross-cutting governance, strategy, materiality and policy, action, metric and target disclosures, and the disclosure requirements of the ten topical standards on climate, pollution, water, biodiversity, circular economy, own workforce, value chain workers, communities, consumers and business conduct.

ETSI EN 303 645 V3.1.3 (2024-09) is the European baseline standard for the cyber security of consumer internet of things devices and their associated services. It sets 78 provisions in thirteen areas plus a reporting duty and data protection provisions: no universal default passwords, a published vulnerability disclosure policy, secure and timely software updates with a published support period, secure storage of keys and credentials, secure communication, a minimised attack surface, software integrity, protection of personal data, resilience to outages, telemetry review, easy deletion of user data, easy secure installation, input validation, and transparency, consent and minimisation for personal data. 36 provisions are mandatory (shall) and 42 are recommendations (should), several of them conditional on a feature or a stated condition; the manufacturer records why any recommendation is not applied.

ETSI's Group Specifications for QKD equipment and networks, all eleven published specifications and modelled: the Common Criteria Protection Profile certified as BSI PP 0120, the module security specification (boundary, two-factor operator authentication, tamper response, environmental protection, side channels, key management, self-tests, life-cycle and Security Policy), what a security proof must state and how an implementation is verified against it, traceable measurement of sources and detectors, deployment planning between QKD and network operators, and the application, key delivery, SDN control, orchestration and key-manager interoperability interfaces.

The world's first comprehensive AI regulation, establishing risk-based rules for the placing on the market, putting into service and use of AI systems in the Union. Adopted 13 Jun 2024 (OJ L 1689/2024); entered into force 1 Aug 2024 with staged application: prohibited practices and AI literacy from 2 Feb 2025; GPAI obligations from 2 Aug 2025; most high-risk AI obligations from 2 Aug 2026; full application from 2 Aug 2027. 113 articles across 13 chapters: general provisions, prohibited AI practices, high-risk AI systems (classification, requirements, operator obligations, notified bodies, conformity assessment, standards), transparency for certain AI, general-purpose AI models (incl systemic-risk GPAI), measures for innovation (regulatory sandboxes), governance (AI Office, AI Board, scientific panel), the EU database for high-risk AI, post-market monitoring and market surveillance, codes of conduct and guidelines, delegation/committee, penalties, and final provisions including the right to explanation of individual decision-making.

The EU directive that sets what every limited liability undertaking's annual accounts must contain and how they are measured, presented, consolidated, reported on by management, audited and published, now carrying the sustainability reporting duties for large undertakings and groups, the third-country group reports, payments-to-governments reporting for extractive and logging companies and public country-by-country tax reporting for the largest groups.

The EU Audiovisual Media Services Directive (AVMSD) coordinates national legislation across the EU on audiovisual media services covering: traditional linear television broadcasts; on-demand audiovisual media services; and (since the 2018 amendment) video-sharing platform services (VSPs). It establishes the country-of-origin principle, content standards (incitement to violence/terrorism, protection of minors, accessibility), rules on audiovisual commercial communications (advertising, sponsorship, product placement), promotion of European works (quotas for linear, prominence for on-demand), the right of reply, dedicated obligations for video-sharing platforms (Articles 28a-28b: jurisdiction and platform protection measures for terrorism, child sexual abuse material, illegal hate speech, advertising and age verification), independence of national regulatory authorities (Articles 30, 30a, 30b establishing ERGA), and media-literacy obligations. The Directive is implemented through national transposition; VSP obligations have been partially superseded for VLOPs by the Digital Services Act (Regulation (EU) 2022/2065) but remain authoritative for non-VLOP VSPs and for AVMSD-specific audiovisual obligations.

The Batteries Regulation replaces Directive 2006/66/EC with a life-cycle regime for all batteries placed on the EU market: substance restrictions, carbon footprint declarations, classes and thresholds, recycled content documentation and minimum shares, performance and durability requirements, removability and replaceability of portable and LMT batteries from February 2027, safety of stationary storage systems, labelling with the separate collection symbol and a QR code, state of health data in the battery management system, conformity assessment with CE marking, the obligations of manufacturers, importers, distributors, fulfilment providers and second-life operators, supply-chain due diligence for cobalt, natural graphite, lithium and nickel (from 18 August 2027 after Regulation (EU) 2025/1561), producer registration, extended producer responsibility, collection targets, treatment, recycling efficiency and material recovery targets, reporting, and the battery passport for LMT, industrial and electric vehicle batteries from 18 February 2027.

The European Strategy for a Better Internet for Kids (BIK+) is a Commission Communication (COM(2022) 212 final, 11 May 2022) updating the original 2012 BIK strategy. It is a non-binding policy document organised around three pillars: (1) Safe digital experiences (better protect children online) including an EU code of conduct on age-appropriate design (building on the DSA, AVMSD and GDPR), age-verification and EU-wide digital proof of age (eID-based), tackling online child sexual abuse, combating cyberbullying and the 116 111 helpline, the Safer Internet Centres (SICs) network, and safety in gaming/recommender systems/addictive design; (2) Digital empowerment (better empower children to make sound choices) including media and information literacy, digital skills aligned with Digital Decade targets, digital citizenship education, the betterinternetforkids.eu portal, and awareness-raising including Safer Internet Day; (3) Active participation (respect childrens views) including child participation in policymaking, industry youth consultations, peer-to-peer activities, and children as content creators with safeguards. Section 6 covers International outreach and cooperation. As a non-binding Communication BIK+ is implemented by Member States and industry through aligned actions; this entry tracks the Strategy structure and policy levers.

The Corporate Sustainability Due Diligence Directive, as amended by Directive (EU) 2026/470, requires very large EU and third-country companies to carry out risk-based human rights and environmental due diligence across their own operations, their subsidiaries and their chains of activities: a due diligence policy and code of conduct, a scoping exercise and in-depth assessment of adverse impacts, prioritisation, prevention and corrective action plans with contractual assurances and SME support, last-resort suspension with an enhanced action plan, remediation, stakeholder engagement, a complaints procedure and notification mechanism, monitoring at least every five years, an annual statement and, for third-country companies, an authorised representative. Scope is above 5,000 employees and EUR 1.5 billion turnover; national authorities supervise with penalties capped at 3 percent of worldwide turnover; liability follows national law; companies comply from 26 July 2029. The climate transition plan duty was deleted.

The EU Carbon Border Adjustment Mechanism (CBAM) is an EU import-side carbon-pricing instrument designed to address carbon leakage and to mirror, at the border, the carbon cost faced by EU producers under the EU Emissions Trading System (EU ETS). Regulation (EU) 2023/956 applies to imports of cement, iron and steel, aluminium, fertilisers, electricity and hydrogen (Annex I), with downstream products added by 2025 amending acts. The CBAM has a transitional phase from 1 October 2023 until 31 December 2025 (quarterly reporting only) and a definitive phase from 1 January 2026 (financial obligation: authorised CBAM declarants must surrender CBAM certificates corresponding to the embedded emissions in the imported goods, at a price linked to the EU ETS allowance auction price). Operation: importers must obtain authorised CBAM declarant status (Art.4-5), file annual CBAM declarations covering embedded emissions (Art.6), verify embedded emissions through accredited verifiers (Art.8), and may deduct carbon prices paid in the country of origin (Art.9). Certificates are sold by Member States (Art.20), surrendered annually (Art.22, with minimum 80% holding rule), with limited repurchase (Art.23) and annual cancellation (Art.24). Enforcement: penalties for unsurrendered certificates (Art.26) and anti-circumvention (Art.27).

The EU Chips Act establishes a comprehensive EU framework to strengthen Europe's semiconductor ecosystem with three pillars. Pillar 1 - Chips for Europe Initiative - funds Union-wide R&D, the design platform, pilot lines for advanced semiconductor manufacturing, advanced packaging/test/assembly capacity, quantum design capacity and skills development, organised around the European Chips Infrastructure Consortium (ECIC) and a European network of competence centres. Pillar 2 - Security of Supply and Resilience - establishes Integrated Production Facilities (IPF) and Open EU Foundries (OEF) with first-of-a-kind status, Design Centres of Excellence, fast-tracked permit procedures and a state-aid framework. Pillar 3 - Monitoring and Crisis Response - mandates strategic mapping, an early-warning monitoring system, key-market-actor identification, alerts/preventive action, crisis-stage activation, an emergency toolbox (information gathering, priority-rated orders, common purchasing). Governance is via the European Semiconductor Board (ESB) and Member State national competent authorities + single points of contact. The Regulation entered into force on 21 September 2023; certain provisions apply progressively per Article 41.

Regulation (EU) No 536/2014 (the Clinical Trials Regulation, CTR) harmonises the authorisation and conduct of clinical trials on medicinal products for human use across the EU/EEA. It repealed Directive 2001/20/EC and came into application on 31 January 2022 following the go-live of the Clinical Trials Information System (CTIS), with mandatory CTIS use from 31 January 2023 (new trials) and full transition by 31 January 2025 (legacy 2001/20/EC trials). Key features: a single EU-wide application through CTIS; harmonised Part I (scientific) and Part II (national / ethics) assessment with one Reporting Member State; substantial modification procedure; subject protection and informed consent rules (with specific provisions for incapacitated subjects, minors, pregnant/breastfeeding women, emergency trials); safety reporting (SUSAR via EudraVigilance, annual safety reports, serious breach reporting); compliance with the protocol and Good Clinical Practice; risk-based monitoring; trial master file and 25-year retention; manufacturing/import authorisation for investigational medicinal products (IMPs) with qualified person responsibility; harmonised labelling; sponsor and investigator obligations; damage compensation systems by Member States; Member State inspections and Union controls; the EU portal and EU database (CTIS) with public-transparency layer; the Clinical Trials Coordination and Advisory Group (CTAG); fees; data protection (alignment with the GDPR for clinical-trial data); penalties.

Regulation (EU) 2024/2847 (the Cyber Resilience Act, CRA) introduces horizontal cybersecurity requirements for Products with Digital Elements (PDEs) placed on the Union market and for their manufacturers, importers and distributors. PDEs cover hardware, software and remote data processing solutions that are connected directly or indirectly to a device or network and intended to be placed on the market separately or alongside a product. The Regulation imposes: (a) Article 13 manufacturer obligations including cybersecurity risk assessment, due diligence on third-party components, a documented support period and security updates throughout, compliance with the essential cybersecurity requirements (Annex I Part I) and the vulnerability handling requirements (Annex I Part II); (b) Article 14 reporting obligations including a 24-hour early-warning notification of actively exploited vulnerabilities to ENISA + CSIRT, 72-hour update, final report, and a parallel 24h/72h severe-incident notification regime, channelled through the single reporting platform under Article 16; (c) Articles 18-25 obligations for authorised representatives, importers, distributors, open-source software stewards and security attestations; (d) Articles 27-34 conformity assessment (Module A self-assessment for default products; Modules B+C / Module H notified-body involvement for important products under Article 7 and critical products under Article 8, with mandatory European cybersecurity certification under Regulation (EU) 2019/881 for critical products as the conformity-assessment route); (e) Articles 35-51 notification of conformity-assessment bodies; (f) Articles 52-60 market surveillance and the Union safeguard procedure; (g) Article 64 penalties (up to EUR 15 million or 2.5% of worldwide annual turnover for breach of essential requirements). Entered into force 10 December 2024; main obligations apply from 11 December 2027 with the Article 14 reporting regime applying from 11 September 2026.

Regulation (EU) 2025/38 (the Cyber Solidarity Act, CSA) builds Union-level cybersecurity solidarity and response capacity through three pillars. Pillar 1 - the European Cybersecurity Alert System - establishes a Union-wide network of National Cyber Hubs and Cross-Border Cyber Hubs (deployed SOC consortia) for early detection of significant cyber threats and incidents across critical sectors, with information sharing inside and across the network and into Union-level networks (CSIRTs network, EU-CyCLONe). Pillar 2 - the Cybersecurity Emergency Mechanism - supports coordinated preparedness testing of essential and important entities under NIS2, establishes the EU Cybersecurity Reserve of certified private incident-response services available to Member States, Union institutions and DEP-associated third countries, supports mutual assistance and is coordinated with Union crisis management mechanisms. Pillar 3 - the European Cybersecurity Incident Review Mechanism - mandates post-incident review of significant or large-scale cybersecurity incidents, run by ENISA at the request of the Commission, EU-CyCLONe or the NIS Cooperation Group, with lessons-learned reports.

Regulation (EU) 2023/2854 (the Data Act) creates the EU horizontal regime for fair access to and use of data. It applies from 12 September 2025. Key levers: Chapter II grants users of connected products and related services a right to access the data they generate and to share that data with third parties of their choice, and imposes data-by-design obligations on manufacturers and data holders. Chapter III governs business-to-business data sharing conditions (FRAND, no abuse of dominance, dispute settlement). Chapter IV prohibits unfair contractual terms unilaterally imposed in B2B data-sharing contracts. Chapter V creates a public-sector exceptional-need access regime for the Commission, the ECB, Union bodies and public sector bodies. Chapter VI imposes the cloud-switching regime on providers of data processing services (cloud + edge): removal of obstacles, contractual terms, gradual withdrawal of switching charges by 12 January 2027, functional equivalence, technical-aspects-of-switching obligations. Chapter VII restricts third-country foreign-court access to non-personal data held in the Union. Chapter VIII sets interoperability essential requirements for data spaces, in-parallel use of data processing services, and smart-contract essential requirements. Chapter IX establishes competent authorities, complaint and remedy rights, and penalties. Chapter X-XI cover the sui generis database-right adjustment (Directive 96/9/EC), model contractual terms, the European Data Innovation Board (EDIB), and the final provisions.

Regulation (EU) 2022/868 (the Data Governance Act, DGA) establishes EU horizontal rules for data governance. It applied from 24 September 2023. The DGA creates four operational regimes framed around the European data spaces. Chapter II governs the re-use of protected data held by public sector bodies (data subject to commercial confidentiality, IP rights, statistical confidentiality or personal data): conditions for re-use, anonymisation / pseudonymisation, single information points, third-country safeguards. Chapter III regulates data intermediation services (DIS): mandatory notification, neutrality / structural separation from data-trader activities, ICT-security obligations, transparency. Chapter IV creates the data-altruism regime: voluntary registration of recognised data-altruism organisations, the European Data Altruism Consent Form, transparency and safeguarding requirements for data subjects. Chapter V designates competent authorities and grants complaint + judicial-remedy rights. Chapter VI establishes the European Data Innovation Board (EDIB) - the body the Data Act and other horizontal data instruments rely on for technical guidance. Chapter VII restricts international access and transfer of protected non-personal data held in the Union. Chapters VIII-IX cover delegation, committee procedure, penalties, evaluation by 24 September 2025 and transitional provisions (DIS notification deadline, recognised data-altruism organisations).

The EU delegated act that switched on the Radio Equipment Directive's cybersecurity essential requirements from 1 August 2025: network protection for internet-connected radio products, privacy safeguards for connected, childcare, toy and wearable devices, and fraud protection for devices that move money, with the EN 18031 conformity route and a repeal from 11 December 2027 when the Cyber Resilience Act takes over.

Regulation (EU) 2022/1925 (the Digital Markets Act, DMA) creates EU ex-ante rules for the largest digital platforms ('gatekeepers') providing 'core platform services' (CPS): online intermediation, search engines, social networks, video-sharing platforms, number-independent interpersonal communication services (N-IICS), operating systems, web browsers, virtual assistants, cloud computing services, online advertising services. Applied from 2 May 2023; gatekeepers were first designated September 2023 with the 6-month obligation-compliance deadline of 6 March 2024. Article 3 sets the quantitative + qualitative designation criteria (turnover thresholds, EUR 7.5B annual EU revenue or EUR 75B market cap; >=45M monthly active end users and >=10K monthly active business users in EU; entrenched and durable position over the past three financial years). Article 4 reviews designation. Article 5 lists the 'self-executing' obligations (e.g. no cross-service personal-data combining without consent, allow business users to offer cheaper elsewhere, allow free communication with end users acquired through the CPS, no anti-steering, transparency in advertising). Article 6 lists obligations susceptible to specification (no use of non-public business-user data, allow uninstallation + default changes + third-party app stores, non-discriminatory ranking, interoperability with hardware/software, effective data portability, FRAND access to app stores / search / N-IICS / social networks, fair termination conditions). Article 7 specifically imposes phased N-IICS interoperability. Article 14 imposes acquisition-notification obligations. Article 23 sets dawn-raid inspection powers. Article 28 mandates a compliance function. Article 30 sets the penalty regime (up to 10% of worldwide annual turnover; 20% for repeat infringements). The DMA operates alongside competition law and is enforced centrally by the European Commission.

The Ecodesign for Sustainable Products Regulation replaces the Ecodesign Directive 2009/125/EC with a framework under which the Commission sets, by delegated act per product group, performance and information requirements on durability, reliability, repairability, upgradability, substances of concern, energy, water and resource efficiency, recycled content, remanufacturing, recyclability, carbon and environmental footprint and waste, backed by a digital product passport connected to a unique product identifier and a Commission register, labelling rules, a ban on destroying unsold apparel and footwear from 19 July 2026 with annual disclosure of discarded unsold products, and the obligations of manufacturers, authorised representatives, importers, distributors, dealers, fulfilment service providers, online marketplaces and supply-chain actors, enforced through CE marking, market surveillance and national penalties.

Directive (EU) 2024/1275 (the EPBD Recast) is the EU's central building-decarbonisation instrument, repealing Directive 2010/31/EU. It entered into force on 28 May 2024 and Member States must transpose by 29 May 2026. Key deliverables: National Building Renovation Plans (NBRPs) every 5 years setting national decarbonisation trajectories aligned with the 2050 climate-neutrality goal; Zero-Emission Building (ZEB) standard for all new buildings (Article 7: new public buildings from 1 January 2028, all new buildings from 1 January 2030); Article 8 trajectory for existing-building renovations; Article 9 Minimum Energy Performance Standards (MEPS) for non-residential buildings (top-worst 16% in 2030, top-worst 26% in 2033) and Member-State trajectories for progressive improvement of the residential building stock; Article 10 solar-energy-on-buildings rollout (new public + non-residential from 2026, parking +2027, new residential 2029, renovations 2027); Article 11 ZEB standard specification (very low energy demand + zero on-site fossil-fuel emissions); Article 12 deep-renovation Renovation Passport voluntary scheme; Article 13 Technical Building Systems (TBS) requirements; Article 14 sustainable-mobility infrastructure (EV charging, bike parking); Article 15 Smart Readiness Indicator (SRI); Article 16 data exchange; Articles 19-22 Energy Performance Certificates (EPC) issue + display + databases; Articles 23-27 inspections + independent experts + certification + independent control system; Article 34 penalties.

Regulation (EU) 2024/1083 (the European Media Freedom Act, EMFA) establishes a common framework for media services in the internal market and amends the AVMSD (Directive 2010/13/EU). It entered into force on 7 May 2024 and applies from 8 August 2025 (with Articles 3, 4(1)-(2) and 6(3) applying from 8 November 2024). Key levers: Article 4 rights of media service providers including the protection against intrusive surveillance (no spyware on journalists' devices except specific safeguards) and the protection of journalistic sources; Article 5 safeguards for the independent functioning of public service media (independent boards, adequate and stable funding, transparent appointments); Article 6 duties of media service providers including ownership transparency; Articles 8-13 the new European Board for Media Services (replacing the ERGA structure); Article 18 protection of media-service-provider content on very large online platforms (VLOPs) from arbitrary moderation, with a specific notice-and-redress regime; Article 19 structured dialogue between VLOPs, the Board and media-service providers; Article 20 right to customise the media offering on smart-television interfaces; Article 22 media market concentration assessment; Article 24 audience-measurement transparency; Article 25 transparency of public-funds allocation for state advertising. EMFA coordinates with AVMSD (which it amends), DSA (VLOP supervision), DMA (gatekeeper-platform issues) and the GDPR (data-protection of journalistic sources).

The EU regulation that fixes what every food label and food information must say and how: fair and accurate information, twelve mandatory particulars, minimum legibility, pre-purchase information for online sales, allergen emphasis, QUID, net quantity, dates, origin and a standard nutrition declaration, with allergen information mandatory even for unpacked food.

Regulation (EU) 2023/988 (the General Product Safety Regulation, GPSR) is the EU horizontal product-safety regime for non-food consumer products, applicable from 13 December 2024. It repeals Directive 2001/95/EC (the General Product Safety Directive). Key levers: Article 5 general safety requirement (only safe products may be placed on the market); Articles 6-8 assessment criteria (intrinsic characteristics, presentation, foreseeable use, exposure to other products, categories of consumers, cybersecurity features where they have a bearing on safety); Articles 9-13 manufacturer + authorised representative + importer + distributor obligations (including risk analysis, technical documentation, conformity-statement equivalent + Article 16 'responsible person in the Union' rule which makes a Union-established economic operator legally accountable for products from non-EU manufacturers); Article 18 specific traceability requirements; Article 19 distance-sales obligations (e-commerce); Article 20 accident-notification regime (Safety Business Gateway); Article 22 specific obligations on providers of online marketplaces (including the Article 22(4) single point of contact and Article 22(7) product recall interface obligations, Article 22(8)-(10) DSA-style notice-and-takedown for dangerous products + DSA-Art.30 trader-traceability link); Articles 23-32 market surveillance + Article 25-27 Safety Gate Rapid Alert System + Safety Business Gateway + Safety Gate Portal; Articles 33-37 recall notice template + remedies (repair, replacement, refund); Article 39 representative actions; Article 44 penalties.

Regulation (EU) 2017/746 (the IVDR) is the EU horizontal regime for in vitro diagnostic medical devices (IVDs). It applied from 26 May 2022 and replaced Directive 98/79/EC. Regulation (EU) 2024/1860 extended transitional periods for legacy IVDs to 2027-2029 staged by risk class. Key levers: Article 5 placing on the market gating + Article 8/Annex I general safety and performance requirements; Articles 10-15 manufacturer + authorised representative + importer + distributor + Person Responsible for Regulatory Compliance (PRRC) obligations; Article 16 substantial-modification rule; Article 17 EU declaration of conformity + Article 18 CE marking; UDI system (Articles 24-25) and economic-operator registration (Articles 26-28); Article 29 summary of safety and performance + Article 30 European database (EUDAMED); Article 47 risk classification (Class A/B/C/D) + Articles 48-54 conformity assessment routes including Article 50 mechanism for scrutiny of Class D devices; Articles 56-77 performance evaluation + performance studies + Article 59 informed consent (with interventional-clinical-performance studies running alongside the Clinical Trials Regulation); Articles 78-90 post-market surveillance + vigilance + serious incident reporting + Periodic Safety Update Report (PSUR); Articles 92-103 market surveillance + Member-State coordination + Medical Device Coordination Group + EU reference laboratories; Articles 102-104 confidentiality and data protection; Article 110 transitional provisions (as amended by (EU) 2024/1860); Articles 112-113 penalties + entry into force.

Regulation (EU) 2023/1230 (the Machinery Regulation) is the EU horizontal regime for machinery, related products and partly completed machinery placed on the Union market. It entered into force on 19 July 2023 and applies from 20 January 2027 (3.5-year transition for the Machinery Directive 2006/42/EC, which is repealed from that date). Key levers: Article 8 + Annex III essential health and safety requirements (EHSR) covering general safety integration, control systems, mechanical hazards, instructions for use, Annex III 1.1.9 protection against corruption (cybersecurity-as-safety) and Annex III 1.2 safety + reliability of control systems including AI integrated into safety functions; Article 6 + Annex I high-risk machinery categories requiring third-party notified-body conformity assessment (woodworking machines, portable cartridge-operated fixing tools, vehicle servicing lifts, etc., plus new categories like machinery with AI safety functions and high-risk software updates); Articles 10-19 economic-operator obligations (manufacturer, authorised representative, importer, distributor, partly-completed-machinery manufacturer); Article 17 substantial-modification rule; Articles 20-24 EU declaration of conformity + EU declaration of incorporation + CE marking; Articles 25-42 conformity assessment + notified bodies; Articles 43-46 market surveillance + Union safeguard; Article 50 penalties; Article 51 repeal of 2006/42/EC + 73/361/EEC; Article 54 entry into force + application from 20 January 2027.

Regulation (EU) 2023/1114 (the Markets in Crypto-Assets Regulation, MiCA) is the EU horizontal regime for crypto-assets that fall outside existing financial-services Union law. It entered into force on 29 June 2023; the e-money-token + asset-referenced-token regime (Titles III + IV) applied from 30 June 2024; the crypto-asset service provider (CASP) regime (Title V) + the remaining titles applied from 30 December 2024. MiCA categorises crypto-assets into three types: (1) asset-referenced tokens (ARTs) - stabilised by reference to multiple assets / currencies; (2) e-money tokens (EMTs) - stabilised by reference to a single fiat currency; (3) other crypto-assets including utility tokens. Title II governs offers and admission to trading of category-3 crypto-assets with a crypto-asset white-paper regime. Title III governs the authorisation + operating conditions for ART issuers including own-funds + reserve-of-assets + custody-of-reserve + governance + conflict-of-interest + redemption-right + significant-ART regime. Title IV governs EMT issuers (subset of EMD2 e-money institutions + credit institutions). Title V authorises CASPs to provide the 10 enumerated crypto-asset services (custody + administration of crypto-assets for clients, operation of a trading platform, exchange of crypto-assets for funds, exchange of crypto-assets for crypto-assets, execution of orders, placing of crypto-assets, reception + transmission of orders, providing advice on crypto-assets, providing portfolio management, providing transfer services for crypto-assets) with prudential + governance + conduct + custody + outsourcing + complaints + conflicts + wind-down obligations. Title VI prohibits insider dealing + unlawful disclosure + market manipulation. Title VII establishes competent authority + EBA + ESMA powers including the significant-token supervisory regime. Titles VIII-IX cover delegated acts + transitional + final provisions.

Regulation (EU) 2017/745 (the MDR) is the EU horizontal regime for medical devices and accessories, replacing the prior MDD (93/42/EEC) and AIMDD (90/385/EEC) framework. It applied from 26 May 2021. Regulation (EU) 2023/607 extended transitional periods for legacy MDs (under MDD/AIMDD certificates) by risk class: Class III implantables + Class IIb implantables (with exceptions) until 31 December 2027; other Class IIb + Class IIa + Class I (sterile/measuring) until 31 December 2028; legacy Class I (with NB involvement under MDD Annex II/V) until same dates. Key levers: Article 5 placing on market gating + Article 7 prohibition of misleading claims; Articles 10-15 manufacturer + authorised representative + importer + distributor + Person Responsible for Regulatory Compliance (PRRC) obligations; Article 16 substantial-modification rule; Articles 17-23 single-use device reprocessing + implant card + EU declaration of conformity + CE marking + special-purpose devices + systems/procedure packs; Article 25 supply-chain identification; Articles 27-30 UDI system + UDI database + device registration; Article 31 economic-operator registration; Article 32 summary of safety and clinical performance (SSCP, public via EUDAMED); Article 33 EUDAMED. Article 51 risk classification (Class I/IIa/IIb/III). Articles 52-60 conformity assessment + Article 54 consultation procedure for certain Class III/IIb + Article 55 scrutiny mechanism for certain Class III/IIb. Articles 61-82 clinical evaluation + clinical investigations including informed consent + vulnerable subject protection + adverse-event recording. Articles 83-90 post-market surveillance + Periodic Safety Update Report (PSUR) + serious-incident reporting + Field Safety Corrective Actions (FSCAs) + trend reporting. Article 109 confidentiality + Article 110-111 data protection. Article 116 civil-liability financial-coverage requirement. Article 120 transitional provisions (as amended by 2023/607).

Commission Delegated Regulation (EU) 2024/1366 of 11 March 2024 establishing the Network Code on sector-specific rules for cybersecurity aspects of cross-border electricity flows (NCCS) is the EU's first sector-specific cybersecurity network code, adopted under Article 59(2)(e) of Regulation (EU) 2019/943 (the Electricity Regulation). NCCS entered into force on 13 June 2024 and is directly applicable in all Member States; transposition is not required but Member States must designate competent authorities + ensure operational implementation. NCCS establishes: (a) a four-level cybersecurity risk-assessment cascade (Union-wide, regional, Member State, and entity-level) with the Union-wide assessment coordinated by ENTSO-E + the EU DSO Entity supported by ACER and the Member State competent authorities; (b) a classification of in-scope entities into 'high-impact' and 'critical-impact' categories based on contribution to cross-border electricity flows + Annex criteria; (c) common minimum cybersecurity controls + advanced cybersecurity controls for high-impact + critical-impact entities respectively; (d) a verification + mutual-recognition scheme for cross-border conformity assessment; (e) a cyber-attack reporting + early-warning system + crisis management framework supplementing NIS2 (Directive (EU) 2022/2555) + CER Directive (Directive (EU) 2022/2557) + EU Cyber Solidarity Act (Regulation (EU) 2025/38); (f) supply-chain cybersecurity requirements; (g) information protection regime including handling of sensitive electricity-grid information. NCCS is implemented through the ENTSO-E + EU DSO Entity joint methodology (Article 8) submitted to ACER for approval. The first Union-wide cybersecurity risk assessment cycle began in 2024-2025 with the first results expected 2026-2027.

The EU directive of February 2026 that simplifies sustainability reporting and due diligence: it lifts the reporting thresholds to EUR 450 million turnover and 1 000 employees, shields smaller value chain suppliers from data requests beyond the voluntary standards, keeps assurance at limited level, and raises the due diligence thresholds while reshaping risk assessment, supplier exit, monitoring, penalties and liability.

Directive (EU) 2015/2366 of 25 November 2015 on payment services in the internal market (PSD2). PSD2 entered into force on 12 January 2016 and Member States transposed it by 13 January 2018. It repealed Directive 2007/64/EC (PSD1) and modernised the EU payments framework by: extending the scope to one-leg-out + third-country-currency transactions; creating two new regulated activities (Payment Initiation Services + Account Information Services) and the corresponding Open Banking regime via the access-to-accounts rules in Articles 65-67; mandating Strong Customer Authentication in Article 97 with three-element elements - knowledge / possession / inherence - and dynamic linking for remote payments; requiring operational + security risk management + incident reporting + the Article 98 EBA Regulatory Technical Standards (Commission Delegated Regulation (EU) 2018/389 on the SCA-RTS and the common + secure open standards of communication); and tightening consumer-liability + refund + safeguarding rules. PSD2 remains in force until the PSD3 Directive + Payment Services Regulation (PSR) (Commission proposals COM(2023) 366 + COM(2023) 367 of 28 June 2023) are adopted and transposed. Note: the PSD2 SCA-RTS (Commission Delegated Regulation (EU) 2018/389) is tracked separately as the 'PSD2 SCA' framework entry.

Directive (EU) 2024/2831 on improving working conditions in platform work, adopted 23 October 2024 and in force since 1 December 2024, with national transposition due by 2 December 2026. It gives persons working through digital labour platforms a rebuttable legal presumption of employment where facts show direction and control, with the platform bearing the burden of proof, and regulates algorithmic management: prohibited processing, mandatory impact assessment, transparency on automated monitoring and decision-making systems, two-yearly human oversight, human-only decisions to suspend or terminate, explanation and review within two weeks, safety and health, consultation, reporting to authorities and protection from retaliation. Replaces the graph's earlier entry for the 2021 proposal.

Directive (EU) 2024/2853 of 23 October 2024 on liability for defective products is the new EU Product Liability Directive replacing Council Directive 85/374/EEC (which had governed product liability since 1985). The 2024 PLD entered into force on 8 December 2024 and Member States must transpose it by 9 December 2026 (Article 24); 85/374/EEC remains applicable to products placed on the market before 9 December 2026 (Article 22 transitional). Key modernisation points: (a) expanded definition of 'product' in Article 4(1) explicitly including software (whether embedded or supplied separately as a SaaS / standalone product), AI systems, and digital manufacturing files; (b) expanded categories of damage in Article 6 covering destruction or corruption of data not used for professional purposes, medically recognised damage to psychological health, and material losses from data loss; (c) substantial modification rule in Article 4(18) making the modifier liable for the modified product; (d) economic-operator chain liability in Articles 7-8 including manufacturer + authorised representative + importer + fulfilment service provider + distributor + online platform under Article 7(3) where they have a contract with the consumer; (e) disclosure-of-evidence regime in Article 9 (the new procedural rules requiring defendants + third parties to disclose relevant evidence on plaintiff motion) and Article 11 presumptions of defectiveness + causality; (f) cybersecurity-related defect treatment (a cybersecurity defect that compromises product safety qualifies as a 'defect' per Recital 38 + Article 7(2)(d)); (g) limitation periods in Articles 15-16: 3-year claim limitation + 10-year long-stop from the date the actual defective product was placed on the market / put into service / substantially modified, extended to 25 years for latent personal injury. Coordination with the proposed AI Liability Directive (Commission Proposal COM(2022) 496): the Commission withdrew the AILD proposal in February 2025 making the 2024 PLD the operative regime for AI-product liability.

Regulation (EU) 2019/2088 of 27 November 2019 on sustainability-related disclosures in the financial services sector (SFDR). SFDR applied from 10 March 2021 with the level 2 SFDR Regulatory Technical Standards (Commission Delegated Regulation (EU) 2022/1288 of 6 April 2022, applicable from 1 January 2023) operationalising the entity-level Article 4 PAI statement, the pre-contractual disclosures for Articles 8/9 financial products, the website disclosures under Article 10, and the periodic reports under Article 11. SFDR creates: (a) entity-level disclosure obligations on financial market participants (FMPs) and financial advisers (Articles 3-5): sustainability-risk policies, the principal-adverse-impacts statement (PAI 14 mandatory indicators + 2 from each of opt-in lists), and remuneration-policy alignment with sustainability risks; (b) product-level disclosure obligations differentiated by product category: Article 6 mainstream-financial-product disclosure of sustainability-risk integration, Article 7 PAI consideration at product level, Article 8 products that promote environmental or social characteristics ('light-green'), Article 9 products with a sustainable investment objective ('dark-green') including the Article 9(3) carbon-emission-reduction objective using EU Climate Transition Benchmarks (CTB) or EU Paris-Aligned Benchmarks (PAB); (c) website disclosures (Article 10) and periodic reports (Article 11) for Articles 8 + 9 products; (d) marketing-consistency obligation (Article 13). SFDR is the cornerstone of the EU sustainable-finance framework alongside the Taxonomy Regulation (EU) 2020/852 (Article 8 + 9 products must disclose Taxonomy-alignment) and the Corporate Sustainability Reporting Directive (EU) 2022/2464 (CSRD/ESRS - the corporate counterpart of SFDR). The European Commission published a comprehensive SFDR review in 2023 + 2024 considering relabelling of categories and a possible SFDR 2.0; pending that, this regulation remains in force.

Directive 2012/18/EU of 4 July 2012 on the control of major-accident hazards involving dangerous substances (the Seveso III Directive) is the EU's chemical-industry major-accident safety regime. Seveso III entered into force on 13 August 2012, was transposed by Member States by 31 May 2015, and applied to operators from 1 June 2015. It repeals + replaces the earlier Seveso II Directive (96/82/EC). Seveso III is named after the 1976 Seveso disaster in Italy where dioxin was released from an industrial accident; the regime has been progressively strengthened (Seveso I 82/501/EEC, Seveso II 96/82/EC, Seveso III 2012/18/EU) to address industrial chemical accidents. The Directive imposes obligations on the operators of establishments holding dangerous substances above defined qualifying quantities (Annex I), differentiating between LOWER-TIER establishments (Article 6 notification + Article 7 Major-Accident Prevention Policy MAPP) and UPPER-TIER establishments (additionally Article 8 safety report + Article 11 emergency plans + Article 14 public consultation). It also requires Member States to organise inspections (Article 20), maintain information systems including the Seveso Plants Information Retrieval System SPIRS (Article 21), ensure access to information + public participation (Articles 14-15 + 22-23 with Aarhus Convention alignment), and impose effective + proportionate + dissuasive penalties (Article 28). The 2025 Commission Communication on Industrial Safety + ongoing work on a Seveso IV is expected but not yet proposed.

The EU directive that governs who may perform statutory audits and sustainability assurance in the Union and how: approval, registration, ethics, independence, firm organisation, auditing and assurance standards, group audits, the audit and assurance reports, quality assurance, and the duties of audited entities and their audit committees on appointing, dismissing and overseeing the auditor.

Regulation (EU) 2020/852 of 18 June 2020 establishing a framework to facilitate sustainable investment ('the Taxonomy Regulation'). The Taxonomy Regulation entered into force on 12 July 2020 and is the cornerstone of the EU sustainable finance legislative framework alongside SFDR (Regulation (EU) 2019/2088) and CSRD (Directive (EU) 2022/2464). It creates a unified EU classification system - the 'Taxonomy' - for environmentally sustainable economic activities. An economic activity qualifies as environmentally sustainable under Article 3 if it: (a) makes a substantial contribution to one or more of the six environmental objectives in Article 9 + Articles 10-15; (b) does not significantly harm any of the other objectives (the DNSH test in Article 17); (c) is carried out in compliance with the minimum safeguards laid down in Article 18 (OECD MNE Guidelines + UN Guiding Principles on Business and Human Rights + ILO Declaration on Fundamental Principles and Rights at Work + the International Bill of Human Rights); and (d) complies with the technical screening criteria established by the Commission Delegated Acts under Article 19. The six environmental objectives (Article 9) are: climate change mitigation; climate change adaptation; sustainable use and protection of water and marine resources; transition to a circular economy; pollution prevention and control; protection and restoration of biodiversity and ecosystems. The Commission Delegated Regulations operationalising the technical screening criteria are: (EU) 2021/2139 (Climate Delegated Act, climate change mitigation + adaptation TSC for 13 economic-activity sectors); (EU) 2023/2486 (Environmental Delegated Act, TSC for the four non-climate environmental objectives); (EU) 2021/2178 (Disclosures Delegated Act, the Article 8 KPI disclosure templates for turnover + CapEx + OpEx alignment); (EU) 2022/1214 (Gas + Nuclear Complementary Climate Delegated Act adding specific gas + nuclear activities to the climate objectives under defined conditions). Article 8 imposes the Taxonomy KPI disclosure obligation on undertakings within the scope of NFRD / CSRD: non-financial undertakings disclose the % of turnover + CapEx + OpEx aligned with the Taxonomy; financial undertakings disclose the Green Asset Ratio (GAR) for credit institutions + insurance KPI for insurance undertakings.

The EU voluntary sustainability reporting standard (VSME) as adopted in Delegated Regulation (EU) 2026/1560: Basic and Comprehensive Module disclosures for undertakings with up to 1,000 employees outside mandatory CSRD reporting, and the value chain cap limiting what large reporters may ask of them from 2027. Voluntary; replaces Recommendation (EU) 2025/1710.

Directive (EU) 2016/2102 of 26 October 2016 on the accessibility of the websites and mobile applications of public sector bodies (the Web Accessibility Directive, WAD). WAD entered into force on 22 December 2016, Member States transposed it by 23 September 2018 (Article 12), and the substantive obligations apply on staggered dates per Article 12(3): 23 September 2019 for websites published on or after 23 September 2018; 23 September 2020 for all other public-sector websites; 23 June 2021 for mobile applications. WAD imposes on public-sector bodies (broadly defined to cover State, regional, local authorities, bodies governed by public law + associations) the obligation to make their websites and mobile applications accessible by complying with the four POUR principles (Perceivable + Operable + Understandable + Robust) from WCAG 2.x. The presumption of conformity (Article 6) is established through the harmonised standard EN 301 549 (currently EN 301 549 v3.2.1, expected to evolve to v4.x with WCAG 2.2). Article 5 provides a disproportionate-burden exception with documented cost-benefit analysis. Article 7 requires a model accessibility statement + feedback mechanism + enforcement procedure link on every covered website. Article 8 imposes a periodic 3-year monitoring + Commission reporting obligation on Member States. WAD is complemented by the European Accessibility Act (Directive (EU) 2019/882) which extends accessibility requirements to private-sector products and services starting from 28 June 2025. WAD is the public-sector-only baseline; EAA is the wider private-sector cousin. Both directives reference EN 301 549 as the harmonised standard. Future evolution includes the ongoing EN 301 549 v4.x transition aligning with WCAG 2.2 + Mobile Accessibility Project + the Commission's planned consolidated 2026-2027 accessibility-framework communication.

Directive 2002/58/EC (the ePrivacy Directive) is the EU sectoral lex specialis on privacy in the electronic communications sector, alongside the GDPR (which is the lex generalis for personal data). The 2009/136/EC amendment introduced the prior-consent rule for cookies and similar storage-of-information technologies (Article 5(3)) and the security and personal-data-breach-notification regime (Article 4). The Directive applies to providers of publicly available electronic communications services and to natural and legal persons placing or accessing information stored in subscribers' / users' terminal equipment. The proposed ePrivacy Regulation has been WITHDRAWN by the European Commission (February 2025); the 2002/58/EC Directive remains the in-force instrument until the Commission tables a new proposal. Key operational articles: Article 4 security of services + personal-data-breach notification (60-day model in Article 4(3) feeds the GDPR Art.33-34 baseline); Article 5 confidentiality of the communications + Article 5(3) prior-consent storage-of-information rule (cookies, tracking pixels, fingerprinting); Article 6 traffic data; Article 7 itemised billing; Article 8 calling-line identification; Article 9 location data other than traffic data; Article 13 unsolicited communications (email/SMS/voice marketing).

EarthCheck Company Standard Version 4.2 (September 2025): the GSTC-recognised certification standard for sustainable travel and tourism organisations, covering a signed sustainability Policy and Statement, annual benchmarking across ten Key Performance Areas, governance and risk, a sustainability and energy management system (EMS and EnMS for high impact sites) and communication and interpretation.

Ecuador's comprehensive personal data protection law (LOPDP, Registro Oficial 459 of 26 May 2021, sanctions from 26 May 2023) with its Reglamento General of 2023 and the Superintendencia's 2025 rules on data protection officers: lawful bases and consent, rights answered within 15 days, children from 15, sensitive, credit and health data, processor contracts, risk-based security and privacy by design, impact assessments, breach notice within 5 working days to the Superintendencia and the telecommunications regulator and 3 to data subjects, records of processing, mandatory officers in listed sectors, registration of databases and transfers, international transfer safeguards, and fines up to 1% of turnover. Built from the law's own text.

Egypt's first comprehensive personal data protection law. Law No. 151 of 2020 promulgates the annexed Personal Data Protection Law (14 chapters, 49 articles) governing the electronic processing of personal data of natural persons by holders, controllers and processors, establishing the Personal Data Protection Centre, a licensing/permit regime, data subject rights, cross-border transfer controls, breach notification, and criminal/administrative penalties. Ratified 13 July 2020; effective from 15 October 2020.

The Equator Principles (EP4, July 2020) are a voluntary benchmark adopted by financial institutions (EPFIs) to identify, assess and manage the E&S risk of Projects. They apply worldwide and in every sector to Project Finance Advisory Services and Project Finance at US$10 million or more, Project-Related Corporate Loans of at least US$50 million and two years, qualifying Bridge Loans, and Project-Related Refinance and Acquisition Finance. Ten Principles cover categorisation, assessment (human rights and climate risk included, with a Climate Change Risk Assessment and alternatives analysis above 100,000 tCO2e a year), the applicable standards (IFC Performance Standards and World Bank EHS Guidelines outside Designated Countries), the ESMS, ESMP and Equator Principles Action Plan, stakeholder engagement and FPIC, grievance mechanisms, independent review, covenants, independent monitoring, and reporting; Annex A (climate alternatives, GHG quantification and reporting) and Annex B (EPFI minimum reporting) are integral. EPFIs had to implement EP4 by 1 October 2020.

Estonia's national Personal Data Protection Act (Isikuandmete kaitse seadus, RT I, 04.01.2019, 11, in force from 15 January 2019). The Act applies in conjunction with the GDPR: Chapter 2 implements the GDPR Article 85-89 derogations for journalistic, academic, scientific/historical research and archiving purposes; Chapter 3 covers national specifications including the child's age of consent (set at 13), processing after death of the data subject, processing in connection with violations of obligations, and processing in public places; Chapter 4 implements Directive (EU) 2016/680 (Law Enforcement Directive) for processing by law enforcement authorities, including processing principles, data subject rights, controller/processor obligations, the data protection specialist, security measures, breach notification, and transmission to third countries; Chapter 5 establishes the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) and its competence; Chapters 6-7 set liability, penalties and implementing provisions.

The ETI Base Code is the code of labour practice of the Ethical Trading Initiative, a UK-founded alliance of companies, trade unions and NGOs, built on International Labour Organisation conventions. Its nine clauses cover freely chosen employment, freedom of association and collective bargaining, safe and hygienic conditions, no child labour, living wages, hours that are not excessive (48 regular, 60 total in seven days save tightly bounded exceptions, one day off in seven), no discrimination, regular employment and no harsh or inhumane treatment. Its provisions are minimum standards: a company using it must still follow national and other law, and where both speak to one topic the more protective rule wins. ETI members adopt it, or an equivalent supplier code, as the basis of their ethical trade programme.

Ethiopia's first comprehensive personal data protection law. Personal Data Protection Proclamation No. 1321/2024, passed by the Federal House of Representatives on 4 April 2024 and published in the Federal Negarit Gazette No. 35 on 24 July 2024. The Proclamation has 70 articles governing the processing of personal data, including processing principles, lawfulness and consent, sensitive personal data (with stronger protections for minors), fairness/transparency/purpose limitation/accuracy/storage limitation/integrity/confidentiality/security, cross-border data transfer (with data sovereignty considerations), data subject rights (be informed, access, rectification, erasure, object, restriction, automated decisions, portability), a controller/processor registration regime, Data Protection Officer, security measures and breach notification, records of processing, DPIA, prior authorisation/consultation, data protection by design and by default, accountability, research exceptions, monitoring and enforcement, administrative fines and criminal sanctions.

Directive (EU) 2019/882 of 17 April 2019 on the accessibility requirements for products and services (the European Accessibility Act, EAA). EAA entered into force on 27 June 2019, Member States transposed it by 28 June 2022 (Article 31), and the substantive obligations apply from 28 June 2025 (Article 31(2)). The EAA is the EU's PRIVATE-SECTOR accessibility companion to the Web Accessibility Directive (WAD, 2016/2102) which covers public-sector websites + mobile apps. EAA imposes accessibility requirements on a specific set of products (Article 2(1)) and services (Article 2(2)): products include consumer general-purpose computer hardware + operating systems + self-service terminals (ATMs + ticketing + check-in + interactive self-service for travel + banking + retail), consumer terminal equipment used for electronic communications services + audiovisual media services + e-readers; services include electronic communications services + audiovisual media services access + air-rail-water-bus passenger transport services + consumer banking services + e-commerce services + e-books and dedicated software. Accessibility requirements are set out in Annex I sections I-VII. Economic operators (manufacturer + authorised representative + importer + distributor + service provider) have parallel obligations to those in horizontal product safety + market surveillance (GPSR + 2019/1020 + PLD). Article 14 provides the fundamental-alteration + disproportionate-burden exception + Article 4(5) microenterprise exemption (under 10 staff + EUR 2 million turnover or balance-sheet total). Article 32 transitional rule allows service providers to continue providing services concluded before 28 June 2025 until 28 June 2030 (5-year service-provider transitional rule); self-service-terminal exception extends to 20 years from first deployment (Article 32(2)) for specific categories. The EAA + WAD together form the EU's combined accessibility framework with the same harmonised standard EN 301 549 as the technical-conformance bar.

The EITI Standard 2023 is the global voluntary standard for the transparent and accountable management of natural resources (oil + gas + mining). The 2023 edition was adopted by the EITI Board in June 2023 and is structured in three parts: PART 1 - EITI Principles and Requirements (the substantive disclosure regime); PART 2 - EITI Board oversight and Validation (the assurance regime); PART 3 - EITI governance + management (the EITI Association, the International Secretariat, the EITI Board). EITI applies in 57 implementing countries (oil + gas + mining producers) which voluntarily commit to disclose payments + revenues + production + exports + contracts + licences + beneficial ownership of companies in the extractive value chain. The 2023 Standard introduces strengthened requirements on: (a) beneficial ownership transparency (Requirement 2.5 - extending the 2019-introduced obligation with stricter timelines + verification expectations); (b) contract + licence transparency (Requirement 2.4 - mandatory public disclosure of all new or amended contracts and licences from 1 January 2021 onwards); (c) energy transition + climate-related disclosures including environmental expenditures + greenhouse gas emissions + decarbonisation efforts (Requirement 6.4 - new in 2023); (d) gender + diversity in MSGs + EITI data + workforce (cross-cutting); (e) data accessibility + open data via the new Open Data Reporting Standard (Requirement 7.2). EITI is operationalised through multi-stakeholder groups (MSGs) in each implementing country comprising government + extractive companies + civil society representatives + supported by Independent Administrators. EITI is reinforced by EU + US + UK mandatory disclosure regimes (Directive 2013/34/EU Chapters 9 + 10 on country-by-country payment reporting; US Dodd-Frank Section 1504; UK + Canada equivalents). It serves as the principal transparency framework for the extractive sector and a complement to the UNGPs + OECD MNE Guidelines + the FATF beneficial-ownership regime + the Open Government Partnership.

FAA AC 20-152A objectives supplementing DO-254 for custom devices, COTS IP, COTS devices and circuit board assemblies.

The FAA's aircraft cybersecurity regime for transport category airplanes, engines and propellers: the three criteria of the special conditions issued on every new certification project since the Boeing 787 (isolation or protection from unauthorized access, prevention of inadvertent and malicious changes and adverse impacts, procedures to keep protections through the aircraft's life), the proposed 14 CFR 25.1319, 33.28(n) and 35.23(f) that would codify them, the draft AC 20-XXX recognising the RTCA DO-326A family as means of compliance, and the operator's aircraft network security program authorised by OpSpec D301 under AC 119-1A, and the cyber security criterion (D&R.115) written into the airworthiness criteria of special class unmanned aircraft. Built from the Federal Register texts and the advisory circulars themselves.

The FATF 40 Recommendations (last comprehensive revision February 2012 with subsequent targeted updates - R.15 Virtual Assets / VASPs 2018-2024, R.24 + R.25 Beneficial Ownership 2022-2024, R.8 Non-Profit Organisations 2016+2023, R.5 Terrorist Financing 2024) are the international standards on combating money laundering + terrorist financing + proliferation financing. The Recommendations are adopted by the Financial Action Task Force (FATF) and applied across 200+ jurisdictions through the FATF Global Network including the FATF-Style Regional Bodies (FSRBs): APG (Asia/Pacific), CFATF (Caribbean), EAG (Eurasian), ESAAMLG (Eastern + Southern Africa), GAFILAT (Latin America), GIABA (West Africa), GABAC (Central Africa), MENAFATF (Middle East + North Africa), MONEYVAL (Council of Europe). Mutual Evaluation cycles (currently the 5th round) assess country compliance through (a) Technical Compliance ratings (C / LC / PC / NC) against the 40 Recommendations + (b) Effectiveness ratings against the 11 Immediate Outcomes. Implementation is supplemented by Best Practices Papers + Methodology + Guidance documents on specific topics (Virtual Assets / VASPs, Beneficial Ownership, NPO sector, Politically Exposed Persons, Risk-Based Approach for various sectors). Non-compliance can lead to inclusion on the FATF Public Statement / 'Grey List' (jurisdictions under increased monitoring) or 'Black List' (High-Risk Jurisdictions Subject to a Call for Action) with severe market-access + correspondent-banking consequences. The 40 Recommendations are the foundational instrument for the EU AMLD6 + AMLD7 (Regulation (EU) 2024/1624 + Directive (EU) 2024/1640) + US Bank Secrecy Act / FinCEN Customer Due Diligence Rule + UK MLR 2017 + global AML/CFT laws.

FATF Recommendation 16 (Wire Transfers) was extended to Virtual Asset Service Providers (VASPs) in October 2018 + June 2019 (R.15 + Interpretive Note to R.15 + the FATF October 2018 Public Statement) operationalising the TRAVEL RULE for virtual asset transfers. The 2024 FATF Targeted Update on Virtual Assets + VASPs (R.15 / R.16) refined implementation expectations. CORE REQUIREMENTS: VASPs must obtain + hold + transmit required originator and beneficiary information for virtual asset transfers; the de minimis threshold is set at USD/EUR 1,000 (lower than for traditional wire transfers); information includes originator name + originator account number / wallet identifier + originator address or national identity number / customer identification number / date and place of birth + beneficiary name + beneficiary account number / wallet identifier. The recipient VASP must conduct counterparty VASP due diligence (CVDD) to determine that the counterparty VASP is licensed/registered + has appropriate AML/CFT controls + risk-rates the counterparty + applies enhanced measures where appropriate. The 'SUNRISE PROBLEM' refers to cross-jurisdictional implementation gaps where some jurisdictions have transposed FATF R.16 for VASPs but others have not - leaving VASPs in compliant jurisdictions transferring to or receiving from VASPs in non-compliant jurisdictions facing ambiguity. UNHOSTED WALLET TRANSFERS (transfers to or from self-hosted / non-custodial wallets) raise additional risks; the 2024 FATF Targeted Update reinforced that VASPs should apply risk-based + enhanced measures + collect originator information for outbound transfers to unhosted wallets + assess incoming transfers from unhosted wallets. EU implementation via Transfer of Funds Regulation (TFR) (Regulation (EU) 2023/1113) + complementing the MiCA + AMLR. US implementation via FinCEN 31 CFR 1010.410(f) (Travel Rule) covering CVCs (Convertible Virtual Currencies). UK implementation via the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017. Travel Rule technical infrastructure includes the InterVASP Messaging Standard (IVMS101) for data exchange + multiple competing networks (TRP, TRUST, Sygna Bridge, OpenVASP, Notabene, Sumsub Travel Rule). Travel Rule compliance is a precondition for VASP licensing in most jurisdictions + a barrier to market access for non-compliant VASPs.

The FBI Criminal Justice Information Services (CJIS) Security Policy establishes minimum security requirements for access to FBI CJIS Division systems and information including the National Crime Information Center (NCIC), Interstate Identification Index (III), and National Instant Criminal Background Check System (NICS). Version 5.9.4 (2024) applies to all entities accessing criminal justice information (CJI) including law enforcement, contractors, and cloud service providers.

47 CFR Part 64 Subpart U (sections 64.2001 to 64.2011) is the US Federal Communications Commission rulemaking implementing Section 222 of the Communications Act of 1934 + the CPNI Order. CPNI is information that relates to the quantity + technical configuration + type + destination + location + amount of use of a telecommunications service subscribed to by a customer + made available to the carrier by the customer solely by virtue of the carrier-customer relationship. CPNI typically includes: call detail records (CDR) - origination + destination + duration + frequency + time of calls; service plan information + features + billing; geographic / location data; technical configuration of customer service. The CPNI rules apply to: telecommunications carriers + interconnected VoIP providers + (post-2016) broadband internet access service providers under FCC Title II classification (since reversed). Core requirements: (a) use + disclosure restrictions under Section 222 (CPNI may only be used for the provision of telecommunications services + adjacent services unless customer approval is obtained); (b) approval mechanisms - opt-in for non-affiliated third parties + opt-out for affiliated marketing of additional services (Section 64.2004); (c) notice requirements for customer approval (Section 64.2008); (d) safeguards on use + disclosure (Sections 64.2009 + 64.2010 - personnel training + supervisory review + authentication for online + telephone + in-store account access + password protection); (e) DATA BREACH NOTIFICATION (Section 64.2011 - law enforcement notification within 7 business days to USSS + FBI via FCC ECPNI portal + customer notification after the 7-business-day waiting period unless law enforcement extends + recordkeeping for 2 years); (f) annual compliance certification by a corporate officer with personal knowledge (filed with FCC by 1 March each year). The FCC CPNI rules have been amended multiple times: 2007 CPNI Order (pretexting + authentication strengthening following the HP pretexting scandal); 2009 CPNI Order (further authentication + password protection); 2011 Data Breach Order (Section 64.2011 breach notification framework + recordkeeping); 2017 FCC Broadband Privacy rules (FCC 16-148 - REPEALED by Congressional Review Act in April 2017 + replaced by common-carrier rules); 2024 FCC Section 222 enforcement action against major carriers for sale of customer location data (Verizon + AT&T + T-Mobile + Sprint - hundreds of millions in fines).

21 CFR Part 11 (62 FR 13430 March 20 1997) establishes the criteria under which the FDA considers electronic records + electronic signatures to be trustworthy + reliable + equivalent to paper records + handwritten signatures. The regulation applies to ALL electronic records + signatures created + modified + maintained + archived + retrieved + transmitted under any records requirement set forth in any FDA regulation or any electronic records submitted to FDA under the Federal Food + Drug + and Cosmetic Act + Public Health Service Act + Tobacco Control Act. STRUCTURE - 3 Subparts: SUBPART A General Provisions (§11.1 scope + §11.2 implementation + §11.3 definitions); SUBPART B Electronic Records (§11.10 controls for closed systems + §11.30 controls for open systems + §11.50 signature manifestations + §11.70 signature / record linking); SUBPART C Electronic Signatures (§11.100 general requirements + §11.200 signature components + controls + §11.300 controls for identification codes + passwords). Risk-based implementation: per the August 2003 FDA Scope and Application Guidance the agency intends to exercise enforcement discretion regarding specific Part 11 requirements + apply Part 11 requirements based on risk + criticality + intended use. Computer System Validation (CSV) under Part 11 + the GAMP 5 framework + ICH Q9 risk + ICH Q10 PQS coordinate to operationalise the regulation. The 2023 FDA Computer Software Assurance (CSA) draft guidance + the related FDA Software Bill of Materials (SBOM) expectations modernise the validation approach for medical device software + production software. Part 11 is the US counterpart to EU GMP Annex 11 (which covers computerised systems in GMP-regulated pharmaceutical manufacturing) + EMA Q&A on Annex 11 + the EU Medical Device Regulation (MDR) + In Vitro Diagnostic Regulation (IVDR) digital records provisions. Part 11 enforcement examples include FDA warning letters citing inadequate audit trails + lack of validation + electronic-signature controls failures + closed-system control deficiencies in pharmaceutical manufacturing sites + clinical trial sponsors + medical device manufacturers + contract research organisations (CROs).

The new 21 CFR Part 820 (Quality Management System Regulation, QMSR) was published as a Final Rule on 31 January 2024 (89 FR 7496) and applies from 2 FEBRUARY 2026. It HARMONISES the FDA medical device quality system requirements with ISO 13485:2016 by INCORPORATING THAT STANDARD BY REFERENCE under §820.7 + retaining a small number of FDA-specific additions (§820.15 clarifications + §820.35 record controls including audit trail + UDI + reporting + §820.45 device labelling + packaging controls). The QMSR replaces the prior Quality System Regulation (QSR) which had its own elaborate structure (former §820.20 through §820.250 covering management responsibility + design controls + document control + purchasing + production + acceptance + CAPA + labelling + handling + records + servicing + statistical techniques). The QMSR applies to FINISHED MEDICAL DEVICES that are intended for human use + are subject to FDA registration + listing under section 510 of the Federal Food, Drug, and Cosmetic Act. STRUCTURE - the QMSR Final Rule has 7 substantive sections: §820.1 scope; §820.3 definitions; §820.7 incorporation by reference; §820.10 requirements for a quality management system (incorporating ISO 13485:2016 Sections 4-8); §820.15 clarification of concepts (FDA-specific clarifications + glossary harmonisation); §820.35 control of records (record retention + audit trail + UDI + medical-device reporting + corrections and removals records); §820.45 device labelling and packaging controls (FDA-specific). RELATED FRAMEWORKS: ISO 13485:2016 (incorporated by reference); EU MDR (Regulation (EU) 2017/745) + IVDR (Regulation (EU) 2017/746) parallel medical device + IVD regulations; FDA Part 11 (Electronic Records + Electronic Signatures) for computer system validation + audit trail records under §820.35; FDA Cybersecurity Premarket Guidance + Cures Act 524B for medical device software. The 2-YEAR TRANSITION PERIOD requires FDA-regulated medical device manufacturers to fully implement the harmonised QMSR by 2 February 2026 + the FDA has clarified that the transition does not require re-certification - existing QSR-compliant systems will be evaluated against QMSR during routine inspections after the application date.

The FFIEC Cybersecurity Assessment Tool (June 2015, updated May 2017) let financial institutions measure their inherent risk profile across five categories and their cybersecurity maturity across five domains, fifteen assessment factors and thirty components through 491 declarative statements at five maturity levels, mapped to the NIST Cybersecurity Framework and the FFIEC IT Examination Handbook. The FFIEC announced its sunset on 29 August 2024, effective 31 August 2025; the tool is modelled in full as retired, with the statements institutions still carry in their programmes.

The FFIEC Information Technology Examination Handbook is the guidance the federal financial institution regulators' examiners use to assess institutions' and service providers' information technology, across its booklets: Architecture, Infrastructure and Operations (2021), Business Continuity Management (2019), Development, Acquisition and Maintenance (2024), Information Security (2016), Management (2015), Outsourcing Technology Services (2004), Retail Payment Systems (2016), Supervision of Technology Service Providers (2012), Wholesale Payment Systems (2004) and Audit (2012). The graph models the booklets' action summaries and examination expectations as 348 leaves.

FIDO2 is the joint FIDO Alliance + W3C standard for passwordless + phishing-resistant authentication composed of: (a) W3C WEB AUTHENTICATION (WebAuthn) Level 3 Recommendation - the browser + relying party API for public-key credential creation + authentication; (b) FIDO CLIENT-TO-AUTHENTICATOR PROTOCOL 2.1 (CTAP2.1) - the protocol between client devices + roaming or platform authenticators; (c) FIDO METADATA SERVICE v3 (MDS3) - the trust + attestation metadata for authenticators including AAGUIDs + status reports + transports + algorithms; (d) DISCOVERABLE CREDENTIALS / PASSKEYS - resident-credential storage on authenticators enabling passwordless workflows + cross-device synchronisation via iCloud Keychain + Google Password Manager + Windows Hello + 1Password / Bitwarden / Dashlane. Core security properties: PHISHING RESISTANCE through origin binding + RP ID validation + channel binding; UNPHISHABLE WITHOUT USER INTERVENTION (no shared secrets); BIOMETRICS + PIN VERIFICATION local to the authenticator (never transmitted); REPLAY RESISTANCE through challenge-based protocol + signature counter + anti-replay timestamping; ENTERPRISE ATTESTATION + AAGUID ALLOWLISTING for managed-device deployments. Adoption: all major browsers (Chrome + Edge + Firefox + Safari) + operating systems (Windows 11 + macOS + iOS + Android) + leading IdPs (Microsoft Entra + Google + Okta + Ping) support FIDO2/WebAuthn. 2023-2025 PASSKEY launch by Apple + Google + Microsoft with cross-device synchronisation + hybrid transport (formerly caBLE) for QR-code-based phone-to-laptop auth. FIDO Alliance certification programs: FIDO2 Server + Authenticator + UAF Server + Authenticator + U2F Server + Authenticator + Biometric Component. FIDO2/WebAuthn is the foundation for NIST SP 800-63B AAL3 phishing-resistant authentication + the basis for executive-order-mandated US federal MFA (M-22-09 + the 2024 ZTA strategy). Coordinated standards: OAuth 2.0 + OpenID Connect + SAML for the federation layer above WebAuthn; W3C Verifiable Credentials for the credential-presentation layer; FIDO Device Onboarding (FDO) for IoT.

FINRA's suitability rule for broker-dealer recommendations of securities transactions and investment strategies: the reasonable-basis belief resting on the customer's investment profile, the three components (reasonable-basis, customer-specific and quantitative suitability), the broad reading of investment strategy including hold recommendations, the institutional-account carve-out on independent judgment, the ban on disclaimers and the financial-ability test, as narrowed by Regulation Best Interest for retail customers from 30 June 2020.

The Forum of Incident Response and Security Teams (FIRST) is the leading global organization for Computer Security Incident Response Teams (CSIRTs) + Product Security Incident Response Teams (PSIRTs) + Vulnerability Coordinators + cybersecurity professionals. FIRST maintains a suite of community-developed standards + frameworks. KEY FIRST STANDARDS: (a) CSIRT SERVICES FRAMEWORK V2.1 (published 2019) - the canonical service-catalog defining 5 SERVICE AREAS + 36 SERVICES that CSIRTs deliver: Information Security Event Management; Information Security Incident Management; Vulnerability Management; Situational Awareness; Knowledge Transfer; (b) COMMON VULNERABILITY SCORING SYSTEM (CVSS) - the industry-standard vulnerability severity metric; CVSS v4.0 published 2023 with revised Base + Threat + Environmental + Supplemental metrics + Macro vector + qualitative severity rating (None/Low/Medium/High/Critical); CVSS v3.1 remains in use for prior advisories; CVSS scores feed into vulnerability management + patch prioritisation + the CISA Known Exploited Vulnerabilities (KEV) Catalog + the NVD; (c) TRAFFIC LIGHT PROTOCOL (TLP) v2.0 - the four-color information-sharing classification system (TLP:RED + TLP:AMBER + TLP:AMBER+STRICT + TLP:GREEN + TLP:CLEAR) used by CSIRTs + ISACs + vendors + governments + replaced TLP v1.0 (TLP:WHITE renamed to TLP:CLEAR in v2.0); (d) INFORMATION EXCHANGE POLICY (IEP) v2.0 - a machine-readable extension of TLP enabling automated policy-driven sharing of cyber threat intelligence; (e) MULTI-PARTY COORDINATED VULNERABILITY DISCLOSURE (MPCVD) GUIDELINES - best practices for coordinated disclosure when multiple affected vendors or affected parties exist; (f) PSIRT SERVICES FRAMEWORK - a parallel Product-team-focused service framework; (g) VULNERABILITY COORDINATION BEST PRACTICES GUIDELINES. FIRST is operated as a non-profit consortium + the standards are publicly available + freely-implementable. Coordination: FIRST standards underpin many national CSIRT regimes (US-CERT + DOE CIRC + CISA + UK NCSC + ENISA + AusCERT + JPCERT/CC + KrCERT/CC + many others) + are referenced in NIST SP 800-61 + ISO/IEC 27035 + NIS2 + CIRCIA + MITRE ATT&CK + the EU Cyber Resilience Act (CRA) vulnerability handling obligations.

FISMA is the Federal Information Security Modernization Act of 2014 (Public Law 113-283), amending the Federal Information Security Management Act of 2002 + codified at 44 USC Chapter 35 Subchapter II (sections 3551-3559). FISMA is the US federal statutory framework for information security applying to all federal agencies (excluding national-security systems covered separately) + contractors operating systems on behalf of federal agencies. STATUTORY STRUCTURE: (a) Section 3551 PURPOSES; (b) Section 3552 DEFINITIONS; (c) Section 3553 AUTHORITY AND FUNCTIONS OF THE DIRECTOR OF OMB + CISA (Cybersecurity and Infrastructure Security Agency, at DHS) including BINDING OPERATIONAL DIRECTIVES (BODs) for federal civilian agencies; (d) Section 3554 FEDERAL AGENCY RESPONSIBILITIES - including agency CIO + CISO designations + agency-wide information security programs + risk assessments + incident reporting; (e) Section 3555 ANNUAL INDEPENDENT EVALUATION by agency Inspector General (IG); (f) Section 3556 FEDERAL INFORMATION SECURITY INCIDENT CENTER (US-CERT now CISA); (g) Section 3557 NATIONAL SECURITY SYSTEMS (NSS) - exclusion from FISMA + governed separately by CNSS + Intelligence Community Directive 503; (h) Section 3558 EFFECT ON EXISTING LAW; (i) Section 3559 SAVINGS PROVISIONS. OPERATIONALISATION: FISMA is implemented through: (1) NIST SP 800-53 Rev 5 (Security and Privacy Controls - 1,189 controls) - VERIFIED separately in graph; (2) NIST SP 800-37 Rev 2 (Risk Management Framework - Categorize + Select + Implement + Assess + Authorize + Monitor); (3) NIST SP 800-171 Rev 3 (Protecting Controlled Unclassified Information in Nonfederal Systems) for contractor systems; (4) FIPS 199 (system categorization Low + Moderate + High); (5) FIPS 200 (minimum security requirements); (6) FedRAMP (Federal Risk and Authorization Management Program for cloud) - VERIFIED separately in graph as FedRAMP Moderate + High + Rev 5 Program reference; (7) CISA Binding Operational Directives (BODs - e.g. BOD 22-01 KEV Catalog, BOD 23-01 Asset Visibility, BOD 23-02 Internet-Accessible Networking Devices); (8) OMB Memoranda (M-22-09 Zero Trust + M-22-18 SBOM + M-24-15 FedRAMP modernization). 2024-2025 PRIORITIES: ZERO TRUST ARCHITECTURE per OMB M-22-09 + CISA Zero Trust Maturity Model v2 + the National Cybersecurity Strategy + CIRCIA Final Rule 2026 alignment.

FSSC 22000 is the GFSI-recognised food safety certification scheme owned by the Foundation FSSC. Version 7.0 (May 2026) requires ISO 22000:2018, the sector prerequisite programmes of the ISO 22002-x series, and the scheme's own Additional Requirements on purchased materials and laboratories, labelling and claims, food defense, food fraud, logo use, allergens, environmental monitoring, food safety and quality culture, quality control, transport and storage, foreign matter, PRP verification, product development, traceability, equipment, food loss and waste, communication with the certification body, and multi-site certification.

FSSC 24000 Version 1.0 certifies social management systems built on BSI/PAS 24000:2022: the extra duties on certified organisations, the social risk assessment, and the audit, worker interview, nonconformity, certificate, CB licensing, auditor and accreditation rules.

The FSSC Development Program Version 2.0 sets a minimum food safety system (management, prerequisite programmes, HACCP) that FSSC licensed bodies assess every year, with sector rules for transport and storage and for packaging, and the assessment, statement and licensing rules for the bodies.

The FTC GLBA Safeguards Rule (16 CFR Part 314) is the Federal Trade Commission regulation implementing Title V of the Gramm-Leach-Bliley Act (15 USC 6801-6809). The Rule applies to NON-BANK FINANCIAL INSTITUTIONS under FTC jurisdiction (consumer reporting agencies + finance companies + auto dealers + mortgage brokers + payday lenders + tax preparers + non-bank lenders + investment advisors + others). Bank-regulator-supervised financial institutions are covered by parallel regulations (12 CFR Part 30 OCC + 12 CFR Part 208 + 225 FRB + 12 CFR Part 364 FDIC + 12 CFR Part 748 NCUA + 17 CFR 248 SEC) issued by the federal banking agencies. REGULATORY HISTORY: (a) 2002 ORIGINAL RULE: required a written information security program + risk assessment + service-provider oversight + adjusting for changes; (b) 2021 AMENDMENTS (effective 9 January 2022 + with January 2023 for elements that required additional time): expanded definition of financial institution to include FINDERS (introducers); added 9 SPECIFIC SAFEGUARD ELEMENTS - (1) ACCESS CONTROLS + role-based + least-privilege + periodic review; (2) DATA INVENTORY + CLASSIFICATION; (3) ENCRYPTION of customer information at rest and in transit; (4) SECURE DEVELOPMENT PRACTICES; (5) MULTI-FACTOR AUTHENTICATION (MFA) for any individual accessing customer information on the network; (6) SECURE DISPOSAL of customer information; (7) CHANGE MANAGEMENT PROCEDURES; (8) MONITORING AND LOGGING of authorized user activity + detecting unauthorized access; (9) CONTINUOUS MONITORING OR ANNUAL PENETRATION TESTING + SEMIANNUAL VULNERABILITY ASSESSMENTS; required QUALIFIED INDIVIDUAL designation responsible for program oversight + Board reporting; required WRITTEN INCIDENT RESPONSE PLAN; (c) 2023 AMENDMENTS: added FTC NOTIFICATION REQUIREMENT for security events affecting 500 OR MORE CONSUMERS within 30 DAYS; (d) 2024-2025 FTC ENFORCEMENT: actions against multiple financial institutions + mortgage brokers + auto dealers for non-compliance with the new elements; (e) 2025 ANTICIPATED: additional amendments on AI-related risk + supply-chain due diligence + interagency coordination. EXEMPTION: institutions maintaining customer information of fewer than 5,000 CONSUMERS may use SIMPLIFIED COMPLIANCE under Section 314.6 (written risk assessment + safeguard elements + service-provider oversight); 5,000+ institutions must comply with full requirements.

The FTC Health Breach Notification Rule (16 CFR Part 318) is the FTC regulation requiring VENDORS OF PERSONAL HEALTH RECORDS (PHR) + PHR-RELATED ENTITIES + THIRD-PARTY SERVICE PROVIDERS to NOTIFY individuals + the FTC + (where applicable) the media of breaches of security involving identifiable health information. The Rule applies to entities NOT COVERED BY HIPAA (Health Insurance Portability and Accountability Act of 1996 + HIPAA Breach Notification Rule at 45 CFR Subpart D) - i.e. consumer-facing health apps + wearables + fitness trackers + reproductive health apps + DTC genetics + mental health apps + smart scales + connected medical devices NOT operated by HIPAA-covered entities. 2009 ORIGINAL RULE: implemented Section 13407 of the HITECH Act (PL 111-5); covered classic PHR vendors. 2024 FINAL RULE AMENDMENTS (effective 29 July 2024 + with 25 April 2025 for delayed elements): EXPANDED SCOPE to (a) MOBILE HEALTH APPS + CONNECTED DEVICES even if not marketed as PHR; (b) NEW DEFINITION OF BREACH explicitly including UNAUTHORIZED DISCLOSURE to advertising/marketing networks + 3rd-party SDKs + data brokers + cross-app tracking + reproductive-health-data scenarios; (c) UPDATED DEFINITION OF PHR IDENTIFIABLE HEALTH INFORMATION; (d) NEW DEFINITION OF HEALTHCARE PROVIDER; (e) THIRD-PARTY SERVICE PROVIDER (TPSP) obligations to upstream notify PHR vendors. NOTIFICATION REQUIREMENTS: (i) INDIVIDUAL NOTIFICATION without unreasonable delay + no later than 60 CALENDAR DAYS after discovery; (ii) FTC NOTIFICATION via online notification form within 60 days (for breaches affecting 500+ individuals) or annual log (<500); (iii) MEDIA NOTIFICATION via prominent media outlet for breaches affecting 500+ individuals in a state or jurisdiction; (iv) CONTENT REQUIREMENTS - brief description + types of info + steps to protect + actions taken + contact info. ENFORCEMENT: FTC may impose civil penalties up to USD 51,744 PER VIOLATION (2025 figure - adjusted annually for inflation per Federal Civil Penalties Inflation Adjustment Act); additional state enforcement under state attorney general consumer protection laws. PRIVATE RIGHT OF ACTION: none under HBNR + but state law claims may apply.

The Fair Labor Association (FLA) Workplace Code of Conduct is a voluntary multi-industry workplace standards code adopted by FLA member companies (apparel + footwear + agriculture + electronics + university licensee sector) and applied across their global supplier networks. The Code was first adopted in 1998 + revised periodically; the current version (post-2017 + ongoing review) consists of 10 principles that operationalise the ILO Declaration on Fundamental Principles and Rights at Work + the UN Guiding Principles on Business and Human Rights + the OECD Guidelines for Multinational Enterprises. The 10 principles are: (1) Employment Relationship; (2) Nondiscrimination; (3) Harassment or Abuse; (4) Forced Labor; (5) Child Labor; (6) Freedom of Association and Collective Bargaining; (7) Health, Safety, and Environment; (8) Hours of Work; (9) Compensation; (10) (varying topical principle covering subcontracting / supply chain responsibility + worker grievance + remediation). The 10 principles are operationalised through 100+ COMPLIANCE BENCHMARKS - specific operational practices that FLA-accredited monitoring + audit programmes assess. FLA-accredited companies submit to periodic Independent External Monitoring (IEM) + Sustainable Compliance Initiative (SCI) audits + remediation oversight + external reporting via the FLA Public Reports system + the FLA Tracking Chart. The FLA Workplace Code is the principal multi-stakeholder voluntary labor-standards code in the apparel + footwear + agriculture sectors alongside the SAC Higg + Better Cotton Initiative + Worldwide Responsible Accredited Production (WRAP) + Social Accountability International SA8000 + amfori BSCI. Substantive content lives in the FLA Workplace Code of Conduct + the FLA Compliance Benchmarks (FLA-member-gated full text but publicly summarised on fairlabor.org).

FERPA is the Family Educational Rights and Privacy Act of 1974 (20 USC 1232g) implemented by 34 CFR Part 99 + administered by the US Department of Education Student Privacy Policy Office (SPPO) + Privacy Technical Assistance Center (PTAC). FERPA protects the privacy of student education records held by educational agencies + institutions receiving funds from any program administered by the Secretary of Education + applies to virtually all US K-12 + postsecondary educational institutions. FERPA confers four core rights on parents (transferred to eligible students at age 18 or upon postsecondary enrollment): (a) the right to INSPECT AND REVIEW education records; (b) the right to REQUEST AMENDMENT of records believed to be inaccurate or misleading; (c) the right to CONSENT to disclosures of personally identifiable information (PII) from education records subject to specified exceptions; (d) the right to FILE A COMPLAINT with the Department of Education for FERPA violations. Educational institutions must provide ANNUAL NOTIFICATION of these rights + the criteria for designating school officials with legitimate educational interest. Disclosures without consent are limited to specific exceptions: school officials + other educational institutions for enrolment + financial aid + accrediting organizations + parents of dependent students + court orders + health/safety emergencies + studies for or on behalf of the institution + audit + evaluation by authorised representatives + directory information after public notice. DIRECTORY INFORMATION (typically name + address + phone + email + photograph + dates of attendance + grade level + sport participation + degrees + honors) may be disclosed without consent if the institution provides annual public notice + a reasonable opportunity to opt-out. DATA SECURITY SAFEGUARDS for PII in education records are required under the studies + audit + evaluation exceptions + the SPPO/PTAC Best Practices Guidance. ENFORCEMENT is by the SPPO (within DoE) + may result in loss of federal funding (the sole statutory remedy). FERPA is coordinated with the Children Online Privacy Protection Act (COPPA) + the Protection of Pupil Rights Amendment (PPRA) + state student privacy laws (SOPIPA + Connecticut + New York + California + ~20 other states). FERPA Final Rule revisions: 1988 + 1995 + 2008 + 2011 (audit + evaluation + studies exceptions clarified) + 2011 directory information + 2020 study by SPPO + ongoing 2024-2025 PTAC guidance updates on AI + cloud + edtech vendor agreements + data breach notification standards.

FedRAMP High baseline, based on NIST SP 800-53 Revision 5, includes all 421 security controls with FedRAMP-specific tailoring and implementation guidance.

FedRAMP Moderate baseline. Federal cloud service authorization built on NIST SP 800-53 Rev 5 with FedRAMP-specific parameters.

FedRAMP is the US Federal Risk and Authorization Management Program established in 2011 by OMB Memorandum M-11-30 + implementing the Federal Information Security Management Act (FISMA) for cloud services used by US federal agencies. FedRAMP Rev 5 is the current version operating against NIST SP 800-53 Revision 5 + the FedRAMP Rev 5 Baselines (Low + Moderate + High + LI-SaaS) with FedRAMP-specific overlay parameters. NB: the substantive control content for the FedRAMP Moderate (323 controls) + FedRAMP High (417 controls) baselines is tracked separately in the graph as 'FedRAMP Moderate' + 'FedRAMP High' frameworks (both verified against NIST 800-53 OSCAL). This entry tracks the PROGRAM-LEVEL reference covering: (a) the FedRAMP Program Management Office (PMO) under GSA; (b) FedRAMP authorization paths - JAB (Joint Authorization Board comprising DOD + DHS + GSA) + Agency-ATO (individual agency Authority to Operate); (c) Authorization Boundary documentation including SSP / SAR / POA&M / continuous-monitoring plan; (d) Continuous Monitoring (ConMon) - monthly vulnerability scanning + quarterly POA&M update + annual assessment + reporting via Salesforce + FedRAMP Marketplace; (e) Significant Change Request (SCR) workflow + FedRAMP review; (f) 2024 OMB Memorandum M-24-15 modernising the FedRAMP process + introducing FedRAMP 2.0; (g) Coordination with StateRAMP + GovRAMP + state + local + tribal government cloud authorization; (h) coordination with FISMA + NIST SP 800-37 RMF + the FedRAMP Marketplace listing of authorized CSPs + assessors (3PAOs).

The UAE's federal personal data protection law, Federal Decree by Law No. (45) of 2021, in force since 2 January 2022 for controllers and processors in onshore UAE and for those abroad processing data of people in the UAE (government, health and banking data under their own laws, and the DIFC and ADGM free zones, are outside it). It requires consent or one of ten listed grounds for processing, seven processing controls, provable and withdrawable consent, privacy by design and default, records of processing kept by controllers and processors, processor contracts, breach notification to the UAE Data Office and to affected people, a data protection officer where processing is high risk, eight data subject rights, security to international standards, impact assessments, and conditions for transfers abroad. Its Executive Regulations, penalty decision and six-month regularisation period were still outstanding in the sources checked in September 2026. Built from the Decree-Law's own text.

Financial Services and Markets Act 2000 (UK) core duties: the general prohibition, financial promotion restriction, threshold conditions, the Senior Managers and Certification Regime, and the controller change of control approval regime. FCA Handbook and PRA Rulebook rules are not built.

The Finland Data Protection Act (Tietosuojalaki, 1050/2018) is the Finnish national supplement to the EU General Data Protection Regulation (Regulation (EU) 2016/679). The Act entered into force on 1 January 2019 + repealed the prior Personal Data Act (523/1999). The Act covers the national-level derogations + supplements permitted by GDPR including: (a) lawful basis under public-interest task + official authority for public authorities and statutorily-tasked private entities (Section 4); (b) processing of PERSONAL IDENTITY CODES (Henkilotunnus) - the Finnish national identifier - with strict purpose limitation + need for identification (Section 29); (c) SPECIAL CATEGORIES of personal data with derogations for employment + social security + professional secrecy + research + statistics + archiving + health + occupational safety (Section 6); (d) PROCESSING OF CRIMINAL OFFENCES DATA per Section 7 + the Criminal Records Act; (e) DATA PROTECTION OMBUDSMAN (Tietosuojavaltuutettu) as the supervisory authority with Sanctions Collegium (Seuraamuskollegio) for administrative fines (Sections 8-13); (f) DEROGATIONS from the right of access + rights of data subjects for scientific or historical research purposes + statistical purposes + archiving purposes in the public interest (Section 31); (g) JOURNALISTIC + ACADEMIC + ARTISTIC + LITERARY EXEMPTIONS (Section 27 + Constitution Section 12 freedom of expression); (h) BILINGUAL TRANSPARENCY (Finnish + Swedish per Constitution Section 17 + Language Act 423/2003) for data subject information notices. SECTORAL COORDINATION: the Tietosuojalaki coordinates with the ACT ON PRIVACY IN WORKING LIFE (Laki yksityisyyden suojasta tyoelamassa, 759/2004) for employee data + workplace monitoring + email inspection; the INFORMATION SOCIETY CODE (Sahkoisen viestinnan palveluista annettu laki, SVTSL 917/2014) for cookies + ePrivacy + electronic-marketing (consent + technical-necessity exemption); the ACT ON ELECTRONIC COMMUNICATIONS SERVICES; the Public Information Disclosure Act; and the new Cybersecurity Act 2024 implementing EU NIS2. ENFORCEMENT: Data Protection Ombudsman + 3-member SANCTIONS COLLEGIUM may impose administrative fines up to 4% of global annual turnover or EUR 20 million (whichever higher) - PUBLIC authorities are exempt from administrative fines under Section 24. APPEALS: to the Administrative Court within 30 days. 2024-2025 PRIORITIES: AI Act interplay + cross-border enforcement under GDPR one-stop-shop + Nordic data-protection coordination (Nordic-Baltic Working Group on Data Protection).

Florida's consumer privacy law (Fla. Stat. 501.701 to 501.722, in force 1 July 2024), whose full controller duties reach only companies with over 1 billion dollars in global revenue that earn half of it from online advertising, run a voice-assistant smart speaker service or run an app store with 250,000 apps; the ban on selling sensitive data without consent reaches smaller for-profit businesses too. It gives consumers rights to access, correct, delete, port and opt out of targeted advertising, sale, significant profiling, sensitive data and voice or facial recognition collection, bars device surveillance, requires consent for sensitive data, privacy notices with fixed sale warnings, processor contracts, data protection assessments, a retention schedule with a two-year inactivity limit and search ranking disclosures, and adds the Department of Legal Affairs security and authentication rules (NIST-based) and the s. 501.1735 duties for online platforms used mainly by children. Enforced by the Attorney General at up to 50,000 dollars per violation, tripled for children. Built from the statute and rule texts.

Florida's all-party consent law: no interception or recording of phone calls, private in-person conversations or electronic communications without every party's prior consent; the federal one-party rule is no defence. Fla. Stat. ch. 934.

The French Labour Code provisions an employer must meet before and while monitoring staff: every restriction justified by the task and proportionate; candidates and employees told in advance of each collection device and evaluation method; telework charters that state how working time is controlled and when staff may be contacted; a right to disconnect; monitoring rules in the internal rules or charters adopted with the works council (CSE) opinion and one month's publicity; and, in undertakings of 50 or more, prior written information and consultation of the CSE on every means of controlling employees' activity, within a one-month default period. Partial build of the Code du travail.

France's criminal invasion-of-privacy offence (Code penal article 226-1): no recording of private words, no images of people in private places and no geolocation without consent, with presumed consent only where the act is done openly.

Gives a legally enforceable right of access to Commonwealth agency documents and Ministers' official documents, subject to defined exemptions, and sets the information publication scheme, request-handling timeframes, decision-notice and charges duties, personal-record amendment rights, and the internal and Information Commissioner review pathways.

France's Sapin II Act (loi n° 2016-1691) requires the managers of companies with at least 500 staff and over 100 million euros of turnover (including groups headed in France, industrial and commercial public bodies, and since June 2025 port facility operators of any size) to prevent and detect corruption and influence peddling through eight measures across the whole group: a code of conduct in the internal rules, an internal alert system, a regularly updated risk map, evaluation of clients, first-tier suppliers and intermediaries, anti-corruption accounting controls, training for managers and exposed staff, a disciplinary regime and internal control and evaluation. The French Anti-Corruption Agency (AFA) audits them and its sanctions commission can impose up to 1 million euros on companies and 200,000 euros on managers; it did so for the first time in July 2026. Employers of 50 or more must also run a confidential whistleblowing procedure. The AFA's 2020 recommendations, which give a presumption of conformity, are built in. Built from the French text.

Bass and Avolio's Full Range Leadership Model: every leader shows a profile of behaviours from laissez-faire non-leadership through passive and active management-by-exception and contingent reward to the four transformational components (idealized influence, inspirational motivation, intellectual stimulation, individualized consideration); the more active forms are more effective and satisfying, transformational leadership augments transactional leadership rather than replacing it, and development shifts the frequencies, measured by the licensed Multifactor Leadership Questionnaire. Built from the originators' own texts (Avolio and Bass 2002, Avolio 2011 chapter 6, the Bass and Avolio MLQ workbook); a conceptual model with a licensed instrument, not a certifiable standard.

GAMP 5 (Good Automated Manufacturing Practice 5) is the INTERNATIONAL SOCIETY FOR PHARMACEUTICAL ENGINEERING (ISPE) flagship guide for Computerised Systems Validation in GxP-regulated environments (pharmaceutical + medical device + biotech + healthcare manufacturing + laboratories). Current edition GAMP 5 SECOND EDITION published July 2022 + supersedes the 2008 First Edition. KEY CONCEPTS: (a) RISK-BASED APPROACH - effort proportional to risk + complexity + regulatory impact; (b) LIFE CYCLE APPROACH - V-Model lifecycle with Specification + Verification phases mirrored; (c) CRITICAL THINKING - applying judgment over checkbox compliance; (d) LEVERAGE SUPPLIER INVOLVEMENT - reduce duplication via supplier qualification + documentation reuse + audit; (e) SCALABILITY - approach scales from small bench instruments to enterprise ERP/MES; (f) GxP regulatory alignment - 21 CFR Part 11 (FDA Electronic Records + Electronic Signatures) + EU Annex 11 (Computerised Systems) + ICH Q9 Quality Risk Management + ICH Q10 Pharmaceutical Quality System + FDA Computer Software Assurance (CSA) 2023 Draft Guidance. 5 SOFTWARE CATEGORIES (Appendix M4): Category 1 INFRASTRUCTURE (operating systems + databases + network); Category 2 was deprecated in 1st Edition; Category 3 NON-CONFIGURED PRODUCTS (commercial off-the-shelf); Category 4 CONFIGURED PRODUCTS (commercial with configuration); Category 5 CUSTOM APPLICATIONS (in-house developed). 2ND EDITION (2022) UPDATES: AI + machine learning systems; cloud + SaaS; agile + iterative development; DevOps; data integrity by design; explicit critical thinking emphasis; data integrity ALCOA+ deepening; computer software assurance (FDA CSA Draft Guidance 2022) alignment + replacing some traditional CSV. APPLICATION: typical implementation includes URS (User Requirements Specification) + FS (Functional Specification) + DS (Design Specification) + IQ (Installation Qualification) + OQ (Operational Qualification) + PQ (Performance Qualification) + Traceability Matrix + Risk Assessment + Change Control + Periodic Review + Data Integrity Controls + Decommissioning. AUDITORS: FDA + EMA + MHRA + PMDA + Health Canada + Brazilian ANVISA + China NMPA + other regulators inspect against GAMP 5 + Part 11 + Annex 11 + national regulations.

General Data Protection Regulation - EU regulation on data protection and privacy for all individuals within the European Union and European Economic Area

The GHG Protocol Corporate Standard from WRI and WBCSD (Revised Edition, 2004) is the base standard for company-level GHG inventories. It requires inventories to follow five principles (relevance, completeness, consistency, transparency, accuracy), an organisational boundary set by equity share or financial or operational control, separate reporting of scope 1 and scope 2 at minimum (scope 3 optional), a base year with a recalculation policy, and a public report with defined boundary and emissions information. Two amendments bind it: the February 2013 amendment adds NF3 to the required gases and sets GWP rules, and the Scope 2 Guidance (2015) requires scope 2 to be reported by both the location-based and the market-based method where contractual instruments exist, with Quality Criteria for those instruments and matching disclosures. The Scope 3 Standard (2011) and other GHG Protocol standards are separate.

The GHG Protocol Scope 3 Standard (WRI and WBCSD, 2011) is the global method for measuring and reporting a company's indirect value chain emissions across fifteen upstream and downstream categories, as a supplement to the GHG Protocol Corporate Standard. Its requirements cover the five accounting principles, accounting for all scope 3 emissions to minimum category boundaries with disclosed exclusions, the gases (NF3 added by the 2013 amendment), biogenic CO2 and removals outside the scopes, financed emissions for investments, base year and recalculation duties when performance is tracked, and ten public reporting items per category.

The Gramm-Leach-Bliley Act (GLBA, also known as the Financial Services Modernization Act of 1999, Public Law 106-102) is a US federal statute enacted 12 November 1999 that imposes privacy + safeguarding + anti-pretexting obligations on FINANCIAL INSTITUTIONS handling nonpublic personal information (NPI). KEY PROVISIONS: (a) SUBCHAPTER I - DISCLOSURE OF NONPUBLIC PERSONAL INFORMATION (15 USC 6801-6809): policy of privacy obligation + safeguarding standard (Sec. 6801); notice + opt-out obligations on disclosure to nonaffiliated third parties (Sec. 6802); annual privacy notice obligation (Sec. 6803); rulemaking authority delegated to Bureau of Consumer Financial Protection (CFPB) + Securities and Exchange Commission (SEC) + Commodity Futures Trading Commission (CFTC) (Sec. 6804); enforcement by federal banking agencies (OCC + Federal Reserve + FDIC + NCUA + OTS) + SEC + CFTC + FTC + State insurance authorities (Sec. 6805); state insurance preemption (Sec. 6806); relation to other Acts (Sec. 6807); study of information sharing (Sec. 6808); definitions (Sec. 6809). (b) SUBCHAPTER II - FRAUDULENT ACCESS TO FINANCIAL INFORMATION (15 USC 6821-6827): PRETEXTING prohibition (Sec. 6821) - obtaining customer information by false pretenses + including phone + internet + impersonation prohibited; administrative enforcement by FTC + federal banking agencies (Sec. 6822); criminal penalties up to 5 years imprisonment or 10 years if aggravated (Sec. 6823); relation to other laws (Sec. 6824); agency guidance (Sec. 6825); reports (Sec. 6826); definitions (Sec. 6827). OPERATIONALISATION: GLBA establishes the statutory umbrella; substantive operational controls are issued by regulators via subordinate rules: (a) FTC Safeguards Rule 16 CFR Part 314 (last major revision 2021 + 2023 breach-notification amendment effective 2024 + further 2024-2025 amendments - verified separately); (b) FTC Privacy Rule 16 CFR Part 313 + model privacy form; (c) SEC Regulation S-P (17 CFR Part 248) - amended March 2024 + effective 2025-2026 with incident-response + breach-notification + 30-day individual notification + supervisory + record-keeping requirements; (d) BANKING-AGENCY RULES (Interagency Guidelines Establishing Standards for Safeguarding Customer Information + Interagency Guidance on Response Programs for Unauthorized Access to Customer Information + Customer Notice) issued by OCC + Federal Reserve + FDIC + NCUA + OTS - see 12 CFR Part 30 + Part 208 + Part 364 + Part 748; (e) NAIC Insurance Data Security Model Law (NAIC #668) adopted by 20+ states; (f) CFPB enforcement under Dodd-Frank for non-bank financial institutions; (g) HIGHER EDUCATION institutions participating in Title IV (FSA - Federal Student Aid) are FTC Safeguards Rule covered + tracked separately as a sectoral application. 2024-2025 PIPELINE: SEC Reg S-P amendments effective 2025-12-03 large + 2026-06-03 small institutions; FTC Safeguards 2024 30-day FTC notification rule effective; CFPB Section 1033 Open Banking Rule (October 2024) imposes additional safeguarding obligations on screen-scrapers; NAIC Model Bulletin on AI 2023; state privacy laws (CCPA + state DP laws) coordinate. ENGAGEMENT: GLBA is the statutory umbrella - cross-mapping to substantive controls + auditor evidence should target the subordinate FTC Safeguards Rule + FTC Privacy Rule + SEC Reg S-P + banking-agency rule frameworks.

GLI-33 Standards for Event Wagering Systems is the leading independent technical standard for certification of EVENT WAGERING SYSTEMS (sports betting / sportsbook / fantasy sports / fixed-odds wagering / pool wagering / pari-mutuel wagering) operated by regulated gaming operators in jurisdictions where such activities are legalized. Published by GAMING LABORATORIES INTERNATIONAL (GLI) - an independent ISO/IEC 17025 + ISO 9001 + A2LA accredited testing laboratory founded 1989, providing testing + certification + professional services to gaming regulators + operators + suppliers across 480+ jurisdictions globally. CURRENT EDITION: v1.1 issued December 2018; ongoing 2024-2025 update pipeline incorporating new categories (in-play wagering + micro-betting + same-game parlays + futures + cross-state mobile + fantasy + esports + AI-driven anti-fraud + cryptocurrency-funded accounts + integrity-monitoring API). SCOPE: covers all components of an Event Wagering System including (a) Event Wagering Engine + Wager Acceptance Logic; (b) Player Account Management (PAM); (c) Risk Management Engine + Odds Engine; (d) Geolocation Verification (typically third-party GLI-19 certified); (e) Identity Verification / KYC; (f) Payment Processing + Anti-Money-Laundering; (g) Mobile + Internet Wagering Security; (h) Audit + Significant Event Logging; (i) Responsible Gaming Features + Self-Exclusion; (j) Integrity Monitoring + Anti-Fraud + Collusion Detection; (k) Reporting + Regulatory Submissions; (l) Information Security; (m) Disaster Recovery + Business Continuity; (n) Change Management + Software Signature Verification; (o) Random Number Generation (if applicable - typically GLI-19 certified). PUBLICATION + LICENSE: GLI-33 is COPYRIGHTED by Gaming Laboratories International + freely downloadable from gaminglabs.com (older versions) + accessible via member portal; state-regulator incorporations make the standard structure publicly known. COORDINATION + ADOPTION: GLI-33 commonly invoked alongside GLI-19 (Standards for Random Number Generators) + GLI-21 (Standards for Client-Server Systems) + GLI-27 (Standards for Network Security) + state-specific technical standards; in regulated jurisdictions a sports-betting platform typically requires GLI-33 certification + state-regulator approval + ongoing annual audits + change-management notifications. 2024-2025 STATUS: GLI continues to update + version maintenance + new sub-sections for emerging features; US sports betting legal in 38+ states (DC + Puerto Rico) by 2026; international markets expanding including Brazil (legalized 2024) + Argentina + Mexico + Ontario Canada + Latin America + Africa.

GLOBALG.A.P. INTEGRATED FARM ASSURANCE (IFA) STANDARD v6 is the world's leading private-sector pre-farm-gate food safety + agricultural quality + sustainability + social-practice assurance scheme published by FoodPLUS GmbH (Cologne, Germany) - a wholly-owned subsidiary of GLOBALG.A.P. ASSOCIATION. KEY VERSIONS: (a) v5.2 + v5.3 (2017-2022 transition); (b) IFA v6 launched September 2022 + transition period completed 2024; (c) v6.1 amended December 2024 with technical updates + clarifications + remediation handling; (d) IFA v6 SMART launched 2024 as modular sub-scheme allowing risk-based + audit-frequency-flexible certification for established producers. SCOPE: covers PRE-FARM-GATE production for (a) CROPS - fruits + vegetables + nuts + flowers + ornamentals + combinable crops + green coffee + plants + plant propagation material; (b) LIVESTOCK - cattle + sheep + dairy + pigs + poultry + turkey + ducks; (c) AQUACULTURE - fish + crustaceans + molluscs + multi-species farming. SCHEME STRUCTURE: modular hierarchy (i) ALL FARM BASE (AF) - cross-cutting requirements for all subscopes (Management + Workers + Environment + Traceability + Food Safety + GFSI hooks); (ii) BASE STANDARD per subscope (CROPS BASE CB + LIVESTOCK BASE LB + AQUACULTURE BASE AB); (iii) PRODUCT-SPECIFIC STANDARDS (Fruit + Vegetables FV + Combinable Crops + Tea + Coffee + Aquaculture species + etc.) layering on top. Producer certifies one or more product-specific scopes + automatically commits to AF + relevant Base. CONTROL POINTS + COMPLIANCE CRITERIA (CPCCs): each control point has (a) Major Must - 100 percent compliance required + no exception; (b) Minor Must - 95 percent compliance threshold; (c) Recommendation - non-binding; remediation period for Minor Must non-compliance + revocation for repeated Major Must. SUB-PROGRAMS + ADD-ONS: GRASP (GLOBALG.A.P. Risk Assessment on Social Practice) - voluntary social-practice add-on; SPRING (Sustainable Program for Irrigation and Groundwater Use) - water sustainability; PLANET PRO PROGRAM - environmental excellence; FOREST RESPONSIBLE PROGRAM; ALBERT HEIJN PROTOCOL + retailer-specific add-ons. GFSI RECOGNITION: IFA v6 is RECOGNIZED under the Global Food Safety Initiative (GFSI) Benchmarking Requirements + recognized internationally by major food retailers + brands (Tesco + Walmart + Carrefour + Lidl + Aldi + Ahold Delhaize + Sainsbury + Costco + Coles + Woolworths + Whole Foods + many more). CERTIFICATION: by accredited Certification Bodies (~140 CBs globally) operating under ISO/IEC 17065 + GLOBALG.A.P. accreditation criteria; certification valid 1 year + annual surveillance audit + unannounced audits; certificates published in IT system. CIPRO + 2024-2025 PIPELINE: digital transformation + IT-system updates + AI risk-based audit selection + remote audits + sustainability indicators expansion + carbon + biodiversity + water-stewardship integration + alignment with EU Green Deal + Farm-to-Fork Strategy + CSRD ESRS sustainability reporting. PUBLICATION + LICENSE: IFA v6 standard document is COPYRIGHTED by FoodPLUS GmbH + freely available via globalgap.org for producers + certification bodies (with attribution); structure publicly known via globalgap.org publications + GFSI Benchmarking Requirements + industry publications. COORDINATION: GLOBALG.A.P. coordinates with GFSI + FSSC 22000 (verified separately) + BRCGS + IFS + SQF + Codex Alimentarius + ISO 22000 + ISO 9001 + Rainforest Alliance + Fair Trade + UTZ (merged into Rainforest Alliance) + Sustainable Agriculture Initiative (SAI) + Fairtrade.

GRI STANDARDS (Global Reporting Initiative) is the world's most widely-used sustainability reporting framework + GLOBAL DE FACTO STANDARD for corporate sustainability + ESG disclosure. Published by GRI (Global Reporting Initiative), Amsterdam-based independent international organization founded 1997 + governed by GSSB (Global Sustainability Standards Board) + Stakeholder Council + Board. MODULAR SYSTEM: (a) UNIVERSAL STANDARDS - GRI 1: Foundation 2021 (foundational concepts + reporting principles + accordance system); GRI 2: General Disclosures 2021 (organization profile + governance + strategy + policies + activities + stakeholders + 30 disclosures); GRI 3: Material Topics 2021 (materiality determination + management of material topics + 3 disclosures); (b) 33 TOPIC STANDARDS organized in 3 series: GRI 200 ECONOMIC (GRI 201 Economic Performance + GRI 202 Market Presence + GRI 203 Indirect Economic Impacts + GRI 204 Procurement Practices + GRI 205 Anti-Corruption + GRI 206 Anti-Competitive Behavior + GRI 207 Tax + GRI 208 Anti-Discrimination); GRI 300 ENVIRONMENTAL (GRI 301 Materials + GRI 302 Energy + GRI 303 Water + GRI 304 Biodiversity + GRI 305 Emissions including Scope 1/2/3 GHG + GRI 306 Waste + GRI 307 Compliance + GRI 308 Supplier Environmental Assessment); GRI 400 SOCIAL (GRI 401 Employment + GRI 402 Labor + GRI 403 Occupational Health + Safety + GRI 404 Training + GRI 405 Diversity + GRI 406 Non-discrimination + GRI 407 Freedom of Association + GRI 408 Child Labor + GRI 409 Forced Labor + GRI 410 Security Practices + GRI 411 Indigenous Peoples + GRI 412 Human Rights Assessment + GRI 413 Local Communities + GRI 414 Supplier Social Assessment + GRI 415 Public Policy + GRI 416 Customer Health + Safety + GRI 417 Marketing + Labeling + GRI 418 Customer Privacy + GRI 419 Compliance); (c) SECTOR STANDARDS (GRI Sector Programme) - GRI 11 Oil and Gas (2021) + GRI 12 Coal (2022) + GRI 13 Agriculture + Aquaculture + Fishing (2022) + Mining (in development) + Textile + Apparel (in development) + Financial Services (in development) + Banking + Insurance + Asset Management + Real Estate + Construction + Pharma + Healthcare + ICT + others). REPORTING IN ACCORDANCE WITH GRI: organizations report 'In accordance with GRI Standards' (comprehensive) or 'with reference to GRI Standards' (partial); requires GRI 1 + GRI 2 + GRI 3 + applicable Topic Standards + Sector Standards. ADOPTION: 75+ percent of Fortune 250 + 10,000+ organizations globally report using GRI; foundational layer for CSRD/ESRS sustainability disclosures + ISSB IFRS S1/S2 climate + SBTi science-based targets + CDP carbon disclosure + TCFD climate-related financial disclosures + UN Global Compact + UN SDGs reporting. PUBLICATION + LICENSE: GRI Standards are FREELY available + downloadable in 10+ languages from globalreporting.org under Creative Commons Attribution-No Derivatives 4.0 International (CC BY-ND 4.0). 2024-2025 PIPELINE: ongoing Sector Standards rollout (Mining + Textile + Financial Services + others); GRI-ISSB interoperability + GRI-ESRS interoperability; double materiality; biodiversity + human rights enhancements; Taxonomy alignment.

GS1 GLOBAL STANDARDS is the world's foundational supply chain identification + barcode + traceability + data-sharing standards system, published by GS1 (Global Standards 1) - international not-for-profit standards organization headquartered in Brussels Belgium with 116 Member Organisations in 150+ countries. Established 1973 (originally Uniform Code Council UCC + EAN International). GS1 STANDARDS PORTFOLIO: (a) GS1 GENERAL SPECIFICATIONS (annual revision; v25 January 2025) - foundational specification covering all GS1 identifiers + barcodes + Application Identifiers + data structures + rules; (b) GS1 IDENTIFICATION KEYS - GTIN (Global Trade Item Number, 8/12/13/14-digit, formerly UPC/EAN) + GLN (Global Location Number, 13-digit) + SSCC (Serial Shipping Container Code, 18-digit) + GRAI (Global Returnable Asset Identifier) + GIAI (Global Individual Asset Identifier) + GSRN (Global Service Relation Number) + GDTI (Global Document Type Identifier) + GINC (Global Identification Number for Consignment) + GSIN (Global Shipment Identification Number) + GCN (Global Coupon Number) + CPID (Component Part Identifier) + GMN (Global Model Number); (c) GS1 BARCODE SYMBOLOGIES - EAN/UPC + GS1-128 (Code 128) + GS1 DataBar (formerly RSS) + GS1 DataMatrix (2D) + GS1 QR Code (2D) + GS1 Composite + GS1 Code 39 (legacy); (d) GS1 APPLICATION IDENTIFIERS (AIs) - 100+ standardized prefix codes identifying data types (e.g. AI 01 GTIN + AI 17 Expiry Date + AI 10 Batch + AI 21 Serial Number + AI 11 Production Date + AI 240 Additional Item Identification + many more); (e) EPCIS (Electronic Product Code Information Services, GS1 + ISO/IEC 19987) - event-based supply chain data exchange standard answering What + When + Where + Why + Disposition; current v2.0 (2022); (f) CBV (Core Business Vocabulary, GS1 + ISO/IEC 19988) - controlled vocabulary for EPCIS events; (g) GDSN (Global Data Synchronization Network) - global network of certified data pools (GS1 GDP) enabling master-data sharing + synchronization between trading partners; (h) GS1 EDI (Electronic Data Interchange) - traditional EDI + GS1 XML + WebForms for B2B transactions; (i) GS1 DIGITAL LINK - URI-based extension of GTIN + AIs enabling web-resolvable product data + connected packaging + EU 2D Code; (j) GS1 EU 2D CODE MANDATE - phased transition from 1D barcodes to 2D codes (Data Matrix + QR) for EU products starting 2026-2027 + EU Digital Product Passport (DPP) integration. ADOPTION: ~2 million member companies + ~6 BILLION barcodes scanned daily globally; foundational to retail + healthcare + food + apparel + pharmaceuticals + electronics + logistics + e-commerce + Amazon + Walmart + retailers + brand-manufacturer supply chains. REGULATORY COORDINATION: (a) EU FALSIFIED MEDICINES DIRECTIVE (FMD, Directive 2011/62/EU) - serialised GS1 DataMatrix on pharma packs since February 2019; (b) EU MEDICAL DEVICE REGULATION (MDR, Regulation (EU) 2017/745) + IVDR (Regulation (EU) 2017/746) - UDI (Unique Device Identification) via GS1 GTIN; (c) FDA DSCSA (Drug Supply Chain Security Act) - serialised GS1 codes for US pharma; (d) FDA UDI - GTIN-based UDI for medical devices; (e) EU TOBACCO PRODUCTS DIRECTIVE (TPD) - GS1-based traceability for tobacco; (f) ISO 22526-1/2/3 (Carbon Footprint) - coordination with GS1 for product-level reporting; (g) GHS (Globally Harmonized System) - safety + hazard coding; (h) EU DIGITAL PRODUCT PASSPORT (DPP) per ESPR Regulation (EU) 2024/1781 + sectoral delegated acts 2026+ - GS1 Digital Link is the primary identifier mechanism; (i) GS1 in HEALTHCARE - GS1 Healthcare Reference Book; (j) GS1 in FOOD + FOODSERVICE - food traceability + recall capability; (k) UN PCB (Product Classification Beneficiation) - GS1 codes underpin trade statistics. 2024-2025 PIPELINE: EU 2D Code transition + DPP integration + Sunrise 2027 (point-of-sale 2D barcode acceptance) + GS1 Sustainability + Carbon Footprint + AI/ML data quality + blockchain integration + new sectoral standards.

The Georgia Law on Personal Data Protection (Law of Georgia No. 5550-IS of 28 December 2011) is the national personal data protection law of the COUNTRY OF GEORGIA (not the US state). Originally enacted 28 December 2011 + entered into force 1 May 2012; substantially AMENDED + GDPR-ALIGNED by Law No. 3144-RS of 2 June 2023 (effective 1 March 2024 + with delayed elements 1 May 2024 + 1 September 2024). Georgia has European Union accession candidate status + the 2023 amendments significantly approximated GDPR + EU Council of Europe Convention 108+ (updated CoE Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data). KEY PROVISIONS: (1) SCOPE + APPLICABILITY - applies to natural-person + in-Georgia data processing + extraterritorial offering of goods/services to Georgia residents + monitoring of behaviour in Georgia (GDPR-aligned); (2) LAWFUL BASIS for processing aligned with GDPR Article 6 + special categories per Art. 9 + criminal data per Art. 10; (3) ENHANCED DATA SUBJECT RIGHTS - access + rectification + erasure + restriction + portability + objection + automated-decision-making protections; (4) CONSENT requirements (freely given + specific + informed + unambiguous + withdrawable + age-of-digital-consent 16); (5) DATA CONTROLLER + PROCESSOR OBLIGATIONS - lawful + fair + transparent processing + purpose limitation + minimisation + accuracy + storage limitation + integrity + confidentiality + accountability; (6) CROSS-BORDER TRANSFERS - adequacy + appropriate safeguards (SCCs + BCRs) + derogations; (7) DPO MANDATORY for public authorities + large-scale + special-category processing; (8) BREACH NOTIFICATION 72 HOURS to PDPS + without undue delay to high-risk data subjects; (9) DPIA mandatory for high-risk processing; (10) VIDEO SURVEILLANCE specific regime; (11) PERSONAL DATA PROTECTION SERVICE (PDPS) - independent supervisory authority with inspection + sanctions + complaint-handling powers + administrative fines up to GEL 20,000 + criminal sanctions for serious breaches; (12) APPEAL to PDPS + Court. SECTORAL COORDINATION: Constitution Article 15 + Criminal Code + Law of Georgia on Information Security + Law of Georgia on Cybersecurity + Law of Georgia on Electronic Communications + sector-specific laws (banking + healthcare + telecommunications + employment). EU-ACCESSION + COE PROCESS: Georgia is EU candidate country (granted candidate status December 2023) + the 2023 DPL amendments are part of the EU Acquis approximation; Georgia is signatory to CoE Convention 108+ + ratification anticipated.

The Lieferkettensorgfaltspflichtengesetz (LkSG, German Supply Chain Due Diligence Act) was enacted 22 July 2021 + entered into force 1 January 2023 for companies with MORE THAN 3,000 EMPLOYEES + 1 January 2024 for companies with MORE THAN 1,000 EMPLOYEES (including German branches of foreign entities). The Act establishes statutory HUMAN RIGHTS + ENVIRONMENTAL DUE DILIGENCE OBLIGATIONS in supply chains. SCOPE: covers (a) the company's OWN OPERATIONS; (b) DIRECT SUPPLIERS - full due diligence required; (c) INDIRECT SUPPLIERS - risk-based + SUBSTANTIATED KNOWLEDGE-triggered due diligence (not full due diligence at outset). KEY STATUTORY DUTIES (sections 4-10 of LkSG): (1) RISK MANAGEMENT SYSTEM with appropriate + effective procedures; (2) IN-HOUSE RESPONSIBILITY - designated human rights officer or equivalent with direct reporting to senior management; (3) RISK ANALYSIS - annual + ad-hoc + covering own business + direct suppliers + (if substantiated knowledge) indirect suppliers; (4) POLICY STATEMENT - human rights strategy + senior management commitment; (5) PREVENTIVE MEASURES - integrating human rights into business processes + training + supplier commitments + contractual obligations + audit rights; (6) REMEDIAL ACTION - for actual + imminent violations in own operations + direct suppliers; (7) COMPLAINTS PROCEDURE - accessible + confidential + bias-free + with rules of procedure; (8) DOCUMENTATION OF DUE DILIGENCE; (9) ANNUAL REPORT to BAFA + on the company's website. PROTECTED LEGAL POSITIONS: human rights covered include forced labour + child labour + slavery + discrimination + freedom of association + collective bargaining + occupational health and safety + minimum wage + exclusive land rights + security forces conduct + others. ENVIRONMENTAL OBLIGATIONS: covers specifically Minamata Convention on Mercury + Stockholm Convention on POPs + Basel Convention on Hazardous Waste; broader environmental impacts to the extent they lead to human rights violations. ENFORCEMENT: BAFA (Bundesamt fur Wirtschaft und Ausfuhrkontrolle) - inspection + complaints handling + monitoring + administrative fines + public-procurement exclusion. SANCTIONS: administrative fines up to EUR 8 MILLION + UP TO 2% OF GLOBAL ANNUAL TURNOVER FOR COMPANIES WITH MORE THAN EUR 400 MILLION TURNOVER + PUBLIC PROCUREMENT EXCLUSION UP TO 3 YEARS for significant violations. EU CSDDD COORDINATION: the EU Corporate Sustainability Due Diligence Directive (CSDDD - Directive (EU) 2024/1760) entered into force July 2024 + phased transposition deadlines 2027/2028/2029; EU CSDDD will substantially supersede LkSG + expand to value-chain due diligence + civil liability + alignment expected during 2025-2029 transposition; Germany was central in CSDDD negotiation; some LkSG provisions may be tightened or aligned during transposition.

Germany's Accessibility Strengthening Act, the national law implementing the European Accessibility Act: from 28 June 2025 covered products and consumer services must be accessible, with duties on manufacturers, importers, distributors and service providers, Laender market surveillance, consumer rights to trigger proceedings and fines up to EUR 100 000.

Germany's criminal rules on recording conversations and taking images: all-party consent for non-public spoken words (StGB s. 201) and the ban on images that violate intimate privacy, show helpless or deceased persons or damage reputation (s. 201a).

Germany's Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG) of 2017, the national law that implements and supplements the GDPR and transposes the Law Enforcement Directive. It sets the German rules on employee data (s 26, read after the Court of Justice's C-34/21 ruling as a necessity test on top of a GDPR legal basis), video surveillance of publicly accessible spaces (s 4), the 20-person data protection officer threshold (s 38), special categories, scoring and the limits on data subject rights, and the full regime for police and prosecution authorities. Built from the current German consolidation (to 3 July 2026) read with the official English translation.

Germany's Works Constitution Act (Betriebsverfassungsgesetz, BetrVG), the law under which employees in private-sector establishments with five or more employees elect works councils, and which sets what the employer must share, discuss and agree with them. Its s 87(1) no. 6 gives the works council a veto over introducing and using any technical device objectively capable of monitoring employees' conduct or performance, so CCTV, telematics, email and web logging, screenshot and keystroke tools, productivity scoring and AI analytics need a works agreement or a conciliation award before use. Built on the full Act from the official English translation and the German consolidation (both as at 19 July 2024), with every employer duty a leaf.

Ghana's Cybersecurity Act, 2020 (Act 1038), which created the Cyber Security Authority and requires owners of designated critical information infrastructure to register, report incidents within 24 hours, commission and submit annual audits and meet the Authority's 2021 baseline Directive, requires every institution to report incidents within 24 hours, licenses cybersecurity service providers and accredits professionals, and places lawful-access, interception and data retention duties on service providers. Built from the Act's own sections and the CII Directive.

The Ghana Data Protection Act, 2012 (Act 843) is the national personal data protection law of Ghana enacted 16 October 2012 + administered by the DATA PROTECTION COMMISSION (DPC) of Ghana (Sec.1-15). Act 843 was one of the earlier comprehensive African data-protection laws + predates GDPR + draws on Council of Europe Convention 108 + UK Data Protection Act 1998 + ECOWAS Supplementary Act on Personal Data Protection. KEY PROVISIONS: (1) ESTABLISHMENT of the Data Protection Commission as independent body with Director-General + Board + offices + powers including registration + complaints + investigations + audit + enforcement; (2) 8 DATA PROTECTION PRINCIPLES per Sec.17-23 - lawful + fair + transparent processing + purpose limitation + data minimisation + accuracy + storage limitation + integrity + confidentiality + accountability; (3) DATA SUBJECT RIGHTS Sec.30-38 - access + rectification + erasure + objection + data portability (2017 amendments) + automated-decision-making protection + complaints to DPC; (4) DATA CONTROLLER + PROCESSOR registration with DPC + annual fee + renewal + register publicly accessible; (5) SENSITIVE DATA + CHILDREN safeguards including explicit consent + special-category basis; (6) CROSS-BORDER TRANSFERS Sec.47 - adequacy + safeguards + Ministerial approval for sensitive transfers + ECOWAS regional cooperation; (7) BREACH NOTIFICATION Sec.55 - DPC notification + data subject notification for material breaches; (8) ENFORCEMENT - administrative penalties up to GHS 1,000-5,000+ + criminal sanctions up to 10 years imprisonment for serious offences; (9) SECTORAL COORDINATION with Ghana Cybersecurity Act 2020 + Banking Act + Electronic Communications Act + Electronic Transactions Act + sector regulators. 2024-2025 AMENDMENT PIPELINE: GDPR-alignment review + potential amendments to enhance DSR + breach notification + AI/ML + cross-border transfers + fines; the Ghana Data Protection Authority + DPC reviewing amendments to align with EU adequacy aspirations + African Union Malabo Convention.

The Global Cross-Border Privacy Rules (CBPR) and Privacy Recognition for Processors (PRP) Systems of the Global CBPR Forum, the international successor to the APEC CBPR System: 57 Global CBPR Program Requirements for controllers (the updated set certified from 1 April 2027, each mapped to the 50 certified today) and 18 Global PRP Program Requirements for processors, verified by Forum-recognised Accountability Agents. Built from the Forum's own requirement documents.

The Goleman Emotional Intelligence Leadership Framework is the most widely-adopted leadership development model based on EMOTIONAL INTELLIGENCE (EI) competencies, developed by Daniel Goleman through a series of influential works: WORKING WITH EMOTIONAL INTELLIGENCE (1998) + LEADERSHIP THAT GETS RESULTS (Harvard Business Review, March-April 2000) + PRIMAL LEADERSHIP (2002, with Richard Boyatzis + Annie McKee) + THE NEW LEADERS (2002) + THE BRAIN AND EMOTIONAL INTELLIGENCE (2011) + ALTERED TRAITS (2017, with Richard Davidson). EI MODEL: 4 DOMAINS encompassing ~12 competencies (per the Goleman/Boyatzis/Hay Group framework used in ESCI): (1) SELF-AWARENESS - Emotional Self-Awareness + Accurate Self-Assessment + Self-Confidence; (2) SELF-MANAGEMENT - Emotional Self-Control + Transparency + Adaptability + Achievement Orientation + Initiative + Positive Outlook + Conscientiousness + Trustworthiness; (3) SOCIAL AWARENESS - Empathy + Organizational Awareness + Service Orientation; (4) RELATIONSHIP MANAGEMENT - Inspirational Leadership + Influence + Coach and Mentor + Change Catalyst + Conflict Management + Building Bonds + Teamwork and Collaboration. 6 LEADERSHIP STYLES (per HBR 2000): (a) VISIONARY (Authoritative) - 'Come with me' - mobilizes people toward a shared vision; (b) COACHING - 'Try this' - connects personal goals with organizational; (c) AFFILIATIVE - 'People come first' - creates harmony + builds emotional bonds; (d) DEMOCRATIC - 'What do you think?' - forges consensus through participation; (e) PACESETTING - 'Do as I do, now' - sets high standards + expects same; (f) COMMANDING (COERCIVE) - 'Do what I tell you' - demands immediate compliance. Goleman demonstrated that effective leaders fluidly switch between styles based on context + situation + team needs + create POSITIVE EMOTIONAL CLIMATE (resonance) which correlates with team + financial performance. ESCI INSTRUMENT: ESCI (Emotional and Social Competency Inventory, formerly ECI) is the operational assessment - 360-degree multi-rater instrument with ~68 items measuring the 12 competencies; published + licensed by KORN FERRY HAY GROUP (acquired Hay Group 2015); COPYRIGHTED + commercially licensed; same copyright-protected academic instrument pattern as Bass + Avolio's MLQ for the Full Range Leadership Model. ADOPTION: ~2 million+ ESCI assessments administered globally; thousands of organizations + leadership development programs use the framework; Fortune 500 + global corporations + military + government + non-profits + healthcare + education. 2024-2025 PIPELINE: continued academic research + neuroscience integration + ESCI 2.0 updates + AI-driven 360-feedback + integrated leadership development platforms + coordination with positive psychology + transformational leadership + servant leadership + authentic leadership.

Greece's Law 4624/2019, the national law that re-establishes the Hellenic Data Protection Authority, sets Greece's GDPR measures (consent at 15, special-category grounds and safeguards, a ban on genetic data in insurance, employee data and workplace CCTV rules, research and archiving safeguards, limits on notice and access with documentation duties, public-body DPOs) and transposes the Law Enforcement Directive for competent authorities, as amended to 2025. Built from the Law's own articles.

HIPAA Breach Notification Rule standards for breach risk assessment and notification to individuals, the media, HHS and covered entities by business associates.

HIPAA Privacy Rule standards for the use and disclosure of protected health information, individual privacy rights, and covered entity administrative requirements.

Health Insurance Portability and Accountability Act security standards for protecting electronic protected health information (ePHI)

The Health Information Technology for Economic and Clinical Health Act (HITECH Act) is a US federal statute enacted 17 February 2009 as Title XIII of the AMERICAN RECOVERY AND REINVESTMENT ACT (ARRA, Public Law 111-5, Stimulus Act). HITECH represents the most significant amendment to HIPAA since enactment. KEY PURPOSES + ACHIEVEMENTS: (a) promoting EHR adoption + Health Information Technology + Meaningful Use + interoperability across the US healthcare system; (b) substantially enhancing HIPAA Privacy Rule + HIPAA Security Rule (separately verified) enforcement with tier-based civil monetary penalties + criminal sanctions + State Attorney General enforcement authority; (c) extending HIPAA direct liability to BUSINESS ASSOCIATES + subcontractor business associates downstream; (d) establishing the HITECH BREACH NOTIFICATION RULE (45 CFR Part 164 Subpart D); (e) strengthening individual rights including electronic access + accounting of disclosures + restrictions on disclosures to health plans + prohibition on sale of PHI + tightened marketing + fundraising; (f) creating Office of the National Coordinator for Health IT (ONC) with statutory authority. STRUCTURE: 4 Subtitles - SUBTITLE A Promotion of Health Information Technology (42 USC 17901-17915); SUBTITLE B Testing of Health IT (42 USC 17916-17919); SUBTITLE C Grants/Loans/Workforce (42 USC 17921-17924); SUBTITLE D Privacy and Security Provisions (42 USC 17931-17953 - the HITECH Privacy/Security amendments). KEY SUBTITLE D PROVISIONS: (a) Section 17931 application of security provisions + penalties to BAs; (b) Section 17932 BREACH NOTIFICATION (codified at 45 CFR 164.400-414); (c) Section 17933 education on health information privacy; (d) Section 17934 application of privacy provisions + penalties to BAs; (e) Section 17935 restrictions on certain disclosures + sales of PHI; (f) Section 17936 conditions on contacts as part of health care operations; (g) Section 17937 individual access + accounting of disclosures; (h) Section 17938 conditioning compliance + enforcement; (i) Section 17939 enforcement provisions (tier-based civil monetary penalties up to USD 1.5M/year per category); (j) Section 17940 education + outreach. ENFORCEMENT: HHS Office for Civil Rights (OCR) primary enforcer + State Attorneys General authority to pursue HIPAA violations on behalf of state residents; tier-based civil monetary penalties: Tier 1 (did not know) USD 100-50K per violation, USD 25K annual max; Tier 2 (reasonable cause) USD 1K-50K per violation, USD 100K annual max; Tier 3 (willful neglect, corrected) USD 10K-50K per violation, USD 250K annual max; Tier 4 (willful neglect, uncorrected) USD 50K per violation, USD 1.5M annual max (per category; inflation-adjusted). RECENT HHS OCR ENFORCEMENT: substantial penalties including Anthem USD 16M + Premera USD 6.85M + Excellus USD 5.1M + Memorial Healthcare USD 5.5M + Advocate USD 5.55M + many other settlements + corrective action plans + audits. MEANINGFUL USE / PROMOTING INTEROPERABILITY: CMS Promoting Interoperability program (formerly Meaningful Use) for EHR Incentive Payments + later Medicare Quality Payment Program (MIPS); 3 stages + value-based care + 2018+ EHR Reporting + Promoting Interoperability + post-Cures Act + ONC USCDI + Open APIs + Information Blocking Final Rule. ONC (Office of the National Coordinator): statutory authority + HIT Standards + Certification programs + Information Blocking + Trusted Exchange Framework + Common Agreement (TEFCA) + Health Data Networks. SUBSEQUENT REGULATORY ACTIVITY: (1) 2013 HIPAA Omnibus Final Rule implementing HITECH including direct BA liability + breach notification + marketing/fundraising changes + sale of PHI; (2) 2016 21st Century Cures Act + Sec. 4002 ONC Information Blocking + HIT Advisory Committee + ONC USCDI; (3) 2020 ONC Cures Act Final Rule + Information Blocking + Open APIs + FHIR R4 implementation; (4) 2024 HHS Notice of Proposed Rulemaking on HIPAA Security Rule modernisation (NPRM December 2024) + comments closing March 2025 + potential Final Rule 2025-2026 incorporating cybersecurity best practices + MFA + encryption + asset inventory + ransomware response; (5) 2024 HHS final rule on reproductive health privacy + April 2024 enforcement effective; (6) ongoing OCR audits + enforcement priorities + ransomware + HIPAA Security Rule violations.

The HKMA's framework for Hong Kong banks to rate their inherent cyber risk, prove the matching maturity against control principles in 26 components across seven domains (baseline for low, intermediate for medium, advanced for high inherent risk) and, at medium or high risk, run intelligence-led attack simulation testing with red and blue teams. The 2.0 matrix itself is issued to banks privately.

The HKMA SUPERVISORY POLICY MANUAL (SPM) is the foundational umbrella collection of supervisory policy modules + guidance issued by the HONG KONG MONETARY AUTHORITY (HKMA) governing banking + financial institution supervision in Hong Kong SAR. The SPM provides the comprehensive framework for HKMA Authorised Institutions (AIs - licensed banks + restricted-licence banks + deposit-taking companies); supplemented by specific Circulars + sectoral cybersecurity frameworks (notably C-RAF v2.0 + Cybersecurity Fortification Initiative). SPM organises ~60+ modules by SUBJECT AREAS: (a) CG CORPORATE GOVERNANCE - CG-1 (Corporate Governance of Locally Incorporated AIs) + CG-2 (Systems of Control) + CG-3 (Code of Conduct) + CG-5 (Guideline on a Sound Remuneration System) + CG-6 (Competence and Ethical Behaviour); (b) CR CREDIT RISK MANAGEMENT - CR-G General Principles + CR-G-7 (Collateral and Credit Risk Mitigation) + CR-G-13 (Counterparty Credit Risk Management) + numerous sub-modules; (c) IR INTEREST RATE RISK - IR-1 (Interest Rate Risk in Banking Book); (d) LM LIQUIDITY MANAGEMENT - LM-1 (Liquidity Risk Management) + LM-2 + LM-3; (e) MR MARKET RISK MANAGEMENT - MR-G + various sub-modules; (f) OR OPERATIONAL RISK - OR-1 (Operational Risk Management) + OR-2 (Operational Resilience); (g) IC INTERNAL CONTROL + RISK MANAGEMENT - IC-1 (Risk Management Framework) + IC-5 (Stress Testing); (h) AC AUDITING - AC-G + various; (i) TM TECHNOLOGY MANAGEMENT modules - TM-G-1 (General Principles for Technology Risk Management, covered as its own framework) + TM-G-2 (Business Continuity Planning) + TM-G-3 (Information Technology Security + Cyber Risk Mgmt) + TM-G-4 (Public Cloud) + TM-E-1 (Risk Management of e-Banking) + TM-M (Monitoring) + TM-N (New Technology) + TM-S (Supervisory); (j) RA RISK-BASED APPROACH modules; (k) AMLO AML/CFT - AML + CFT supervision + AMLO Guidelines; (l) CA CAPITAL ADEQUACY - CA-G-1 (Capital Adequacy Assessment) + Basel III implementation; (m) RR RECOVERY + RESOLUTION PLANNING - RR-1 (Recovery Planning); (n) SA OUTSOURCING - SA-2 (Outsourcing); (o) DI DEPOSIT INSURANCE; (p) various other modules covering reporting + governance + remuneration + sectoral. KEY MODULE NUMBERING: each module has a letter-prefix (e.g. CG + CR + TM) + number (e.g. 1 + 2 + G + E) + sub-number (e.g. G-1 + G-2); modules updated periodically with version control + effective dates + supervisory expectations. KEY MODULES + SUPERVISORY EXPECTATIONS: each module establishes principles + expectations + applicable to AIs based on size + complexity + risk + sophistication; HKMA supervisory dialogue + assessment + reporting + remediation cycle. INTEGRATION: SPM coordinates with HKMA Banking Ordinance + Banking (Capital) Rules + various Cap. 155 sub-regulations + Banking (Disclosure) Rules + Banking (Liquidity) Rules + Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615); Cybersecurity Fortification Initiative (CFI) + C-RAF v2.0 (verified separately) operationalises cybersecurity-specific expectations. INTERNATIONAL COORDINATION: Basel Committee on Banking Supervision (BCBS) standards + IOSCO + FATF + Financial Stability Board (FSB); Singapore MAS + UK PRA + ECB + Australia APRA + Federal Reserve + OCC equivalent supervisory frameworks. RECENT UPDATES + 2024-2025+: ongoing module revisions including Operational Resilience (OR-2) + Climate Risk + ESG-related expectations + AI + cybersecurity + recovery + DORA-coordination + sustainability + DPP-coordination + emerging tech.

HKMA TM-G-1 is the FOUNDATIONAL HKMA Supervisory Policy Manual MODULE on Technology Risk Management + cybersecurity + IT risk for all HKMA AUTHORISED INSTITUTIONS (AIs) in Hong Kong SAR. TM-G-1 GENERAL PRINCIPLES FOR TECHNOLOGY RISK MANAGEMENT covers the comprehensive lifecycle of IT + cyber risk management. KEY STRUCTURE: 26+ subsection control areas organized in 9 sub-modules: (1) GOVERNANCE OF TECHNOLOGY RISK (TM-G-1.2.1-3) - Board + Senior Management Oversight + Technology Risk Management Framework + Roles + Responsibilities; (2) IT STRATEGY + POLICIES (TM-G-1.3.1-3) - IT Strategy + Planning + Policies + Standards + Procedures + Technology Risk Assessment; (3) IT DEVELOPMENT + CHANGE (TM-G-1.4.1-3) - Project + Programme Management + System Development + Acquisition + Change Management; (4) IT OPERATIONS (TM-G-1.5.1-3) - IT Operations Management + Capacity + Performance + Problem + Incident Management; (5) INFORMATION SECURITY (TM-G-1.6.1-8) - Information Security Programme + Access Control + Identity Management + Privileged Access Management + Network Security + Cryptographic Controls + Data Loss Prevention + Vulnerability + Patch Management + Endpoint + Mobile Security; (6) CYBER MONITORING + RESPONSE (TM-G-1.7.1-3) - Security Monitoring + SIEM + Cyber Threat Intelligence + Cyber Incident Response; (7) INDEPENDENT AUDIT (TM-G-1.8.1) - Independent Audit of Technology Risk; (8) OUTSOURCING + CLOUD (TM-G-1.9.1-2) - Outsourcing + 3rd Party Risk + Cloud Computing Risk Management. ADJACENT TM MODULES included in this framework's scope: (a) TM-G-2 Business Continuity Planning (BCG + BIA + Recovery + Backup + Testing); (b) TM-E-1 Risk Management of e-Banking (Governance + Customer Authentication + Transaction Monitoring + Customer Protection + Application Security); (c) OR-2 Operational Resilience (Framework + Severe but Plausible Scenario + 3rd Party Concentration); (d) C-RAF v2.0 (IRA + Maturity Assessment + iCAST) - separately tracked sectoral cybersecurity framework. KEY 2024-2025+ DIRECTIONS: AI + ML governance + generative AI cyber risk + quantum-resistant cryptography + cloud + ransomware + supply chain + DORA coordination + sectoral cyber evolution + recent HKMA supervisory communications + Circulars + sectoral exercises.

The HL7 FHIR Security Framework is the foundational security + privacy + access control framework for FHIR (Fast Healthcare Interoperability Resources) - the global standard for healthcare data exchange APIs. Developed + maintained by HEALTH LEVEL 7 INTERNATIONAL (HL7), the framework covers all aspects of API-based healthcare data exchange security. KEY HISTORY: FHIR DSTU1 (2014) + DSTU2 (2015) + STU3 (2017) + R4 normative (October 2019) + R4B (2022) + R5 (2023) + R6 (planning). FHIR is now the DEFACTO global standard for healthcare interoperability APIs + foundation for ONC Cures Act Final Rule + USCDI + TEFCA + e-prescribing + telehealth + research + EHR-to-EHR + patient + provider + payer + public health + AI + clinical decision support APIs. SECURITY FRAMEWORK PILLARS: (a) TRANSPORT SECURITY - TLS 1.2+ + certificate pinning + secure communications; (b) AUTHENTICATION - SMART App Launch + OAuth 2.0 + OpenID Connect + Backend Services (asymmetric key) + user + system authentication; (c) AUTHORIZATION - OAuth 2.0 scopes (patient/Resource.* + user/* + system/* + scope granularity) + SMART scope syntax + Security Labels + Consent Resource enforcement; (d) AUDIT + PROVENANCE - AuditEvent Resource logging + Provenance tracking + retention + integrity; (e) CONSENT - Consent Resource modeling + enforcement + patient authorization + breach disclosure; (f) BULK DATA - Bulk Data Export Authorization (Backend Services + SMART Bulk Data); (g) DIGITAL SIGNATURES - Resource-level digital signatures + Provenance signatures; (h) CROSS-ORGANIZATIONAL - Backend services to backend services + JWT Bearer Tokens + Asymmetric keys; (i) PRIVACY - de-identification + research + Security Labels + consent integration; (j) EMERGENCY ACCESS - Break the Glass + override procedures; (k) RESILIENCE - Rate Limiting + Anti-Abuse + Server CapabilityStatement security + CORS + Token lifetime + Refresh. SMART ON FHIR (Substitutable Medical Applications + Reusable Technologies): SMART App Launch IG v2.2.0 (current) + EHR-Launch + Standalone-Launch + Backend Services Launch + PKCE + asymmetric key + OAuth 2.1 + OpenID Connect + scopes + capabilities; SMART Health Cards + SMART Health Links + SMART Cards Framework. KEY HL7 FHIR SECURITY SPECIFICATIONS: hl7.org/fhir/security.html (R4/R5 core) + SMART App Launch Implementation Guide + FHIR Bulk Data IG + FHIR Consent Resource + AuditEvent Resource + Provenance Resource + Security Labels + FHIR Operations + FHIR Subscriptions. COORDINATION: (1) HIPAA Privacy + Security Rules (verified separately) - foundational US healthcare privacy + security law; (2) ONC Information Blocking Final Rule (verified separately as HITECH-coordinated) - mandates FHIR-based APIs + Open APIs + USCDI; (3) 21st Century Cures Act - Section 4002 ONC requirements + FHIR + Open APIs; (4) USCDI United States Core Data for Interoperability v1-v4+ - FHIR-mapped data elements; (5) TEFCA Trusted Exchange Framework + Common Agreement (2022+) - voluntary nationwide interoperability + QHINs + FHIR coordination; (6) FDA UDI + DSCSA + clinical research + drug + device registries + FHIR coordination; (7) ONC EHR Certification 2015 Edition Cures Update + FHIR R4 + USCDI + Open APIs; (8) GLOBAL ADOPTION - UK NHS + Israel + Canada + Australia + India + Singapore + Brazil + many countries adopting FHIR for interoperability. 2024-2025+ DIRECTIONS: (a) AI + ML INTEGRATION - FHIR APIs + AI + clinical decision support + agentic AI + Subscriptions; (b) BULK DATA + ANALYTICS + AI - large-scale data exchange + research; (c) QUANTUM-RESISTANT CRYPTOGRAPHY - transition planning for OAuth + TLS + JWT; (d) PATIENT-DIRECTED EXCHANGE - patient access + Apps + 3rd-party + Open Banking-style consent; (e) RANSOMWARE + CYBERSECURITY - sectoral cybersecurity + Change Healthcare crisis + healthcare-specific threat landscape; (f) FHIR R6 PLANNING + further security enhancements + new IGs + Federated Identity + Verifiable Credentials integration. STATUS: HL7 FHIR is FREELY available + open standard published under HL7 SPECIFICATIONS license; broad sectoral adoption + Fortune 500 healthcare + payers + EHRs + Mainland China + global + ongoing R6 planning + emerging cybersecurity + AI + tokenization features.

The chain-of-responsibility primary duty and the loading requirements duty, with its three risk-tiered breach categories, from Part 4.4 (and the Chapter 1A primary duty) of the Heavy Vehicle National Law, the schedule to the Heavy Vehicle National Law Act 2012 (Qld), applied nationally except Western Australia and the Northern Territory. The detailed load restraint performance standards sit in the Heavy Vehicle (Mass, Dimension and Loading) National Regulation and its means of compliance, the NTC/NHVR Load Restraint Guide, which are not built as separate leaves this run.

Ronald Heifetz's adaptive leadership framework: leadership is the practice of mobilizing people to tackle tough challenges and thrive, distinct from authority; its core is distinguishing technical problems from adaptive challenges (which need changes in people's priorities, beliefs, habits and loyalties and involve loss), regulating distress within a productive zone, countering work avoidance, observing, interpreting and intervening from the balcony, giving the work back and protecting voices from below. Built from the authors' own texts (Part One of The Practice of Adaptive Leadership, 2009; the 1997 Harvard Business Review article The Work of Leadership; Heifetz's essay Mobilizing for Adaptive Work; his 2020 and 2021 teaching decks), with the book's later chapters held as their contents page and a chapter summary; a leadership framework, not a certifiable standard.

Hersey and Blanchard's Situational Leadership Model: there is no best leadership style, and the leader matches the amount of direction (task behaviour) and support (relationship behaviour) to the follower's readiness, the ability and willingness to do a specific task, moving through four styles (telling, selling, participating, delegating; in Blanchard's SLII directing, coaching, supporting, delegating) as readiness rises and back when it falls. A practitioner model with contested empirical support, not a certifiable standard.

The Hong Kong Personal Data (Privacy) Ordinance (Cap 486, enacted 1996, significantly amended 2012 and 2021) regulates the collection, use, storage, and transfer of personal data. The Privacy Commissioner for Personal Data (PCPD) oversees compliance. The 2021 amendment criminalised doxxing. Establishes six Data Protection Principles (DPPs) governing the lifecycle of personal data. The PCPD has enhanced enforcement powers including criminal prosecution for doxxing.

Hungary's Act CXII of 2011 on Informational Self-Determination and Freedom of Information (Info Act, amended 2018) supplements the EU GDPR with national provisions. The National Authority for Data Protection and Freedom of Information (NAIH - Nemzeti Adatvédelmi és Információszabadság Hatóság) oversees enforcement. The Act covers both data protection and freedom of information. National provisions include the age of digital consent (16 years), research derogations, public interest data access, and administrative fine procedures.

IACS Recommendation No. 194 (December 2025) sets a minimum baseline of fourteen cybersecurity controls for existing ships (contracted before 1 July 2024, over 100 GT), which the class rules of UR E26 and E27 do not cover: an OT asset inventory; network segmentation into OT, IT and crew zones; malware protection, access control, wireless limits, controlled remote access, USB and portable device protection, crew training and managed updates; network monitoring; shore contacts, incident reporting and response with network isolation; and backup and restore. Each control points to the UR E26 requirement it scales down for the existing fleet.

IACS Unified Requirements E26 (the ship as a whole) and E27 (onboard systems and equipment) on cyber resilience, both in Rev.1 of 2023, are applied uniformly by IACS member societies to ships whose building contract is signed on or after 1 July 2024 (the April 2022 originals were withdrawn before taking effect). E26 treats the ship as a whole: 17 requirements under identify, protect, detect, respond and recover (asset inventory, security zones, network protection, malware protection, access control, wireless, remote access, portable devices, monitoring, diagnostics, incident response, independent local control, network isolation, fallback to a minimal risk condition, recovery, backup and controlled restart), demonstrated through design documents, witnessed commissioning tests and an owner's cyber security and resilience programme checked at annual and special surveys, with a risk-assessed route for excluding isolated systems. E27 sets what suppliers must deliver: documentation, 30 required and 11 additional security capabilities drawn from IEC 62443-3-3, a secure development lifecycle drawn from IEC 62443-4-1, and plan approval with survey and factory acceptance testing leading to a System certificate.

The IAEA Nuclear Security Series No. 17-T (Rev 1) provides technical guidance on implementing computer security at nuclear facilities. It addresses cybersecurity for nuclear instrumentation and control (I&C) systems, safety systems, and information technology supporting nuclear security. Part of the broader IAEA Nuclear Security framework that includes physical protection, nuclear material accounting, and transport security.

The International Association of Insurance Supervisors (IAIS) Insurance Core Principles (ICPs) provide a globally accepted framework for the supervision of the insurance sector. The 26 ICPs cover licensing, governance, risk management, conduct of business, group supervision, and cross-border cooperation. They serve as the benchmark for insurance regulation globally and are assessed by the IMF and World Bank as part of Financial Sector Assessment Programs (FSAPs).