What should the next regulation pack be?

[SandroHub013]

Four packs ship today: GDPR, ECOA / Reg B, EU AI Act, and the Table 7 review-paper pack. The pack format is TOML, the authoring guide is docs/authoring-packs.md, and a pack is just requirements with signal dependencies and verbatim statutory text held to the drift check.

Candidates that keep coming up:

• HIPAA (US health data)
• SR 11-7 (US model risk management, banking)
• ISO/IEC 42001 (AI management systems)
• Colorado AI Act (state-level, duties from 2026)
• something else entirely?

What would you actually run against your own decision logs? Bonus points for naming the articles that bite hardest.

[eduardstan]

This overlaps #54 almost exactly, and
#54 is the one ROADMAP.md objective 4 names as the intake for pack proposals, so I would rather
keep the answers in one place. I have posted the substantive reply there, including the candidate
that was chosen (EU AI Act Articles 53 and 55, the GPAI obligations, now under way) and where
HIPAA, SR 11-7 and ISO/IEC 42001 land against it.

Short version so this thread is not a dead end:

• ISO/IEC 42001 is ruled out by this project's own source rule — the standard is sold rather
  than published, so there is no public in-force text the monthly drift check can re-fetch.
• SR 11-7 is the most interesting of the three, because its model-validation expectations are
  real constraints rather than checklists, which is the thing the packs are short of. It is the one
  I would most like someone to take.
• HIPAA is mostly organisational duties rather than duties about a decision record.

Closing this in favour of #54. If you want to name a specific clause in any of those, that is the
thread — and the SR 11-7 offer above is genuine.

[eduardstan]

This overlaps with discussion #54, which is asking the same pack-selection question and has the fuller discussion. I’m going to keep the proposal details there so the answers do not split across two threads.

Please add your candidate and the specific clause(s) you would want checked to #54. I recommend closing this one as a duplicate, with that redirect rather than a bare close.

[eduardstan]

Closing as a duplicate of #54, which is the intake ROADMAP.md objective 4 names for pack proposals — so the answers stay in one place rather than splitting across two threads.

Nothing here is lost. The candidates raised in this thread — HIPAA, SR 11-7, ISO/IEC 42001, the Colorado AI Act — are all recorded as open proposals in #54 and remain live.

One update worth carrying across, because it changed the ordering argument: the Digital Omnibus on AI (in force 27 July 2026) deferred the AI Act's high-risk obligations to December 2027, leaving the transparency layer as the part in force today. Article 50 is covered by no shipped pack, so that is the next one, tracked in #270.

Please add further candidates, with the specific clauses you would want checked, to #54.