Resource Center
Practical guides to AI governance and data privacy. Choose a resource type, then find the guide for your industry and business type.
Choose a resource type
Regulation Maps
Which AI and privacy laws apply to your industry, what each one covers, and what to do about it.
Find your guide 02AI Use Policy Guides
What an AI acceptable use policy should cover for your type of organization, with sample language.
Find your guide 03AI Risk Registers
Sample use-case registers showing the AI uses typical for your industry and how to rate their risk.
Find your guide 04Vendor Assessment Checklists
The questions to ask AI vendors about data, security, accuracy, and contract terms before you buy.
Find your guide 05Governance Blueprints
Committee structures, roles, and approval flows for AI oversight, sized to your organization.
Find your guide 06Training Guides
What staff in your industry need to know to use AI tools productively and within the rules.
Find your guide 07AI Impact Assessments
Worked examples of assessing a specific AI system, from its purpose and data through its risks, controls, and approval.
Find your guide 08AI Incident Response Playbooks
What to do, in order, when an AI tool fails, exposes data, or produces a harmful result, including who to notify and when.
Find your guide 09Board Oversight Guides
What directors should ask, review, and approve on AI, written for the board rather than for staff.
Find your guide 10Privacy Program Guides
The privacy laws, notices, data maps, and member or customer rights your privacy program needs to cover.
Find your guide 11AI Contract Clause Libraries
Sample contract terms for AI vendors, ranked by priority, with why each one matters in your industry.
Find your guide 12State AI Law Trackers
The state AI and privacy laws that affect your industry, their status, and when each takes effect.
Find your guide 13AI Use Case Catalogs
Where AI helps most in your type of organization, rated by value and risk, with the controls each use needs.
Find your guide 14Data Protection Assessment Templates
Filled-in example assessments for common systems, ready to adapt for your own records.
Find your guide 15Tabletop Exercise Scenarios
Ready-to-run AI incident scenarios with timed developments and discussion questions for your team.
Find your guideAI Laws by State
Click on your state to see where its AI rules stand, or see every state AI law we track.
- Comprehensive AI law
- Targeted AI laws
- Privacy law with profiling rules
- Government AI rules
- No AI-specific law
Reference
AI Governance Scorecard
Answer 15 questions and get an instant maturity score, your weakest area, and where to start.
AI Policy Builder
Answer a few questions and get a draft AI acceptable use policy you can edit, download, and adopt.
AI Use Case Intake Form
A ready-to-use form for requesting and approving new AI tools and uses.
AI Vendor Questionnaire
The questions to send AI vendors before you buy, ready to download and send.
AI Laws by State
The state AI laws most likely to affect U.S. organizations, what each covers, and when each takes effect.
AI Governance and Privacy Glossary
Plain-language definitions of the AI governance, AI risk, and privacy terms you’ll see in laws, standards, and contracts.
2027 AI Governance Checklist
Eighteen steps to prepare your organization for the AI laws and expectations arriving in 2027.
ISO/IEC 42001 Buyer’s Guide
What ISO/IEC 42001 certification costs, how long it takes, and how to choose a consultant.
Our AI Assurance Methodology
How we test AI systems: the criteria we apply, how we rate findings, and what our assurance letter and seal mean.
Latest guides
AI Regulation Map for Credit Unions
The federal and state laws that apply when credit unions use AI in lending, fraud detection, member service, and marketing, and what each requires.
AI Use Policy Guide for Behavioral Health Centers
What a behavioral health center’s AI use policy must cover, from HIPAA and 42 CFR Part 2 to state laws restricting AI in therapy.
AI Use Policy Guide for Credit Unions
What a credit union’s AI use policy should cover, which uses to approve, restrict, or prohibit, how to train staff on it, and sample policy language.
AI Risk Register for Credit Unions
A sample register of common credit union AI uses, the data each one touches, its risk tier, the controls it needs, and who owns it.
AI Vendor Assessment Checklist for Credit Unions
The questions credit unions should ask AI vendors about member data, security, model fairness, and contract terms before signing.
AI Governance Blueprint for Credit Unions
Who owns AI decisions at a credit union, how new AI uses get approved, how the board oversees AI, and how to size the structure to your asset size.
Browse by industry
Each industry covers the business types below, with guides specific to their laws and risks.
Public Sector
Agencies use AI in services that affect residents directly, under public records laws and growing state AI requirements.
- Child Welfare Agencies
- Department of Motor Vehicles
- Department of Transportation
- Economic Development
- Election Commissions
- and 18 more business types
Healthcare & Life Sciences
Health organizations hold the most sensitive data there is, and AI tools must work within HIPAA and fast-moving state health AI laws.
- Assisted Living Facilities
- Behavioral Health Centers
- Chiropractic Clinics
- Clinical Trials Management
- Contract Research Organizations
- and 20 more business types
Financial Services
Lenders and financial firms use AI in credit, fraud, and member service, all areas covered by long-standing consumer protection laws.
- Asset Management Firms
- Commercial Banks
- Commodity Brokers
- Credit Unions and Lenders
- Crowdfunding Platforms
- and 20 more business types
Insurance
Insurers use AI in underwriting, pricing, and claims, where state insurance regulators expect governance and fairness testing.
- Actuarial Consulting Firms
- Aviation Insurance Providers
- Captive & Independent Agencies
- Claims Investigation Services
- Crop Insurance Providers
- and 20 more business types
Technology
Technology companies build AI into products, so customers, investors, and regulators expect documented governance.
- Artificial Intelligence Startups
- Blockchain Technology Companies
- Cloud Infrastructure Providers
- Consumer App Developers
- Cybersecurity
- and 20 more business types
Professional Services
Firms that handle client confidences need AI rules that protect privilege, confidentiality, and professional standards.
- Accounting Firms
- Architecture Firms
- Business Valuation Services
- Compliance Consulting Firms
- Engineering Firms
- and 20 more business types
Nonprofit
Nonprofits hold sensitive data about the people they serve and need AI governance sized to small teams and tight budgets.
- Animal Rescue and Shelters
- Arts & Culture Organizations
- Charitable Services Organizations
- Community Development Corporations
- Disability Support Organizations
- and 20 more business types
Education
Schools and training providers use AI with student records, where FERPA and state student privacy laws apply.
- Accreditation Agencies
- Art and Design Institutes
- Assessment & Testing Services
- Beauty and Cosmetology Schools
- Bootcamps and Technical Training
- and 20 more business types
Engineering
Engineering firms use AI in design and analysis, where professional liability and client data protection set the rules.
- Acoustical Engineering Services
- Aerospace Engineering Services
- Biomedical Engineering Firms
- CAD & BIM Software Providers
- Chemical Engineering Consultants
- and 20 more business types
Manufacturing & Distribution
Manufacturers use AI in quality, maintenance, and supply chains, where trade secrets and supplier data need protection.
- Aerospace Manufacturing
- Agricultural Equipment Manufacturing
- Beverage Distribution
- Building Materials Manufacturing
- Chemical Manufacturing
- and 20 more business types
Real Estate
Real estate firms use AI in marketing, screening, and valuation, areas covered by fair housing and consumer protection laws.
- 1031 Exchange Intermediaries
- Commercial Real Estate Agencies
- Coworking Space Operators
- HOA Management Companies
- Home Inspection Services
- and 20 more business types
Retail & eCommerce
Retailers use AI in personalization, pricing, and customer service, all built on consumer data covered by state privacy laws.
- Affiliate Marketing Networks
- Apparel and Fashion Retailers
- Automotive Parts Stores
- Consumer Electronics Stores
- Cosmetics and Beauty Retailers
- and 20 more business types
Consumer Products
Consumer brands use AI in marketing and product development, where advertising and privacy rules apply.
- Adult Beverages
- Apparel and Footwear
- Baby and Maternity Products
- Cleaning and Janitorial Products
- Consumer Electronics Brands
- and 20 more business types
Media & Communications
Media companies use AI to create and distribute content, raising copyright, disclosure, and likeness questions.
- Advertising Agencies
- Audiobook Publishers
- Cable and Satellite Providers
- Corporate Video Production
- Entertainment Management Companies
- and 20 more business types
Energy & Utilities
Utilities use AI in grid operations and customer service, under regulators who expect reliability and security.
- Biomass Power Generation
- Carbon Capture and Storage
- District Heating and Cooling
- Electric Vehicle Charging Networks
- Energy Efficiency Consulting
- and 20 more business types
Automotive
Automotive businesses use AI in sales, financing, and service, where consumer finance and privacy laws apply.
- Auto Auction Houses
- Auto Body Collision Centers
- Auto Glass Repair Services
- Auto Parts Manufacturers
- Automotive Dealership Software
- and 20 more business types
Transportation
Transportation operators use AI in routing, safety, and logistics, where safety regulators and shipper contracts set expectations.
- Airports & Port Authorities
- Armored Transport
- Bulk Cargo Haulers
- Cold Chain Logistics
- Commercial & Cargo Airlines
- and 20 more business types
Trade Services
Trade businesses adopt AI for estimating, scheduling, and customer contact, and need simple, practical rules.
- Asbestos and Lead Abatement
- Building Material Suppliers
- Carpentry and Woodworking
- Commercial Cleaning
- Demolition & Excavation
- and 20 more business types
Talk through your AI and privacy questions
Tell us what you're working on, and we'll reply within one business day.