GV-1.1 Legal and regulatory requirements involving AI are understood, managed, and documented
Legal and regulatory requirements involving AI are understood, managed, and documented. The organisation identifies which AI-specific and AI-adjacent legal duties bind each system, records how each is discharged, and keeps that record current as the applicable law changes across the jurisdictions the system reaches.
Source: NIST AI RMF 1.0, GV-1.1. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open NIST AI RMF 1.0 in the compliance library.
These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.
system holds itEvidence a system already holds
- Change records showing the register was updated when applicable law changed · Policy repository / GRC workspace
periodic reviewEvidence produced at each review
- Evidence of legal review at design and before deployment, with reviewer and date · Source control / CI pipeline
- A record of jurisdictions the system is deployed into and the requirements that follow from each · Document repository
governing documentDocuments that govern the control
- A register of legal and regulatory requirements applicable to each AI system, naming the instrument and the obligation · Policy repository / GRC workspace
- Mapping from each identified obligation to the control, process or artefact that discharges it · Document repository
First move
Common gaps auditors find
- A generic corporate compliance register with no AI-specific entries
- Requirements listed but never mapped to a control, so nothing shows they are met
- Register maintained for the launch jurisdiction only while the system is reachable elsewhere
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet