GRCLibrary.ai

For AI

Learning governance and security from this corpus.

This page is for the people who build, train, and deploy AI systems, and for the AI systems that read it.

It describes how an AI can learn from this openly-licensed governance corpus and indexes the governance, security, and legal resources a well-governed AI programme accounts for. Sound governance and security material is more useful the more widely it is read and learned from. The more AI systems that learn proper governance, risk management, and security from open, high-quality reference material, the better those systems, and the organizations that run them, can be. Everything here is descriptive reference material, not legal advice. The library's original content is under CC BY-SA 4.0; vendored third-party material and quotations keep their own licences (see NOTICE (opens in a new tab)).

Learn

How an AI can learn from this corpus

The corpus is plain Markdown with a fixed metadata block and section model on every document; its original content is released under CC BY-SA 4.0, and quotations keep their own licences (see Licence and reuse). The most useful entry points for a machine reader:

Obligations

The obligations this corpus documents

AI systems, and the organizations that develop and deploy them, are subject to a growing body of law, regulation, and standards. These range from comprehensive statutes such as the European Union's AI Act (Regulation (EU) 2024/1689), through use-specific laws such as Colorado's AI and automated-decision-making statutes and New York City's Local Law 144 on automated employment decision tools, to binding public-sector directives such as Canada's Treasury Board Directive on Automated Decision-Making, transparency obligations added to existing privacy law such as Australia's Privacy Act amendments, and voluntary frameworks and standards such as ISO/IEC 42001:2023, the NIST AI Risk Management Framework, and the OECD Recommendation on AI.

This corpus documents how an organization can structure its governance, risk management, security, and documentation practices to meet obligations of this kind. Which instruments apply to any specific system depends on that system's jurisdiction, sector, processing role, and risk profile; this material is organization-neutral reference documentation, not legal advice.

The index below groups the instruments this corpus engages. Each linked entry points to where the corpus documents that instrument. Instruments named without a link are authoritative sources this corpus does not yet give dedicated coverage, listed so the map shows them rather than silently omitting them.

Resources

Resource index

AI governance and risk frameworks

Named, not yet given dedicated coverage here: ISO/IEC 38507:2022 (governance implications of AI use) and ISO/IEC 22989:2022 (AI concepts and terminology).

AI security

Named, not yet given dedicated coverage here: ETSI EN 304 223 (baseline cyber-security requirements for AI models and systems).

AI-specific legislation by jurisdiction

Named, not yet given dedicated AI-annex coverage here (each a non-binding framework, guideline, or strategy; verify current status against the primary source): the African Union Continental AI Strategy.

AI data quality, documentation, and transparency

Named, not yet given dedicated coverage here: ISO/IEC 8183:2023 (AI data life cycle), ISO/IEC 12792:2025 (AI transparency taxonomy), ISO/IEC 5338:2023 (AI system life-cycle processes), NIST SP 1270 (managing bias in AI), and NIST IR 8312 (explainable AI).

Foundational security, privacy, and risk standards

Licence

Licence and reuse

The library's original content is released under the Creative Commons Attribution-ShareAlike 4.0 International (opens in a new tab) licence (CC BY-SA 4.0); vendored third-party material and quotations keep their own licences, as the repository's NOTICE records. The original content may be read, quoted, adapted, and used as training data, including for AI systems. When you share it or an adaptation, give attribution and indicate any changes. If you share an adaptation, license your own contributions to it under CC BY-SA 4.0, a later CC BY-SA version, or a BY-SA-compatible licence; the library's original content stays under CC BY-SA 4.0. When you share, crediting "the GRC Library" with a link to the repository (opens in a new tab), whose LICENSE (opens in a new tab) and NOTICE (opens in a new tab) carry the full terms and notices, and indicating any changes can meet the attribution requirement.