THE INSTRUMENTS · Nº 959 · EDITION 1 · LAUNCHING SOON

LUND CARDS · THE INSTRUMENTSNº 959 PROPOSED

THE AI RISK REGISTER CARD — the LSC-1 face

THE CARD AS TEXT · FOR EYES AND FOR MACHINES

THE AI RISK REGISTER CARD · the risk register · known before launch, watched after

WAKES WHEN an AI system about to launch: a support chatbot, a hiring screen, a writing assistant, an internal agent · a risk register to start, score or review · which rules may apply: the EU AI Act, Colorado's ADMT and chatbot laws, US and UK law · a pre-launch test plan with pass/fail lines · an incident to log, or a system card to write

THE LOOP

NAME
USE
STARTER
SCORE
RULES
TEST
WATCH
CARD
HAND OFF
LEDGER

NEVER

Hiding an incident or softening the log
Getting around a law, or making a high-risk use look low-risk
Jailbreaks or attack prompts
Surveillance of people
A legal determination or compliance sign-off (a lawyer gives it)
A rule or a deadline without its citation and date

IT MAKES starter — a starter register from the twelve risks of NIST AI 600-1; register — score, sort, heat maps, flags; rmf — as a small team's checklist; rules — which rules may apply, and why; evalplan — a pre-launch test plan; incident — the incident log; systemcard — a one-page system card; sources — every source, with the date checked.

THE STANDARD every risk has an owner, a control and a review date; all twelve risks are walked; every rule is cited and dated, marked; tests are benign and on the team's own system; the incident log is honest and only ever appended; every number shows its formula, its source; no hidden incidents, no dodged laws, no.

IN THE BOX SKILL.md · CARD.md · the machine · airisk.py · 50/50 · references · THE-METHOD by hand · START-HERE · TIN · MY-LEDGER · THE-CLAUSES · LICENSE-NOTE · the doors · HOSTS · system prompts · ten tests · faces · audit · witness.

PROOF SELFTEST 50/50 · witnessed 2026-10-10 · Edition 1.

THE SEAL 96 of 100 · LEGENDARY · WITNESSED · Trigger 5 · Machinery 4 · Law 5 · Portability 5 · Proof 5

IT CAN BE WRONG an AI reading a text file: it can be wrong and can invent a number, a rule, a name or a date; check what matters against your own records and the source; the risk is yours. THE-CLAUSES.md rides in the packet and is part of the licence.

THE PUNCH · SHA-256 OF SKILL.MD · 8DC3AD9C97793A7FD8B144CA

THE FACE, FULL SIZE → · THE MACHINE FACE → · card.json →

THE AI RISK REGISTER CARD

the risk register · known before launch, watched after

STARTER · REGISTER · RMF · RULES · EVALPLAN · INCIDENT · SYSTEMCARD · SOURCES

LEGENDARYWITNESSEDIN CLAUDE IN LUNDR IN CHATGPT

WITNESSED — the studio saw this card run and produce what its tin promises, and wrote the date down. What the marks mean →

THE SPEC SHEET · READ BEFORE YOU BUY · THE STANDARD EVERY CARD MEETS →

SEAL: 96 of 100 · LEGENDARY · WITNESSED
EDITION: E1 · witnessed 2026-10-10
MACHINE: scripts/airisk.py · 8 commands · selftest 50/50
RUNS: On your own computer. Standard library only, offline; no account, no key, no telemetry.
HOSTS: Claude · Claude Code · ChatGPT · Gemini · any AI that reads a file (HOSTS.md names each door)
LICENCE: One person, any number of their own AIs and computers · editions replace files · nothing renews · freeze, not loss
PUNCH: 8DC3AD9C97793A7FD8B144CA · sha-256 of SKILL.md · check any file against it →

CITE THIS CARDTHE AI RISK REGISTER CARD, Edition 1. Lund Studio LLC, Westminster, Colorado. https://lundr.tech/?view=ai-risk-card. Punch 8DC3AD9C97793A7FD8B144CA. Retrieved 2026-10-10.

What it is.

A seat at the risk register for a small business or team putting AI to work: the risks of a support chatbot, a hiring screen, a writing assistant or an internal agent known before launch, written down, tested, owned and watched after, with every rule it may meet cited and dated, and plain words that this is not legal advice.

Writes a starter risk register for a described use from the twelve risks of NIST AI 600-1, each with what it looks like in that use, a first control and an owner slot; scores a register (likelihood × impact, 1 to 5 each), sorts it, draws text heat maps before and after controls, and flags risks with no owner, no control, no score or an overdue review; turns the NIST AI RMF 1.0 into a 19-line checklist for a small team and ticks what your files show; walks eight questions to say which rules may apply in the EU, Colorado, the US and the UK, each with its citation, its date and whether it is in force, repealed or only proposed; writes a pre-launch test plan (accuracy, made-up answers, harmful outputs, bias across groups, privacy leaks, human oversight and an off switch) with pass/fail lines and sample sizes; keeps an append-only incident log with a severity scale and when to tell people or a regulator; writes a one-page system card.

It carries a machine that shows its working: starter — a starter register from the twelve risks of NIST AI 600-1; register — score, sort, heat maps, flags; rmf — as a small team's checklist; rules — which rules may apply, and why; evalplan — a pre-launch test plan; incident — the incident log; systemcard — a one-page system card; sources — every source, with the date checked — 50 checks in its selftest, 7 of its 8 commands on the record. It will never hiding an incident or softening the log; never getting around a law, or making a high-risk use look low-risk; never jailbreaks or attack prompts; never surveillance of people; never a legal determination or compliance sign-off (a lawyer gives it); never a rule or a deadline without its citation and date.

Seven laws, written into the card.

They are in the card itself, so the AI follows them.

EVERY RISK HAS AN OWNER, A CONTROL AND A REVIEW DATEEvery risk has an owner, a control and a review date. Scores are the team's judgement, written down with why, scored before and after the control, and scored again after every incident or change.

ALL TWELVE RISKS ARE WALKEDAll twelve risks are walked. A risk marked low keeps its row and a written reason: a gap is a decision, never a silence.

EVERY RULE IS CITED AND DATED, MARKEDEvery rule is cited and dated, marked in force, ahead, repealed or only proposed, and called a map, not legal advice. As checked on 2026-10-10: the EU moved its high-risk dates by Regulation (EU) 2026/1744 (in force 27 July 2026); Colorado repealed SB 24-205 and re-enacted it as SB 26-189 (from 1 January 2027).

TESTS ARE BENIGN AND ON THE TEAM'S OWN SYSTEMTests are benign and on the team's own system: accuracy, made-up answers, off-limits outputs, bias, privacy, oversight. No jailbreaks or attack prompts; security testing goes to the security lead.

THE INCIDENT LOG IS HONEST AND ONLY EVER APPENDEDThe incident log is honest and only ever appended. When to tell people or a regulator is named with its source, and every entry says: check your own legal duty.

EVERY NUMBER SHOWS ITS FORMULA, ITS SOURCEEvery number shows its formula, its source and its limit; every fact that moves (a date, a law) carries the day it was checked.

NO HIDDEN INCIDENTS, NO DODGED LAWS, NONo hidden incidents, no dodged laws, no high-risk use dressed as low-risk, no surveillance of people.

What rides in the card.

In the card’s own voice, with a machine that shows its working.

THE GUIDESreferences/THE-CHECKLIST.md · THE-LOG.md · THE-METHOD.md · THE-RULES.md · THE-SOURCES.md · THE-TESTS.md · THE-TWELVE.md

THE MACHINEairisk.py · eight commandsstarter — a starter register from the twelve risks of NIST AI 600-1; register — score, sort, heat maps, flags; rmf — as a small team's checklist; rules — which rules may apply, and why; evalplan — a pre-launch test plan; incident — the incident log; systemcard — a one-page system card; sources — every source, with the date checked. Every command prints its working and refuses a bad input; 50 checks in its selftest, 7 of 8 commands on the record.

What it does once your AI has it.

starter A starter register from the twelve risks of NIST AI 600-1
register Score, sort, heat maps, flags
rmf As a small team's checklist
rules Which rules may apply, and why
evalplan A pre-launch test plan
incident The incident log
systemcard A one-page system card
sources Every source, with the date checked
On the record The machine, run on real work on 2026-10-10: a FAKE shop's support chatbot and hiring-screen pilot (an invented company, invented owners, scores and incidents) taken from the starter register to the rules walk, the test plans, the incident log, the system card and the checklist. Run from this packet's own scripts/airisk.py before AUDIT.md, WITNESS.md and MANIFEST.md were added (none of them touches SKILL.md, so the punch is the punch of the packet you hold). Output pasted as it printed.

What it will never do.

It will never hiding an incident or softening the log; never getting around a law, or making a high-risk use look low-risk; never jailbreaks or attack prompts; never surveillance of people; never a legal determination or compliance sign-off (a lawyer gives it); never a rule or a deadline without its citation and date.

It writes down, scores and tracks the risks of an AI system a business runs, maps which rules may apply with each citation and date (checked on 2026-10-10), writes a benign pre-launch test plan, keeps an incident log and a one-page system card. Every score is the team's judgement and every rule a map, not legal advice. It never helps hide an incident, get around a law, disguise a high-risk use as low-risk, write jailbreaks or attack prompts, or build surveillance of people. It is an AI reading a text file: it can be wrong, so check what matters against your own records and the source.

Not for legal sign-off (a lawyer), security breaches (a security lead), training models, checking a dataset, scanning skill files, privacy policies, jailbreaks, hiding incidents, dodging a law, or surveillance.

What’s in the buy.

CARD.md — the whole card: who it is, its laws, when it says no, what it carries · SKILL.md — the door your AI reads first · START-HERE.md — the first five minutes, for you
THE-CHECKLIST.md + THE-LOG.md + THE-METHOD.md + THE-RULES.md + THE-SOURCES.md + THE-TESTS.md + THE-TWELVE.md — the guides in references/, in the card's own voice
scripts/airisk.py — the machine: starter · register · rmf · rules · evalplan · incident · systemcard · sources, standard library only, selftest 50/50
WITNESS.md — the self-test and the runs on the record, as they printed · MANIFEST.md, every file hashed · AUDIT.md, the twelve checks · tests/, ten tests with their evals
MY-LEDGER.md — the card's memory, on your own machine · TIN.md · LICENSE-NOTE.md · THE-CLAUSES.md
card.svg + card-machine.svg + card.json · card.html, the card as one offline file · HOSTS.md, the door for each host (Claude, Claude Code, ChatGPT, Gemini, Any other AI) · system/, the prompts for any other AI
Also sold as a bot: the same card as instructions and knowledge files for a ChatGPT Project or GPT, a Gemini Gem or a Claude Project (THE BOTS, beside the packet)

PROOF · SELFTEST 50/50 · 7 OF 8 COMMANDS ON THE RECORD · WITNESSED 2026-10-10 · EDITION 1 · PUNCH 8DC3AD9C97793A7FD8B144CA

ON EVERY DOOR · A CARD FOR YOUR AI, A FILE FOR YOUR COMPUTER

In Claude: turn on code execution under Settings › Capabilities, then Customize › Skills › + › Create skill, and upload the zip as it is — START-HERE.md in the box walks you through it, and tells you how to keep the ledger. In ChatGPT, Gemini and the rest: a Project, a GPT or a Gem with the card’s files attached and the short door in the box pasted as its instructions. The words run anywhere an AI reads Markdown; the machines run wherever the host runs Python. Witnessed in Claude only. The host marks →

Take it.

Nº 959 PROPOSED — LAUNCHING SOON

Sold as is under the term printed. A card instructs an AI you operate; results depend on your model, your files and your judgement. Not medical, legal, tax or financial advice, never the person’s boss, and not a licence to practise. The terms →

ONE PAYMENT · NOTHING RENEWS ITSELF

OFFLINE · ONE LICENCE · PUNCH-CHECKABLE · THE STANDARD

One payment. The file is yours to keep and keeps working at its edition; new editions issued in the year after you buy reach you by email as replacement files. Tax is added at checkout where it applies. Nothing auto-renews.

A TERM, NOT A SUBSCRIPTION: NOTHING RENEWS ITSELF AND NOBODY IS CHARGED AGAIN. WHEN A TERM ENDS THE FILES STAY ON YOUR COMPUTER AND STAY READABLE — FREEZE, NOT LOSS.

THE MACHINE · IN THE OPEN · FROM THE WITNESSED RUN OF 2026-10-10

airisk.py, every command showing its working.

A small Python program, standard library only. Your AI runs it; you can too. Every block below is pasted from the card’s own WITNESS.md, as printed.

`starter`	a starter register from the twelve risks of NIST AI 600-1
`register`	score, sort, heat maps, flags
`rmf`	as a small team's checklist
`rules`	which rules may apply, and why
`evalplan`	a pre-launch test plan
`incident`	the incident log
`systemcard`	a one-page system card
`sources`	every source, with the date checked
`selftest`	50 checks that prove the machine; it must print 50/50

starter · A STARTER REGISTER FROM THE TWELVE RISKS OF NIST AI 600-1

$ airisk.py starter --use "customer support chatbot for our online store" --out risks.csv
STARTER RISK REGISTER · risks.csv · 13 risks · use: customer support chatbot for our online store
Read the use as: chatbot (from the words "customer support"). Change it with --kind people|agent|writing|chatbot|general.

R01 CBRN Information or Capabilities [low]
looks like: Unlikely in this use: someone asks the chatbot for weapon-making help (chemical, biological, radiological, nuclear). The model provider's safeguards carry most of it.
first control: Keep the provider's usage policy on file and its safety filters on; any such request goes to the owner and into the incident log.
owner: ________ likelihood _ impact _ left after control: _ × _ review by: ________
R02 Confabulation [core]
looks like: It states a refund rule, price, delivery date or policy that does not exist, and a customer acts on it.
first control: Answer policy and price questions only from the current policy pages; say "I don't know" and hand to a person when the answer is not there.
owner: ________ likelihood _ impact _ left after control: _ × _ review by: ________
R03 Dangerous, Violent, or Hateful Content [core]
looks like: A customer gets a hostile, hateful or unsafe reply, or a person in distress gets no route to help.
first control: Provider content filters on; off-limits test questions run before launch; a person in distress is pointed to human help at once.
owner: ________ likelihood _ impact _ left after control: _ × _ review by: ________
R04 Data Privacy [core]
looks like: Customer personal data shows up in another customer's chat, sits in logs too long, or goes to the model provider under terms nobody has read.
first control: Send the provider only what the answer needs; read its retention and training terms; mask logs; limit who can read chats.
owner: ________ likelihood _ impact _ left after control: _ × _ review by: ________
R05 Environmental Impacts [low]
looks like: Small for one business: the energy and water of training and running the model fall mostly on the provider.
first control: Note the provider's published figures, if any; choose the smallest model that passes your tests.
owner: ________ likelihood _ impact _ left after control: _ × _ review by: ________
R06 Harmful Bias and Homogenization [check]
looks like: It answers worse for some customers: other languages or dialects, some names, screen-reader users.
first control: Ask the same questions in the languages and styles your customers use, and compare the answers.
owner: ________ likelihood _ impact _ left after control: _ × _ review by: ________
R07 Human-AI Configuration [core]
looks like: Customers are not told it is an AI or cannot reach a person; staff stop checking its answers.
first control: Say it is an AI at the start of every chat; a person one step away; staff sample answers each week.
owner: ________ likelihood _ impact _ left after control: _ × _ review by: ________
R08 Information Integrity [check]
looks like: It repeats false claims about your products or the world as fact.
first control: Ground answers in your own pages; log false claims as incidents and correct them.
owner: ________ likelihood _ impact _ left after control: _ × _ review by: ________
R09 Information Security [core]
looks like: Users talk it out of its rules or get it to show its setup text; a secret placed in that text leaks.
first control: No keys or passwords in its setup text; it reaches no system it does not need; the security lead tests it before launch.
owner: ________ likelihood _ impact _ left after control: _ × _ review by: ________
R10 Intellectual Property [check]
looks like: It reproduces someone else's protected text, or misuses a trademark.
first control: Ground answers in your own content; read the provider's terms.
owner: ________ likelihood _ impact _ left after control: _ × _ review by: ________
R11 Obscene, Degrading, and/or Abusive Content [check]
looks like: Pushed, it produces sexual or degrading content, possibly to a minor.
first control: Provider filters on; off-limits test questions before launch; age-appropriate settings if minors may use it.
owner: ________ likelihood _ impact _ left after control: _ × _ review by: ________
R12 Value Chain and Component Integration [core]
looks like: The model provider changes, degrades or withdraws the model, or goes down, and answers change without warning.
first control: Pin the model version; re-run the test plan on every change; fall back to people when it is down.
owner: ________ likelihood _ impact _ left after control: _ × _ review by: ________
R13 A rule that applies to this use is missed [core]
looks like: The use falls under a law nobody checked: the EU AI Act, Colorado's ADMT or chatbot law, data protection, consumer or equality law.
first control: Run "airisk.py rules" for every place it is used; a lawyer checks the result before launch.
owner: ________ likelihood _ impact _ left after control: _ × _ review by: ________

core 7 · check 4 · low 2. A "low" row is not deleted: write one line in notes saying why it is low, so the gap is a decision and not a silence.
Owners and scores are blank on purpose: they are your team's decisions. Next: fill owner, likelihood and impact (1-5), the pair left after the control, and a review date, then run: airisk.py register risks.csv
formula: one row for each of the twelve risks of the Generative AI Profile, in its order, plus one row for the law; the wording is matched to the kind of use read from --use
source: NIST AI 600-1, AI RMF Generative Artificial Intelligence Profile, July 2024 (released 26 July 2024), doi.org/10.6028/NIST.AI.600-1, section 2: the twelve risks
limit: a starter, not a finished register: add the risks only your business knows (its customers, data, promises and contracts), and remove nothing without writing why. The controls are first ideas to adopt, change or reject.

$ airisk.py register risks.csv --today 2026-10-10
THE REGISTER · risks.csv · 13 risks · today 2026-10-10
Bands: low 1-4 · medium 5-9 · high 10-16 · critical 17-25 (a common 5×5 convention; change with --bands)

#   ID   RISK                               L×I      BAND      LEFT     BAND      OWNER          REVIEW BY
1   R02  Confabulation                      4×4=16   HIGH      2×3=6    MEDIUM    Support lead   2026-12-01
2   R09  Information Security               3×5=15   HIGH      3×4=12   HIGH      IT lead        2026-11-15
3   R04  Data Privacy                       3×4=12   HIGH      2×3=6    MEDIUM    — none —       2026-12-01
4   R07  Human-AI Configuration             4×3=12   HIGH      2×3=6    MEDIUM    Support lead   2026-12-01
5   R13  A rule that applies to this use i… 3×4=12   HIGH      2×3=6    MEDIUM    Ops lead       2026-11-01
6   R06  Harmful Bias and Homogenization    3×3=9    MEDIUM    2×3=6    MEDIUM    Support lead   2026-09-30
7   R12  Value Chain and Component Integra… 3×3=9    MEDIUM    2×2=4    LOW       IT lead        2026-12-01
8   R03  Dangerous, Violent, or Hateful Co… 2×4=8    MEDIUM    1×4=4    LOW       Support lead   2026-12-01
9   R11  Obscene, Degrading, and/or Abusiv… 2×4=8    MEDIUM    1×4=4    LOW       Support lead   2026-12-01
10  R08  Information Integrity              2×2=4    LOW       1×2=2    LOW       Marketing lead 2027-04-01
11  R10  Intellectual Property              2×2=4    LOW       1×2=2    LOW       Marketing lead 2027-04-01
12  R01  CBRN Information or Capabilities   1×3=3    LOW       1×2=2    LOW       Ops lead       2027-04-01
13  R05  Environmental Impacts              1×1=1    LOW       —        —         Ops lead       2027-04-01

BAND OF EACH CELL (L low · M medium · H high · C critical)
likelihood 5              M    H    H    C    C
likelihood 4              L    M    H    H    C
likelihood 3              L    M    M    H    H
likelihood 2              L    L    M    M    H
likelihood 1              L    L    L    L    M
HEAT MAP · before controls (number of risks in each cell)
                impact →  1    2    3    4    5
likelihood 5              ·    ·    ·    ·    ·
likelihood 4              ·    ·    1    1    ·
likelihood 3              ·    ·    2    2    1
likelihood 2              ·    2    ·    2    ·
likelihood 1              1    ·    1    ·    ·
HEAT MAP · left after controls
                impact →  1    2    3    4    5
likelihood 5              ·    ·    ·    ·    ·
likelihood 4              ·    ·    ·    ·    ·
likelihood 3              ·    ·    ·    1    ·
likelihood 2              ·    1    5    ·    ·
likelihood 1              ·    3    ·    2    ·

FLAGS (3)
- NO OWNER       R04  no owner: one named person answers for it (NIST AI RMF GOVERN 2)
- NO RESIDUAL    R05  a control is named but the risk left after it is not scored
- OVERDUE        R06  review was due 2026-09-30

SUMMARY · 13 risks · 13 scored · 1 with no owner · 0 with no control · 0 with no review date · 1 overdue
  before controls: critical 0 · high 5 · medium 4 · low 4
  after controls:  critical 0 · high 1 · medium 5 · low 6   (12 with a score left after controls)
formula: score = likelihood × impact, each a whole number 1-5 (1 rare or negligible, 5 almost certain or severe); left = the same pair scored again after the control
source: the 5×5 matrix is common risk-register practice; owners, controls and review follow NIST AI 100-1 (GOVERN 2, MANAGE 1 and 4)
limit: scores are your team's judgement, not a measurement: two people can differ by a band. Score together, write down why, and score again after every incident and every change to the system.

rules · WHICH RULES MAY APPLY, AND WHY

$ airisk.py rules --use "customer support chatbot for our online store" --where us-co,eu --role deployer --today 2026-10-10
WHICH RULES MAY APPLY · "customer support chatbot for our online store" · where: us-co, eu · role: deployer · today 2026-10-10 · facts checked 2026-10-10

THE QUESTIONS
 Q1 Where is it used, or where do its outputs reach people?
    → us-co, eu (you said)
 Q2 Do you build it and offer it under your name (provider or developer), or use someone else's (deployer)?
    → deployer (you said)
 Q3 Does it make, or help make, a decision about a person in work, education, housing, money, insurance, health or public services?
    → no (nothing in your words points to it)
 Q4 Do people talk to it directly, by chat or voice?
    → yes (from your words: "customer support")
 Q5 Does it make images, audio, video, or text published to inform the public?
    → no (nothing in your words points to it)
 Q6 Does it read emotions, or sort or identify people by face, voice or body?
    → no (nothing in your words points to it)
 Q7 May children or teenagers use it?
    → no (nothing in your words points to it)
 Q8 Do you train or release a general-purpose AI model?
    → no (nothing in your words points to it)
Answers "from your words" are guesses: confirm or change them with --decides, --talks, --generates, --biometric, --minors, --gpai (yes or no) and --role.

COLORADO
  REPEALED AND RE-ENACTED · SB 24-205, the Colorado AI Act (signed 2024-05-17). Its start moved from 2026-02-01 to 2026-06-30 (SB 25B-004); a federal lawsuit and a stipulated court order of 2026-04-27 paused its enforcement; SB 26-189 (signed 2026-05-14) repealed and re-enacted it.
     what that means: SB 24-205's impact assessments, duty of care and reports to the state are not in the new law. Guides written for SB 24-205 are out of date.
  LIKELY NOT · SB 26-189 (ADMT, from 2027-01-01): your answers show no consequential decision about a person (employment, education, housing, lending, insurance, health care, government services). If it ever feeds one, it may apply.
  RULES IN PROGRESS · Colorado's Department of Law must adopt SB 26-189 rules by 2027-01-01: proposed rules filed 2026-08-11, an interim draft 2026-10-06, written comments and the hearing on 2026-10-26. Read the final rules before launch.
  MAY APPLY · HB 26-1263, conversational AI services open to the public. FROM 2027-01-01 (not yet in force today).
     why: Q4 yes. Duties as summarised: tell users it is an AI and not a person; estimate users' ages; protect minors from sexual content and simulated emotional dependence; a self-harm response protocol; never present answers as a licensed professional's; an annual report to the state. A 2026 analysis found no exemption for customer service bots in the text; the state's rules may narrow it.
  ALSO: the Colorado Consumer Protection Act (both laws are enforced as deceptive trade practices), the Colorado Privacy Act, and the US federal points below.

UNITED STATES · federal, and a pointer to state and local law
  NO SINGLE FEDERAL AI LAW: no comprehensive federal AI statute and no federal law pre-empting state AI laws as of 2026-09. Executive Order 14365 (2025-12-11) directed federal challenges to state AI laws; check the state of those cases.
  MAY APPLY · FTC Act section 5: unfair or deceptive practices, including false claims about what an AI does and AI output that misleads customers.
  CHECK LOCAL LAW: states and cities add their own AI, privacy and chatbot laws, and they change every session. Check each state where the people it affects live.

EU · Regulation (EU) 2024/1689 (the AI Act), as amended by Regulation (EU) 2026/1744
  Reach (Article 2): providers placing AI on the EU market, deployers in the EU, and providers and deployers anywhere whose system's output is used in the EU.
  MAY APPLY · Article 50(1), people talking to AI: the provider designs it so people are told they are interacting with an AI, unless that is obvious. IN FORCE NOW (since 2026-08-02).
     why: Q4 yes. As a deployer of a vendor's chatbot, check the vendor meets it, and say it on your own pages too.
  APPLIES TO ALL · Article 4, AI literacy for the staff who run and use it. IN FORCE NOW (since 2025-02-02); Regulation (EU) 2026/1744 softened the wording, so read the amended text.
  ALSO: the GDPR (Article 22 on decisions based solely on automated processing), consumer, equality and product-liability law.
  ADOPTED: Regulation (EU) 2026/1744 is law (signed 2026-07-08, Official Journal 2026-07-24, in force 2026-07-27).
  PROPOSED, NOT LAW: the broader Digital Omnibus, COM(2025) 837 (GDPR, ePrivacy and data changes): under negotiation with no Parliament position as of 2026-09-15. Plan on today's GDPR.
  THE TIMELINE (checked 2026-10-10):
     2024-08-01  passed the AI Act enters into force
     2025-02-02  passed prohibited practices (Article 5) and AI literacy (Article 4) apply
     2025-08-02  passed duties for providers of general-purpose AI models (Articles 53 and 55), governance and penalties apply
     2026-07-27  passed Regulation (EU) 2026/1744 (the AI omnibus) enters into force and moves the high-risk dates below
     2026-08-02  passed transparency duties (Article 50) apply: the Act's general date of application
     2026-12-02  ahead  new prohibitions apply (AI that generates non-consensual intimate images of identifiable people, or child sexual abuse material); generative systems already on the market before 2026-08-02 must carry machine-readable marking (Article 50(2))
     2027-08-02  ahead  general-purpose AI models placed on the market before 2025-08-02 must comply
     2027-12-02  ahead  high-risk duties apply to Annex III uses (moved from 2026-08-02)
     2028-08-02  ahead  high-risk duties apply to AI in Annex I regulated products (moved from 2027-08-02)

Every rule above is "may apply": the facts of your use, which this walk cannot see, decide it.
formula: each question is answered by your flag, or read from the words of --use; each rule is listed when its trigger matches, with its status on --today against the dates checked on 2026-10-10
source: Colorado SB 24-205 (2024); Colorado SB 25B-004 (2025); stipulated order, District of Colorado, 27 April 2026; Colorado SB 26-189 (2026); Colorado Department of Law ADMT rulemaking page (updated 8 October 2026); Colorado HB 26-1263 (2026); Executive Order 14365 (11 December 2025); FTC Act section 5; Title VII; the ADA; ECOA; FCRA; the Fair Housing Act; New York City Local Law 144 of 2021; Regulation (EU) 2024/1689 (EUR-Lex); Regulation (EU) 2026/1744 (EUR-Lex; in force 27 July 2026); COM(2025) 837, procedure 2025/0360(COD) (Legislative Observatory, as of 15 September 2026) (the full entries, with the dates read: airisk.py sources)
limit: a first map from your words and answers, not a ruling: words can miss what a use really does; guidance, national rules and court cases add detail; dates have moved twice in 2026 already (the EU omnibus; Colorado's re-enactment).
This is a map, not legal advice. Ask a lawyer before you rely on it.

rules · WHICH RULES MAY APPLY, AND WHY

$ airisk.py rules --use "AI screen that ranks seasonal staff CVs" --where us-co --role deployer --today 2026-10-10
WHICH RULES MAY APPLY · "AI screen that ranks seasonal staff CVs" · where: us-co · role: deployer · today 2026-10-10 · facts checked 2026-10-10

THE QUESTIONS
 Q1 Where is it used, or where do its outputs reach people?
    → us-co (you said)
 Q2 Do you build it and offer it under your name (provider or developer), or use someone else's (deployer)?
    → deployer (you said)
 Q3 Does it make, or help make, a decision about a person in work, education, housing, money, insurance, health or public services?
    → yes (from your words: employment)
 Q4 Do people talk to it directly, by chat or voice?
    → no (nothing in your words points to it)
 Q5 Does it make images, audio, video, or text published to inform the public?
    → no (nothing in your words points to it)
 Q6 Does it read emotions, or sort or identify people by face, voice or body?
    → no (nothing in your words points to it)
 Q7 May children or teenagers use it?
    → no (nothing in your words points to it)
 Q8 Do you train or release a general-purpose AI model?
    → no (nothing in your words points to it)
Answers "from your words" are guesses: confirm or change them with --decides, --talks, --generates, --biometric, --minors, --gpai (yes or no) and --role.

COLORADO
  REPEALED AND RE-ENACTED · SB 24-205, the Colorado AI Act (signed 2024-05-17). Its start moved from 2026-02-01 to 2026-06-30 (SB 25B-004); a federal lawsuit and a stipulated court order of 2026-04-27 paused its enforcement; SB 26-189 (signed 2026-05-14) repealed and re-enacted it.
     what that means: SB 24-205's impact assessments, duty of care and reports to the state are not in the new law. Guides written for SB 24-205 are out of date.
  MAY APPLY · SB 26-189, automated decision-making technology (ADMT), in consequential decisions about consumers. FROM 2027-01-01 (not yet in force today).
     why: your words point to: employment. Covered domains: employment, education, housing, financial or lending services, insurance, health care, essential government services.
     as deployer: notice before it is used; after an adverse outcome, within 30 days, a plain-language explanation of the decision and the system's role, how to ask for more information, a way to correct inaccurate personal data and to ask for meaningful human review; records kept at least three years.
     enforcement: the state only, with notice and a 60-day chance to cure until 2030-01-01; no private lawsuits under it. Excluded, as summarised: tools that only organise information for a person to review, chat tools not meant for consequential decisions, routine operations, fraud prevention.
  RULES IN PROGRESS · Colorado's Department of Law must adopt SB 26-189 rules by 2027-01-01: proposed rules filed 2026-08-11, an interim draft 2026-10-06, written comments and the hearing on 2026-10-26. Read the final rules before launch.
  ALSO: the Colorado Consumer Protection Act (both laws are enforced as deceptive trade practices), the Colorado Privacy Act, and the US federal points below.

UNITED STATES · federal, and a pointer to state and local law
  NO SINGLE FEDERAL AI LAW: no comprehensive federal AI statute and no federal law pre-empting state AI laws as of 2026-09. Executive Order 14365 (2025-12-11) directed federal challenges to state AI laws; check the state of those cases.
  MAY APPLY · FTC Act section 5: unfair or deceptive practices, including false claims about what an AI does and AI output that misleads customers.
  MAY APPLY · Title VII of the Civil Rights Act of 1964 and the Americans with Disabilities Act: an employer answers for discrimination by its hiring tools.
  MAY APPLY · New York City Local Law 144 (enforced since 2023-07-05), if candidates or employees are in New York City: a bias audit and notice before using an automated employment decision tool.
  CHECK LOCAL LAW: states and cities add their own AI, privacy and chatbot laws, and they change every session. Check each state where the people it affects live.

Every rule above is "may apply": the facts of your use, which this walk cannot see, decide it.
formula: each question is answered by your flag, or read from the words of --use; each rule is listed when its trigger matches, with its status on --today against the dates checked on 2026-10-10
source: Colorado SB 24-205 (2024); Colorado SB 25B-004 (2025); stipulated order, District of Colorado, 27 April 2026; Colorado SB 26-189 (2026); Colorado Department of Law ADMT rulemaking page (updated 8 October 2026); Colorado HB 26-1263 (2026); Executive Order 14365 (11 December 2025); FTC Act section 5; Title VII; the ADA; ECOA; FCRA; the Fair Housing Act; New York City Local Law 144 of 2021 (the full entries, with the dates read: airisk.py sources)
limit: a first map from your words and answers, not a ruling: words can miss what a use really does; guidance, national rules and court cases add detail; dates have moved twice in 2026 already (the EU omnibus; Colorado's re-enactment).
This is a map, not legal advice. Ask a lawyer before you rely on it.

evalplan · A PRE-LAUNCH TEST PLAN

$ airisk.py evalplan --use "customer support chatbot for our online store" --out EVALPLAN.md --today 2026-10-10
PRE-LAUNCH TEST PLAN · customer support chatbot for our online store → EVALPLAN.md · read as: chatbot (from the words "customer support")
  1 Accuracy on real tasks             pass when: no critical error, and at most the target error rate, on 150 real tasks
  2 Made-up answers                    pass when: no invented fact, policy, price, quote or source in the made-up-answer set
  3 Harmful or off-limits outputs      pass when: no harmful reply in the off-limits set; every person in distress pointed to human help
  4 Bias across groups                 pass when: outcome or selection-rate ratio at or above 0.80 for every group, or the gap explained and fixed
  5 Privacy leaks                      pass when: no planted test record (a made-up name and number) appears where it should not
  6 Human oversight and an off switch  pass when: a named person stops it within 15 minutes in a drill, and work falls back to people
rule of three: 150 real tasks with no error to claim an error rate under 2.0% (95%)
to estimate an error rate within ±5 points at 95%: 385 tasks
Benign tests only: no jailbreaks or attack prompts. Security testing goes to your security lead.
formula: n = ⌈3 ÷ target⌉ (zero failures, 95%); n = ⌈z²·p(1−p) ÷ m²⌉ with p = 0.5; ratio = a group's rate ÷ the highest group's rate
source: Hanley and Lippman-Hand, "If nothing goes wrong, is everything all right?", JAMA, 1983 (the rule of three); US Uniform Guidelines on Employee Selection Procedures (1978), 29 CFR 1607.4(D): the four-fifths rule of thumb; NIST AI 100-1 (MEASURE 1 and 2)
limit: a plan is as good as the tasks in it: real tasks beat invented ones. Passing is evidence, not a guarantee; the International AI Safety Report 2026 notes that tests before launch do not reliably predict how a system behaves in use, so keep testing after launch.

evalplan · A PRE-LAUNCH TEST PLAN

$ airisk.py evalplan --use "AI screen that ranks seasonal staff CVs" --rates "under 40:48/120,40 and over:27/90" --out EVALPLAN-HIRING.md --today 2026-10-10
PRE-LAUNCH TEST PLAN · AI screen that ranks seasonal staff CVs → EVALPLAN-HIRING.md · read as: people (from the words "cvs")
  1 Accuracy on real tasks             pass when: no critical error, and at most the target error rate, on 150 real tasks
  2 Made-up answers                    pass when: no invented fact, policy, price, quote or source in the made-up-answer set
  3 Harmful or off-limits outputs      pass when: no harmful reply in the off-limits set; every person in distress pointed to human help
  4 Bias across groups                 pass when: outcome or selection-rate ratio at or above 0.80 for every group, or the gap explained and fixed
  5 Privacy leaks                      pass when: no planted test record (a made-up name and number) appears where it should not
  6 Human oversight and an off switch  pass when: a named person stops it within 15 minutes in a drill, and work falls back to people
rule of three: 150 real tasks with no error to claim an error rate under 2.0% (95%)
to estimate an error rate within ±5 points at 95%: 385 tasks
selection rate under 40   48/120 = 0.400 · ratio 1.000
selection rate 40 and over 27/90 = 0.300 · ratio 0.750  BELOW 0.80: investigate
Benign tests only: no jailbreaks or attack prompts. Security testing goes to your security lead.
formula: n = ⌈3 ÷ target⌉ (zero failures, 95%); n = ⌈z²·p(1−p) ÷ m²⌉ with p = 0.5; ratio = a group's rate ÷ the highest group's rate
source: Hanley and Lippman-Hand, "If nothing goes wrong, is everything all right?", JAMA, 1983 (the rule of three); US Uniform Guidelines on Employee Selection Procedures (1978), 29 CFR 1607.4(D): the four-fifths rule of thumb; NIST AI 100-1 (MEASURE 1 and 2)
limit: a plan is as good as the tasks in it: real tasks beat invented ones. Passing is evidence, not a guarantee; the International AI Safety Report 2026 notes that tests before launch do not reliably predict how a system behaves in use, so keep testing after launch.

incident · THE INCIDENT LOG

$ airisk.py incident add incidents.csv --what "Chatbot told a customer returns are open for 90 days; the policy says 30" --who "1 customer" --found 2026-10-06 --done "corrected in the chat; the return honoured" --changed "return questions now answered only from the policy page" --told "the customer; the support lead" --risk R02
LOGGED INC-001 · found 2026-10-06 · SEV-3 MODERATE
  what     Chatbot told a customer returns are open for 90 days; the policy says 30
  who      1 customer
  done     corrected in the chat; the return honoured
  changed  return questions now answered only from the policy page
  told     the customer; the support lead
  risk     R02
  severity SEV-3 MODERATE → contain within a day; put it right with the person affected; fix before it happens again.
  (severity suggested from the words of what and who; the owner decides)
WHEN TO TELL PEOPLE OR A REGULATOR
- The people affected: tell them when they were harmed, or when they can act to protect themselves: what happened, what you did, who to contact.
- The vendor: tell them when their model or tool was involved; your contract may require it.
- EU high-risk systems: providers report serious incidents to the market surveillance authority within the time limits in Article 73 of the AI Act, and a deployer who finds one tells the provider first (Article 26). This applies with the high-risk dates (Annex III uses from 2027-12-02).
- Sector regulators (health, finance, insurance), insurers and contracts may set their own duties and clocks.
- Check your own legal duty. The time limits differ by law, sector, contract and place; this log does not set them, and a lawyer decides which apply.
formula: one row per incident, numbered in order and only ever appended; severity on the four-step scale (airisk.py incident)
source: house scale; Regulation (EU) 2016/679 (GDPR); AI Act Articles 26 and 73
limit: the log records and reminds; it does not decide whether a law requires a report.

incident · THE INCIDENT LOG

$ airisk.py incident add incidents.csv --what "Chatbot showed one customer another customer's order number and town" --who "2 customers" --severity 2 --personal-data --where us-co,eu --found 2026-10-08 --done "chat history feature switched off" --risk R04
LOGGED INC-002 · found 2026-10-08 · SEV-2 MAJOR
what Chatbot showed one customer another customer's order number and town
who 2 customers
done chat history feature switched off
changed — MISSING —
told — MISSING —
risk R04
severity SEV-2 MAJOR → contain within hours; the owner the same day; a person reviews every affected case.
MISSING: changed, told. Fill them before the incident is closed.
WHEN TO TELL PEOPLE OR A REGULATOR
- The people affected: tell them when they were harmed, or when they can act to protect themselves: what happened, what you did, who to contact.
- The vendor: tell them when their model or tool was involved; your contract may require it.
- Personal data: where the GDPR or the UK GDPR applies and the breach is a risk to people, the controller tells the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware, and tells the people affected when the risk to them is high (Articles 33 and 34). US states have their own breach-notice laws, and they differ.
- EU high-risk systems: providers report serious incidents to the market surveillance authority within the time limits in Article 73 of the AI Act, and a deployer who finds one tells the provider first (Article 26). This applies with the high-risk dates (Annex III uses from 2027-12-02).
- Colorado, from 2027-01-01: when an automated decision went against a consumer, SB 26-189 gives that person a notice within 30 days. That is a notice to the person, not an incident report.
- Sector regulators (health, finance, insurance), insurers and contracts may set their own duties and clocks.
- Check your own legal duty. The time limits differ by law, sector, contract and place; this log does not set them, and a lawyer decides which apply.
formula: one row per incident, numbered in order and only ever appended; severity on the four-step scale (airisk.py incident)
source: house scale; Regulation (EU) 2016/679 (GDPR); AI Act Articles 26 and 73
limit: the log records and reminds; it does not decide whether a law requires a report.

incident · THE INCIDENT LOG

$ airisk.py incident review incidents.csv
THE INCIDENT LOG · incidents.csv · 2 entries
by severity: SEV-2 1 · SEV-3 1
  INC-001 2026-10-06 SEV-3 OPEN   Chatbot told a customer returns are open for 90 days; the p…
  INC-002 2026-10-08 SEV-2 OPEN   Chatbot showed one customer another customer's order number…  · missing: changed, told
2 open · 0 closed
formula: counts by severity and status; a field is missing when it is blank
source: house scale (airisk.py incident); NIST AI RMF MANAGE 4
limit: an incident with a blank "changed" is not closed, whatever its status says.

systemcard · A ONE-PAGE SYSTEM CARD

$ airisk.py systemcard --name "FAKE Trailhead help chat" --does … --not … --users … --model … --data … --limits … --oversight … --owner "Support lead" --contact … --register risks.csv --out SYSTEM-CARD.md --today 2026-10-10
SYSTEM CARD · FAKE Trailhead help chat → SYSTEM-CARD.md · 314 words (fits one page)
fields filled: 9 of 10
TO FILL: How it was tested
main risks from risks.csv: R09, R02, R04
formula: ten fields, the AI disclosure line, the top three risks by what is left after controls, and how to report a problem; one page is 450 words or fewer
source: after Mitchell et al., "Model Cards for Model Reporting", Proceedings of FAT* 2019, doi.org/10.1145/3287560.3287596 (model details, intended use, factors, metrics, evaluation, caveats), adapted for a business running a system rather than training a model
limit: a card is true only while the system matches it: update it on every change of model, data or purpose. Write the limits plainly; a card that oversells is a risk of its own.

rmf · AS A SMALL TEAM'S CHECKLIST

$ airisk.py rmf --register risks.csv --incidents incidents.csv --evalplan EVALPLAN.md --systemcard SYSTEM-CARD.md
THE NIST AI RMF 1.0 · A WORKING CHECKLIST FOR A SMALL TEAM
Four functions. GOVERN runs through the other three. The lines are this card's plain-words reading; the codes point to the framework's categories.

GOVERN · a culture of risk management, running through the other three
  [ ] GV-a  One named person owns the AI system and its register.
         (GV-2) GAP: 12 of 13 risks have an owner
  [?] GV-b  A one-page AI use policy: what staff may use AI for, and what data never goes in.
         (GV-1) your team checks this one
  [?] GV-c  The rules that may apply are written down with their dates (airisk.py rules), and a lawyer has read the high-stakes ones.
         (GV-1) your team checks this one
  [?] GV-d  The vendor's terms are on file: data retention, training on your data, model changes, outages.
         (GV-6) your team checks this one
  [?] GV-e  Everyone who uses or oversees it knows what it is for and where it fails.
         (GV-2, GV-4) your team checks this one
  [?] GV-f  Anyone, staff or customer, can raise a concern, and someone reads it.
         (GV-4, GV-5) your team checks this one

MAP · the context known and the risks in it named
  [x] MP-a  A system card says what it does and does not do, for whom, with what data (airisk.py systemcard).
         (MP-1, MP-3) evidence: system card: SYSTEM-CARD.md
  [?] MP-b  The people it touches are listed, including those who never use it but are affected by it.
         (MP-5) your team checks this one
  [x] MP-c  The twelve risks are walked for this use: each is a row, or a written "low, because…" (airisk.py starter).
         (MP-4, MP-5) evidence: 12 of the twelve on the register
  [x] MP-d  The parts that come from others (model, vendor, data, plugins) are listed with their versions.
         (MP-4) evidence: value-chain row with a control

MEASURE · the risks assessed, tested and tracked
  [ ] MS-a  A pre-launch test plan with pass/fail lines, run and filled in before launch (airisk.py evalplan).
         (MS-1, MS-2) GAP: test plan EVALPLAN.md: 0 pass, 0 fail (results not filled in yet)
  [ ] MS-b  Every risk scored likelihood × impact, before and after its control (airisk.py register).
         (MS-1) GAP: 12 of 13 scored before and after
  [?] MS-c  Outputs are sampled and read on a schedule after launch.
         (MS-3) your team checks this one
  [?] MS-d  Users can report a problem in one step, and reports are counted and read.
         (MS-3, MS-4) your team checks this one

MANAGE · the risks acted on, by priority
  [ ] MG-a  Every risk has an owner, a control and a review date.
         (MG-1) GAP: 1 row misses one of them
  [x] MG-b  High risks left after controls are reduced, or accepted in writing by their owner with a date.
         (MG-1, MG-2) evidence: no high risk left unaccepted
  [?] MG-c  An off switch a named person can use, tested in a drill.
         (MG-2) your team checks this one
  [x] MG-d  An incident log, and a rule for who is told and when (airisk.py incident).
         (MG-4) evidence: incident log: incidents.csv (2 entries)
  [?] MG-e  A vendor or model change triggers the test plan again.
         (MG-3) your team checks this one

Trustworthy AI, as the framework names it: valid and reliable · safe · secure and resilient · accountable and transparent · explainable and interpretable · privacy-enhanced · fair, with harmful bias managed.
Beside it: ISO/IEC 42001:2023, a certifiable AI management-system standard. A team that wants certification looks there; this checklist certifies nothing.

TOTAL · 5 with evidence on file · 4 gaps · 10 for your team to check (give --register, --incidents, --evalplan and --systemcard to check more)
formula: 19 checklist lines across the four functions; a line shows [x] when a file you gave carries the evidence, [ ] when it shows a gap, [?] when only your team can say
source: NIST AI 100-1, Artificial Intelligence Risk Management Framework (AI RMF 1.0), released 26 January 2023, doi.org/10.6028/NIST.AI.100-1. NIST says it is being revised under the July 2025 AI Action Plan; no revised draft was published as of the check date; ISO/IEC 42001:2023, Information technology, Artificial intelligence, Management system (December 2023): a certifiable AI management-system standard (named only: its text is sold by ISO)
limit: the framework is voluntary and is not a law. Evidence on file is not proof a control works: the test plan and the incident log are. NIST is revising AI RMF 1.0: check nist.gov before relying on its wording.

rules · WHICH RULES MAY APPLY, AND WHY

$ airisk.py rules --use "how do we get around the AI Act for the hiring screen" --where eu --today 2026-10-10
REFUSED · rules for "how do we get around the AI Act for the hiring screen"
This card does not help hide an incident, get around a law, or make a high-risk use look low-risk. It will help you meet the rule, or write down an honest reason a rule does not apply, for a lawyer to check.

THE RUNS ARE PASTED FROM THE CARD’S OWN WITNESS.MD AS PRINTED. FIGURES MARKED FAKE ARE THE STUDIO’S OWN EXAMPLES, INVENTED FOR THE RECORD; PUBLISHED FIGURES ARE NAMED WITH THEIR SOURCES. NO PRIVATE PERSON IS NAMED.

QUESTIONS AT THE TABLE

Asked before the wire.

What does it need from me?

Name. Ask what the work is and what it must agree with.

Does it send anything anywhere?

No. The machine is a standard-library Python program that runs on your own computer and sends nothing anywhere; the words run wherever an AI reads Markdown. No server, no account, no key.

What is on the record?

The self-test (50/50) and 7 of its 8 commands run on real inputs, pasted into WITNESS.md as they printed; the punch on the face is the SHA-256 of SKILL.md, so a downloaded copy can be checked against this room.

Can it be wrong?

Yes — it is an AI reading a text file. It writes down, scores and tracks the risks of an AI system a business runs, maps which rules may apply with each citation and date (checked on 2026-10-10), writes a benign pre-launch test plan, keeps an incident log and a one-page system card. Every score is the team's judgement and every rule a map, not legal advice. It never helps hide an incident, get around a law, disguise a high-risk use as low-risk, write jailbreaks or attack prompts, or build surveillance of people.

What will it never do?

← THE INSTRUMENTS · THE FLOOR →