Describe your business, leave with a checklist you can assign

The effect of FDA review and authorisation of a PCCP is that no additional marketing submission is needed for each modification implemented within the plan. Companies therefore need a gating process confirming, for every release, that the intended modification falls within the authorised modification list and methodology and that validation was performed as specified; anything outside must return to the marketing submission route. The final guidance specifically clarifies implementation of modifications consistent with an authorised PCCP, and the implementation evidence must be retrievable during inspection.

Evidence: Per-release determination of whether the change is within the PCCP scope; Validation reports executed under the PCCP methodology with performance comparison data; Release approval records and sign-off; Marketing submission records for out-of-scope modifications; Traceability register for model and data versions

Include a PCCP in the marketing submission for a device with one or more AI-enabled device software functions. It should describe the planned AI-DSF modifications, the associated methodology to develop, validate and implement those modifications, and an assessment of the impact of those modifications. FDA reviews the PCCP as part of the marketing submission, so the plan boundary must be specific enough to be reviewable yet broad enough to cover foreseeable iteration needs, and the terminology for training, tuning and test data should follow the clarifications in the final guidance.

Evidence: PCCP document covering the planned modification list, methodology and impact assessment; Modification boundary criteria and the test for when a new submission is required; Description of training, tuning and test data splits with the data dictionary; Validation protocol and acceptance criteria, including the no-performance-degradation threshold; FDA review correspondence (additional information or deficiency letters) and responses

Model Card

The final guidance adds clarifications on postmarket surveillance relative to the draft. For an AI device this means monitoring real-world performance continuously while the PCCP is in force, detecting distribution shift, subgroup performance differences and degradation, and feeding the findings back into decisions on further modifications and risk controls. The system must connect to the device quality system and adverse event reporting processes.

Evidence: Real-world performance monitoring plan and metric definitions, including subgroup stratification; Legal basis and privacy compliance analysis for the monitoring data collection; Thresholds, alerts and response records for performance degradation and data drift; Records showing monitoring findings driving modification decisions and risk control updates; Documented interface with the adverse event reporting process

AI incident and serious incident reporting record (register plus report drafts)

One of the clarifications the final guidance makes over the draft concerns the PCCP information to include in labelling and in publicly available decision summaries. In practice the labelling must let users know that an authorised change plan exists, what types of change may occur and how to identify the current version, and the wording in the public decision summary must match the submission so that external marketing does not overstate what automatic updating means.

Evidence: Final labelling and instructions for use containing the PCCP description, with version records; Consistency check between the PCCP wording in the public decision summary and the submission; Compliance review records for promotional materials; Evidence of how users can identify the current software version

Covered transactions include acquiring an equity or contingent equity interest in a covered foreign person; providing debt financing with equity-like rights; converting a contingent equity interest acquired on or after 2025-01-02; acquiring, leasing or developing operations, land, property or assets in a country of concern that will result in the establishment of a covered foreign person or the engagement of a country-of-concern person in a covered activity; entering a joint venture, wherever located, with a country-of-concern person that will engage in a covered activity; and acquiring a limited partner interest in a non-U.S. fund that the U.S. person knows likely will invest in a country-of-concern person in the semiconductor and microelectronics, quantum information technology or artificial intelligence sectors.

Evidence: Transaction structure chart and covered-transaction determination memo citing the paragraphs of § 850.210; Description of the target activities mapped against the § 850.217 and § 850.224 lists; Investment-scope description and fund undertakings for limited partner interests; Approval record for the determination signed by legal and compliance

Two AI triggers make a transaction prohibited: developing an AI system designed to be exclusively used for, or intended by the covered foreign person to be used for, any military end use or government intelligence or mass-surveillance end use; and developing an AI system trained using more than 10 to the power of 25 computational operations, or more than 10 to the power of 24 computational operations using primarily biological sequence data. Chip-side prohibited activities include EDA software, front-end semiconductor fabrication equipment, volume advanced packaging equipment, EUV-dedicated items, designing integrated circuits meeting or exceeding ECCN 3A090.a, fabricating logic on non-planar transistor architectures or at 16/14 nm or below, NAND with 128 or more layers, DRAM at 18 nm half-pitch or below, gallium-based compound semiconductors, graphene or carbon nanotube circuits, circuits designed to operate at or below 4.5 Kelvin, and specified supercomputer and quantum computing activities.

Evidence: Training compute accounting with a stated methodology distinguishing pre-training, fine-tuning and reinforcement learning; Training data composition statement addressing whether biological sequence data predominates; Product end-use statement and exclusion undertakings for military and intelligence uses; Technical file recording chip design parameters and process nodes

A U.S. person undertaking a notifiable transaction must file with Treasury no later than 30 calendar days after the completion date, following the electronic filing instructions on the Outbound Investment Security Program website, with the content required by § 850.405 and the certification in § 850.203. A U.S. person must also file for notifiable transactions of its controlled foreign entities, and must file within 30 calendar days of acquiring post-closing actual knowledge of facts that would have made the transaction covered. AI-side notifiable triggers include developing an AI system trained using more than 10 to the power of 23 computational operations, and AI systems intended for cybersecurity applications, digital forensics tools, penetration testing tools or the control of robotic systems.

Evidence: Memo establishing the completion date; Notification working papers and the electronic filing receipt; Certification signed by the chief executive officer or a duly authorized designee; Internal log of post-closing knowledge events and evidence of filing within 30 days

In assessing whether a U.S. person knew a fact, Treasury considers what the person had or could have had through a reasonable and diligent inquiry at the time of the transaction, including the questions asked of the target or counterparty, the contractual representations and warranties obtained or attempted, efforts to obtain and consider non-public information, available public information and its consistency with other information, whether the person purposefully avoided learning relevant information, the presence or absence of warning signs such as evasive or non-responses or refusal to provide information or warranties, and the use of public and commercial databases. A person that failed to conduct such an inquiry may be assessed to have had reason to know.

Evidence: Diligence questionnaire and the original responses from the target; Text of the representations and warranties in the transaction documents; Search records from public and commercial databases; Memo identifying warning signs and how they were resolved

A U.S. person must take all reasonable steps to prohibit and prevent transactions by its controlled foreign entities that would be prohibited if undertaken by a U.S. person. Treasury considers compliance agreements with the controlled foreign entity, the existence and exercise of governance or shareholder rights, periodic training and internal reporting, documented internal controls that are periodically reviewed, and a documented testing or auditing process. Separately, a U.S. person may not knowingly direct a transaction by a non-U.S. person that would be prohibited if undertaken by a U.S. person. A U.S. officer or director can avoid being treated as directing by recusing from formal approval and decision-making, from reviewing, editing, commenting on, approving and signing transaction documents, and from negotiations.

Evidence: Compliance agreements executed with controlled foreign entities; Internal control documents, periodic review records and testing or audit reports; Records of training and internal reporting mechanisms; Recusal statements by U.S. directors or officers, corroborated by meeting minutes

Before procuring, deploying or supplying any item, determine its Export Control Classification Number. The most relevant entries for AI companies are advanced computing chips and electronic assemblies (3A090, 4A090 and the .z paragraphs of 3A001, 4A003, 4A004, 4A005, 5A002, 5A004 and 5A992), the associated software and technology (3D001, 3E001, 4D001, 4D090, 4E001 and others), high bandwidth memory (3A090.c), specified semiconductor manufacturing equipment (3B001, 3B002 and others) and AI model weights (4E091). Classification conclusions must be documented and refreshed as items change.

Evidence: Item classification register recording ECCN, rationale, determiner and date; Written ECCN notifications furnished by suppliers; Compute-usage record for model weights and the 4E091 determination memo; Reclassification records triggered by product or model version changes

License requirements sit in section 742.6(a) and license review policy sits in section 742.6(b); the two paragraph numbers run independently and must not be conflated. Requirements: a worldwide license requirement applies to top-tier items such as 3A090.a and 4A090.a (section 742.6(a)(6)(iii)(A)); for second-tier items such as 3A090.b a license is required for the UAE and Country Groups D:1, D:4 and D:5, excluding destinations also in A:5 or A:6 (subparagraph (B)); and separate requirements cover specified semiconductor manufacturing equipment and high bandwidth memory (3A090.c) to or within Macau and Country Group D:5 (section 742.6(a)(6)(i)). Review policy in section 742.6(b)(10) is tiered: for 3A090.c there is a presumption of approval for entities not headquartered in Macau or D:5 and a presumption of denial otherwise; for commodities within section 742.6(a)(6)(iii) exported to end users located in China or Macau there is case-by-case review where total processing performance is below 21,000 and total DRAM bandwidth below 6,500 GB/s and the applicant supplies the additional information in supplement no. 2 to part 748 under paragraph (dd), with a presumption of denial otherwise. Applications for 4E091 model weights are reviewed under section 742.6(b)(14) with a presumption of denial for end users headquartered outside the destinations in paragraph (a) of supplement no. 5 to part 740.

Evidence: Per-transaction licensing memo covering destination, country group, end-user headquarters and ultimate parent; BIS license applications and the approvals or denials received; Working papers computing total processing performance and total DRAM bandwidth; End-user and end-use statements including re-export control undertakings

AI model weights specified in ECCN 4E091 require a license for export, reexport or in-country transfer to any destination worldwide. The requirement does not apply to deemed exports or deemed reexports to permanent regular employees of entities headquartered, or with an ultimate parent headquartered, in a destination listed in paragraph (a) of supplement no. 5 to part 740. License Exception AIA (§ 740.27) can authorize model weights only under strict conditions: the receiving entities must be located outside Macau and Country Group D:5, and the weights must be stored in a facility that complies with paragraphs 14, 15 and 18 of supplement no. 10 to part 748. A foreign-produced 4E091 item includes any item further trained or modified by fine-tuning, quantization or other post-training techniques.

Evidence: Training compute-usage records and the 4E091 determination memo; Inventory of weight storage locations and access controls with facility security compliance evidence; Records of License Exception AIA use, including the written notice to the ultimate consignee; Access audit logs for the weights repository covering onshore and offshore personnel

Even an item manufactured entirely outside the United States falls under the EAR if it meets both the product scope and destination scope of an FDP rule. The advanced computing FDP rule (§ 734.9(h)) covers two situations: foreign-produced items that are the direct product of U.S.-controlled technology or software such as 3D001, 3E001, 4D001, 4D090, 4E001, 5D002 or 5E002; and items produced by a complete plant or major component of a plant that is itself a direct product of U.S. technology or software. In both cases the item must also be specified in 3A090, 4A090 or the corresponding .z entries. The AI model weights FDP rule (§ 734.9(l)) has a worldwide destination scope. The Entity List FDP rules (§ 734.9(e)) add separate footnote 1, footnote 4 and footnote 5 provisions.

Evidence: FDP applicability memo addressing product scope and destination scope item by item; Technology-origin statements from offshore foundries and cloud providers; Supply-chain map annotating each node with item ECCN and the origin of the production tooling; Legal opinions or records of BIS advisory opinion requests where obtained

A license is required, to the extent specified on the Entity List, whenever a listed entity or an entity using an address flagged on the Entity List as presenting a high diversion risk is a party to the transaction. The listing itself states which license exceptions are available and the applicable review policy. Screening must cover the purchaser, end user, ultimate consignee, intermediate consignees and freight forwarders, and must be rerun before each shipment. BIS may also impose license requirements on a specific party by informing the exporter under § 744.11(c).

Evidence: Per-order screening records showing list version, screening timestamp and hit disposition; Entity List entry extracts or citations recording the license requirement and exception scope; Any BIS is-informed letters received and their internal distribution records; Party files for purchaser, end user, intermediate consignees and carriers

Supplier and subcontractor ESG and security due diligence questionnaire (for use as the buyer)

On 2025-09-30 BIS published an interim final rule (90 FR 47201, effective 2025-09-29) automatically extending Entity List restrictions to entities 50 percent or more owned by one or more listed entities, and applying the same treatment to 50 percent affiliates of listed military end users and certain sanctioned parties. On 2025-11-12 BIS then published a final rule (90 FR 50857) staying that interim final rule, effective 2025-11-10, until 2026-11-09, absent a future extension. Companies should set a calendar trigger for that date and complete ownership look-through mapping in advance so screening logic can be switched over the moment the stay lapses.

Evidence: Group ownership look-through chart annotating each tier and any listed entities; Watch-list register for the stay expiry date with a named owner; Contingency plan for alternative procurement and compliance if the affiliate treatment applies; External legal opinion on the aggregate 50 percent test where obtained

Releasing controlled technology or software to a foreign national inside the United States is a deemed export and must be treated like an actual export. Section 742.6 contains specific provisions keyed to persons whose most recent citizenship or permanent residency is in Country Group D:1 or D:5, including controls on GAAFET technology in ECCN 3E905 and a limited carve-out for employees already employed as of 2024-09-06 who are not prohibited persons under part 744. Companies must therefore segment access to R&D systems by nationality and update entitlements on hire, transfer and departure.

Evidence: Controlled-technology inventory with an access matrix segmented by citizenship and residency status; Export-control review records completed at onboarding and internal transfer for foreign nationals; Access audit logs for code repositories, model repositories and design files; Deemed-export license applications and approvals where required

Institutionalize the above decisions: item classification workflow, counterparty screening workflow, licensing and exception workflow, red-flag escalation, training, internal audit and complete retention of transaction documents. The EAR imposes independent liability for recordkeeping failures and false statements, so export documents such as invoices, packing lists, end-user statements and internal determination memos should be centrally filed to support BIS end-use checks.

Evidence: Export compliance manual and approval workflow chart; Red-flag checklist and escalation disposition records; Export control training records and assessment results; Transaction document archive index covering invoices, end-user statements, determination memos and screening records

Before using License Exception AIA under § 740.27, the exporter must furnish the ECCN of each item to the ultimate consignee and obtain a one-time ultimate-consignee certification, which is submitted to BIS at EARReports@bis.doc.gov with the subject line AIA Certification. Each shipment must be accompanied by written notice to the ultimate consignee that it is made pursuant to License Exception AIA, identifying the covered items or stating that the whole shipment is covered. The reporting requirement is triggered where the ultimate consignee receives items under § 740.27(a)(1) with a cumulative total processing performance of 253,000,000 TPP.

Evidence: Original ultimate-consignee certification and the record of its submission to BIS; Written ECCN notification letters; Copies of the per-shipment AIA notices; Cumulative TPP ledger used to test the reporting threshold

Build a data inventory and test each category against the bulk thresholds: human omic data on more than 1,000 U.S. persons (100 for human genomic data), biometric identifiers on more than 1,000, precise geolocation data on more than 1,000 U.S. devices, personal health data and personal financial data on more than 10,000 each, and covered personal identifiers on more than 100,000. Combined data is measured at the lowest applicable threshold. Thresholds aggregate across transactions between the same U.S. person and the same foreign or covered person in the preceding 12 months, and apply regardless of anonymization, pseudonymization, de-identification or encryption.

Evidence: Inventory of sensitive personal data mapped to the six categories in 28 CFR § 202.249 plus government-related data; Working papers showing 12-month aggregation per counterparty; Determination memo for combined data and covered personal identifiers, listing the paired listed identifiers; Screening record against the Government-Related Location Data List in § 202.1401

Open tool: Transfer Matrix

Determine before contracting whether the counterparty is a covered person. Countries of concern are China (including Hong Kong and Macau), Cuba, Iran, North Korea, Russia and Venezuela. Covered persons include foreign entities organized in, or with a principal place of business in, a country of concern, foreign entities 50 percent or more owned directly or indirectly, individually or in the aggregate, by such persons, and persons designated by the Attorney General on the Covered Persons List. Publication in the Federal Register is deemed constructive knowledge.

Evidence: Counterparty due-diligence questionnaire and ownership chain chart including the aggregate 50 percent test; Covered Persons List screening records with screening date and hits; Register of foreign employees and contractors with citizenship and primary residence; Signed screening conclusion approved by the compliance owner

Do not knowingly engage in data brokerage involving government-related data or bulk U.S. sensitive personal data with a country of concern or covered person. Data brokerage means the sale of data, licensing of access to data or similar commercial transactions where the recipient did not collect or process the data directly from the linked individuals. The rule examples expressly cover selling or licensing bulk precise geolocation data from an autonomous-driving fleet to a parent company abroad, embedding tracking pixels or SDKs that pass data to a covered person, and licensing subscription access to a chatbot trained on bulk sensitive data that can be prompted to disclose that training data.

Evidence: Data-flow map annotating each outbound channel with recipient and legal characterization; Inventory of SDKs, tracking pixels and advertising partners with field-level data mapping; List of terminated or restructured data-brokerage contracts with evidence of termination; Training-data provenance statement showing no prohibited transaction was used to obtain or transfer data

Any covered data transaction giving a country of concern or covered person access to bulk human omic data (genomic, epigenomic, proteomic, transcriptomic) or to human biospecimens from which such data could be derived is prohibited outright, including vendor, employment and investment agreements. It cannot be converted into a restricted transaction by implementing the CISA security requirements. The bulk threshold for human genomic data is only 100 U.S. persons.

Evidence: Inventory of omic datasets and biospecimens with source-country tagging; Access matrix showing which onshore and offshore R&D staff can reach omic data systems; Review records for omics collaborations, outsourced sequencing and academic partnerships; Training attendance records on the prohibition for R&D and business development teams

Vendor, employment and investment agreements with a country of concern or covered person that involve access to bulk sensitive personal data are restricted transactions, permitted only if the U.S. person complies with the CISA Security Requirements for Restricted Transactions (EO 14117 Implementation, January 2025) and all other applicable requirements. A rule example is explicit: substituting self-designed controls the company believes are equivalent, instead of the security requirements, makes the transaction prohibited.

Evidence: Implementation statement mapping each CISA security requirement to a control; Evidence of identity and access management configuration, data minimization and encryption or de-identification; Register of restricted transactions split into vendor, employment and investment agreements; Written security-requirements policy certified annually by the officer responsible for compliance

When engaging in data brokerage involving government-related data or bulk sensitive personal data with any foreign person that is not a covered person, the U.S. person must contractually require that the foreign person not engage in onward data brokerage of the same data with a country of concern or covered person, and must report any known or suspected breach to DOJ within 14 days, including the date, a description of the transaction and clause, the parties involved and copies of relevant documents.

Evidence: Template and executed contracts containing the onward-transfer prohibition; Clause-implementation register maintained per counterparty; Internal escalation and investigation records for suspected breaches; Breach report filed with DOJ within 14 days and the filing receipt

Supplier and subcontractor ESG and security due diligence questionnaire (for use as the buyer)

A U.S. person engaging in any transaction subject to this part must keep a full and accurate record of each transaction, available for examination for at least 10 years. For restricted transactions the following must additionally be maintained in an auditable manner: the annually certified compliance-program and security-requirements policies, annual audit results, due-diligence documentation of the data flow (types and volumes, party identities including direct and indirect ownership or individual citizenship and primary residence, and end use), the transfer method, transaction start and end dates, copies of agreements, copies of any licenses or advisory opinions and their document reference numbers, and an annual certification by the responsible compliance person as to the completeness and accuracy of the due-diligence records.

Evidence: Transaction record archive index with the 10-year retention marker; Due-diligence file covering data types and volumes, party identities, end use and transfer method; Register of agreements, licenses and advisory opinions with document reference numbers; Signed annual certification of completeness and accuracy of the due-diligence records

A U.S. person engaging in any restricted transaction must develop and implement a data compliance program no later than 2025-10-06. At a minimum it must include risk-based procedures to verify and log, in an auditable manner, the types and volumes of data, the identity of the parties (entity ownership and individual citizenship or primary residence) and the end use and transfer method; risk-based vendor identity verification; a written policy describing the compliance program; and a written policy describing implementation of the security requirements. The last two must be certified annually by an officer, executive or employee responsible for compliance.

Evidence: Written data compliance program policy with the annual officer certification page; Written security-requirements implementation policy with the annual officer certification page; Auditable data-flow verification logs; Vendor identity verification records

A U.S. person engaging in restricted transactions on or after 2025-10-06 must conduct an audit once for each calendar year in which it engages in such transactions, covering the preceding 12 months. The auditor must be qualified, independent and not a covered person or country of concern. The audit must examine the restricted transactions, the data compliance program and its implementation, the records required by § 202.1101 and the security requirements. The auditor must deliver a written report within 60 days of completing the audit, describing any failures or deficiencies in the security requirements and recommending improvements. The report must be retained for at least 10 years.

Evidence: Auditor independence and qualification statement; Annual audit report covering methodology, personnel interviewed and systems or facilities examined; Remediation plan for audit findings and evidence of closure; Archival record demonstrating 10-year retention of the audit report

Two reporting duties apply. First, an annual report: a U.S. person that, on or after 2025-10-06, engages in a restricted transaction involving cloud-computing services and has 25 percent or more of its equity owned, directly or indirectly and through any contract, arrangement, understanding or relationship, by a country of concern or covered person must file by March 1 for transactions in place as of December 31 of the previous year. Second, a rejected-transaction report: from 2025-10-06, a U.S. person that receives and affirmatively rejects (including automatically, using software or automated tools) an offer to engage in a prohibited data-brokerage transaction must file within 14 days of the rejection. Both must be signed and certified as true, accurate and complete by an officer, director, a person performing those functions, or an employee responsible for compliance.

Evidence: Ownership look-through calculation showing whether the 25 percent threshold is met; Annual report working papers and filing receipt, covering transaction dates, data types and volumes, transfer method and party names and locations; Rejected-transaction log and copies of the reports filed within 14 days; Signature authority documentation and the certification page for each filing

Build and maintain an item classification register covering advanced computing integrated circuits and their software and technology; high bandwidth memory (3A090.c with the corresponding 3D001 and 3E001), whose licence requirement for Macau and D:5 destinations does not apply to deemed exports or deemed reexports; and AI model weights (ECCN 4E091, a worldwide licence requirement whose licence requirement does not apply to deemed exports or deemed reexports for permanent regular employees of entities headquartered in specified destinations). The classification must be wired into procurement, cloud deployment and model release processes, so every new hardware model or model release passes the classification gate again.

Evidence: Item classification register mapping model to ECCN to licence requirement to the citing provision; Determination and technical rationale for whether model weights fall under 4E091; Reclassification triggers and review rules for new models, versions and destinations; Where applicable, advisory opinion requests submitted to BIS and the responses

Beyond list-based controls, a licence is required where the exporter has knowledge that the item is destined for: the development, production, operation, installation (including on-site installation), maintenance (checking), repair, overhaul or refurbishing of a supercomputer located in or destined to Macau or a Country Group D:5 destination; incorporation into, or the development or production of, any component or equipment to be used in such a supercomputer; the development or production of ICs destined to a facility located in Macau or a D:5 destination where production of advanced-node ICs occurs; and, where the technology node is unknown, Category 3 items in Product Groups B, C, D or E. Companies must translate this knowledge standard into workable customer due diligence questionnaires, red-flag lists and release gates.

Evidence: End-user and end-use statement templates and the signed documents; Red-flag list and due diligence questionnaire covering supercomputer and advanced-node facility identification; Customer and destination screening records including restricted party screening; Release gate approval records and a ledger of refusals and escalations; Use confirmation records for installation, operations and repair services

§742.6(a)(13) imposes a worldwide licence requirement for the export, reexport and in-country transfer of items under ECCN 4E091, and (b)(14) provides that applications are reviewed under a presumption of denial for end users headquartered, or with an ultimate parent headquartered, outside the destinations listed in paragraph (a) of supplement no. 5 to part 740. Companies must therefore control where model weights are stored, who can access them and how they move, bring who may download the weights, which region they are copied to and which entity controls them into access control and audit, and assess case by case whether overseas research collaborations, customer on-premises deployments or open releases amount to a controlled transfer.

Evidence: Model weight asset register (version, storage region, controlling entity); Access control policy and access logs for weights; Controlled-transfer assessments for cross-border transfers, on-premises deliveries and open releases; Deemed export applicability determinations for employees and collaborators; Licence application materials and end-user information where an application is required

From 15 January 2026 the licence review policy for exports to China and Macau of the Nvidia H200 and its equivalents and less advanced chips changes from presumption of denial to case-by-case, subject to two sets of conditions: the semiconductor must have been commercially available in the United States at publication of the rule; and the exporter must certify that there is sufficient supply of the product in the United States, that production for exports to China will not divert global foundry capacity for similar or more advanced products for U.S. end users, that the recipient has demonstrated sufficient security procedures, and that the item undergoes independent third-party testing in the United States to verify its performance specifications. Buyers should therefore agree the certification package, third-party testing arrangements and lead times with suppliers in advance, and write the review uncertainty into the delivery and excuse clauses of purchase contracts.

Evidence: Recipient security procedure documentation (physical security, access control, use restrictions, audit cooperation); Agreed certification checklist and allocation of responsibility with the exporter; Arrangements and reports for independent third-party performance testing in the United States; Licence condition, delivery extension and excuse clauses in the purchase contract; Licence application status tracking and contingency records for alternative models or deployment locations

Section 5 of the FTC Act prohibits unfair or deceptive acts or practices in commerce. In its Operation AI Comply sweep the FTC stated that using AI tools to trick, mislead or defraud people is illegal and that there is no AI exemption from the laws on the books. The cases announced included a company promoting an AI tool that enabled customers to create fake reviews, a company claiming to sell AI Lawyer services, and companies claiming AI could help consumers make money through online storefronts. Companies must therefore hold substantiation before publishing accuracy, performance, autonomy or earnings claims.

Evidence: Claims register mapped to supporting evidence, recording benchmark set, methodology, date and owner; Raw benchmark data and reproducible evaluation scripts; Compliance review records and version history for marketing materials; Verification records for testimonials and endorsements

Model Card

In the Rite Aid matter the FTC alleged that the retailer deployed AI-based facial recognition in hundreds of stores without taking reasonable measures to prevent harm to consumers, who were erroneously flagged as shoplifters or troublemakers and suffered humiliation and other harm. The order requires comprehensive safeguards when deploying automated systems that use biometric information to track or flag consumers, requires discontinuing the technology where potential risks to consumers cannot be controlled, and requires a robust information security program overseen by senior company executives. This establishes an enforcement baseline that deployment must come with safeguards.

Evidence: Pre-deployment risk assessment and accuracy or false-positive testing reports broken down by demographic group; Design documentation for human review and appeal mechanisms; Notification plan for affected individuals; Minutes evidencing senior executive oversight of security and algorithm governance

FTC enforcement outcomes have strong demonstrative effect: the safeguards, prohibitions and executive oversight arrangements imposed in peer consent orders typically become the de facto standard used in customer diligence and procurement questionnaires. Companies should track FTC actions against comparable business models, map their requirements into internal controls, and be able to give evidenced answers in customer security questionnaires and investor diligence.

Evidence: Tracking register of peer enforcement developments; Mapping table from enforcement requirements to internal controls; Standard answer library for customer security questionnaires with an evidence index; Annual compliance self-assessment report

The SEC published the final climate-related disclosure rules in the Federal Register on 2024-03-28 (89 FR 21668), originally effective 2024-05-28. On 2024-04-12 it announced (89 FR 25804) that the effective date is delayed indefinitely pending completion of the consolidated Eighth Circuit review, with a further Federal Register notification to follow. On 2026-06-03 the SEC published a proposed rule (91 FR 33296) to rescind those climate-related disclosure rules, with comments due 2026-08-03. No final rescission rule was observed as of 2026-09-12. Companies listed or listing in the United States should therefore not prepare disclosure as though the rules were in force, but equally should not infer that no other climate disclosure obligations apply.

Evidence: Status tracking register recording Federal Register citations and the date checked; Statement of the status assumptions underlying the disclosure preparation plan; Confirmation records with auditors and counsel; Comparison table of climate disclosure duties in other jurisdictions, to avoid generalizing from the U.S. status

ISSB (IFRS S1 / S2) sustainability-related financial disclosure report outline

Even while the federal rule is stalled, climate data capability retains commercial value: supply chain questionnaires from U.S. enterprise customers, investor diligence and mandatory regimes in other jurisdictions all draw on the same underlying data. Retain the emissions accounting boundary, activity data collection processes and data quality controls rather than suspending the build-out as the rule status changes. This item is practical guidance and does not assert a current SEC mandate.

Evidence: Emissions accounting boundary and methodology documentation; Activity data collection workflow and data quality control records; History of responses to customer supply chain questionnaires; Internal allocation of responsibility for climate data governance

Greenhouse gas inventory workpaper (GHG Protocol Scope 1 / 2 / 3)ISSB (IFRS S1 / S2) sustainability-related financial disclosure report outlineThird-party sustainability assurance readiness checklist (starting from limited assurance)

Open tool: Carbon Estimator