Laws compared
A cell records what a text requires of the parties it defines. It does not show that any developer falls within them, or complied.
What does each binding government instrument that addresses developers of frontier or general-purpose AI models say on the same questions? Each column is one instrument; each row is one question, worded so that it fits every instrument. The questions are Selekoa’s; an instrument’s own terms appear only in quotation marks. Some instruments address providers of services rather than developers, and the first row quotes the party each one defines.
Question Q15Frameworks and codes
Does the instrument require, recognise or refer to a developer’s own safety framework, or to a code of practice or standard, and how?
Criterion: A provision that requires a developer’s framework, names a code of practice or standard as a means of showing compliance, deems compliance with another regime to be compliance, or otherwise refers to such documents. The relation is recorded in the instrument’s own words: requires, may rely on, deemed, refers to.
What the statuses mean
- Stated
- A passage of the instrument meets the question’s criterion as worded, however conditional or narrow its scope. The condition or scope is in the note.
- Stated, partly
- A passage has what the criterion asks for, but in a weaker form than the criterion’s own words: for example, a power (“may”) where the criterion asks for a duty (“shall”), or a duty without the deadline the question asks about.
- Not found in the recorded search
- No passage meeting the criterion was found. The cell lists the sections read, the search terms and every passage set aside, with the reason. It does not show that the instrument lacks such a provision elsewhere, or that no other law imposes one.
- Does not apply
- The question does not arise for this instrument, for the reason given (for example, there is no framework document whose publication could be asked about).
Four rules decide “partly” in borderline cases:
- An order to an agency to impose a duty counts as partly.
- Protection only by reference to another law counts as partly.
- “Without undue delay” counts as a stated deadline.
- Required security measures for model weights count as risk-management measures under Q03.
Every stated or partly cell quotes the instrument’s own text with its article, section or page; Chinese passages carry Selekoa’s working translation. Three cells give a paraphrase with its locator instead, and say so. A not-found cell lists the sections read, the terms searched and every passage set aside, with the reason.
Paraphrased with its locator, not quoted: quoting it would pass the source’s quotation limit, or the source’s length is not known.
Limits of this comparison
- A cell records what the text requires of the parties it defines. It does not show that any named developer falls within them, or that anyone complied.
- A not-found cell is bounded by its search: the sections read and the terms searched. Another provision, or another law, may still impose the duty.
- The Code of Practice is a compliance route, not a law. Executive Order 14110 is revoked, and the BIS rule’s rescission was announced; each column shows its standing.
- The table compares and does not rank. Statuses are not scores and are not to be summed.
- Biological and chemical risk provisions are recorded at policy level only.
- Dates keep their kind: adoption, signature, approval, publication, entry into force and application are different events. A computed date is marked as computed.
How we searched
The instruments started from those on the frameworks-and-law page. A column was kept where the instrument is binding, or is the AI Act’s stated means of compliance (the Code), and places duties on developers or providers of frontier or general-purpose AI models. Fifty other instruments on that page were set aside, each with its reason, in the research pack: proposed or vetoed texts, guidance and reports, voluntary commitments, binding texts that place no duty on developers, and one standard whose text was not retrieved (GB 45438-2025).
United Kingdom: within the searches made, no UK law or other binding instrument placing duties on developers of such models was located. This is not a finding that none exists. The 2024 King’s Speech announced an intent to legislate; the 2026 briefing notes contain none of the searched terms; the memoranda with developers state that they are not legally binding; and title searches of legislation.gov.uk for 2023 to 2026 found one instrument, which places a duty on the Information Commissioner.
Other US federal texts: as read, none places a binding duty on developers. Executive Order 14409 of 2 June 2026 provides for a voluntary access framework and says that its section 3 authorises no licensing requirement.
Not yet read: the Republic of Korea’s AI Basic Act, Japan’s AI Promotion Act (2025), China’s provisions on deep synthesis (2022) and on algorithm recommendation (2021), and Colorado SB 24-205 (2024). They are not in the dataset; a later pack starts with Korea.
Illinois: the act’s official website refused the preparer’s requests, and the Internet Archive reset the connections. The cross-family checker’s session saved the enacted text from an Internet Archive capture of the official PDF (2026-09-08), and the cells were drafted from that saved text. The two model families read the act independently and agreed on the status of 13 of 15 cells. The approval date rests on the checker’s copy of the official bill status record, which the preparer could not open; it is given as a paraphrase, labelled as that copy.
Texts were read in official copies: the EU texts through the Publications Office’s repository, because EUR-Lex returned empty responses; California SB 53 from the Legislative Counsel’s database file, because its website refused requests; New York’s chapters in the Senate print and the Assembly’s bill records, not the session laws; the Chinese measures in the gov.cn policy library. Six web pages served changed bytes between retrievals; every quotation still matched.
Roles: one model family (Claude) drafted the cells, audited 50 of them in a fresh context and adjudicated. A model from another family (GPT, through Codex) checked 122 items, answering 85 of them blind before seeing the drafted answers. Where it disagreed, its status was applied. One cell it disputed (Executive Order 14110, Q06) was settled as not found after its second pass. For Illinois the roles were reversed: the checker read the act first, blind, and the drafter then wrote all fifteen cells without seeing its answers. The maintainer decided the remaining questions, including the four rules for “partly” and Illinois Q05 (partly, as for California’s identical wording). No person has checked the cells against the texts.
European Union
EU AI Act
Stated
“may rely on codes of practice within the meaning of Article 56 to demonstrate compliance”
Article 55(2), first sentence
“shall demonstrate alternative adequate means of compliance for assessment by the Commission”
Article 55(2), third sentence
“The Commission, taking utmost account of the opinion of the Board, shall assess whether the codes of practice cover the obligations provided for in Articles 53 and 55”
Article 1, point (21), replacing Article 56(6) of Regulation (EU) 2024/1689
Note: 'May rely on' codes of practice, until a harmonised standard is published (Articles 53(4) and 55(2)); compliance with European harmonised standards grants a presumption of conformity to the extent they cover the obligations. Providers that do not adhere to an approved code or comply with a standard demonstrate alternative means. Regulation (EU) 2026/1744 replaced Article 56(6): the Commission, rather than the AI Office and the Board, now assesses codes; its recital (41) states that these codes 'do not grant a presumption of conformity'. The Act does not require a developer's own safety framework.
Inspect sources and checks: EU AI Act, Q15 Frameworks and codesEU Code of Practice, Safety and Security
Stated
“To serve as a guiding document for demonstrating compliance with the obligations provided for in Articles 53 and 55 AI Act”
Objectives, point A (PDF p. 2)
“adherence to the Code does not constitute conclusive evidence of compliance with these obligations under the AI Act”
Objectives, point A (PDF p. 2)
“Signatories commit to adopting a state-of-the-art Safety and Security Framework (“Framework”).”
Commitment 1, first paragraph (PDF p. 6)
Note: The Code requires a Signatory's own Framework (Commitment 1) and presents itself as a guiding document for compliance with Articles 53 and 55 AI Act. Recital (d) states that Signatories 'may be able to rely on international standards' to the extent they cover the Chapter's provisions.
Inspect sources and checks: EU Code of Practice, Safety and Security, Q15 Frameworks and codes
United States: states
California SB 53
Stated
“A large frontier developer shall write, implement, comply with, and clearly and conspicuously publish on its internet website a frontier AI framework”
SEC. 2, Bus. & Prof. Code § 22757.12(a), opening clause
“shall declare its intent to do so to the Office of Emergency Services.”
SEC. 2, Bus. & Prof. Code § 22757.13(i)(1)
“including a system card or model card, shall be deemed in compliance with the applicable paragraph.”
SEC. 2, Bus. & Prof. Code § 22757.12(c)(3)
Note: Requires a developer framework, which describes how the developer approaches incorporating national standards, international standards and industry-consensus best practices (§ 22757.12(a)(1)). A frontier developer that declares its intent to comply with § 22757.13 through a federal law, regulation or guidance document designated by the Office of Emergency Services is “deemed in compliance” with that section to the extent it meets it (§ 22757.13(i)(2)(A)). Publishing transparency-report contents in a system or model card is deemed compliance (§ 22757.12(c)(3)). § 22757.12(c)(4) encourages disclosures consistent with industry best practices.
Inspect sources and checks: California SB 53, Q15 Frameworks and codesNew York RAISE Act (As amended, Chapter 96 of 2026)
Stated
“incorporating national standards, international standards, and”
Bill text, § 2 (GBL § 1421(1)(a) as re-added), p. 4, line 19
“the frontier developer shall be deemed in compliance with”
Bill text, § 2 (GBL § 1422(9)(b)(i) as re-added), p. 7, line 28
“including a system card or model card, shall be deemed in compliance”
Bill text, § 2 (GBL § 1421(3)(c) as re-added), p. 5, lines 21–22
Note: Requires a developer framework (§ 1421(1), Q03) that describes how it handles incorporating national and international standards and industry consensus best practices. A frontier developer that declares its intent to meet § 1422(3) through a federal law, regulation or guidance document designated by the office is deemed in compliance with that subdivision to the extent it meets the standards of, or complies with, the designated federal law, regulation or guidance document, and must copy federal incident reports to the office (§ 1422(9)). Publishing transparency-report contents in a system or model card is deemed compliance (§ 1421(3)(c)).
Inspect sources and checks: New York RAISE Act (As amended, Chapter 96 of 2026), Q15 Frameworks and codesNew York RAISE Act (As signed, Chapter 699 of 2025)
Stated
“Before deploying a frontier model, the large developer of such frontier model shall do all of the following: (a) Implement a written safety and security protocol”
Proposed GBL § 1421(1)(a), p. 4, lines 10–12
“industry best practices”
Proposed GBL § 1421(3), p. 4, line 38
Note: Requires a developer’s written safety and security protocol. The annual review accounts for changes to model capabilities “and industry best practices” (§ 1421(3)). No code of practice or standard is named as a means of compliance, and no deemed-compliance provision was found.
Inspect sources and checks: New York RAISE Act (As signed, Chapter 699 of 2025), Q15 Frameworks and codesIllinois AI Safety Measures Act
Stated
“Beginning January 1, 2028, a large frontier developer … shall write, implement, comply with, and clearly and conspicuously publish on its website a frontier AI framework”
Section 10(a), opening clause, PDF pp. 4–5
“the frontier developer shall be deemed in compliance with this Act to the extent that the frontier developer meets the standards of, or complies with the requirements imposed or stated by, the designated federal law, regulation, or guidance document”
Section 17(b)(2)(A), PDF p. 16
“including a system card or model card, shall be deemed in compliance with the applicable paragraph.”
Section 10(c)(4), PDF p. 8
Note: Requires a developer framework, which describes how the developer approaches incorporating national standards, international standards and industry-consensus best practices (Section 10(a)(1)); penalises failure to comply with it (Section 25(a)). Deems compliance with a federal law, regulation or guidance document that the Agency designates as substantially equivalent, once the developer declares its intent to the Agency (Section 17(a)–(b)); failure to meet the designated standard is then a violation of the act (Section 17(b)(2)(B)). Deems a transparency report published within a system card or model card compliant (Section 10(c)(4)). Audits follow generally accepted auditing standards (Section 10(d)). “…” in the quotation stands for the running footer at a PDF page break; no words of the act are omitted.
Inspect sources and checks: Illinois AI Safety Measures Act, Q15 Frameworks and codes
China
These measures address providers of services, not developers as such.
China, generative AI services (2023)
Not found in the recorded search
- Read
- Articles 1–24 in full.
- Terms searched
- “标准”, “规范”, “指引”, “按照《”.
- Passages read and set aside
- Article 17 (第十七条): Refers to 'relevant state provisions' for security assessment and to the Algorithmic Recommendation Provisions for filing: departmental rules, not a code of practice or standard. Article 12 (第十二条): Labelling under the Deep Synthesis Provisions (《互联网信息服务深度合成管理规定》): a departmental rule, not a code or standard. Article 16 (第十六条), second paragraph: Authorities are to formulate classified and graded supervision rules or guidelines (监管规则或者指引); a direction to authorities, not a document named as a means of compliance.
Note: No reference to a provider's own safety framework, a code of practice or a standard was found. The Measures refer to other departmental rules, set aside below.
Open the search record: China, generative AI services (2023), Q15 Frameworks and codesChina, AI content labelling (2025)
Stated
“还应当符合相关法律、行政法规、部门规章和强制性国家标准的要求”
Working translation: shall also comply with the requirements of relevant laws, administrative regulations, departmental rules and mandatory national standards
Article 11 (第十一条)
Note: Service providers carrying out labelling 'shall also comply with' mandatory national standards (强制性国家标准); the Measures do not name a standard (no standard number appears in the text). No developer framework or code of practice is referred to. Articles 4 and 5 refer to the Deep Synthesis Provisions for the scope of explicit labelling and for implicit labels.
Inspect sources and checks: China, AI content labelling (2025), Q15 Frameworks and codes
Revoked, or rescission announced
Kept as part of the record, each with its standing shown.
US Executive Order 14110
Stated
“based on guidance developed by NIST pursuant to subsection 4.1(a)(ii) of this section”
Sec. 4.2(a)(i)(C), 88 FR 75197
Note: Refers to: the red-team results to be reported are those based on NIST guidance that Sec. 4.1(a)(ii) directs NIST to establish. Sec. 4.1(a)(i) also directs NIST companion resources to the AI Risk Management Framework and the Secure Software Development Framework. No developer framework is required or recognised.
Inspect sources and checks: US Executive Order 14110, Q15 Frameworks and codesUS BIS AI diffusion rule
Stated
“The VEU’s datacenters must be compliant with NIST 800–53”
Supplement No. 10 to part 748, para. 14, 90 FR 4566 (PDF p. 23)
“Ensure compliance with all best practices in the NSA cybersecurity information sheet”
Supplement No. 10 to part 748, para. 15(a), 90 FR 4566 (PDF p. 23)
“technical opinions issued by the U.S. AI Safety Institute”
ECCN 4E091 Note 2.a.1, 90 FR 4579 (PDF p. 36)
Note: Requires: VEU data centres, and facilities storing 4E091 weights under License Exception AIA, must comply with NIST 800–53 consistent with FedRAMP High and with the NSA sheet “Deploying AI Systems Securely”. May rely on: an exporter may self-classify for the 4E091 exclusion by relying on BIS guidance or technical opinions of the U.S. AI Safety Institute and the Department of Energy. No developer safety framework is referred to.
Inspect sources and checks: US BIS AI diffusion rule, Q15 Frameworks and codes