Obligations, evidence and documents, tied to the systems they concern.
When a regulator, an auditor or a customer asks how you govern AI, the answer is a set of records. GhostAudit keeps those records: which rules apply to which systems, how each was assessed, and what was approved by whom.
The regulation tracker's current contents. Reference data, last verified 10 November 2026.
| Law, order or standard | Jurisdiction | Status | Next date |
|---|---|---|---|
| EU AI Act | European Union | Partially applicable | 2 Dec 2026 |
| Colorado ADMT Act | Colorado | Enacted, not yet effective | 1 Jan 2027 |
| Colorado Chatbot Act | Colorado | Enacted, not yet effective | 1 Jan 2027 |
| NYC LL 144 | New York City | In force | None scheduled |
| Illinois HB 3773 | Illinois | In force | None scheduled |
| Texas TRAIGA | Texas | In force | None scheduled |
| California SB 53 | California | In force | None scheduled |
| CPPA ADMT Regulations | California | Partially applicable | 1 Jan 2027 |
| Utah AI Policy Act | Utah | In force | None scheduled |
| NY RAISE Act | New York State | Enacted, not yet effective | 1 Jan 2027 |
| EO 14365 (State AI law preemption) | United States (federal) | Executive action in effect | None scheduled |
| Federal AI bills (watch) | United States (federal) | Proposed, watch | None scheduled |
| Korea AI Basic Act | South Korea | In force | None scheduled |
| NIST AI RMF | United States (federal) | Voluntary framework | None scheduled |
| ISO/IEC 42001 | Global | Voluntary framework | None scheduled |
Which laws apply to which systems, with the reasoning shown.
The difficult question in AI regulation is rarely what a law says. It is whether it applies to a particular system your company uses.
GhostAudit tracks 15 laws, executive actions and standards, each verified against its official text and divided into obligations with their own dates. It maps them onto your inventory using attributes of each system: the jurisdictions involved, whether the system is used in employment or in consequential decisions, whether it interacts with customers, whether it generates synthetic media.
Each match states the rule that produced it. Circumstantial matches, such as a general assistant used within HR, are kept apart as potential matches until someone confirms them. You can follow and challenge the logic, which is what makes it usable in front of a regulator.
- Dates per obligation, not one date per law
- Proposals labelled as proposals, never as law
- A link to the official source on every entry
Example workspace. Names and figures are illustrative.
| Art. 9 | Risk management systemRisk register v4 | Risk register v4 | Met |
| Art. 10 | Data and data governanceRemediation planned | Remediation planned | Partial |
| Art. 12 | Record-keeping and logsJira GOV-212 | Jira GOV-212 | Gap |
| Art. 13 | Transparency to deployersVendor documentation | Vendor documentation | Met |
| Art. 14 | Human oversightRecruiter review step | Recruiter review step | Met |
| Art. 26 | Deployer obligationsRemediation planned | Remediation planned | Partial |
The near-term calendar.
As of November 2026, these are the dates most programs are working to:
- EU AI Act Article 50 transparency duties have applied since 2 August 2026. Providers of generative systems placed on the market before that date have until 2 December 2026 to implement machine-readable marking.
- Colorado SB 26-189 core obligations apply from 1 January 2027: notice, adverse-decision explanations within 30 days, and human review for automated decisions.
- California's CCPA regulations on automated decision-making: pre-use notice, opt-out and access rights for significant decisions from 1 January 2027.
- EU AI Act Annex III high-risk obligations from 2 December 2027, after the Digital Omnibus postponed them.
Already in force: NYC Local Law 144 for hiring tools, Illinois HB 3773 on AI in employment, and Texas TRAIGA's intent-based prohibitions. Each is covered in the regulation tracker with its source.
Drafts built on your facts, then reviewed and approved.
GhostAudit generates 17 documents from your records, among them an AI acceptable use policy, algorithmic impact assessments, an Article 50 transparency notice, a consumer automated-decision disclosure, an employee AI monitoring notice, a works council briefing, third-party vendor assessments and an incident response plan.
Each names your systems, owners and controls, and marks clearly anything your records do not answer. A document is a draft until it has been through review and approval; rejections carry a reason; every version is kept. For counsel, that means reviewing a specific, complete draft instead of adapting a generic template.
The documents are a starting point for legal review, not a substitute for it.
Example workspace. Names and figures are illustrative.
The system ranks applicants for customer-support roles against the posted job requirements. A recruiter reviews every ranked list before any candidate is contacted; no application is rejected without human review.
- Algorithmic impact assessmentRisk and impact · one systemPer-system assessment of impacts on individuals and groups: fairness, privacy, transparency, oversight, safety; applicability screening (FRIA, DPIA, ADMT laws) and mitigation plan.Basis: EU AI Act Art. 27; GDPR Art. 35; ISO/IEC 42001 6.1.4, A.5; NIST AI RMF MAP 5; Colorado SB 26-189; CCPA ADMT
- EU AI Act Article 50 transparency noticeTransparency and disclosure · selected systemsArticle 50 applicability by system plus approved wording for AI-interaction, AI-generated content, deep-fake and public-interest text disclosures.Basis: EU AI Act Art. 50 (from 2 Aug 2026); Regulation (EU) 2026/1744
- Consumer automated-decision disclosureTransparency and disclosure · one systemConsumer pre-use notice, rights statement and adverse-outcome letter for an AI system supporting consequential decisions, with a compliance checklist.Basis: Colorado SB 26-189 (eff. 1 Jan 2027); California CCPA ADMT regulations; GDPR Art. 22
An audit trail you did not have to build.
Because discovery decisions, status changes, assessments and approvals happen in GhostAudit, the audit log is a by-product of the work. It records the person, the action and the time, and it can be exported for an auditor.
Access follows roles. A compliance manager runs assessments and approves documents; members work on what is assigned to them; viewers, such as an external auditor, can read everything and change nothing.
Example workspace. Names and figures are illustrative.
- 09:42M. Okafor approved Algorithmic Impact Assessment v3
- 09:15J. Lindqvist set status Unsanctioned on Cursor
- FriR. Patel marked Met EU AI Act Art. 14 · Candidate screening
- FriS. Brandt generated AI Acceptable Use Policy v1
Answers for the AI section of a customer questionnaire.
For many companies the first hard question about AI comes from a customer, not a regulator: do you have an AI policy, do you keep an inventory, how do you stop staff putting our data into unapproved tools?
The records in GhostAudit are the evidence for those answers. The AI usage report is a dated account of which AI tools are in use. The inventory is the register. The acceptable use policy and vendor assessments are generated from both. And where a customer or your own programme follows a standard that is not built in, you can define your own framework, by form or CSV import, and assess systems against it in the same way; Govern includes up to three.
Our guide to answering AI questions in security questionnaires groups the questions into six themes with the evidence for each.
Usage monitoring you can put in front of a works council.
Measuring employee AI use is itself a processing activity that needs a lawful basis, proportionality and, in many countries, consultation with employee representatives. GhostAudit was designed with that review in mind.
Sensors collect metadata only: which AI tool and for how long, never prompts, content or full URLs. Identity can be named, pseudonymous or anonymous. Employees can see what is collected, next to a notice you write. If you self-host, the data stays on your infrastructure.
Two templates support the process: an employee AI monitoring notice, filled from your actual sensor settings, with employer notes on the notice statutes of New York, Connecticut and Delaware and on the GDPR; and a briefing for works councils and other employee representatives. Our guide explains what those three states require.
Our privacy by design page is written to be shared with a works council or data protection officer, and the data processing addendum sets out our role as processor.
Sensor settings in an example workspace.
A public AI trust page, with the commitments confirmed by a named owner.
Customers ask how you use AI before they sign. The AI trust center publishes the answer once: the policy and its approval date, the approved tools, what happens to customer data, and the self-assessments you have completed, stated as self-assessments.
It is built for a lawyer's caution. Nothing is public until someone publishes a version. The statements about customer data appear only after the workspace owner has confirmed each one, with the date shown. Documents are shared on request, marked with the recipient's name. You can read a live example.
Interactive example with fictional records. Switch sections on and publish.
- How we govern AI
- Approved AI tools
- Customer data and AI
- Monitoring and controls
- Documents on request
- AI acceptable use policy
- In place, approved 10 Oct 2026
- AI inventory
- Maintained
Questions
- Is the regulatory content legal advice?
No. It is a maintained summary with links to official texts and a transparent mapping to your systems. It is meant to make your counsel faster, not to replace them.
- How current is the tracker?
Entries carry a last-verified date, currently 10 November 2026, and link to the source they were checked against. Items that could not be verified are left out.
- Do we need a DPIA to deploy the sensors?
That depends on your jurisdiction and your choice of identity mode, and is a question for your DPO. The metadata-only design and the pseudonymous and anonymous modes exist to make that assessment straightforward. The field-level documentation for both sensors gives you the facts a DPIA needs.
- Regulation trackerWhat is tracked and how applicability works.
- Employee AI monitoring noticesWhat New York, Connecticut and Delaware require.
- Answering AI questions in security questionnairesSix themes, with the evidence for each.
- AI Governance StarterA report, a policy and a notice in 30 days, at a fixed price.
- Monitoring employee AI use without surveillanceThe legal and practical ground rules.
- How to write an AI acceptable use policySection by section.
See what is in use before you decide anything.
Start a 14-day trial with every Govern feature, connect one discovery source and enroll a handful of devices. No card is needed to start, and nobody is asked to change how they work.