Regulation map · For security, legal, and audit leaders
Every chapter answers a rule your examiner already cites.
Staff adopted AI faster than your review cycle did. The SEC now expects documented privacy safeguards, a cyber disclosure process measured in business days, and training an exam can inspect. This map shows, obligation by obligation, what the rule requires and which chapter carries it. Aligned with, not certified by, any regulator.
Why now
The tool arrived before the policy
Adoption outran the review cycle. The realistic choice left is trained, supervised use in sanctioned tools, or untracked use in accounts you cannot see.
Why now
Disclosure runs on business days
A material incident must be disclosed within four business days, and that decision rests with whoever saw it first. Trained staff escalate in hours.
Why now
A policy states intent. A record proves it
Exams, insurers, and enterprise questionnaires ask who was trained, on what, and when. Every attempt is scored, dated, and exportable.
SEC rules
Where AI use meets the federal securities laws
Reg S-P
Privacy of consumer financial information
Requires Written policies to safeguard customer records, a written incident response programme, and notice to affected individuals when a breach touches 500 or more consumers.
This training Chapters 03 and 09 keep non-public customer information out of unapproved AI tools; chapter 10 makes reporting a suspected exposure immediate rather than at month end.
Reg S-ID
Identity theft red flags
Requires A written programme that detects, prevents, and mitigates identity theft across covered accounts, with staff trained to spot and escalate red flags.
This training Chapter 07 covers AI-assisted phishing, voice cloning, and deepfakes, and the identity checks to run before acting on a suspicious request.
Item 1.05 of Form 8-K
Material cybersecurity incident disclosure
Requires Disclosure of a material cybersecurity incident within four business days of determining materiality, decided by people who understand the facts.
This training Chapter 10 defines what counts as an AI incident and what to report, so the four-day clock is not lost inside a chat window.
Reg S-K Item 106
Cybersecurity risk management, strategy, and governance
Requires Annual disclosure of how the company assesses, identifies, and manages cyber risk, including board oversight and management’s role.
This training A recorded, scored, exportable completion log is the evidence that people, not just policies, carry the controls.
Rules 17a-3 and 17a-4
Books and records
Requires Business communications must be captured and retained. Work conducted in personal or unsanctioned tools falls outside the record.
This training Chapters 02 and 06 limit work to approved tools and company-managed accounts, and require authorisation for agent actions.
Regulation Best Interest and the Marketing Rule
Care, honesty, and no misleading statements
Requires Recommendations and marketing claims must be accurate, balanced, and free of material misstatements, including claims about what AI does.
This training Chapter 05 verifies AI output before anyone relies on it; chapter 09 covers disclosing AI involvement and avoiding overstated capability claims.
Other regulators and frameworks
State, EU, health, and audit frameworks
FINRA Reg Notice 24-09
Generative AI in member firms
Requires Supervision of generative AI use, including recordkeeping, vendor diligence, and controls on what the model may see and do.
This training Chapters 02, 06, and 08 draw the line between sanctioned and unsanctioned use.
NYDFS 23 NYCRR 500
Cybersecurity programme training
Requires A risk-based programme that includes regular cybersecurity awareness training for all personnel, with records kept.
This training The assessment and per-employee certificate give a dated, per-person record.
EU AI Act, Article 4
AI literacy
Requires Providers and deployers must take measures to ensure staff dealing with AI systems have sufficient AI literacy for their role.
This training Eleven chapters of plain-language literacy, plus a scored check on what was learned.
GDPR and CCPA / CPRA
Personal data protection
Requires Lawful basis, data minimisation, and safeguards when personal data is processed — including prompts pasted into third-party models.
This training Chapter 04 forbids real personal data in prompts and teaches the synthetic-example habit.
HIPAA Security Rule (where applicable)
Workforce training and access control
Requires Training for the workforce on protecting electronic protected health information, plus controls on who may see it.
This training Chapters 03 and 08 cover what never enters a tool and which tasks need approval first.
NIST AI RMF, NIST SP 800-53, ISO/IEC 42001, SOC 2
Control frameworks your auditors already test
Requires Documented awareness training (AT-2), AI governance policies (GOVERN), and evidence of operating effectiveness.
This training Chapter-level mapping is published on the compliance page for your reviewers.
Why a corporation should require this
AI awareness is now an examined control, not a culture initiative. These are the six reasons it moves from discretionary to budgeted.
Nobody has to be careless for it to cost you
The common case is not a malicious insider. It is a capable, well-meaning employee trying to finish work faster, pasting the shortest version of a document that gets the job done.
Data leaves the moment someone pastes
A prompt carrying customer records, deal terms, or source code is a disclosure the moment it is sent. No retention policy recovers it, and no incident response programme can log what it never saw.
Regulators ask for evidence, not intentions
Exams and audits ask who was trained, on what, and when. A policy in a shared drive is a statement; a dated completion log with a verifiable certificate is evidence.
Phishing now writes perfect English
AI-assisted lures and cloned voices remove the grammar tells people were trained on. Staff need the new signals and a fast path to report them.
Agents act without a person watching
Once an AI agent can send, pay, or file, over-broad permissions become money. Teaching least privilege before the rollout is far cheaper than after the transfer.
Insurance and client diligence now ask
Cyber policies and enterprise security questionnaires increasingly ask for documented AI awareness training. Having it shortens those conversations.
What the twenty questions actually test
- Which tools and accounts are approved, and what to do when the tool someone wants is not.
- What never enters a prompt: customer data, employee records, financials, credentials, and unannounced plans.
- How to check an AI answer before it reaches a client, a filing, or production code.
- Where hidden instructions hide, and the warning signs of AI-assisted phishing and impersonation.
- Which agent actions a person must authorise each time, and why least privilege matters.
- When to stop, contain, and report — and what the first fifteen minutes look like.
75% is required to pass, each attempt is scored and logged, and a passing employee receives a certificate with an ID an employer can verify.
This page describes how the training supports those obligations. It is not legal advice, not a regulatory certification, and not a substitute for your own policies or a formal control assessment.