[{"data":1,"prerenderedAt":652},["ShallowReactive",2],{"uc-legacy-code-modernization":3,"uc-regulations":446},{"useCase":4,"evidence":193,"blitsAiDeployments":340,"benchmarks":341,"indicative":358,"related":361,"indexability":444,"includeUnpublished":199},{"title":5,"shortTitle":6,"seoTitle":7,"metaDescription":8,"status":9,"definition":10,"aliases":11,"industries":16,"functions":22,"patterns":24,"channels":28,"audience":30,"autonomy":31,"adoptionStage":32,"problem":33,"problemStats":34,"howItWorks":35,"valueDrivers":36,"kpis":41,"indicativeValue":46,"macroEstimates":81,"feasibility":82,"implementation":95,"risk":141,"blitsAi":171,"faq":173,"related":183,"datePublished":188,"dateModified":188,"lastVerified":188,"changelog":189,"slug":192},"AI for legacy code modernization","Legacy code modernization","AI for COBOL and legacy code modernization","AI explains legacy code and drafts specifications so engineers can modernize with less risk. Morgan Stanley says its tool saved about 280,000 hours in five months.","published","AI that reads legacy code such as COBOL, PL/I or old Java, explains what each program does, maps its data flows and dependencies, drafts the equivalent modern code or specification, and generates the regression tests needed to prove the new system behaves like the old one.",[12,13,14,15],"COBOL modernization with AI","mainframe modernization","legacy code translation","code migration agent",[17,18,19,20,21],"cross-industry","banking","capital-markets","automotive","technology",[23],"it-and-engineering",[25,26,27],"code-generation","summarization","agentic-workflow",[29],"internal-tools","employee-facing","copilot","early-adopters","Core systems in many large organizations still run on code written decades ago, often in COBOL or\nproprietary languages, with little documentation. The evidence on this page shows both: a global\nbank whose foundational systems were designed decades ago, at a time when COBOL talent is becoming\nscarce, and Toyota Motor Europe, whose applications in a proprietary language depend on developers\nwho are retiring. Every change is slow and risky, and a full rewrite is hard to plan because nobody\ncan say with confidence what the old system actually does.\n\nThe hard part of modernization was never typing the new code. It is comprehension (what does\nthis program do, which rules are buried in it, what depends on it) and proof (does the new\nversion behave the same on real data). Three of the four deployments on this page use AI for\ncomprehension: Morgan Stanley and Toyota Motor Europe turn code into readable specifications and\ndocumentation, and at the GFT bank AI also generated test scenarios and made the converted code more\nreadable, while deterministic tools did the conversion. Amazon went furthest, using a code\ntransformation agent to help migrate applications to a newer Java version.",[],"1. **Inventory and dependency mapping.** Tools parse the estate to find programs, copybooks,\n   jobs, data stores and the calls between them, so work can be split into modules.\n2. **Explain the code.** A model generates technical and business documentation per program:\n   what it does, its inputs and outputs, and the business rules and conditions it applies.\n3. **Review by the remaining experts.** Subject matter experts check a sample of the\n   documentation against the code and correct it. Their corrections improve the next batch.\n4. **Convert or rewrite.** Deterministic converters or engineers produce the modern code from\n   the specification, with AI assistance for readability and idiomatic structure.\n5. **Prove equivalence.** AI generates regression tests and test data from the documented rules;\n   old and new systems run in parallel on production like data until the differences are\n   explained.\n6. **Cut over in controlled steps.** Each module moves through the normal change process, with\n   traceability from the legacy module to the new service.",[37,38,39,40],"speed","cost-to-serve","risk-reduction","employee-productivity",[42,43,44,45],"hours-saved","cost-savings","productivity-gain","processing-time-reduction",{"referenceOrg":47,"inputs":48,"formula":76,"currency":77,"period":78,"resultLabel":79,"caveat":80},"A bank with 5 million lines of legacy code in scope for modernization",[49,55,62,69],{"key":50,"label":51,"low":52,"high":52,"unit":53,"note":54},"linesOfCode","Lines of legacy code in scope",5000000,"lines of code","The reference organization.",{"key":56,"label":57,"low":58,"high":59,"unit":60,"note":61},"hoursPerThousandLines","Analysis, documentation and test design hours per thousand lines, done manually",10,20,"hours per thousand lines","Editorial assumption. Replace with the estimate from your own modernization plan.",{"key":63,"label":64,"low":65,"high":66,"unit":67,"note":68},"aiReduction","Share of that effort the AI removes",0.3,0.5,"fraction of effort","Editorial assumption, conservative against the evidence on this page (Morgan Stanley reports roughly 280,000 hours saved on nine million lines, about 31 hours per thousand lines).",{"key":70,"label":71,"low":72,"high":73,"unit":74,"note":75},"hourlyCost","Blended cost of an engineering hour",80,120,"USD per hour","Editorial assumption. Replace with your own rates, including specialist contractors.","linesOfCode / 1000 * hoursPerThousandLines * aiReduction * hourlyCost","USD","over the program","Analysis and test design effort avoided","Covers comprehension, documentation and test design only. It leaves out conversion, parallel running, infrastructure and license savings after decommissioning, and the risk reduction of having documented systems, which is often the larger benefit.",[],{"complexity":83,"complexityNote":84,"dataPrerequisites":85,"integrations":90},"high","The model is rarely the hardest part. Modernization programs touch the most critical systems, need parallel running and, in regulated firms, early engagement with supervisors, and depend on experts who are scarce. AI shortens comprehension and testing; it does not remove the program.",[86,87,88,89],"Complete source code, including copybooks, job control and configuration","Access to the remaining experts for review of generated documentation","Production like test data, masked where it contains personal data","An agreed target architecture and coding standards",[91,92,93,94],"Source repositories and mainframe code management","Static analysis and dependency mapping tools","Model access in a tenant with zero retention and suitable data location","Test automation and parallel run comparison tooling",{"steps":96,"guardrails":115,"humanInTheLoop":121,"kpisToInstrument":122,"failureModes":128},[97,100,103,106,109,112],{"title":98,"detail":99},"Start with comprehension, not conversion","Pick one module and have the AI document it. Let the experts grade the documentation. This tells you quickly how reliable the model is on your code and languages.",{"title":101,"detail":102},"Split the estate into modules","Use dependency mapping to find boundaries where a module can move on its own, and sequence the program by business risk and dependency.",{"title":104,"detail":105},"Choose the conversion approach per module","Deterministic conversion keeps logic identical but produces unidiomatic code; rewriting from a specification gives better code but more risk. Many programs combine both.",{"title":107,"detail":108},"Generate and run the tests","Turn the documented rules into regression tests and compare old and new outputs on the same data. Differences are investigated, not waved through.",{"title":110,"detail":111},"Keep traceability","Link every new service back to the legacy programs and documented rules it replaces, for auditors and for the next change.",{"title":113,"detail":114},"Retire the old code","Plan decommissioning from the start. Savings only arrive when the legacy runtime is switched off.",[116,117,118,119,120],"No direct cutover from AI output; every module passes testing and parallel running","Expert review of generated documentation before it is used as a specification","Code processed only in a tenant with zero retention and agreed data location","Traceability from each legacy module to its replacement","Change approval by the owners of the business process, not only by IT","Experts validate the documentation, engineers own the new code, and business owners sign off on behavioral equivalence after parallel running. Human sign off at the cutover gate is not optional.",[123,124,125,126,127],"Documentation accuracy on expert reviewed samples","Hours per module for analysis and test design, before and after","Differences found in parallel running and their root causes","Defects after cutover per module","Legacy capacity decommissioned",[129,132,135,138],{"title":130,"detail":131},"Plausible but wrong documentation","The model describes what similar code usually does, not what this code does. Expert sampling and generated tests against real behavior catch it.",{"title":133,"detail":134},"Converting dead code","Large parts of old estates are unused. Measure what runs before converting everything.",{"title":136,"detail":137},"Losing the business rules","Rules hidden in data or job control are missed when only programs are analyzed. Include the whole runtime in scope.",{"title":139,"detail":140},"Big bang cutover","A full switch without parallel running turns small differences into incidents. Move module by module.",{"euAiAct":142,"regulations":145,"guidance":151,"controls":164,"incidents":170},{"tier":143,"basis":144},"minimal","Tools that analyze, document and translate code are not prohibited practices under Article 5 and are not listed in Annex III, so no high risk obligations apply to the tooling. Engineers and analysts know they are working with an AI tool, including when they query the documentation through a chat assistant, so the Article 50 disclosure duty has no practical effect for the deploying organization. What remains is AI literacy for the staff who use it (Article 4). If the system being modernized is itself an AI system in an Annex III area (for example creditworthiness assessment, point 5(b)), its new version still has to meet the high risk requirements.",[146,147,148,149,150],"eu-ai-act","gdpr","dora","iso-42001","apra-cps-230",[152,158],{"title":153,"issuer":154,"region":155,"url":156,"note":157},"Guidelines on Risk Management Practices, Technology Risk","Monetary Authority of Singapore","asia-pacific","https://www.mas.gov.sg/regulation/guidelines/technology-risk-management-guidelines","Supervisory expectations for technology risk governance, system development, testing and change management at financial institutions in Singapore.",{"title":159,"issuer":160,"region":161,"url":162,"note":163},"Guidelines for secure AI system development","UK National Cyber Security Centre","europe","https://www.ncsc.gov.uk/collection/guidelines-secure-ai-system-development","Security guidance for organizations that build AI systems, relevant to in house pipelines and agents that process and generate code.",[165,166,167,168,169],"Program level risk assessment with the AI tooling in scope","Third party risk review of model providers and integrators","Test evidence and parallel run results retained per module","Traceability records from legacy to new components","Independent review of cutover readiness for critical systems",[],{"howToBuild":172},"Blits.ai does not convert code. It fits around a modernization program as the knowledge\nlayer: generated program documentation and specifications go into a **knowledge base** with\nversion control and hybrid retrieval, and an **AI agent** lets engineers and business analysts\nask what a legacy program does, which rules it applies and what depends on it.\n\n**Agentic workflows** can draft documentation module by module through **custom functions**,\nwith **human in the loop confirmation** and a full audit trail per run. Approved documents are\nthen uploaded to the **knowledge base** (document library with version control). **Test suites**\ncheck the agent's answers against expert approved question sets. The platform is **model\nagnostic**, so the model can be chosen per task, and it can run in the EU or UAE region.",[174,177,180],{"question":175,"answer":176},"Can AI convert COBOL to Java on its own?","Not reliably enough for core systems. Most deployments on this page use AI for comprehension and documentation, and humans or deterministic tools produce the new code. Morgan Stanley's DevGen.AI turns legacy code into English specifications that developers rewrite, because the firm says the tool does not yet write new code as well as a human, and GFT describes a bank where deterministic tools did the conversion while generative AI produced documentation and test scenarios, the only deployment here that reports AI generated tests. Amazon's agent did help upgrade applications from Java 8 or 11 to Java 17, a version upgrade rather than a change of language.",{"question":178,"answer":179},"How much time does it save?","Morgan Stanley says DevGen.AI worked through nine million lines in five months and saved about 280,000 developer hours. Amazon reports that its code transformation agent helped migrate tens of thousands of production applications to Java 17 and estimates that this saved more than 4,500 years of development work. Toyota Motor Europe's documentation proof of concept gives no time figure, and savings on mainframe estates depend heavily on how much expert review the output needs.",{"question":181,"answer":182},"What should stay with humans?","Validation of business rules, the decision to cut over, and sign off on test and parallel run results. The retiring experts are most valuable as reviewers of AI generated documentation.",[184,185,186,187],"developer-coding-assistant","developer-api-integration-assistant","enterprise-knowledge-search","aiops-incident-triage","2026-09-27",[190],{"date":188,"note":191},"First published","legacy-code-modernization",[194,229,251,283,312],{"title":195,"useCases":196,"organization":197,"vendors":202,"summary":205,"stage":206,"year":207,"channels":208,"languages":209,"metrics":210,"outcomeDisclosed":218,"sources":219,"verification":224,"grade":226,"id":227,"organizationSlug":228},"Google: AI assisted internal code migrations cut engineering time by an estimated 50%",[192],{"name":198,"anonymized":199,"country":200,"region":201,"industry":21},"Google",false,"US","global",[203],{"name":198,"role":204},"in-house","Google used an internal LLM based system to help engineers with large scale code migrations, such as changing identifier types from int32 to int64. Engineers doing the migrations estimated the total time spent was reduced by about 50%, and reported that 80% of the code changes in landed changelists were AI authored, with the rest written by humans.","production",2026,[29],[],[211],{"kpi":45,"value":212,"unit":213,"qualifier":214,"claimant":215,"quote":216,"sourceUrl":217},50,"percent","approximately","organization","The total time spent on the migration was reduced by an estimated 50% as reported by the engineers doing the migration.","https://research.google/blog/accelerating-code-migrations-with-ai/",true,[220],{"url":217,"title":221,"publisher":222,"date":223},"Accelerating code migrations with AI","Google Research","2026-01-01",{"level":225,"checkedAt":188},"source-verified","B","google-legacy-code-migration","google",{"title":230,"useCases":231,"organization":232,"vendors":234,"summary":236,"stage":206,"year":237,"channels":238,"languages":239,"metrics":240,"outcomeDisclosed":218,"sources":241,"verification":248,"grade":226,"id":249,"organizationSlug":250},"Airbnb: LLM driven migration of about 3,500 test files finished in 6 weeks instead of an estimated 1.5 years",[192],{"name":233,"anonymized":199,"country":200,"region":201,"industry":21},"Airbnb",[235],{"name":233,"role":204},"Airbnb migrated around 3,500 React test files from Enzyme to React Testing Library using a combination of frontier language models and automation. Airbnb had originally estimated the migration would take about 1.5 years of engineering time to do by hand, and instead completed it in 6 weeks.",2025,[29],[],[],[242],{"url":243,"title":244,"publisher":245,"date":246,"archivedUrl":247},"https://medium.com/airbnb-engineering/accelerating-large-scale-test-migration-with-llms-9565c208023b","Accelerating large scale test migration with LLMs","Airbnb Engineering","2025-01-01","https://web.archive.org/web/2026/https://medium.com/airbnb-engineering/accelerating-large-scale-test-migration-with-llms-9565c208023b",{"level":225,"checkedAt":188},"airbnb-test-migration-llm",null,{"title":252,"useCases":253,"organization":254,"vendors":256,"summary":258,"stage":259,"year":260,"channels":261,"languages":262,"metrics":263,"outcomeDisclosed":218,"sources":271,"verification":280,"grade":226,"id":281,"organizationSlug":282},"Amazon: a code transformation agent helped migrate tens of thousands of production applications to Java 17",[192],{"name":255,"anonymized":199,"country":200,"region":201,"industry":21},"Amazon",[257],{"name":255,"role":204},"Amazon integrated the Java transformation capability of Amazon Q Developer into its internal systems and migrated tens of thousands of production applications from Java 8 or 11 to Java 17 with its assistance. AWS describes the product's transformation agents as analyzing source code, generating new code, testing it and executing the change once the customer approves; the sources do not describe how Amazon's own developers reviewed each upgrade. Amazon estimates more than 4,500 years of development work saved compared with manual upgrades, and annual savings from hosts it could remove after the faster Java 17 runtime. AWS has since extended the approach to .NET, VMware and mainframe workloads.","scaled",2024,[29],[],[264],{"kpi":43,"value":265,"unit":266,"currency":77,"qualifier":267,"period":268,"claimant":215,"quote":269,"sourceUrl":270},260000000,"currency","exact","per year, estimated from hosts removed after the Java 17 upgrade","This effort saved more than 4,500 years of development work, compared to what it would have taken previously, and realized performance improvements of $260 million in annual cost savings.","https://press.aboutamazon.com/2024/12/new-amazon-q-developer-capabilities-accelerate-large-scale-transformations-of-legacy-workloads",[272,275],{"url":270,"title":273,"publisher":255,"date":274},"New Amazon Q Developer Capabilities Accelerate Large-Scale Transformations of Legacy Workloads","2024-12-03",{"url":276,"title":277,"publisher":278,"date":279},"https://aws.amazon.com/blogs/devops/amazon-q-developer-just-reached-a-260-million-dollar-milestone","Amazon Q Developer just reached a $260 million dollar milestone","AWS","2024-08-01",{"level":225,"checkedAt":188},"amazon-java-upgrade-code-transformation","amazon",{"title":284,"useCases":285,"organization":286,"vendors":289,"summary":298,"stage":206,"year":207,"channels":299,"languages":301,"metrics":302,"outcomeDisclosed":199,"sources":303,"verification":308,"grade":310,"id":311,"organizationSlug":250},"Toyota Motor Europe: generative AI documents a legacy mainframe warranty application",[192],{"name":287,"anonymized":199,"country":288,"region":161,"industry":20},"Toyota Motor Europe","BE",[290,292,295],{"name":278,"role":291},"platform",{"name":293,"role":294},"Anthropic","model-provider",{"name":296,"role":297},"Deloitte","integrator","Toyota Motor Europe runs more than 70 custom applications on legacy mainframe and AS400 platforms, several written in a proprietary language with little documentation and a shrinking pool of experts. With Deloitte and the AWS Generative AI Innovation Center it built a proof of concept on Amazon Bedrock that generates technical documentation, business documentation and process flows from the source code of a warranty handling application of over 1.3 million lines. The remaining experts reviewed a sample against the source and confirmed its accuracy. The proof of concept covered 2 of the 10 modules; AWS reports that it has since led to a production rollout.",[300],"api",[],[],[304],{"url":305,"title":306,"publisher":278,"date":307},"https://aws.amazon.com/blogs/industries/accelerating-mainframe-modernization-how-toyota-motor-europe-tme-uses-amazon-bedrock-to-automate-legacy-code-documentation","Accelerating mainframe modernization: How Toyota Motor Europe (TME) uses Amazon Bedrock to automate legacy code documentation","2026-03-04",{"level":225,"checkedAt":309},"2026-09-26","C","toyota-motor-europe-legacy-code-documentation",{"title":313,"useCases":314,"organization":315,"vendors":317,"summary":321,"stage":259,"year":237,"channels":322,"languages":323,"metrics":325,"outcomeDisclosed":218,"sources":332,"verification":337,"grade":310,"id":338,"organizationSlug":339},"Morgan Stanley: DevGen.AI translates legacy code into modern specifications",[192],{"name":316,"anonymized":199,"country":200,"region":201,"industry":19},"Morgan Stanley",[318,319],{"name":316,"role":204},{"name":320,"role":294},"OpenAI","Morgan Stanley launched DevGen.AI in January 2025, an in house tool built on OpenAI's GPT models and trained on the languages in its own code base, including company specific ones. It turns code in older languages such as Perl into plain English specifications that developers then use to rewrite the code in modern languages. The firm keeps developers in the loop because the tool does not yet write the new code as well as a human, and said it would not cut its engineering workforce as a result.",[29],[324],"en",[326],{"kpi":42,"value":327,"unit":328,"qualifier":214,"period":329,"claimant":215,"quote":330,"sourceUrl":331},280000,"hours","first five months after launch","Mike Pizzi, Morgan Stanley’s global head of technology and operations, told WSJ that in the five months since its launch, DevGen.AI has worked through nine million lines of code, saving the firm’s 15,000 developers roughly 280,000 hours of work.","https://www.entrepreneur.com/business-news/morgan-stanley-builds-ai-tool-that-fixes-major-coding-issue/492697",[333],{"url":331,"title":334,"publisher":335,"date":336},"'Building It Ourselves': Morgan Stanley Created an AI Tool to Fix the Most Annoying Part of Coding","Entrepreneur","2025-06-03",{"level":225,"checkedAt":309},"morgan-stanley-devgen-ai","morgan-stanley",0,[342,348,353],{"kpi":43,"label":343,"unit":266,"currency":77,"aggregate":199,"higherIsBetter":218,"n":344,"nUpTo":340,"median":265,"min":265,"max":265,"byClaimant":345,"vendorOnly":199,"points":346},"Cost savings",1,{"organization":344,"vendor":340,"regulator":340,"independent":340},[347],{"evidenceId":281,"organization":255,"value":265,"qualifier":267,"claimant":215,"grade":226,"pooled":218},{"kpi":45,"label":349,"unit":213,"aggregate":218,"higherIsBetter":218,"n":344,"nUpTo":340,"median":212,"min":212,"max":212,"byClaimant":350,"vendorOnly":199,"points":351},"Cycle time reduction",{"organization":344,"vendor":340,"regulator":340,"independent":340},[352],{"evidenceId":227,"organization":198,"value":212,"qualifier":214,"claimant":215,"grade":226,"pooled":218},{"kpi":42,"label":354,"unit":328,"aggregate":199,"higherIsBetter":218,"n":344,"nUpTo":340,"median":327,"min":327,"max":327,"byClaimant":355,"vendorOnly":199,"points":356},"Hours saved",{"organization":344,"vendor":340,"regulator":340,"independent":340},[357],{"evidenceId":338,"organization":316,"value":327,"qualifier":214,"claimant":215,"grade":310,"pooled":218},{"low":359,"high":360},1200000,6000000,[362,383,409,424],{"slug":184,"title":363,"shortTitle":364,"definition":365,"status":9,"industries":366,"functions":368,"patterns":369,"audience":30,"autonomy":31,"adoptionStage":370,"evidenceCount":371,"publicEvidenceCount":371,"organizations":372,"bestGrade":226,"headline":379,"lastVerified":188,"indexable":218},"AI coding assistant for software developers","Developer coding assistant","An AI assistant in the developer's IDE and code review flow that completes and generates code, explains unfamiliar modules, drafts unit tests and reviews pull requests for common defects, while generated code goes through the same review, testing and change controls as any other code.",[17,18,19,21,367],"professional-services",[23],[25],"mainstream",6,[373,374,375,376,377,378],"Accenture","ANZ","Bank of America","Citi","CME Group","Meta",{"kpi":44,"label":380,"unit":213,"n":381,"nUpTo":340,"kind":382,"value":59,"qualifier":267,"claimant":250,"organization":250,"vendorReported":199},"Productivity gain",3,"median",{"slug":185,"title":384,"shortTitle":385,"definition":386,"status":9,"industries":387,"functions":389,"patterns":392,"audience":395,"autonomy":396,"adoptionStage":32,"segment":397,"evidenceCount":398,"publicEvidenceCount":398,"organizations":399,"bestGrade":226,"headline":404,"lastVerified":188,"indexable":218},"AI assistant for developers integrating a company's APIs","API integration assistant","An AI assistant on a developer portal and in its documentation that answers integration questions, recommends the right endpoints, helps debug connections and generates sample calls, grounded in the API catalogue, reference docs and test material, so clients and partners integrate faster with fewer support tickets.",[17,18,388,21],"payments",[23,390,391],"customer-service","onboarding-and-kyc",[393,394,25],"rag-knowledge-assistant","conversational-agent","customer-facing","assist","specialized-businesses",4,[400,401,402,403],"CircleCI","Mapbox","monday.com","U.S. Bank",{"kpi":405,"label":406,"unit":213,"n":344,"nUpTo":340,"kind":407,"value":408,"qualifier":267,"claimant":215,"organization":401,"vendorReported":199},"contact-deflection","Contact deflection","reported",30,{"slug":186,"title":410,"shortTitle":411,"definition":412,"status":9,"industries":413,"functions":417,"patterns":420,"audience":30,"autonomy":396,"adoptionStage":370,"evidenceCount":398,"publicEvidenceCount":398,"organizations":421,"bestGrade":226,"headline":250,"lastVerified":188,"indexable":218},"AI enterprise knowledge search for employees","Enterprise knowledge search","An assistant that lets any employee ask a question in plain language and get a synthesized answer from the organization's own policies, procedures, product manuals and research, with citations to the source documents and only from documents the employee is allowed to see.",[17,18,414,415,416,367],"wealth-and-asset-management","insurance","government",[418,419,390],"knowledge-management","operations",[393,394,26],[375,316,422,423],"SIGNAL IDUNA","Wells Fargo",{"slug":187,"title":425,"shortTitle":426,"definition":427,"status":9,"industries":428,"functions":430,"patterns":432,"audience":30,"autonomy":31,"adoptionStage":32,"evidenceCount":371,"publicEvidenceCount":435,"organizations":436,"bestGrade":226,"headline":440,"lastVerified":188,"indexable":218},"AI for IT incident triage and root cause analysis (AIOps)","AIOps incident triage","AI that turns a flood of monitoring alerts into one probable incident, routes it to the right team, proposes likely root causes and remediation from runbooks and past incidents, and drafts the stakeholder updates and the post incident review, while an engineer authorizes every change.",[17,18,21,429,388],"telecommunications",[23,419,431],"risk-management",[433,434,26,393,27],"anomaly-detection","classification-and-routing",5,[198,378,437,438,439],"Microsoft","Mizuho Financial Group","TD Bank",{"kpi":441,"label":442,"unit":213,"n":381,"nUpTo":340,"kind":382,"value":443,"qualifier":267,"claimant":250,"organization":250,"vendorReported":199},"accuracy","Accuracy",90,{"indexable":218,"reasons":445},[],[447,453,458,464,472,477,484,491,497,503,509,515,522,529,535,540,547,553,559,565,571,577,582,587,592,599,606,611,616,623,629,635,641,646],{"id":146,"label":448,"issuer":449,"region":161,"url":450,"description":451,"useCases":452,"indexable":218},"EU AI Act","European Union","https://eur-lex.europa.eu/eli/reg/2024/1689/oj","Regulation (EU) 2024/1689: risk based rules for AI systems, with obligations for high risk systems listed in Annex III and transparency duties under Article 50.",197,{"id":147,"label":454,"issuer":449,"region":161,"url":455,"description":456,"useCases":457,"indexable":218},"GDPR","https://eur-lex.europa.eu/eli/reg/2016/679/oj","General Data Protection Regulation, including Article 22 on decisions based solely on automated processing.",180,{"id":149,"label":459,"issuer":460,"region":201,"url":461,"description":462,"useCases":463,"indexable":218},"ISO/IEC 42001","ISO and IEC","https://www.iso.org/standard/81230.html","The international management system standard for AI.",110,{"id":465,"label":466,"issuer":467,"region":468,"url":469,"description":470,"useCases":471,"indexable":218},"nist-ai-rmf","NIST AI Risk Management Framework","NIST","north-america","https://www.nist.gov/itl/ai-risk-management-framework","Voluntary US framework to map, measure, manage and govern AI risk, with a generative AI profile.",83,{"id":148,"label":473,"issuer":449,"region":161,"url":474,"description":475,"useCases":476,"indexable":218},"DORA","https://eur-lex.europa.eu/eli/reg/2022/2554/oj","Digital Operational Resilience Act for financial entities: ICT risk, incident reporting and third party risk, including AI providers.",66,{"id":478,"label":479,"issuer":480,"region":161,"url":481,"description":482,"useCases":483,"indexable":218},"uk-gdpr","UK GDPR","Information Commissioner's Office","https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/","The UK's version of the GDPR, including rules on solely automated decisions.",64,{"id":485,"label":486,"issuer":487,"region":161,"url":488,"description":489,"useCases":490,"indexable":218},"uk-consumer-duty","FCA Consumer Duty","Financial Conduct Authority","https://www.fca.org.uk/firms/consumer-duty","UK rules that require firms to deliver good outcomes for retail customers, including through automated channels.",47,{"id":492,"label":493,"issuer":154,"region":155,"url":494,"description":495,"useCases":496,"indexable":218},"mas-ai-risk-management","MAS AI risk management guidelines","https://www.mas.gov.sg/news/media-releases/2025/mas-guidelines-for-artificial-intelligence-risk-management","Singapore's supervisory expectations for AI risk management at financial institutions, building on the FEAT principles.",36,{"id":150,"label":498,"issuer":499,"region":155,"url":500,"description":501,"useCases":502,"indexable":218},"APRA CPS 230","Australian Prudential Regulation Authority","https://www.apra.gov.au/operational-risk-management","Australian operational risk standard covering critical operations and material service providers.",25,{"id":504,"label":505,"issuer":506,"region":201,"url":507,"description":508,"useCases":59,"indexable":218},"pci-dss","PCI DSS","PCI Security Standards Council","https://www.pcisecuritystandards.org/","Security standard for any system that stores, processes or transmits cardholder data.",{"id":510,"label":511,"issuer":512,"region":468,"url":513,"description":514,"useCases":59,"indexable":218},"us-sr-11-7","SR 11-7 model risk management","Federal Reserve and OCC","https://www.federalreserve.gov/boarddocs/srletters/2011/sr1107.htm","US supervisory guidance on model risk management, applied by banks to AI and machine learning models.",{"id":516,"label":517,"issuer":518,"region":161,"url":519,"description":520,"useCases":521,"indexable":218},"uk-atrs","UK Algorithmic Transparency Recording Standard","UK Government","https://www.gov.uk/government/collections/algorithmic-transparency-recording-standard-hub","Mandatory transparency records for algorithmic tools used by UK central government.",16,{"id":523,"label":524,"issuer":525,"region":201,"url":526,"description":527,"useCases":528,"indexable":218},"fatf-recommendations","FATF Recommendations","Financial Action Task Force","https://www.fatf-gafi.org/en/publications/Fatfrecommendations/Fatf-recommendations.html","Global standards for anti money laundering and counter terrorist financing that national rules implement.",15,{"id":530,"label":531,"issuer":449,"region":161,"url":532,"description":533,"useCases":534,"indexable":218},"eu-amlr","EU Anti Money Laundering Regulation","https://eur-lex.europa.eu/eli/reg/2024/1624/oj","Regulation (EU) 2024/1624: the single EU rulebook for customer due diligence, beneficial ownership and suspicious transaction reporting.",14,{"id":536,"label":537,"issuer":449,"region":161,"url":538,"description":539,"useCases":534,"indexable":218},"nis2","NIS2 Directive","https://eur-lex.europa.eu/eli/dir/2022/2555/oj","Directive (EU) 2022/2555 on cybersecurity for essential and important entities, including telecom networks, energy and public administration.",{"id":541,"label":542,"issuer":543,"region":468,"url":544,"description":545,"useCases":546,"indexable":218},"us-bsa","Bank Secrecy Act","FinCEN","https://www.fincen.gov/resources/statutes-and-regulations/bank-secrecy-act","US anti money laundering law: customer due diligence, suspicious activity reports and record keeping.",13,{"id":548,"label":549,"issuer":449,"region":161,"url":550,"description":551,"useCases":552,"indexable":218},"eu-accessibility-act","European Accessibility Act","https://eur-lex.europa.eu/eli/dir/2019/882/oj","Directive (EU) 2019/882: accessibility requirements for banking services, ecommerce and other digital services, applicable since June 2025.",12,{"id":554,"label":555,"issuer":556,"region":468,"url":557,"description":558,"useCases":552,"indexable":218},"hipaa","HIPAA","US Department of Health and Human Services","https://www.hhs.gov/hipaa/index.html","US rules for the privacy and security of protected health information.",{"id":560,"label":561,"issuer":562,"region":201,"url":563,"description":564,"useCases":552,"indexable":218},"telecom-consumer-rules","Telecom consumer protection rules","National telecom regulators","https://www.berec.europa.eu/","National rules on telecom contracts, switching, billing disputes and marketing consent.",{"id":566,"label":567,"issuer":449,"region":161,"url":568,"description":569,"useCases":570,"indexable":218},"eecc","European Electronic Communications Code","https://eur-lex.europa.eu/eli/dir/2018/1972/oj","Directive (EU) 2018/1972: consumer protection, contract, switching and security rules for telecom operators.",11,{"id":572,"label":573,"issuer":574,"region":468,"url":575,"description":576,"useCases":570,"indexable":218},"us-tcpa","Telephone Consumer Protection Act","Federal Communications Commission","https://www.fcc.gov/consumers/guides/stop-unwanted-robocalls-and-texts","US consent rules for automated and prerecorded calls and texts; the FCC has confirmed AI generated voices count as artificial voices.",{"id":578,"label":579,"issuer":154,"region":155,"url":580,"description":581,"useCases":58,"indexable":218},"mas-notice-626","MAS Notice 626","https://www.mas.gov.sg/regulation/notices/notice-626","Singapore's anti money laundering and counter terrorism financing requirements for banks.",{"id":583,"label":584,"issuer":449,"region":161,"url":585,"description":586,"useCases":58,"indexable":218},"mifid-ii","MiFID II","https://eur-lex.europa.eu/eli/dir/2014/65/oj","Directive 2014/65/EU on markets in financial instruments: suitability and appropriateness of advice, record keeping and product governance.",{"id":588,"label":589,"issuer":449,"region":161,"url":590,"description":591,"useCases":58,"indexable":218},"eu-psd2","PSD2","https://eur-lex.europa.eu/eli/dir/2015/2366/oj","Payment Services Directive 2: strong customer authentication, transaction risk analysis exemptions and open banking access.",{"id":593,"label":594,"issuer":595,"region":161,"url":596,"description":597,"useCases":598,"indexable":218},"eba-loan-origination","EBA Guidelines on loan origination and monitoring","European Banking Authority","https://www.eba.europa.eu/regulation-and-policy/credit-risk/guidelines-on-loan-origination-and-monitoring","Expectations for credit decisioning, including the use of automated models.",9,{"id":600,"label":601,"issuer":602,"region":468,"url":603,"description":604,"useCases":605,"indexable":218},"us-ecoa-reg-b","ECOA and Regulation B","Consumer Financial Protection Bureau","https://www.consumerfinance.gov/rules-policy/regulations/1002/9/","US fair lending rules, including specific reasons in adverse action notices, which also apply when credit decisions use AI models.",8,{"id":607,"label":608,"issuer":449,"region":161,"url":609,"description":610,"useCases":605,"indexable":218},"solvency-ii","Solvency II","https://eur-lex.europa.eu/eli/dir/2009/138/oj","Directive 2009/138/EC: risk based capital, governance and model requirements for insurers.",{"id":612,"label":613,"issuer":449,"region":161,"url":614,"description":615,"useCases":371,"indexable":218},"eu-idd","Insurance Distribution Directive","https://eur-lex.europa.eu/eli/dir/2016/97/oj","Directive (EU) 2016/97: conduct rules for selling insurance, including demands and needs testing and advice.",{"id":617,"label":618,"issuer":619,"region":620,"url":621,"description":622,"useCases":435,"indexable":218},"cbuae-ai-guidance","CBUAE guidance on AI and ML","Central Bank of the UAE","middle-east","https://www.centralbank.ae/","UAE central bank expectations for the enabling technologies, AI and machine learning used by licensed financial institutions.",{"id":624,"label":625,"issuer":626,"region":161,"url":627,"description":628,"useCases":398,"indexable":218},"pra-ss1-23","PRA SS1/23 model risk management","Prudential Regulation Authority","https://www.bankofengland.co.uk/prudential-regulation/publication/2023/may/model-risk-management-principles-for-banks-ss","UK model risk management principles for banks, covering AI and machine learning models.",{"id":630,"label":631,"issuer":632,"region":161,"url":633,"description":634,"useCases":398,"indexable":218},"uk-psr-app-reimbursement","UK APP scam reimbursement rules","Payment Systems Regulator","https://www.psr.org.uk/our-work/app-scams/","Mandatory reimbursement of authorised push payment scam victims by UK payment firms, which shifts scam losses onto banks.",{"id":636,"label":637,"issuer":638,"region":155,"url":639,"description":640,"useCases":381,"indexable":218},"au-scams-prevention-framework","Australian Scams Prevention Framework","Australian Treasury","https://treasury.gov.au/consultation/c2024-573813","Economy wide obligations for banks, telcos and digital platforms to prevent, detect, disrupt and respond to scams.",{"id":642,"label":643,"issuer":449,"region":161,"url":644,"description":645,"useCases":381,"indexable":218},"eu-mar","EU Market Abuse Regulation","https://eur-lex.europa.eu/eli/reg/2014/596/oj","Regulation (EU) 596/2014: insider dealing and market manipulation, including the duty to detect and report suspicious orders and transactions.",{"id":647,"label":648,"issuer":649,"region":468,"url":650,"description":651,"useCases":381,"indexable":218},"us-fcra","Fair Credit Reporting Act","Federal Trade Commission","https://www.ftc.gov/legal-library/browse/statutes/fair-credit-reporting-act","US rules on consumer reports, their accuracy and permissible use, relevant to credit scoring and screening.",1790598300437]