Regulations
37jurisdictions
7regions, one signed policy
134texts and guidance from authorities and professional bodies calling for or recommending measures AIDataVeil applies
Their authorities ask to limit what reaches AI, know where it goes, govern agents and be able to prove it: AIDataVeil applies these measures to every exchange routed through it. It keeps the proof, and the legal assessment remains for your organization and its advisers.
Each point is a jurisdiction where an official text calls for or recommends measures AIDataVeil applies to every exchange. Hover a point or pick a name.
Choose
Type a country, a region or the name of a regulation: its articles, authorities and dates, and what AIDataVeil does for each.
Pick a country on the map, a region above or a regulation. Its articles, authorities and dates show here, with what AIDataVeil does for each.
Try:
What the text asks
Measures “such as pseudonymisation” by design; pseudonymisation and encryption among the security measures.
How AIDataVeil helps
Article 32 names pseudonymisation: AIDataVeil replaces detected identifiers with coherent stand-ins before the AI, and keeps the history encrypted, keys apart.
What the text asks
Minimise, limit retention, secure, and be able to demonstrate that these principles are met.
How AIDataVeil helps
Accountability calls for proof: every exchange leaves a signed, content-free receipt, verifiable offline; your administrator sets retention.
What the text asks
Processors that offer sufficient guarantees, and a record that names who receives the data.
How AIDataVeil helps
The record names recipients: AI destinations are named by your administrator, and each receipt states where the request went and under which policy version.
What the text asks
Among the measures authorities may consider to limit risks when a model is developed: mask personal data or replace it with fake data in the training set, for example fake names and fake email addresses.
How AIDataVeil helps
The EDPB describes replacement with fake names and addresses: AIDataVeil applies a related principle to every exchange: coherent stand-ins before the model, real values put back in the answer.
What the text asks
Pseudonymisation is an effective supplementary measure if the additional information stays exclusively with the exporter.
How AIDataVeil helps
The mapping is never sent to the AI provider: it stays in the encrypted history, keys kept apart.
What the text asks
Address supply-chain security, including the relationship with each direct supplier.
How AIDataVeil helps
For your AI providers too: destinations named by your administrator, a change of model without redoing the controls, a signed receipt per exchange.
What the text asks
Management approves the measures; their effectiveness is assessed; a cryptography and encryption policy.
How AIDataVeil helps
Management approves a signed AI policy and sees it applied: receipts your auditor verifies offline, an encrypted history whose keys are kept apart.
What the text asks
After a significant incident: early warning within 24 hours, notification within 72 hours, final report within one month.
How AIDataVeil helps
If the incident hits an AI provider: your receipts show which exchanges went to it and under which policy: a concrete starting point for your NIS2 early warning.
Annex, points 3.2, 5.1.2(d) and 9.2(c)
Official text · EUR-Lex (new tab)What the text asks
For cloud, managed and managed security services: logs protected against tampering, limited dependence on one supplier, key life cycle.
How AIDataVeil helps
If you are an IT or managed services provider: signed receipts, an encrypted history with separate keys, and the same policy across cloud, private or local models.
Version 1.0 · for the entities covered by Implementing Regulation (EU) 2024/2690
Official text · enisa.europa.eu (new tab)What the text asks
Mask or pseudonymise test data, hash for log integrity, keep a short list of alternatives against lock-in.
How AIDataVeil helps
Three points of the guidance: stand-ins before the model, signed receipts, and one policy whatever the model: changing it does not mean redoing the controls.
What the text asks
The financial entity stays responsible for its ICT providers: register, exit strategy, processing and storage locations set in the contract.
How AIDataVeil helps
Locations matter: your AI destinations are named and set by the administrator, and the same policy applies to cloud, private or local models.
Art. 11(2)(i) and 14(1)(b)
Official text · EUR-Lex (new tab)What the text asks
Prevent data loss and leakage; prevent and detect leaks to third parties.
How AIDataVeil helps
The text targets leaks to third parties: on the AI channel, detected identifiers leave as stand-ins and what cannot be protected is not sent.
What the text asks
Logs protected against tampering, deletion and unauthorised access.
How AIDataVeil helps
Records whose tampering shows: receipts are signed, verifiable offline, and contain no content.
What the text asks
Control staff use of third-party AI tools, including use unknown to management, and protect client information.
How AIDataVeil helps
Controlled use: an authorized workspace where your policy applies to every exchange, with a signed receipt.
What the text asks
The insurer remains responsible for AI systems built with third parties, including their security and confidentiality.
How AIDataVeil helps
The insurer stays responsible: a signed policy, named AI destinations and proof of every exchange.
Banking supervision
Official text · bankingsupervision.europa.eu (new tab)What the text asks
Encrypt in transit, at rest and where possible in use; protect against data loss; control storage locations.
How AIDataVeil helps
The ECB’s practices, on the AI channel: encrypted history, keys kept apart, named destinations, stand-ins before the model.
What the text asks
For digital products: minimisation, confidentiality of processed data, activity logging, due diligence on third-party components.
How AIDataVeil helps
A design aid: build AI into your product without sending your customers’ detected identifiers to the model: each customer has its own stand-ins, and every exchange leaves a receipt the auditor verifies offline.
Art. 26 · deployers of high-risk systems
Official text · EUR-Lex (new tab)Consolidated version of 27 Jul 2026 · EUR-Lex (new tab)What the text asks
From 2 Dec 2027 for an Annex III high-risk system: human oversight by competent people, monitoring of operation, logs kept for at least six months.
How AIDataVeil helps
Logs under your control: every exchange leaves a signed receipt stating the destination and the policy applied, without keeping readable data.
What the text asks
A trade secret is protected only if reasonable steps were taken to keep it secret.
How AIDataVeil helps
Reasonable steps: the client names and terms you list leave as stand-ins, under a signed policy applied to every exchange and proven by a receipt.
Audit and assurance
Issuer’s document · accountancyeurope.eu (new tab)What the text asks
Generative AI can create confidentiality risks, especially when sensitive client information is entered into publicly available tools; clear policies, training and supervision are important.
How AIDataVeil helps
A clear policy, applied: detected identifiers are replaced before sending, and every exchange leaves a signed receipt.
Points 5.3 and 5.9 · Eastern Caribbean Currency Union
Official text · eccb-centralbank.org (new tab)What the text asks
Prior central bank approval; access to confidential data limited to authorised people and logged, with tamper-resistant logs.
How AIDataVeil helps
Tamper-resistant records: for every exchange with an AI model, a signed receipt: any alteration would show.
European Union
R34
Official text · cyber.gouv.fr (new tab)What the text asks
With a consumer generative AI service, never put the organisation’s sensitive data into prompts.
How AIDataVeil helps
R34 keeps sensitive data out: the policy replaces detected identifiers, refuses what cannot be protected, or keeps a file on a private or local model.
R29
Official text · cyber.gouv.fr (new tab)What the text asks
Log prompts, the processing done before sending, and the data actually sent to the model.
How AIDataVeil helps
Tell what is typed from what leaves: your team sees the protected payload and the destination before sending, and every exchange leaves a signed, content-free receipt.
Joint French–German recommendations
Official text · cyber.gouv.fr (new tab)What the text asks
Ban uncontrolled access through personal accounts, offer legitimate tools with clear rules, remove sensitive data.
How AIDataVeil helps
A legitimate tool with clear rules: compatible software only changes its AI address and comes under the same signed policy.
What the text asks
For agents: tools approved by IT and security, human approval of actions with side effects, least privilege.
How AIDataVeil helps
Least privilege, for each agent: it acts under a signed mandate, and a real value appears only in a decision the mandate allows.
What the text asks
Frame use with a charter, avoid personal data in prompts as far as possible, prefer on-premises solutions for sensitive documents.
How AIDataVeil helps
The charter becomes an enforced rule: a signed policy on every exchange, and sensitive documents kept to a private or local model.
What the text asks
Trace each task, limit access to the data needed, partition memory per agent, approve critical actions, be able to stop.
How AIDataVeil helps
Partitioned memory: each mission has its own stand-ins, each agent acts under a signed mandate, and every exchange leaves a receipt.
What the text asks
Professional secrecy covers every document in the lawyer’s file.
How AIDataVeil helps
The whole file is covered: listed client names and terms leave as stand-ins, and the firm’s policy can refuse a file or keep it on a private or local model.
What the text asks
Prohibit submitting information covered by professional secrecy to an AI system unless the tool has been validated beforehand (security, no reuse and hosting in line with the GDPR).
How AIDataVeil helps
Validate the tool and protect secrecy: the firm’s charter becomes a signed policy: stand-ins, refusal, or a private or local model for the most sensitive files.
Regional council of the Order
Issuer’s document · oec-paris.fr (new tab)What the text asks
Remove client data before submitting anything to an AI without sufficient safeguards; give up uses that cannot be protected.
How AIDataVeil helps
Less manual sorting: detected identifiers are replaced automatically, and what cannot be protected is not sent.
What the text asks
With a provider of important functions, share information covered by secrecy only where it is necessary.
How AIDataVeil helps
Only what is necessary: detected identifiers leave as stand-ins, and the policy can refuse whole categories: minimisation you can show, before the model.
What the text asks
Inform and consult the works council (companies with at least 50 employees) before introducing means or techniques that allow monitoring of employees’ activity.
How AIDataVeil helps
A clear file for the consultation: the signed policy, the named AI destinations and content-free receipts.
European Union
What the text asks
Among the measures: supply-chain security, encryption, access control; management is accountable.
How AIDataVeil helps
The supply chain includes AI: every exchange with a model goes to a named destination, leaves with stand-ins and leaves a signed, content-free receipt.
Information brochure
Official text · autoriteprotectiondonnees.be (new tab)What the text asks
Baseline measures for AI: minimisation, encryption at rest and in transit, access control, logging and audit.
How AIDataVeil helps
Baseline measures, on every exchange: stand-ins before the model, an encrypted history with keys kept apart, a signed content-free receipt.
European Union
What the text asks
Confidentiality; data protected in transit, in memory and at rest by encryption with key management; need-to-know across the chain.
How AIDataVeil helps
Encryption and key management: the history is encrypted with its keys kept apart, and the model receives stand-ins instead of client identifiers.
What the text asks
A documented legal analysis; provider staff access only with explicit consent and monitoring; encryption with key management.
How AIDataVeil helps
Less policyholder data at the provider: detected identifiers leave as stand-ins, and every transfer leaves a signed receipt.
What the text asks
Risk-management measures, including supply-chain security and policies on cryptography and, where appropriate, encryption.
How AIDataVeil helps
Your AI providers included: each destination is named by your organization, the history is encrypted with keys apart, and receipts verifiable offline record every exchange.
European Union
Guidance for deployers
Official text · dataprotection.ie (new tab)What the text asks
Understand what data the system uses, where it goes, and whether the provider keeps or reuses it.
How AIDataVeil helps
Know where data goes: destinations named by your organization, stand-ins for what leaves, history retention set by your administrator.
What the text asks
Apply minimisation at the point of deploying AI as well.
How AIDataVeil helps
Minimisation in use: on every exchange, detected identifiers are replaced before sending and what cannot be protected stays with you.
What the text asks
Immutable logs sufficient to reconstruct an incident; control of shadow AI.
How AIDataVeil helps
Reconstruct an incident: one signed receipt per exchange, verifiable offline.
European Union
Art. 19(2), including (k)
Official text · legislation.mt (new tab)Commencement notice · legislation.mt (new tab)What the text asks
The directive’s measures, plus insider-risk management and, in (k), logging and traceability.
How AIDataVeil helps
Traceability is named: for AI use, one signed, content-free receipt per exchange, verifiable offline.
Art. 2(1), 3(1), 4(1) and 6(1)
Official text · legislation.mt (new tab)What the text asks
Prohibited disclosure includes transmitting documents or electronic data; lawyers, notaries, accountants, auditors, bank and insurance staff are bound.
How AIDataVeil helps
Electronic data is covered: listed client names and terms leave as stand-ins, and the policy can keep a category on a local AI.
Europe outside the EU
What the text asks
Protection by design, processors with sufficient guarantees, and pseudonymisation and encryption among the security measures.
How AIDataVeil helps
Article 31 names pseudonymisation: detected identifiers leave as stand-ins before the model, and the history stays encrypted, keys apart.
Europe outside the EU
What the text asks
Protection by design and minimisation by default, security, controlled outsourcing, controlled disclosure abroad.
How AIDataVeil helps
Processor choice and disclosure abroad matter: AI destinations are named by your organization, what leaves is in stand-ins, every transfer leaves a signed receipt.
What the text asks
Confidentiality and traceability: access limited to need, and the ability to check to whom data is disclosed.
How AIDataVeil helps
Check who receives the data: each receipt states the destination and the policy applied.
Awareness campaign
Official text · bacs.admin.ch (new tab)What the text asks
Before entering any information, check whether it contains sensitive or personal data (customer data, trade secrets) and strip what identifies; where possible, use the business version of the tools rather than personal accounts.
How AIDataVeil helps
Check before entering: your policy applies to every exchange: detected identifiers replaced before sending, refusal of what cannot be protected, in an authorized workspace.
Critical data
Official text · finma.ch (new tab)What the text asks
Access to critical data restricted to those who need it, controlled risks if it is accessible from abroad, enhanced due diligence on providers.
How AIDataVeil helps
Exposure abroad stays controlled: models receive stand-ins instead of client identifiers, and the mapping is never sent to the AI provider; it stays encrypted, keys apart.
What the text asks
A central inventory of AI uses, clear responsibilities, and extra controls and clauses when outsourcing.
How AIDataVeil helps
A reliable inventory: every use routed through AIDataVeil leaves a signed receipt: which destination, which policy, no content.
What the text asks
Professional secrecy binds lawyers, notaries, doctors and their auxiliaries.
How AIDataVeil helps
Secrecy follows the file: listed client names and terms leave as stand-ins, and the most sensitive files can stay on a private or local model.
What the text asks
Critical infrastructure operators report cyberattacks within 24 hours.
How AIDataVeil helps
Establish the facts fast: if an AI provider is hit, signed receipts show which exchanges went to it.
Europe outside the EU
What the text asks
Pseudonymisation and encryption are among the security measures.
How AIDataVeil helps
The law names pseudonymisation: detected identifiers leave as coherent stand-ins before every request, and the history stays encrypted.
What the text asks
Keep the additional information separate, encrypted, under strict and logged access, with secure key management.
How AIDataVeil helps
Additional information kept apart: the mapping stays in your encrypted history, keys held apart: neither the vault nor the Guardian can read it alone.
Schedule 7 (UK GDPR, Art. 44A to 46)
Official text · legislation.gov.uk (new tab)What the text asks
A transfer may go ahead if protection is not materially lower; the exporter makes that judgment.
How AIDataVeil helps
The exporter decides: and sees what leaves: stand-ins, to named destinations, with a signed receipt per exchange.
What the text asks
Report a breach within 72 hours and keep documentation the regulator can check.
How AIDataVeil helps
Scope the breach: receipts show which exchanges went to the AI provider, and under which policy.
What the text asks
Organisations remain responsible for their agents: limited access to information, least privilege, masking, log monitoring.
How AIDataVeil helps
Masking and least privilege: the agent reasons on stand-ins and acts under a signed mandate: a real value appears only in a decision the mandate allows.
With the Code of Conduct, para 6.3
Official text · sra.org.uk (new tab)What the text asks
Enter client information into an AI system only with contractual, technical and organisational safeguards; no retention longer than necessary.
How AIDataVeil helps
The technical part: client names and detected identifiers as stand-ins, a private or local model for sensitive matters, chosen retention, a receipt per exchange.
What the text asks
Do not enter private or confidential information into public AI tools.
How AIDataVeil helps
Nothing private in a public tool: detected identifiers are replaced before sending, or the file stays on a private model.
What the text asks
Oversee outsourced functions; the provider protects the confidential information of the firm and its clients.
How AIDataVeil helps
The provider must protect: the AI provider receives stand-ins, destinations are named, and receipts verifiable offline feed your oversight.
With reporting of material third-party arrangements
Official text · bankofengland.co.uk (new tab)What the text asks
Manage third-party risk; from 18 March 2027, report material third-party arrangements to the regulator.
How AIDataVeil helps
Known third parties: your AI destinations are named by your organization, and every exchange is documented by a signed receipt.
What the text asks
Use only the minimum confidential information necessary, with access on a strict need-to-know basis.
How AIDataVeil helps
The minimum necessary: detected identifiers leave as stand-ins, and the policy sets which AI may receive each kind of data.
What the text asks
No official information in a public AI unless it is publishable; filter prompts and responses; log every interaction.
How AIDataVeil helps
Filter and log: one policy on every exchange, named destinations, a content-free receipt, and the option of a private model.
Provisions 2.6, 6.1 and 12.1 (principles 2, 6 and 12)
Official text · gov.uk (new tab)What the text asks
Log system and user actions, assess access control, limit the AI’s permissions.
How AIDataVeil helps
For software vendors: each customer has its own stand-ins, and every exchange leaves a receipt the auditor verifies offline.
Europe outside the EU
Data Protection (Jersey) Law 2018
Official text · jerseyoic.org (new tab)What the text asks
Great care before entering personal data into a public AI; a list of approved tools; only the data needed.
How AIDataVeil helps
An approved tool: stand-ins before the model, destinations named by your organization, retention set by your administrator.
Europe outside the EU
What the text asks
Only the data truly needed; encryption, access control, audits.
How AIDataVeil helps
What is needed, encrypted: detected identifiers leave as stand-ins, the history stays encrypted and every exchange leaves a signed receipt.
What the text asks
An accountable board, identified outsourced assets, notification of material data losses; anti-leak tools recommended.
How AIDataVeil helps
On the AI channel: what cannot be protected is refused before sending.
Europe outside the EU
Guidance note, version 2
Official text · fsc.gi (new tab)What the text asks
Off-the-shelf machine learning models are third-party arrangements, to be assessed as such.
How AIDataVeil helps
Third parties to assess: your AI destinations are named and set, under one policy for cloud, private or local models.
North America
What the text asks
The organization is accountable for what it transfers to a third party; collection limited to what is needed; security matched to sensitivity.
How AIDataVeil helps
You answer for the third party: the AI provider receives stand-ins, and only destinations named by your organization receive requests.
Federal, provincial and territorial commissioners
Official text · priv.gc.ca (new tab)What the text asks
Use de-identified information in prompts wherever possible; do not try to re-identify.
How AIDataVeil helps
De-identified prompts: detected identifiers are replaced with stand-ins before sending, then put back in the answer.
Federal institutions
Official text · canada.ca (new tab)What the text asks
No personal information in public AI tools; de-identification and synthetic data; usage policies.
How AIDataVeil helps
The rule, applied: your policy keeps out or replaces what must not leave, on every exchange, with a signed receipt.
What the text asks
Key management, data loss prevention, control of privileged access, logging.
How AIDataVeil helps
On the AI channel: an encrypted history with keys kept apart, refusal of what cannot be protected, a signed receipt verifiable offline.
What the text asks
Model risk also covers AI and machine-learning models, including third-party models.
How AIDataVeil helps
Know which models receive what: each receipt states the destination and the policy version applied.
What the text asks
A lawyer holds in strict confidence all information about the client’s affairs.
How AIDataVeil helps
Confidentiality, on every prompt: the client’s identity leaves as stand-ins, and what cannot be protected is not sent.
What the text asks
Report critical incidents within 72 hours.
How AIDataVeil helps
Establish the facts: if an AI provider is hit, signed receipts show which exchanges went to it.
Sections 5(2) and 6(2)
Official text · kings-printer.alberta.ca (new tab)What the text asks
Name the countries outside Canada where a service provider processes personal information.
How AIDataVeil helps
Name the countries: your AI destinations are named by your organization: you know where requests go.
What the text asks
Public bodies tell people, at collection, that their information may be entered into an automated system that generates content.
How AIDataVeil helps
An accurate notice: the signed policy states which categories may go to which AI, and receipts show what actually happened.
Sections 34 and 35
Official text · bclaws.gov.bc.ca (new tab)What the text asks
Reasonable security and limited retention of personal information.
How AIDataVeil helps
Security and retention: an encrypted history with keys kept apart, and a period your administrator sets.
North America
s. 3.3 · CAI PIA guide, v3.1
Official text · cai.gouv.qc.ca (new tab)What the text asks
A PIA for any project to acquire or overhaul a system that handles personal information; the CAI names generative AI in its guide.
How AIDataVeil helps
Facts for the PIA: the signed policy, the named AI destinations, and a signed receipt per exchange stating where each request went.
What the text asks
Before disclosing information outside Québec: a PIA that weighs, among other things, the protective measures and the destination’s legal regime, plus a written agreement.
How AIDataVeil helps
Protective measures count: only AI destinations named by your organization receive requests, with stand-ins in place of identifiers.
Security measures (Law 25, s. 10)
Official text · cai.gouv.qc.ca (new tab)What the text asks
De-identify before use when identity is not needed, encrypt, grant access on need, log access.
How AIDataVeil helps
The CAI speaks of de-identification: AIDataVeil replaces identifiers with coherent stand-ins before the AI, keeps the history encrypted and leaves a receipt per exchange.
Practical guide
Issuer’s document · barreau.qc.ca (new tab)What the text asks
Exclude direct or indirect identification of the client; if de-identification is impossible, do not use the tool.
How AIDataVeil helps
De-identify, or refrain: detected names and identifiers leave as stand-ins, and what cannot be protected is not sent.
Voluntary model
Issuer’s document · cpaquebec.ca (new tab)What the text asks
No personal or sensitive information in prompts without adequate measures; remove identifying data first.
How AIDataVeil helps
Remove first: detected identifying data is replaced before every prompt, automatically.
College practice standard
Issuer’s document · cmq.org (new tab)What the text asks
Check whether the data given to the tool identifies a patient, directly or indirectly.
How AIDataVeil helps
Before anything reaches an AI: detected patient identifiers are replaced with coherent stand-ins.
College practice standard
Issuer’s document · cmq.org (new tab)What the text asks
Record the use of the tool in the file when information that identifies the patient is accessible to it or when it contributes to clinical reasoning: traceability, continuity of care and professional responsibility.
How AIDataVeil helps
A record without content: every exchange leaves a signed receipt that states the destination and the policy applied.
North America
What the text asks
Access control, audit controls and, depending on the risk analysis, encryption and decryption of protected health information (an “addressable” specification).
How AIDataVeil helps
Technical safeguards, on the AI channel: detected identifiers leave as stand-ins, the history stays encrypted with keys apart, and every exchange leaves a signed, content-free receipt.
What the text asks
Specific security and confidentiality rules for these records.
How AIDataVeil helps
A category apart: the policy can refuse it or keep it on a private or local model.
What the text asks
Access control, encryption in transit and at rest, activity logging, selection and oversight of providers, notice to the FTC within 30 days (500 consumers or more).
How AIDataVeil helps
Evidence for your program: an encrypted history with keys kept apart, named AI destinations, a signed receipt per exchange.
What the text asks
Assess an incident’s scope and the customer information involved, notify individuals within 30 days, oversee service providers.
How AIDataVeil helps
Scope the incident: if an AI provider is hit, signed receipts show which exchanges went to it and under which policy.
What the text asks
A written information security program and written assurances before releasing children’s data to a third party.
How AIDataVeil helps
Less children’s data at the third party: detected identifiers leave as stand-ins, and your administrator sets the retention period.
What the text asks
A provider may act as the institution’s agent if it stays under direct control for the use of records.
How AIDataVeil helps
Direct control: AI destinations set by the institution, student identifiers replaced, a signed receipt per exchange.
Treas. Reg. 301.7216-1 · definitions
Official text · eCFR (new tab)What the text asks
Information furnished to prepare a tax return, including the taxpayer’s name, address and identifying number, is protected tax return information.
How AIDataVeil helps
The firm knows where each item goes: detected names and numbers leave as stand-ins, and analysis can stay on a private model.
What the text asks
Inventory third parties that access content and keep a list of approved providers.
How AIDataVeil helps
An approved-provider list: your AI destinations are set by the administrator, and each receipt states which one was used.
What the text asks
Reasonable security appropriate to the nature of the personal information.
How AIDataVeil helps
Reasonable security, on the AI channel: the provider receives stand-ins, and the history stays encrypted, keys apart.
§ 7150 and § 7152 (risk assessment)
Official text · cppa.ca.gov (new tab)What the text asks
A risk assessment before processing sensitive information, with the minimum necessary and safeguards such as encryption and access control.
How AIDataVeil helps
The minimum necessary, on every exchange: detected identifiers replaced, categories refused per policy, a signed content-free receipt.
Industry letter of 16 Oct 2024
Official text · dfs.ny.gov (new tab)What the text asks
Consider blocking staff queries that could expose nonpublic information to a public AI, and monitor unusual queries.
How AIDataVeil helps
Block what would expose: for what is routed through AIDataVeil, what cannot be protected is not sent, the rest leaves as stand-ins, with a signed receipt.
AI and external data in insurance
Official text · dfs.ny.gov (new tab)What the text asks
Due diligence, audit rights and oversight of the AI and external data vendors used for underwriting and pricing; the insurer remains responsible for the outcomes.
How AIDataVeil helps
Oversee AI vendors: a signed policy and receipts that document every exchange with them.
What the text asks
Reasonable safeguards, including oversight of service providers.
How AIDataVeil helps
Concrete safeguards: an encrypted history with keys kept apart, stand-ins for what leaves, named destinations.
What the text asks
Limit access to health data to those who need it and apply reasonable security.
How AIDataVeil helps
Health data protected: detected identifiers replaced before sending, an encrypted history, keys kept apart.
Sensitive data
Official text · mgaleg.maryland.gov (new tab)What the text asks
Sensitive data is limited to what is strictly necessary.
How AIDataVeil helps
Strictly necessary: the policy can refuse some categories for cloud AI, or keep them on a private or local model.
Generative AI and confidentiality
Issuer’s document · osbar.org (new tab)What the text asks
Remove or redact what identifies the client before an open model; consent may still be needed.
How AIDataVeil helps
Remove before the model: client names and detected identifiers leave as stand-ins, and categories covered by privilege can be refused.
What the text asks
A business associate contract with every provider that receives protected health information on the entity’s behalf.
How AIDataVeil helps
You keep your BAAs: AIDataVeil reduces what the AI provider receives, names the authorized destinations and leaves a signed, content-free receipt per exchange.
Asia-Pacific
Privacy Act 1988 · APPs 6, 8 and 11
Official text · oaic.gov.au (new tab)What the text asks
Best practice: do not enter personal information, especially sensitive information, into public generative AI tools; controls to prevent it.
How AIDataVeil helps
Controls rather than hope: an authorized workspace where identifiers become coherent stand-ins before sending, with a signed receipt.
What the text asks
“Reasonable steps” for security now include technical and organisational measures.
How AIDataVeil helps
The technical part, on the AI channel: stand-ins before the model, an encrypted history, destinations named by your organization.
What the text asks
An inventory of AI tools and uses, visibility across the whole AI supply chain (third and fourth parties), control of autonomous agent workflows and robust security testing.
How AIDataVeil helps
One control layer: the same policy for people, software and agents, named destinations, a signed content-free receipt per exchange.
Australian Government
Official text · digital.gov.au (new tab)What the text asks
A risk-based approach, with technical controls such as upload blockers, splash screens and data loss prevention tools.
How AIDataVeil helps
Alongside the blockers: an authorized channel where your rules apply to every exchange, with signed proof.
Australian legal practice
Official text · lsb.vic.gov.au (new tab)What the text asks
Do not enter confidential, sensitive or privileged client information into public AI tools; with a commercial tool, examine the contract terms carefully to make sure the information stays secure.
How AIDataVeil helps
No public tool for client information: listed client names and terms leave as stand-ins, or the matter stays on a private or local model, with a receipt per exchange.
Code of Professional Conduct, item 6 · confidentiality
Official text · tpb.gov.au (new tab)What the text asks
Do not disclose information about a client’s affairs to a third party without the client’s permission; the guidance applies this rule to the use of AI tools.
How AIDataVeil helps
Document what leaves: a controlled AI channel, detected identifiers as stand-ins, and a signed receipt per exchange.
Victorian public sector
Official text · ovic.vic.gov.au (new tab)What the text asks
Staff and contractors do not enter personal information into public generative AI tools.
How AIDataVeil helps
Nothing personal in a public tool: detected identifiers leave as stand-ins, under the agency’s policy.
Asia-Pacific
What the text asks
Do everything reasonable to prevent unauthorised use or disclosure by a provider; overseas transfers only on specific grounds.
How AIDataVeil helps
Prevent unauthorised use: the AI provider receives stand-ins, at destinations named by your organization.
What the text asks
No personal or confidential information unless non-retention is confirmed; otherwise, strip from inputs anything that allows re-identification.
How AIDataVeil helps
Strip before sending: what identifies is replaced with stand-ins, then the authorized real values come back in the answer.
For lawyers
Official text · courtsofnz.govt.nz (new tab)What the text asks
Nothing private, confidential, suppressed by order or covered by legal privilege in a chatbot; in general, nothing that is not already public.
How AIDataVeil helps
Nothing that links matters: each discussion, client and mission has its own stand-ins, and detected identifiers leave as stand-ins.
GenAI foundations
Official text · digital.govt.nz (new tab)What the text asks
Even data that does not identify on its own can, when aggregated, allow re-identification.
How AIDataVeil helps
Against aggregation: each discussion has its own stand-ins, with no link between them.
Asia-Pacific
What the text asks
Protect personal data by making reasonable security arrangements against unauthorised access, collection, use and disclosure.
How AIDataVeil helps
Protect what leaves: stand-ins before the model, an encrypted history, AI destinations named by your organization.
Paras 9.3 to 9.5
Official text · pdpc.gov.sg (new tab)What the text asks
Deployers protect prompts, inputs, outputs and agent activity; for example, scan prompts to detect common identifiers.
How AIDataVeil helps
The PDPC’s own example: every exchange is examined before sending: detected identifiers leave as stand-ins, the history stays encrypted.
Free and enterprise tools
Official text · mlaw.gov.sg (new tab)What the text asks
For free tools: replace identifiers with generic substitutes and document the mappings.
How AIDataVeil helps
Substitutes and their mappings: AIDataVeil does it automatically: coherent stand-ins, the mapping kept encrypted, the real values put back in the answer.
What the text asks
A verifiable identity for each agent, limited and non-transferable permissions, human approval enforced by the system rather than the prompt.
How AIDataVeil helps
By the system, not the prompt: the signed mandate is enforced by AIDataVeil, outside the model: a real value appears only in a decision it allows.
What the text asks
Governance policies set out permitted and prohibited uses of AI, for example prohibiting the entry of confidential, proprietary or client information into public AI tools.
How AIDataVeil helps
The rule becomes a control: a signed policy applied to every exchange, with receipts verifiable offline.
What the text asks
Customer information may be disclosed by a bank only as the Act expressly provides.
How AIDataVeil helps
Stay in control: detected customer identifiers leave as stand-ins, and the policy can keep whole categories on a private model.
Asia-Pacific
What the text asks
Encryption, obfuscation, masking or virtual tokens; access control; logs, monitoring and review.
How AIDataVeil helps
Rule 6 names masking and virtual tokens: detected identifiers leave as stand-ins before the model, the history stays encrypted, every exchange leaves a receipt.
What the text asks
The data fiduciary answers for its processor: contract, reasonable safeguards, breach notification.
How AIDataVeil helps
You answer for the processor: the AI provider receives stand-ins, at destinations named by your organization.
Asia-Pacific
Checklist for internal policies
Official text · pcpd.org.hk (new tab)What the text asks
Specify in the internal policy the permitted generative AI tools and the types and amounts of information that can be entered into them.
How AIDataVeil helps
Permitted tools and information: your policy sets which AI receives which kind of data, and applies it automatically to every exchange.
What the text asks
Controls against entering sensitive confidential information, including personal data; encryption of non-public data.
How AIDataVeil helps
Control before sending: detected identifiers leave as stand-ins, what cannot be protected stays with you, the history is encrypted.
Maghreb
What the text asks
Prevent use by unauthorised persons and be able to check access afterwards; INPDP authorisation for any transfer abroad.
How AIDataVeil helps
Limit what leaves: sensitive categories can be kept on a private or local model, and every exchange leaves a signed content-free receipt.
Maghreb
Art. 3, 41 bis 2, 41 bis 3 and 44
Official text · joradp.dz (new tab)What the text asks
A record of processing with recipients abroad, an automated log of operations available to the ANPDP, transfers on authorisation.
How AIDataVeil helps
An operations log: every exchange with an AI model leaves a signed receipt stating the destination and the policy applied, without keeping the content.
Africa
What the text asks
Appropriate technical and organisational measures, regularly verified; a written contract with each operator; controlled transfers.
How AIDataVeil helps
Verified measures: every exchange with an AI model leaves a signed, content-free receipt, verifiable offline: proof the policy is applied.
What the text asks
Confidentiality, integrity and availability of data in any cloud hosting country; regulator access; material arrangements reported.
How AIDataVeil helps
Where the data sits: AI destinations are named by your organization, the history is encrypted and the proof holds no content.
Africa
Article 43 and Schedule 2
Official text · ndpc.gov.ng (new tab)What the text asks
AI deployers document their technical and organisational parameters, including cross-border flows, and file them with their annual audit.
How AIDataVeil helps
The substance of the filing: a signed, versioned policy, named destinations, and content-free receipts for every exchange.
Africa
What the text asks
Pseudonymise data and keep the identification keys separately.
How AIDataVeil helps
Pseudonymise and keep keys apart: AIDataVeil separates in the same way: stand-ins before the model, an encrypted mapping, and a vault without keys beside a Guardian without history.
What the text asks
Among the expected measures: pseudonymisation and encryption.
How AIDataVeil helps
Both, on the AI channel: stand-ins before sending, an encrypted history.
Caribbean and Atlantic
What the text asks
Pseudonymisation and encryption are among the security measures for processing.
How AIDataVeil helps
The law names pseudonymisation: it applies before the AI model, with a signed receipt for every exchange.
Caribbean and Atlantic
What the text asks
Outsourced IT remains the entity’s responsibility; material incidents are reported within 72 hours.
How AIDataVeil helps
Keep responsibility: AI destinations are named and set, and every transfer is traced by a signed content-free receipt.
Caribbean and Atlantic
PIPA 2016, section 15
Official text · privacy.bm (new tab)What the text asks
The organization remains responsible for personal information it transfers to an overseas third party.
How AIDataVeil helps
Responsible abroad: less data leaves, as stand-ins, to named destinations, with proof of what left.
Maghreb
Art. 23, 43 and 44
Official text · adala.justice.gov.ma (new tab)What the text asks
Technical and organisational measures against loss, alteration and unauthorised access, including for network transmissions; a transfer abroad only to a State with a sufficient level of protection, except for the exemptions the law provides.
What stays with your organization
Choosing the provider, its written contract and, for an AI hosted outside Morocco, checking the level of protection or obtaining the CNDP’s authorisation stay with your organization.
How AIDataVeil helps
Choosing a processor means naming the AI: only the AI your organization names receives requests, with coherent stand-ins in place of detected identifiers; a signed receipt says where each request went.
Africa
Art. 26, 41 and 46
Official text · artci.ci (Official Gazette) (new tab)What the text asks
Measures to prevent unauthorised access to installations, media and processing systems; for a transfer to a third country (outside ECOWAS), the authority’s prior authorisation and a higher or equivalent level of protection.
What stays with your organization
The authorisation request to the ARTCI for a transfer to a third country and the annual report to the authority stay with your organization; your receipts supply the facts.
How AIDataVeil helps
Know where each request goes: only the AI your organization names receives requests, with coherent stand-ins in place of detected identifiers; every exchange leaves a signed receipt that states the destination.
Africa
Art. 5, 39, 49 and 71
Copy of the law · WIPO Lex repository (new tab)What the text asks
Every useful precaution to keep unauthorised third parties out, with the ability to check afterwards who had access to the data; before any transfer to a third country with a sufficient level of protection, prior notice to the CDP.
What stays with your organization
Informing the CDP before a transfer to a third country and the written contract with each provider stay with your organization.
How AIDataVeil helps
A record of exchanges: every exchange with an AI leaves a signed receipt, with no content, verifiable offline, that states the destination; detected identifiers leave as coherent stand-ins.
Africa
Art. 391, 426 and 462
Official text · sgg.gouv.bj (new tab)What the text asks
Pseudonymisation and encryption among the security measures; a transfer to a third State (outside ECOWAS) only if the authority finds an equivalent level of protection, after its prior authorisation.
What stays with your organization
The authorisation request to the APDP for a transfer to a third State and the impact assessment where required stay with your organization.
How AIDataVeil helps
The law names pseudonymisation and encryption: detected identifiers leave as coherent stand-ins before the model, the history stays encrypted with keys kept apart, and only the AI your organization names receives requests.
Africa
Art. 113 and 171
Copy of the Official Gazette · AFAPDP repository (new tab)What the text asks
Pseudonymisation and encryption among the security measures suited to the risk; a transfer to another State only with the APDPVP’s authorisation, which assesses that State’s level of protection.
What stays with your organization
The authorisation request to the APDPVP for a transfer to another State stays with your organization; your receipts say where each request went.
How AIDataVeil helps
The law names pseudonymisation and encryption: detected identifiers leave as coherent stand-ins before the model, the history stays encrypted with keys kept apart, and each signed receipt says where the request went.
Africa
Art. 187, 201, 221, 224 and 262
Copy of the ordinance-law · are.gouv.cd (new tab)What the text asks
Personal data is stored or hosted in the DRC; a transfer to a host in a third State is possible, for digital sovereignty and security needs, only when the APD finds an adequate level of protection; any transfer to a third country needs its prior authorisation; the controller takes the means needed to guarantee data security, including protection against unauthorised or unlawful processing and against loss or destruction, with backup and restoration (Art. 221).
What stays with your organization
The choice of hosting and the authorisation request to the APD for any transfer abroad stay with your organization.
How AIDataVeil helps
Know where what leaves is hosted: only the AI your organization names receives requests, with coherent stand-ins in place of detected identifiers, and each signed receipt says where the request went.
Africa
Art. 47 to 50
Official text · minict.gov.rw (Official Gazette) (new tab)What the text asks
Appropriate technical measures against loss, damage and destruction; data is stored in Rwanda, and storage outside Rwanda needs a registration certificate from the authority; a transfer outside Rwanda rests on specific conditions, with a written contract.
What stays with your organization
The registration that authorises storage outside Rwanda, the transfer authorisation and the written contract with each recipient stay with your organization.
How AIDataVeil helps
Where the data is stored: only the AI your organization names receives requests, each signed receipt says where the request went, and the history is encrypted and kept for the period your administrator sets.
Africa
Sections 28 to 30 and 47(1)(g)
Official text · dataprotection.org.gh (new tab)What the text asks
Technical and organisational measures against loss, destruction and unauthorised access, regularly verified; a written contract with each processor; the registration application names the countries to which data may be transferred.
What stays with your organization
Registration, the written contracts with processors and the notification of a security compromise (s. 31) stay with your organization.
How AIDataVeil helps
Verifiable measures: detected identifiers leave as coherent stand-ins before sending, the history stays encrypted with keys kept apart, and every exchange leaves a signed receipt that states the destination.
Asia-Pacific
Sections VII(d), IX and XIV
Official text · sbp.org.pk (new tab)What the text asks
When an outsourcing arrangement involves confidential customer information: the customer’s specific consent, or encryption or anonymisation of personally identifiable information so that identities cannot be readily inferred, and records of those cases kept for SBP inspection; any outsourcing outside Pakistan needs the SBP’s prior approval and a legal opinion.
What stays with your organization
The approval request to the SBP for any provider outside Pakistan and the legal opinion stay with your organization.
How AIDataVeil helps
Know who receives what: your organization names the AI it allows, the signed policy says which AI receives which categories of data, detected identifiers leave as coherent stand-ins, and every exchange leaves a signed, content-free receipt with the destination.
Asia-Pacific
Sections 4(1)(f) and 15 to 17
Official text · cert.gov.vu (new tab)What the text asks
Reasonable security measures against unauthorised access, loss and disclosure; data collected in Vanuatu is not used elsewhere without the Minister’s authorisation, except to the countries he lists by Order or in the cases the Act provides.
What stays with your organization
The authorisation request to the Minister before using data outside Vanuatu stays with your organization.
How AIDataVeil helps
Know where each request goes: only the AI your organization names receives requests, with coherent stand-ins in place of detected identifiers, and a signed receipt per exchange that states the destination.
What the text asks
Never broad access to sensitive data, a distinct identity for each agent, human approval of decision steps, full logging by default.
How AIDataVeil helps
Identity and limits per agent: each agent acts under its own signed mandate, reasons on stand-ins, and every exchange leaves a receipt.
Art. 33 and 34 · outsourcing
Official text · bceao.int (new tab)What the text asks
Data, and the servers that store it and host applications, stay available and accessible in the UMOA, or failing that backup servers with full replication; the outsourcing contract goes first to the Banking Commission’s General Secretariat.
What stays with your organization
The General Secretariat’s prior review of the contract and the choice of hosting inside the Union stay with your organization.
How AIDataVeil helps
If an AI counts as outsourcing: your organization names the AI that receives requests, the signed policy says which AI receives what, and each signed receipt says where the request went.
What AIDataVeil does for you here
What stays in your hands
Your impact assessments, contracts with AI providers and notifications stay yours; AIDataVeil gives you verifiable facts for each.
See AIDataVeil on your caseWhat recurs everywhere
Five guidelines recur from one jurisdiction to the next, and AIDataVeil answers each, on every exchange. The figure counts the jurisdictions where at least one text cited here states it.
15jurisdictions out of 37
An authorized workspace, under your signed policy.
22jurisdictions out of 37
Coherent stand-ins before the model, the real values in the answer.
29jurisdictions out of 37
AI destinations named by your organization, and a receipt that says where each request went.
7jurisdictions out of 37
Agents under a signed mandate; a real value only where the mandate allows it.
15jurisdictions out of 37
One signed receipt per exchange, no content, verifiable offline.
By profile
Texts specific to your profession or sector, each with what AIDataVeil applies in response.
Bars ask for safeguards before client data meets an AI: AIDataVeil replaces client names and listed terms before sending.
12 texts and guidelines
Client confidentiality and professional secrecy: AIDataVeil replaces detected identifiers before every prompt and refuses what cannot be protected.
7 texts and guidelines
Patient data: AIDataVeil replaces detected identifiers before sending and can keep a file on a private or local model.
7 texts and guidelines
Third-party providers, leaks, financial secrecy: AIDataVeil names the AI destinations and leaves a signed receipt per exchange for your supervisor.
30 texts and guidelines
Citizens’ data: AIDataVeil applies the administration’s rule to every exchange, with stand-ins for what leaves.
11 texts and guidelines
Building AI into a product: AIDataVeil replaces your customers’ detected identifiers before the model, and every exchange leaves a receipt that the auditor verifies offline.
6 texts and guidelines