REGULATORS · 5 BINDING INSTRUMENTS · 5 JURISDICTIONS MAPPED
REVISED 2026-08-06 · PER-ARTICLE OBLIGATION MAPPING

The regulators we
map evidence against.

Warrant maps agent actions to enacted, publicly citable regulation: the EU AI Act (Articles 12, 13, 14, 15 and Annex IV), the UK FCA Consumer Duty, NYDFS Part 500, and India's SEBI algorithmic-trading circular and DPDP Act 2023. Every one of those citations resolves to text on the regulator's own domain, and any reviewer can open it. We do not put paywalled standards, superseded guidance, draft consultations or repealed statutes on the record. Four further sources are mapped and labelled non-binding: US Federal Reserve SR 26-2, the RBI's FREE-AI committee report, NIST AI RMF and ISO/IEC 42001. SR 26-2 is supervisory guidance, not an enforceable rule, and as of the letter of 17 April 2026 its footnote 3 places generative and agentic AI outside its scope.

BINDING INSTRUMENTS
5· across 4 jurisdictions · 5 mapped in all
Clause-level mapping across the EU, UK, New York and India. Four further sources are mapped and labelled non-binding, US Federal Reserve SR 26-2 among them.
EU AI ACT · ART. 12
2027-12-02
Application date for Annex III high-risk providers, as deferred by Regulation (EU) 2026/1744 (in force 2026-07-27), Article 1(40)(b) replacing Article 113, third paragraph, point (c). The date was 2026-08-02 before that amendment.
COVERAGE
live· 2026-05-08
Status reflects production coverage. We do not claim certifications we do not hold.
01 · OPENING

One trace in. One verifiable package out.

A Warrant record is the artefact a regulator reads. It cites, by number, the specific articles that apply to the trace it was built from, binds each agent decision to the obligation it answers to, and is independently verifiable without contacting Warrant. Coverage follows the trace: this page is the index of what we map and where each obligation lives, not a list of clauses every record carries. Two entries answer the questions counsel ask before any regime name comes up: what records must an AI agent keep, and what counts as audit-ready evidence.

Mapping is article-level. We cite specific obligations and the Warrant evidence fields that satisfy them. We do not claim certifications we do not hold. Coverage we have not shipped is not listed.

"Logs are the cheapest part of compliance. Producing the chain that makes them admissible is the entire job."Counsel B.W. · regulatory review · 2026-04-30
02 · REGIMES

Regulation and guidance, cited to clause.

Status chip per row. live means production-shipped article-level mapping. partial means some obligations satisfied, others surfaced as Gaps. roadmap means we have not shipped it. pending means the regime is still drafting. Coverage status is separate from legal force: a row carrying not binding is supervisory guidance, a committee report or a voluntary standard, mapped and labelled, never cited as binding.

EU · 2027-12-02
EU AI Act · Art. 12 + Art. 13Regulation (EU) 2024/1689 · record-keeping and transparency to deployers · €15M or 3% turnover penalty. Application 2027-12-02 (deferred from 2026-08-02 by the adopted Digital Omnibus). live deep dive →
UK · 2023-07-31
FCA Consumer Duty · PS22/9 Principle 12SMCR personal liability · PRIN 12 binds the decision however it was produced. Retail customer outcomes evidenced per decision. live deep dive →
US · 2026
SR 26-2 · Federal Reserve / OCC / FDICIssued 17 April 2026; supersedes and replaces SR 11-7 (4 Apr 2011) and SR 21-8. Organised in Roman sections I–VII, with "effective challenge" defined in § III and governance and controls at § VI. Not binding: an interagency supervisory letter, which does not itself set enforceable standards, and as of the 17 April 2026 letter its footnote 3 places generative and agentic AI outside its scope. Mapped and labelled, never cited as binding; agent evidence against it is framed as governance rather than model risk. not binding live deep dive →
US-NY · 2024-10-16
NYDFS Part 500 · 23 NYCRR § 500Second Amendment + AI Industry Letter. § 500.17(a) 72-hour notice, § 500.17(b) annual notice of compliance, § 500.19 exemptions. The corpus carries no § 500.6 sub-clause, so the audit trail is reported as classified and not evaluated. live deep dive →
IN · 2026-04-01
SEBI algo circular · Safer participation of retail investors in Algorithmic tradingSEBI/HO/MIRSD/MIRSD-PoD/P/CIR/2025/0000013 (4 Feb 2025); applicable to all stock brokers 1 April 2026 under ¶8 of the circular of 30 Sep 2025. Not AI/ML-scoped: it governs "algo" orders, defined as orders generated using automated execution logic, and the words artificial intelligence, machine learning and model do not occur in it. Permission runs per algo from the STOCK EXCHANGE (¶II(a)); algo providers "shall not be regulated by SEBI" (¶III(a)). No backtesting or model-documentation duty — the only documentation duty is the Research Analyst report for black-box algos (¶V(a)(ii)). live deep dive →
IN · 2025-08-13
RBI · Framework for Responsible and Ethical Enablement of AIFREE-AI Committee Report. Seven sutras, 26 recommendations, six strategic pillars. AI in regulated banking entities. Not binding: a committee report the RBI has not adopted by any direction or instrument, mapped and labelled, never cited as binding. not binding deep dive →
IN · 2027-05-14
DPDP Act 2023Digital Personal Data Protection Act. Lawful basis, purpose limitation, data principal rights. Assented 11 Aug 2023 and commenced in tranches by G.S.R. 843(E) (13 Nov 2025); the substantive obligations apply at the eighteen-month mark. Penalties are tiered by Schedule entry under s.33(1) — the ₹250 crore ceiling attaches to the s.8(5) duty to take reasonable security safeguards, and the Act sets no per-instance multiplier. enacted · duties 2027 deep dive →
SG · 2026
MAS AI Risk Management · not mappedPublished as consultation paper P017-2025, which is a draft. Warrant does not put draft instruments on the record, so Singapore is not a jurisdiction we cite today. This changes when the guidelines are issued in final form. draft deep dive →
EU · 2026 Q3
EU AI Act · Art. 14 + Art. 26(6)Human oversight effectiveness review, deployer-side log retention. Authorization-envelope foundation shipped; full Article 14 mapping planned v0.5. roadmap

The two Article 12 questions that arrive with the EU rows have their own entries: how long must Article 12 logs be kept, and is there a standard for Article 12 logging.

W
Sample evidence packages · EU · UK · US · IndiaINDEPENDENTLY VERIFIABLE WITHOUT CONTACTING WARRANT
→ /samples
03 · MAPPED IN THE CORPUS

Twenty regimes mapped. Six published.

The evidence corpus behind the pipeline maps 20 regimes. Eight of those are carried by the published deep-dive pages above — Article 13 sits on the EU AI Act page and the RBI FREE-AI report on the India page. The twelve remaining regimes are indexed here. Each entry names the instrument, carries its status as recorded in the corpus, and points at the closest published surface. A draft, a superseded letter, or a non-binding source is mapped and labelled — it is never cited as binding.

EU
EU AI Act Annex IV — Technical documentation referred to in Article 11(1) · Regulation (EU) 2024/1689. Deferred by enacted amendment: applies 2027-12-02 (Annex III) or 2028-08-02 (Annex I, subject to the Article 2(13) qualifier). Closest reading: Annex IV technical documentation.
EU
EU AI Act Article 14 — Human oversight · Regulation (EU) 2024/1689. Deferred by enacted amendment: applies 2027-12-02 (Annex III) or 2028-08-02 (Annex I, subject to the Article 2(13) qualifier). Closest reading: Article 14 human oversight.
EU
EU AI Act Article 15 — Accuracy, robustness and cybersecurity · Regulation (EU) 2024/1689. Deferred by enacted amendment: applies 2027-12-02 (Annex III) or 2028-08-02 (Annex I, subject to the Article 2(13) qualifier). Closest reading: Article 15, line by line.
EU
EU AI Act Article 50 — Transparency obligations for providers and deployers of certain AI systems · Regulation (EU) 2024/1689. In force — applies from 2026-08-02 under Article 113, second paragraph; the Digital Omnibus (Regulation (EU) 2026/1744, in force 2026-07-27) replaced Article 50(7), by its Article 1(20), and left the operative duties in Article 50(1) to (6) unamended and undeferred, so they apply from 2026-08-02. Closest reading: Article 50 transparency.
US
Federal Reserve SR 11-7 — Model Risk Management (4 Apr 2011). Superseded: SR 26-2 (17 Apr 2026) supersedes and replaces SR 11-7 and SR 21-8. Retained in the corpus for historical records only, never cited as current. See the SR 26-2 deep dive.
SG
MAS Consultation Paper P017-2025 — Proposed Guidelines on Artificial Intelligence Risk Management. In the corpus as a draft — not cited. Consultation closed 2026-01-31; no final Guidelines issued as of the corpus source date (2026-03-20). Warrant does not put draft instruments on the record, so Singapore stays not mapped, as the grid above says. See the MAS deep dive.
US-CO
Colorado AI Act (SB24-205, codified at C.R.S. 6-1-1701 et seq.). Developer and deployer duties of reasonable care for high-risk AI systems; corpus enforcement date 2026-06-30. Closest reading: Colorado AI Act + CCPA ADMT.
ISO
ISO/IEC 42001:2023 — Information technology, Artificial intelligence, Management system. Voluntary standard, published 2023-12-18; mapped and labelled non-binding. No certification claimed or implied. Closest reading: ISO/IEC 42001.
US
NIST AI Risk Management Framework 1.0 (AI RMF 1.0, NIST AI 100-1). Voluntary, released 2023-01-26; mapped and labelled non-binding. Closest reading: NIST AI RMF.
US
US TCPA — AI-generated voice calls (47 U.S.C. § 227; 47 CFR § 64.1200; FCC 24-17 Declaratory Ruling). In force; the FCC 24-17 Declaratory Ruling (2024-02-08) reads AI-simulated voice into the artificial-or-prerecorded-voice rule. Corpus questions route via Q and A.
AU
Do Not Call Register Act 2006 (Cth) + Telecommunications (Telemarketing and Research Calls) Industry Standard 2017 (F2017L00323). Both instruments in force; DNC Act Part 2 commenced 2007-05-31. Corpus questions route via Q and A.
AU
Privacy Act 1988 (Cth) — Australian Privacy Principles. In force; corpus enforcement date 2014-03-12. Corpus questions route via Q and A.

Warrant's own submissions to regulators are on the record too: Regulatory filings register.

04 · MOAT

Per-article depth, not regime-level.

Horizontal infrastructure layers (runtime evidence buses, generic GRC platforms) cover regimes by name. Warrant cites specific articles, sub-clauses, and the Warrant evidence field that satisfies each one. That is the difference between an answer and a citation.

9
FRAMEWORKS COVERED
Five binding: EU AI Act Arts 12–15 + Annex IV · FCA Consumer Duty · NYDFS Part 500 · SEBI · DPDP Act 2023. Four labelled non-binding: SR 26-2 · RBI FREE-AI · NIST AI RMF · ISO/IEC 42001. Clause-level.
5
JURISDICTIONS
European Union, United Kingdom, United States Federal, New York State, India. Singapore is not counted: the MAS guidelines are still a consultation paper, so we do not cite them.
2027-12-02· enacted
EU AI ACT APPLICATION
Annex III high-risk application date, deferred from 2026-08-02 by the Digital Omnibus (Regulation (EU) 2026/1744). Penalty the higher of €15M or 3% of total worldwide annual turnover under Article 99(4).
0
CERTIFICATIONS CLAIMED
We do not claim ISO, SOC, or any certification we do not hold. Mapping is verifiable; certification is not implied.
05 · VERIFICATION

The regulator never has to call us.

Anyone, including the regulator, can confirm an artefact is genuine independently, without contacting Warrant. Open /verify, paste a package id, and the record checks out on its own. That is the point.

MDR / IVDR (EU healthcare) is on the v0.5 roadmap, 2026 Q3. DORA (EU operational resilience for finance, mandatory 2025-01-17) is downstream of SR 26-2 mapping and shares roughly 70 percent of the evidence shape. Coverage we have not shipped is not listed.

06 · DECISION TREE

Which framework applies to your AI system.

A counsel reviewing an AI deployment in 2026 walks the same branches. The questions follow Annex III, the Consumer Duty, the model-risk trigger, the SEBI pre-approval gate, and the DPDP perimeter. Each leaf below names the regime that attaches and the deep-dive page that carries the per-clause map. Where nothing attaches, the leaf says so.

Q1
Does the AI system make, recommend, or score a decision affecting a natural person in the European Union, or is it placed on the Union market under Article 2(1)(a) · regardless of where the provider is established. YES → Article 6 + Annex III triggers high-risk classification → EU AI Act mapping (Art. 12 + 13) attaches on 2027-12-02 (deferred from 2026-08-02 by the adopted Digital Omnibus) with EUR 15M / 3 percent turnover penalty under Article 99(4).
Q2
Is the deployer FCA-authorised and is the AI involved in a retail customer outcome (lending, mortgages, insurance distribution, investment advice, payment account features). YES → FCA Consumer Duty mapping attaches under PS22/9 Principle 12 and the four outcomes, which bind the decision however it was produced. Senior Manager Function holder carries personal SMCR liability.
Q3
Is the operator an insured depository institution under Federal Reserve, OCC, or FDIC supervision, with the AI used in any material decisioning model. YES → the SR 26-2 mapping carries "effective challenge" (§ III) and governance and controls (§ VI). SR 26-2 is a supervisory letter, not an enforceable rule, and as of the 17 April 2026 letter its footnote 3 places generative and agentic AI outside its scope — so a Warrant record mapped against it is governance evidence, not proof of compliance with a binding standard. NY-licensed entity → NYDFS Part 500 § 500.17(a) 72-hour notice and § 500.17(b) annual notice of compliance, which are binding.
Q4
Does the AI act on retail Indian investors (algorithmic trading), AI-in-banking (regulated banking entity), or process personal data of an Indian data principal. YES → India mapping · SEBI Retail Algorithmic Trading Framework pre-approval gate (mandatory 2026-04-01), RBI FREE-AI seven sutras + 26 recommendations (a committee report, not a binding instrument), DPDP Act 2023 whose ₹250 crore ceiling attaches to the s.8(5) security-safeguards duty under the Schedule to s.33(1).
Q5
Is the firm a Singapore financial institution, as defined in section 2 of the Financial Services and Markets Act 2022, using AI at any point in the AI life cycle. Warrant does not map Singapore today. The proposed AI Risk Management Guidelines are still Consultation Paper P017-2025 (issued Nov 2025, consultation closed 31 Jan 2026), and a draft does not go on the record. A cross-border SG-licensed firm gets its India and EU obligations mapped; the Singapore branch is named as out of scope rather than filled in.
Q6
Are two or more of the above true (cross-border firm, multi-jurisdictional deployment, group-level supervision). YES → one Warrant trace, one evidence package, multiple regime attachments. The record is independently verifiable without contacting Warrant and returns the same answer to every supervisor; per-clause field mapping shows which obligation each evidence field satisfies.
07 · SAMPLE PACKAGES

Three evidence packages. Three jurisdictions.

Each sample is a real evidence package produced by Warrant against a hand-crafted trace. Each record is mapped to a specific obligation and is independently verifiable without contacting Warrant. Open offline and confirm it checks out on its own. No one ever has to call us.

W
EU sample · Frankfurt bank lending agent · maps Article 12 + 13INDEPENDENTLY VERIFIABLE WITHOUT CONTACTING WARRANT · ID 7de85ceaeac42a47
→ eu-fintech.pdf
W
US sample · Northcentral Trust Bank small-business underwriting · maps model-risk-management obligationsINDEPENDENTLY VERIFIABLE WITHOUT CONTACTING WARRANT · ID 041f2335488dd56f
→ us-fintech.pdf
W
India sample · RBI NBFC-MFI lending agent · CIBIL bureau report · maps RBI FREE-AI + DPDPINDEPENDENTLY VERIFIABLE WITHOUT CONTACTING WARRANT · ID c30707ea704c6b6d
→ india-fintech.pdf
08 · FAQ

Index-level questions, answered plainly.

How many regulatory regimes does Warrant map? As of 2026-08-06 the evidence corpus maps 20 regimes. Five binding instruments are published as per-clause deep-dive pages — the EU AI Act (Articles 12 and 13 on one page), the FCA Consumer Duty, NYDFS Part 500, and India's SEBI algorithmic-trading framework and DPDP Act 2023 (together with the RBI FREE-AI report on one page). SR 26-2 has a deep-dive page of its own and is mapped and labelled non-binding: it is an interagency supervisory letter rather than an enforceable rule, and as of the letter of 17 April 2026 its footnote 3 places generative and agentic AI outside its scope. The remainder are mapped in the corpus and indexed in section 03 above with instrument and status.

Does a regime without a published page mean Warrant does not cover it? No. A regime listed as mapped in the corpus has per-clause obligation data the pipeline can cite; a published page is the public deep dive on top of it. Every corpus entry carries its status — a draft consultation, a superseded letter, or a non-binding source is held in the corpus and labelled, and is never cited as binding.

Where are Warrant's own submissions to regulators recorded? In the regulatory filings register, which lists each submission Warrant has made to a regulator on the public record.

09 · RUN IT

Which regulators does Warrant map evidence against?

Each deep-dive page carries the verbatim statute text, the Warrant evidence field per obligation, the primary-source URL, and a sample evidence package you can confirm offline. The record returns the same answer to you, to your regulator, and to a stranger on the internet — independently verifiable without contacting Warrant.

Open the demo → Verify a package How it works