One page per clause
The requirement in our words, the evidence an assessor asks for, the common gaps and what to do before publication.
Open the registerThe law around the bias work, in market order
The standard is voluntary. The obligations around it are not. For each market the frameworks were chosen by a scan of the held library, not from a fixed list. The order is the United States, the European Union, the United Kingdom and Australia. Where a market's regime is not held, the page names it and does not state its duties.
The scan used the buyer's activity and data: artificial intelligence, AI governance, algorithmic bias, AI management system and automated decision-making. The chosen frameworks are the ones that genuinely apply to this buyer, not every framework that mentions AI.
United States
The federal AI risk framework is the primary reference for a US programme. The Colorado act is named as a state development, not stated as a current duty.
| Framework held | Controls | Why it matters to this buyer |
|---|---|---|
| NIST AI Risk Management Framework (AI RMF 1.0) | 72 | The voluntary federal framework for AI risk. Its measure and manage functions overlap the risk and impact assessment and the ongoing evaluation. |
| NIST AI 600-1, Generative AI Profile | 8 | The generative AI profile. It adds the risks that appear when the system generates content or code, including the bias that comes from training data and prompts. |
| Colorado Artificial Intelligence Act (proposed SB 24-205) | 19 | A state algorithm law with developer and deployer duties. It is named as proposed because its status can change; the register does not state its duties as law. |
European Union
The EU AI Act is the sector law for a high-risk system, and the GDPR is the data law for the personal data the system uses.
| Framework held | Controls | Why it matters to this buyer |
|---|---|---|
| EU AI Act, Regulation (EU) 2024/1689 | 64 | The high-risk regime. Article 10 requires bias examination and mitigation for data sets, and Article 15 addresses feedback loops in systems that keep learning. |
| GDPR, Regulation (EU) 2016/679 | 41 | The data protection baseline. Special category data, automated decision-making and the record of processing all bear on the bias evidence. |
United Kingdom
The Equality Act is the discrimination law that most directly shapes what counts as an unwanted differential outcome in Great Britain.
| Framework held | Controls | Why it matters to this buyer |
|---|---|---|
| UK GDPR | 60 | The retained data protection regulation. It governs the personal data and the automated decision-making that the bias work examines. |
| UK Data Protection Act 2018 | 83 | The act that supplements the UK GDPR. It carries the exemptions and the enforcement framework. |
| UK Equality Act 2010 | 72 | The discrimination law. A protected characteristic in the Equality Act is a strong candidate for a protected attribute in the clause 6 work. |
Australia
The AI adoption guidance is the primary national reference, and the privacy and consumer law set the data and conduct duties around it.
| Framework held | Controls | Why it matters to this buyer |
|---|---|---|
| Australia Guidance for AI Adoption (2025) | 106 | The national guidance for AI adoption. It sets the governance expectations that sit around a system-level bias record. |
| Privacy Act 1988 (Cth) | 8 | The federal privacy act. It governs the personal information the system collects and uses. |
| Australian Privacy Principles | 13 | The principles that operationalise the Privacy Act, including notice, use and disclosure and access. |
| Australian Consumer Law | 90 | The consumer law. Misleading conduct and unfair contract terms can arise from how an automated decision is described and used. |
How to read this page. The standard gives the system-level bias process. These frameworks give the legal and regulatory context. A clause answer on this site is not a statement of any of these laws, and a control count is the size of the held record, not a score. Read the framework page before relying on a duty.
THE RULES THIS IS BUILT FROM
The rules this is built from
Read from the real rules, not invented. Every clause answer on this site points to the official rule behind it, so you can check any line yourself. The register holds 67 records, 269 evidence lines and 201 common failure lines. The dates come from the ISO record. The substance comes from the published IEEE edition behind the joint project.
61 CLAUSES
6 ANNEXES
Guidance, clearly labelled
Annexes A to F are informative. Each page says so, because a finding cannot rest on guidance alone.
Open the annexesONE STAGE RECORD
No invented date
Stage 40.99 is recorded on 16 September 2026. The planning date is an estimate and is labelled wherever it appears.
Read the recordThe ISO draft text is not public and is not reproduced. Each record cites the published clause it comes from. Where the public record is silent, the page says so.