Frameworks Overview

The Modulos docs give information about laws, standards, guidance, principles, and supplier requirements for AI governance, data protection, and cybersecurity. This page gives the type and status of each instrument and a link to its pages.

Not sure which framework applies to you?

The AI Governance Frameworks Comparison puts frameworks side by side and shows which of them are law and which are voluntary.

Frameworks by type

The instruments in the Modulos docs are of seven types. The status of an instrument comes from its own text. The Status column tells you if the instrument is binding law. The pages of each instrument tell you who it applies to.

Type	Instruments	Status
EU law	EU AI Act, GDPR, DORA, and the Cyber Resilience Act are Regulations. NIS2 is a Directive.	Binding law. A Regulation applies directly in all Member States, from the dates of application in its text. The EU AI Act applies in stages (Article 113). NIS2 applies to entities through the national measures that each Member State adopts and applies (Article 41(1)).
U.S. law (Colorado, California, New York City)	Colorado SB 26-189 is a Colorado law. The CCPA ADMT Regulations are regulations that the California Privacy Protection Agency adopted for the CCPA. NYC Local Law 144 is a city law, with the rules of the Department of Consumer and Worker Protection (DCWP).	Binding law, each from its own dates.
UAE federal law	UAE PDPL (Federal Decree-Law No. 45 of 2021).	Binding law, from its own dates (Articles 29 and 31). See the dates of the UAE PDPL.
Standards	ISO/IEC 42001, ISO/IEC 27001, ISO/IEC 27701, IEEE 7003, and EN 18286.	Voluntary. EN 18286 is a harmonized standard for the EU AI Act.
Guidance and principles from public bodies	NIST AI RMF (NIST AI 100-1), Singapore MGF for Agentic AI (IMDA), and Saudi AI Risk Management (SDAIA) are frameworks. FINMA Guidance 08/2024 and UAE Consumer AI (CBUAE Guidance Note) are guidance. MAS FEAT and UAE AI Ethics are principles.	Not law. NIST is voluntary, IMDA gives guidance, and SDAIA gives advisory guidance. FINMA guidance has no legal effect. The CBUAE Guidance Note supplements laws, regulations, and directives. MAS FEAT is non-prescriptive, and UAE AI Ethics is non-binding.
Community security guidance	OWASP Top 10 for LLM Applications and OWASP Top 10 for Agentic Applications. See also OWASP for AI.	Not law. Each OWASP Top 10 is for general information only and is not legal advice. Each OWASP Top 10 has the CC BY-SA 4.0 license.
Supplier requirements	Microsoft Supplier DPR.	Not law. The DPR apply to a Microsoft supplier that processes Microsoft Personal Data or Microsoft Confidential Data through its contract with Microsoft.

How Frameworks work in Modulos

Modulos has one or more Frameworks for each instrument. A Framework is at the AI System level or at the Organization level. For most instruments, the pages of the instrument tell you which Frameworks Modulos has and at which level.

A Requirement Owner reviews the completed Controls and marks the Requirement Fulfilled. For guidance, principles, and voluntary instruments, a Requirement is not a legal obligation.

The Control Overlap Across AI Governance Frameworks page counts shared Controls, which do not automatically make Requirements Fulfilled.

Modulos sends Framework version notifications when it makes a new Framework version available.

AI-specific frameworks

The instruments in this group are about AI systems, AI models, and automated decisionmaking technology (ADMT). The definitions of ADMT in Colorado SB 26-189 and in the CCPA ADMT Regulations also include technology that does not use AI. The definition of an automated employment decision tool in NYC Local Law 144 also includes technology that does not use AI.

EU AI ActAnnex III: Dec 2027

EU Regulation on AI systems and general-purpose AI models. The badge gives the date of application for Annex III high-risk rules (Article 113).

Regulation: EU

EN 18286 QMS

European Standard for a quality management system for EU AI Act regulatory purposes. Its reference was published in the Official Journal on 14 October 2026.

Standard: CEN/CENELEC

ISO/IEC 42001

Standard for an AI management system in an organization.

Standard: ISO

IEEE 7003

IEEE standard for algorithmic bias considerations across the AI system life cycle.

Standard: IEEE

NIST AI RMF

Voluntary NIST framework (NIST AI 100-1) for the management of AI risks.

Framework: NIST

Colorado SB 26-189Jan 2027

Colorado law on developers and deployers of covered ADMT that materially influences consequential decisions.

Law: Colorado

CCPA ADMT RegulationsJan 2027

CCPA regulations on business use of automated decisionmaking technology (ADMT) for significant decisions, consumer rights, and risk assessments.

Regulation: California

NYC Local Law 144

New York City law on employers and employment agencies that use automated employment decision tools for employment decisions.

Law: New York City

OWASP Top 10 for LLM

OWASP community guidance on security risks and mitigations for applications that use large language models.

Security guidance: OWASP

OWASP Top 10 for Agentic

OWASP community guidance on security risks and mitigations for agentic applications.

Security guidance: OWASP

UAE AI Ethics

Non-binding UAE principles and guidelines (DEC 2022 edition) for AI developer and AI operator organizations, for AI systems that make or inform significant decisions.

Principles: UAE

UAE Consumer AI

CBUAE Guidance Note on consumer protection and the responsible use of AI and machine learning by licensed financial institutions.

Guidance: UAE

MAS FEAT

MAS principles on fairness, ethics, accountability, and transparency in AI and data analytics in Singapore's financial sector.

Principles: Singapore

FINMA AI Governance

FINMA Guidance 08/2024 on governance and risk management when using AI, for the institutions that FINMA supervises.

Guidance: Switzerland

Singapore MGF for Agentic AI

IMDA voluntary best-practice governance framework for agentic AI systems.

Framework: Singapore

Saudi AI Risk Management

SDAIA's advisory national framework to identify, assess, treat, and monitor AI risks.

Framework: Saudi Arabia

Data protection and cybersecurity

The instruments in this group are about personal data, information security, and cybersecurity. These instruments are also for systems and products that do not use AI.

GDPR

EU Regulation on the processing of personal data, for controllers and processors.

Regulation: EU

NIS2

EU Directive on cybersecurity risk-management measures and incident reporting for essential and important entities. It also applies to entities that provide domain name registration services (Article 2(4)). Member States apply it through national law.

Directive: EU

DORA

EU Regulation on digital operational resilience for financial entities and ICT third-party service providers.

Regulation: EU

Cyber Resilience ActDec 2027

EU Regulation on cybersecurity requirements for products with digital elements, for manufacturers and other economic operators.

Regulation: EU

ISO/IEC 27001

Standard for an information security management system.

Standard: ISO

ISO/IEC 27701

Standard for a standalone privacy information management system (2025 edition).

Standard: ISO

UAE PDPL

UAE federal decree-law on personal data processing by controllers and processors in the State, or outside it for data subjects in the State. Article 2(2) gives exclusions.

Law: UAE

Supplier requirements

Microsoft Supplier DPR

Microsoft's data protection requirements for each supplier that processes Microsoft Personal Data or Microsoft Confidential Data through its contract with Microsoft.

Supplier requirements: Microsoft

---

Disclaimer

This page gives general information. It is not legal advice.