Audit evidence · v2026.05
Citations.
Every claim, clause, article, court case and standard the course cites, each linked to its primary source. Re-walked quarterly. Found a broken link or an error? The complaints route is on this page.
Confidence levels
verified, text-checked against the primary source on the last review.
well-known, widely cited and expected accurate; not text-checked on this pass.
flag, needs human verification before next release. We publish these openly rather than hide them.
EU AI Act, Regulation (EU) 2024/1689
| Ref | Claim | Confidence |
|---|---|---|
| Art 4 | AI literacy obligation on providers and deployers ("take measures to support" since the 2026 Digital Omnibus); applies from 2 Feb 2025 | well-known |
| Art 5 | Prohibited AI practices; applies from 2 Feb 2025 | well-known |
| Art 13 | Information for deployers from providers of high-risk AI | well-known |
| Art 14 | Human oversight of high-risk AI systems | well-known |
| Art 22 | Authorised Representatives of Providers of High-Risk AI Systems. (Resolved 2026-05-19, earlier mis-cross-ref removed from standards-map.) | verified |
| Art 26 | Deployer obligations, instructions, monitoring, logging, information | well-known |
| Art 27 | Fundamental Rights Impact Assessment (FRIA) | well-known |
| Art 50 | Transparency, deepfakes labelled, AI-generated text on matters of public interest disclosed | well-known |
| Art 53 | GPAI providers publish training-data summary | well-known |
| Art 73 | Serious incident reporting | well-known |
| Annex III | High-risk AI use cases, employment, education, essential services, biometrics, justice, migration, infrastructure | well-known |
| Art 99 | Penalties, up to €35M or 7% global turnover | well-known |
ISO/IEC 42001:2023
| Ref | Claim | Confidence |
|---|---|---|
| Cl 5.2 | AI policy, documented, communicated | well-known |
| Cl 6.1 | Risks and opportunities; AI risk assessment | well-known |
| Cl 7.2 | Competence | well-known |
| Cl 7.3 | Awareness | well-known |
| Cl 7.5 | Documented information | well-known |
| A.2 | Policies for AI use | well-known |
| A.3.2 | "AI Roles and Responsibilities" (NOT "AI policy", earlier mistake). AI policy lives at A.2. | verified |
| A.4.6 | Human resources: the competence of the people working with AI systems (A.4.5 is system and computing resources; corrected 11 Oct 2026) | well-known |
| A.5.2 | AI system impact assessment | well-known |
| A.6.2 | AI system life cycle (requirements, design, verification, deployment, operation). Fairness is an objective under A.6.1.2, not a control of its own | well-known |
| A.6.2.5 | "AI-System Deployment" (NOT "documented procedures for incidents", earlier mistake). Incident handling sits at A.6.2.6 (Operation and Monitoring) and A.8.4 (Communication of incidents). M10 reference corrected. | verified |
| A.7 | Data for AI systems | well-known |
| A.9 | Use of AI systems (performance evaluation is Clause 9 of the main body, a separate thing) | well-known |
| A.10 | Third-party AI relationships | well-known |
NIST AI RMF + OWASP LLM Top 10
| Ref | Claim | Confidence |
|---|---|---|
| AI RMF 1.0 | Govern · Map · Measure · Manage | verified |
| AI 600-1 | Generative-AI specific profile, Jul 2024 | well-known |
| SP 800-50r1 | Building a cybersecurity and privacy learning programme (Rev 1, Sep 2024); uses training on approved generative-AI tools as a worked example | well-known |
| LLM01-10 | The ten categories of the 2025 edition are cited in standards-map, for reference. OWASP published a 2026 edition in Aug 2026 that renumbers the list; the map has not yet been moved to it | well-known |
Case-law and named incidents
| Cite | Claim and source | Confidence |
|---|---|---|
| Mata v. Avianca | Two US attorneys and their firm sanctioned (US$5,000) for filing six AI-invented case citations. S.D.N.Y. 22-cv-1461; opinion 22 Jun 2023 | well-known |
| Arup deepfake | A Hong Kong finance employee transferred HK$200m (about US$25m, £20m) in 15 payments in Jan 2024 after a deepfake video call. Disclosed by Hong Kong police Feb 2024; Arup confirmed it was the victim May 2024 | well-known |
| Samsung leak | Engineers pasted proprietary source code and meeting notes into ChatGPT; leaks reported 30 Mar 2023, upload size capped, then generative AI banned on company devices (reported 2 May 2023). Economist Korea / Bloomberg | well-known |
| UK GDPR maximum fine | Up to £17.5 million or 4% of total annual worldwide turnover, whichever is higher. UK GDPR Article 83(5); Data Protection Act 2018, section 157 | well-known |
| 72-hour breach report | A personal data breach that risks people's rights and freedoms must be reported to the ICO (the Information Commission since Sep 2026) without undue delay and, where feasible, within 72 hours of becoming aware of it. UK GDPR Article 33 | well-known |
| NYT v. OpenAI | S.D.N.Y. 1:23-cv-11195, filed Dec 2023 | well-known |
| Getty v. Stability AI | UK [2023] EWHC 3090 (Ch) (interim) and [2025] EWHC 2863 (Ch) (trial judgment, 4 Nov 2025). US: D.Del. 1:23-cv-00135, dismissed and refiled in N.D. Cal. in Aug 2025 (citation corrected 11 Oct 2026) | well-known |
| Authors Guild v. OpenAI | S.D.N.Y. 1:23-cv-08292, Sept 2023 | well-known |
| Doe v. GitHub | N.D. Cal. 4:22-cv-06823, Nov 2022 | well-known |
| US Copyright Office | copyright.gov/ai/, fully AI-generated material with no significant human authorship is not copyrightable | well-known |
| NYC Local Law 144 | Automated employment decision tools, bias audit requirement; effective 1 Jan 2023, enforced from 5 Jul 2023 | well-known |
| Illinois AIVI Act | 820 ILCS 42, AI Video Interview Act | well-known |
| Colorado SB21-169 | Insurance unfair discrimination from AI use | well-known |
| Utah SB 149 (2024) | Utah AI Policy Act | well-known |
Audit-pass policy
This page is re-walked every quarter as part of the standards refresh (see the changelog for cadence). Any flag item must be resolved before any marketing push or commercial launch. If you find an error, please use the complaints procedure.