[{"data":1,"prerenderedAt":558},["ShallowReactive",2],{"uc-performance-review-drafting-agent":3,"uc-regulations":349},{"useCase":4,"evidence":192,"blitsAiDeployments":257,"benchmarks":258,"indicative":269,"related":272,"indexability":347,"includeUnpublished":198},{"title":5,"shortTitle":6,"seoTitle":7,"metaDescription":8,"status":9,"definition":10,"aliases":11,"industries":17,"functions":20,"patterns":22,"channels":26,"audience":29,"autonomy":30,"adoptionStage":31,"problem":32,"problemStats":33,"howItWorks":34,"valueDrivers":35,"kpis":39,"indicativeValue":42,"macroEstimates":75,"feasibility":76,"implementation":89,"risk":135,"blitsAi":167,"faq":169,"related":182,"datePublished":187,"dateModified":187,"lastVerified":187,"changelog":188,"slug":191},"AI agent for drafting employee performance reviews","Performance review drafting","AI performance review drafting for managers","AI drafts a first version of each performance review from collected feedback. Windmill reports an 83% drop in review hours at Rho and 93% employee preference.","published","An assistant that gathers an employee's work history, goals and peer feedback from the systems a manager already uses, and drafts a first version of the performance review for the manager to edit, rewrite or reject, so the manager starts from a grounded summary instead of a blank form and a stack of six months of context to recall from memory.",[12,13,14,15,16],"AI performance review generator","AI assisted review writing","review drafting copilot","AI 360 feedback summarizer","performance management AI agent",[18,19],"cross-industry","technology",[21],"human-resources",[23,24,25],"content-generation","summarization","agentic-workflow",[27,28],"internal-tools","email","employee-facing","copilot","early-adopters","A formal review asks a manager to remember and evaluate six or twelve months of a person's work,\nusually while running the same exercise for every other person they manage at once. Windmill\ndescribes this playing out at Rho as the company grew: managers spent significant time gathering\nwork artifacts and feedback across separate tools, reviews stretched longer than intended, and\nleaders lacked a unified view of performance across teams.\n\nWindmill describes this at Case Status, where what Case Status called the \"blank page problem\",\nmanagers and employees staring at an empty review form and trying to reconstruct months of work\nfrom memory, played out against a prior process, a patchwork of Google Docs and forms, that was\nboth time consuming and made it hard to capture the full scope of an employee's contributions.\nWindmill also argues that mid sized companies often see the largest gains from this kind of tool,\nbecause they typically lack the dedicated HR resources of large enterprises to run and chase a\nformal cycle by hand.",[],"1. **Collect the year's context continuously.** The assistant connects to the tools work already\n   happens in, such as project trackers, chat and documents, and to goals set earlier in the\n   cycle, so it has real material to draw from rather than starting from nothing at review time.\n2. **Gather structured feedback.** Peers, the manager and, where used, the employee's own self\n   review answer a short set of questions; the assistant chases outstanding responses so the\n   cycle does not stall on one missing input.\n3. **Draft the review.** The assistant synthesises the work history and feedback into a first\n   draft organised against the organization's review template and competencies, citing the\n   specific examples it drew from.\n4. **The manager edits and owns it.** The manager rewrites, adds judgement the data cannot\n   capture, and is accountable for the final rating and text; the draft is a starting point, not\n   the answer.\n5. **Coordinate the cycle.** The assistant tracks who still owes feedback, reminds them, and gives\n   HR or the manager's own manager visibility into where the cycle stands, without a dedicated\n   coordinator running it by hand.",[36,37,38],"employee-productivity","cost-to-serve","speed",[40,41],"handling-time-reduction","processing-time-reduction",{"referenceOrg":43,"inputs":44,"formula":70,"currency":71,"period":72,"resultLabel":73,"caveat":74},"An organization with 2,000 employees who receive a formal performance review each cycle",[45,50,57,63],{"key":46,"label":47,"low":48,"high":48,"unit":46,"note":49},"employees","Employees reviewed per cycle",2000,"The reference organization.",{"key":51,"label":52,"low":53,"high":54,"unit":55,"note":56},"cyclesPerYear","Formal review cycles per year",1,2,"cycles per year","Editorial assumption, replace with your own; many organizations run one annual and one mid year cycle.",{"key":58,"label":59,"low":53,"high":60,"unit":61,"note":62},"hoursSavedPerReview","Manager and employee hours saved per review",3,"hours per review","Editorial assumption, replace with your own. Rho's CFO is quoted comparing the AI assisted draft to a review he estimated would otherwise have taken him 3 hours, which anchors the upper bound; the Case Status figure is treated here as a reduction in elapsed cycle time, not in hours worked, so it is not used to derive this range.",{"key":64,"label":65,"low":66,"high":67,"unit":68,"note":69},"hourlyCost","Blended fully loaded hourly cost of a manager or employee",40,80,"USD per hour","Editorial assumption. Replace with your own blended rate.","employees * cyclesPerYear * hoursSavedPerReview * hourlyCost","USD","per year","Manager and employee review time cost avoided","Gross avoided time cost only. It leaves out the platform cost, the value of more consistent and timely reviews, and any effect on retention, development or promotion decisions, which this page's evidence does not measure.",[],{"complexity":77,"complexityNote":78,"dataPrerequisites":79,"integrations":84},"medium","Drafting from feedback already collected in a form is straightforward. The value comes from connecting to where work actually happens (chat, project tools, documents) so the draft has real, specific material; without that, the assistant just reformats whatever a person typed into a box, which saves little time.",[80,81,82,83],"The organization's review template, competencies and rating scale","Goals set earlier in the cycle for each employee, where the organization uses them","Access to the work context tools the assistant should draw from, scoped per employee","A clear policy on what AI generated text may and may not be used for",[85,86,87,88],"HR information system for employee, manager and cycle data","Chat and project tools (for example Slack, Jira, GitHub) the assistant summarises from","Document storage for prior reviews and goal documents","Identity provider for single sign on and access scoping",{"steps":90,"guardrails":109,"humanInTheLoop":115,"kpisToInstrument":116,"failureModes":122},[91,94,97,100,103,106],{"title":92,"detail":93},"Decide what the draft may and may not touch","Write down, before launch, that the AI draft is a starting point only, the manager owns the final text and rating, and the system is not used directly in pay or promotion decisions.",{"title":95,"detail":96},"Connect real work context, not just a form","Wire the assistant to the tools work happens in for a pilot group before rolling out broadly, so the draft cites specific, verifiable examples rather than generic language.",{"title":98,"detail":99},"Keep feedback collection structured","Use a short, consistent set of questions for peer and self feedback so the assistant can synthesise reliably, and let it chase outstanding responses automatically.",{"title":101,"detail":102},"Require a human edit before anything is final","Do not allow a draft to be submitted unedited; require the manager to open and modify the text, and log that the review was edited before submission.",{"title":104,"detail":105},"Pilot with one team's cycle","Run a full cycle with one function first, measure cycle time, hours and employee preference, and fix template and integration gaps before the next team joins.",{"title":107,"detail":108},"Decide how sensitive topics are handled","Performance issues that touch conduct, health or personal circumstances should route to a person and a private conversation, not into an AI drafted written record.",[110,111,112,113,114],"The manager reviews and edits every draft; nothing is sent to the employee unedited","The system is not used to set pay, bonus or promotion decisions directly from its output","Feedback and drafts are visible only to the people the organization's existing review process would show them to","Draft text is clearly marked as AI assisted until the manager has reviewed and approved it","Conversation and draft logs have a defined retention period and restricted access","The manager owns every rating and every word of the final review. HR owns the template, the cycle policy and what counts as a sensitive topic that must go to a person instead of into a draft, and reviews a sample of cycles for consistency and fairness across teams.",[117,118,119,120,121],"Total manager and employee hours spent on the cycle, before and after","Cycle length from opening to closing the review period","Employee preference for the AI assisted process versus the prior one","Share of drafts materially rewritten by the manager, as a check that editing is real","On time completion rate across the organization",[123,126,129,132],{"title":124,"detail":125},"Generic, uneditable prose","A draft that reads fluently but says nothing specific gets rubber stamped rather than improved. Require citations to specific work items in the draft and sample reviews for genuine editing.",{"title":127,"detail":128},"The draft becomes the decision","Under time pressure, managers submit the draft with only cosmetic changes, so the AI's synthesis quietly becomes the evaluation. Track the share of drafts materially edited and make manager training explicit about this risk.",{"title":130,"detail":131},"Feedback collected without consent context","Peers do not realise their comments will be summarised and shown to the subject, which damages trust in the feedback process. Be explicit up front about what is collected and how it is used.",{"title":133,"detail":134},"Sensitive matters written into a permanent record","A conduct or health related issue gets synthesised into formal review text instead of handled as a private conversation. Define these topics in advance and route them to a person, not the drafting flow.",{"euAiAct":136,"regulations":139,"guidance":145,"controls":160,"incidents":166},{"tier":137,"basis":138},"high","Annex III point 4(b) lists AI systems intended to monitor and evaluate the performance and behaviour of workers as high risk. Synthesising an employee's work history and feedback into a performance evaluation is very plausibly profiling of a natural person under GDPR Article 4(4), which expressly covers analysing or predicting a person's \"performance at work\". Article 6(3)'s last subparagraph makes an Annex III system high risk regardless of the derogations whenever it performs such profiling, so a tool built this way is high risk by default however much the manager edits the output. The derogations in Article 6(3), including a narrow procedural task or improving the result of a previously completed human activity, do not fit drafting an evaluation from scratch; the closest is point (d), a preparatory task ahead of a human assessment, which only has a chance of applying to a design that avoids profiling altogether, for example one that only surfaces raw facts without synthesising a judgement. Where that derogation is argued, the documentation duty under Article 6(4) falls on the provider of the system, and only on the deploying organization when it builds the tool itself. Because the tool is high risk by default, Article 26(7) requires informing affected workers and their representatives before it is put into use in the workplace, whatever the tool's output is used for; using the same system's output directly in pay, promotion or termination decisions removes any doubt and triggers the full high risk regime. Annex III's high risk obligations apply from 2 December 2027.",[140,141,142,143,144],"eu-ai-act","gdpr","uk-gdpr","iso-42001","nist-ai-rmf",[146,152,156],{"title":147,"issuer":148,"region":149,"url":150,"note":151},"Annex III, high risk AI systems referred to in Article 6(2)","European Union","europe","https://artificialintelligenceact.eu/annex/3/","Point 4(b) lists monitoring and evaluating the performance and behaviour of workers as a high risk employment use.",{"title":153,"issuer":148,"region":149,"url":154,"note":155},"Article 6, classification rules for high risk AI systems","https://artificialintelligenceact.eu/article/6/","Sets out the narrow procedural task, prior human activity and preparatory task derogations in Article 6(3), the rule in its last subparagraph that profiling of natural persons always makes an Annex III system high risk regardless of those derogations, and the documentation duty in Article 6(4), which falls on the provider of the system.",{"title":157,"issuer":148,"region":149,"url":158,"note":159},"Article 26, obligations of deployers of high risk AI systems","https://artificialintelligenceact.eu/article/26/","Article 26(7) requires informing affected workers and their representatives before a high risk AI system is put into use in the workplace.",[161,162,163,164,165],"Written policy that the AI draft is a starting point and the manager owns the final rating and text","Documented Article 6(3) and 6(4) assessment from the system's provider, covering whether the design profiles workers","Inventory entry for the assistant with an accountable HR owner","Sampled review of edited versus unedited drafts, to check editing is real","Defined list of sensitive topics that route to a person instead of the drafting flow",[],{"howToBuild":168},"On Blits.ai this is an **AI agent** with **custom functions** that read work context from\nconnected tools (project trackers, chat, document storage) through the **integration catalog**,\ncombined with a **knowledge base** holding the review template and competency framework so\nevery draft is structured the same way. An **agentic workflow** collects structured peer and\nself feedback through **web chat**, **email** or **Microsoft Teams**, chases outstanding\nresponses, and produces the draft with **structured output** mapped to the organization's\nreview fields.\n\nEvery draft is written to the HR system only after **human in the loop approval** from the\nmanager; nothing reaches the employee without the manager's approval. **Guardrails** block conduct, health or personal\ncircumstance content from the draft, and a **human handover** rule or agent tool escalates it to\na person, while **PII masking** limits what personal data reaches the model. **Run history with\na full audit trail** records each drafting run and the manager's approve or reject decision, and\n**test suites** evaluate the drafting flow against a reference set of feedback inputs. The\nplatform is model agnostic and offers EU and UAE data residency.",[170,173,176,179],{"question":171,"answer":172},"Does AI decide an employee's rating?","The sources on this page do not describe the AI setting a rating, and neither Windmill customer story says who decides it. Design the system so the manager decides: require the manager to open, edit and approve every draft before it reaches the employee, and keep the rating a manager judgement that the tool never sets on its own.",{"question":174,"answer":175},"How much time does AI assisted drafting actually save?","Windmill reports an 83% reduction in total hours spent on reviews at Rho and an 84% faster full cycle at Case Status, both alongside a reported 93% of employees preferring the new process to the prior one. Both figures cover the whole cycle (reminders, feedback collection, synthesis) rather than drafting on its own, and neither evidence record on this page is a drafting only deployment. Windmill's companies list page separately describes JPMorgan Chase using AI for drafting only, and cites a Boston Consulting Group figure of a 40% reduction in writing time when staff use AI to draft reviews; that is Windmill's own secondhand claim about a different deployment, not evidence recorded on this page.",{"question":177,"answer":178},"Is this high risk under the EU AI Act?","By default, yes. Annex III point 4(b) lists monitoring and evaluating worker performance as high risk, and Article 6(3)'s last subparagraph makes an Annex III system high risk regardless of the derogations whenever it profiles natural persons; synthesising someone's work history and feedback into a performance evaluation is plausibly profiling under GDPR's definition. Only a design that avoids profiling and fits a narrow procedural or preparatory task can argue for the derogation, and even then the documentation duty under Article 6(4) falls on the provider of the system, not the deploying organization, unless the organization built it itself.",{"question":180,"answer":181},"What should stay out of an AI drafted review?","Conduct issues, health matters and anything tied to a protected characteristic should be handled in a private conversation and only entered into the formal record by a person, not synthesised automatically from feedback text.",[183,184,185,186],"hr-and-policy-assistant","internal-talent-marketplace-matching","meeting-summarization-and-action-items","employee-onboarding-assistant","2026-09-28",[189],{"date":187,"note":190},"First published","performance-review-drafting-agent",[193,234],{"title":194,"useCases":195,"organization":196,"vendors":201,"summary":205,"stage":206,"year":207,"channels":208,"languages":209,"metrics":211,"outcomeDisclosed":220,"sources":221,"verification":229,"grade":231,"id":232,"organizationSlug":233},"Case Status: AI performance review cycle with Windmill",[191],{"name":197,"anonymized":198,"country":199,"region":200,"industry":19},"Case Status",false,"US","north-america",[202],{"name":203,"role":204},"Windmill","platform","Case Status, a client experience platform for law firms, used Windmill's AI review agent to solve what Windmill calls the \"blank page problem\": managers and employees starting a review with an empty form and having to reconstruct months of work from memory. Windmill surfaces work context from Slack and other connected tools and generates a summary that becomes the starting point for every review, replacing a prior process built on Google Docs and forms.","production",2025,[27],[210],"en",[212],{"kpi":41,"value":213,"unit":214,"qualifier":215,"period":216,"claimant":217,"quote":218,"sourceUrl":219},84,"percent","exact","full review cycle, versus the prior Google Docs and forms process","vendor","Case Status completed their entire performance review cycle in 84% less time compared to their previous process, while dramatically improving the experience.","https://gowindmill.com/customers/case-status",true,[222,225],{"url":219,"title":223,"publisher":203,"date":224},"How Case Status Ran Fast Performance Reviews That Solved the Blank Page Problem with Windmill","2025-01-21",{"url":226,"title":227,"publisher":203,"date":228},"https://gowindmill.com/resources/lists/companies-using-ai-performance-management/","How 6 Companies Use AI for Performance Management","2026-05-07",{"level":230,"checkedAt":187},"source-verified","C","case-status-ai-performance-review-cycle",null,{"title":235,"useCases":236,"organization":237,"vendors":239,"summary":241,"stage":206,"year":207,"channels":242,"languages":243,"metrics":244,"outcomeDisclosed":220,"sources":249,"verification":255,"grade":231,"id":256,"organizationSlug":233},"Rho: AI drafted performance reviews with Windmill",[191],{"name":238,"anonymized":198,"country":199,"region":200,"industry":19},"Rho",[240],{"name":203,"role":204},"Rho, a fintech platform for startups, runs its full performance review cycle on Windmill's AI review agent. The People team replaced a process where managers spent significant time gathering work artifacts and feedback across separate tools with a cycle that drafts each review from collected feedback and work history: self reviews complete in about 2.5 days, 360 reviews in 5 days, and the full self to manager cycle in 8 days, against an industry average that Windmill describes as several weeks.",[27],[210],[245],{"kpi":40,"value":246,"unit":214,"qualifier":215,"period":247,"claimant":217,"quote":248,"sourceUrl":226},83,"total hours spent on reviews","Results: 83% reduction in total hours spent on reviews and 93% of employees preferred Windmill to the prior process.",[250,251],{"url":226,"title":227,"publisher":203,"date":228},{"url":252,"title":253,"publisher":203,"date":254},"https://gowindmill.com/customers/rho-perf","Rho: Streamlining Performance Reviews at Scale with Windmill","2025-11-19",{"level":230,"checkedAt":187},"rho-ai-performance-review-drafting",0,[259,264],{"kpi":41,"label":260,"unit":214,"aggregate":220,"higherIsBetter":220,"n":53,"nUpTo":257,"median":213,"min":213,"max":213,"byClaimant":261,"vendorOnly":220,"points":262},"Cycle time reduction",{"organization":257,"vendor":53,"regulator":257,"independent":257},[263],{"evidenceId":232,"organization":197,"value":213,"qualifier":215,"claimant":217,"grade":231,"pooled":220},{"kpi":40,"label":265,"unit":214,"aggregate":220,"higherIsBetter":220,"n":53,"nUpTo":257,"median":246,"min":246,"max":246,"byClaimant":266,"vendorOnly":220,"points":267},"Handling time reduction",{"organization":257,"vendor":53,"regulator":257,"independent":257},[268],{"evidenceId":256,"organization":238,"value":246,"qualifier":215,"claimant":217,"grade":231,"pooled":220},{"low":270,"high":271},80000,960000,[273,301,319,336],{"slug":183,"title":274,"shortTitle":275,"definition":276,"status":9,"industries":277,"functions":280,"patterns":282,"audience":29,"autonomy":285,"adoptionStage":31,"evidenceCount":286,"publicEvidenceCount":287,"organizations":288,"bestGrade":293,"headline":294,"lastVerified":300,"indexable":220},"AI assistant for HR and policy questions","HR and policy assistant","An employee self service assistant that answers questions on leave, pay and tax forms, benefits, expenses, travel and conduct policies from the organization's own HR documents, personalized to the employee's country and role, and starts simple HR transactions such as leave requests or employment letters in the HR system.",[18,278,19,279],"banking","healthcare",[21,281],"knowledge-management",[283,284,25],"rag-knowledge-assistant","conversational-agent","supervised-agent",5,4,[289,290,291,292],"Bank of America","IBM","Turing","Vituity","B",{"kpi":295,"label":296,"unit":214,"n":54,"nUpTo":257,"kind":297,"value":298,"qualifier":215,"claimant":299,"organization":290,"vendorReported":198},"employee-adoption","Employee adoption","reported",99,"organization","2026-09-27",{"slug":184,"title":302,"shortTitle":303,"definition":304,"status":9,"industries":305,"functions":309,"patterns":310,"audience":29,"autonomy":313,"adoptionStage":31,"evidenceCount":287,"publicEvidenceCount":287,"organizations":314,"bestGrade":293,"headline":233,"lastVerified":300,"indexable":220},"AI internal talent marketplace for matching employees to projects, roles and mentors","Internal talent marketplace","An internal platform that uses AI to infer employees' skills and interests and recommend short term projects, open roles, mentors and learning to them, while showing managers which employees fit an opportunity, so that work is staffed from inside before hiring or contracting externally.",[18,306,307,308],"manufacturing","payments","government",[21],[311,312],"recommendation-and-personalization","prediction-and-scoring","assist",[315,316,317,318],"Federal Bureau of Prisons","Mastercard","Schneider Electric","Unilever",{"slug":185,"title":320,"shortTitle":321,"definition":322,"status":9,"industries":323,"functions":325,"patterns":327,"audience":29,"autonomy":30,"adoptionStage":329,"evidenceCount":286,"publicEvidenceCount":286,"organizations":330,"bestGrade":293,"headline":233,"lastVerified":300,"indexable":220},"AI meeting summarization and action items","Meeting summaries and action items","AI that summarizes internal and operational meetings, such as team, project, board and case meetings: it transcribes an online or in person meeting with the participants' knowledge and produces a summary, decisions and action items with owners and dates for the organizer to check and share. It is the general purpose tool; client advice meetings and sales calls, which feed a regulated record or a sales pipeline, have their own pages.",[18,308,19,324],"professional-services",[281,326],"operations",[24,328],"speech-analytics","mainstream",[331,332,333,334,335],"U.S. Department of Labor","Ministry of Justice","Softcat","Trace3","Government Digital Service",{"slug":186,"title":337,"shortTitle":338,"definition":339,"status":9,"industries":340,"functions":341,"patterns":342,"audience":29,"autonomy":285,"adoptionStage":31,"evidenceCount":287,"publicEvidenceCount":60,"organizations":343,"bestGrade":293,"headline":233,"lastVerified":300,"indexable":220},"AI assistant for employee onboarding","Employee onboarding assistant","An assistant that guides each new employee from signed contract through the first months: it answers first week questions in plain language, tracks the personal onboarding checklist, triggers the paperwork, equipment, access and training steps in the systems that own them, and keeps the manager and HR informed of what is still open.",[18,308,324,279],[21,281],[284,283,25],[344,345,346],"American Addiction Centers","KPMG","U.S. Department of Agriculture",{"indexable":220,"reasons":348},[],[350,355,360,367,372,378,384,391,399,406,413,419,426,433,439,444,451,457,463,469,475,481,487,492,497,504,511,516,522,529,535,541,547,552],{"id":140,"label":351,"issuer":148,"region":149,"url":352,"description":353,"useCases":354,"indexable":220},"EU AI Act","https://eur-lex.europa.eu/eli/reg/2024/1689/oj","Regulation (EU) 2024/1689: risk based rules for AI systems, with obligations for high risk systems listed in Annex III and transparency duties under Article 50.",197,{"id":141,"label":356,"issuer":148,"region":149,"url":357,"description":358,"useCases":359,"indexable":220},"GDPR","https://eur-lex.europa.eu/eli/reg/2016/679/oj","General Data Protection Regulation, including Article 22 on decisions based solely on automated processing.",180,{"id":143,"label":361,"issuer":362,"region":363,"url":364,"description":365,"useCases":366,"indexable":220},"ISO/IEC 42001","ISO and IEC","global","https://www.iso.org/standard/81230.html","The international management system standard for AI.",110,{"id":144,"label":368,"issuer":369,"region":200,"url":370,"description":371,"useCases":246,"indexable":220},"NIST AI Risk Management Framework","NIST","https://www.nist.gov/itl/ai-risk-management-framework","Voluntary US framework to map, measure, manage and govern AI risk, with a generative AI profile.",{"id":373,"label":374,"issuer":148,"region":149,"url":375,"description":376,"useCases":377,"indexable":220},"dora","DORA","https://eur-lex.europa.eu/eli/reg/2022/2554/oj","Digital Operational Resilience Act for financial entities: ICT risk, incident reporting and third party risk, including AI providers.",66,{"id":142,"label":379,"issuer":380,"region":149,"url":381,"description":382,"useCases":383,"indexable":220},"UK GDPR","Information Commissioner's Office","https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/","The UK's version of the GDPR, including rules on solely automated decisions.",64,{"id":385,"label":386,"issuer":387,"region":149,"url":388,"description":389,"useCases":390,"indexable":220},"uk-consumer-duty","FCA Consumer Duty","Financial Conduct Authority","https://www.fca.org.uk/firms/consumer-duty","UK rules that require firms to deliver good outcomes for retail customers, including through automated channels.",47,{"id":392,"label":393,"issuer":394,"region":395,"url":396,"description":397,"useCases":398,"indexable":220},"mas-ai-risk-management","MAS AI risk management guidelines","Monetary Authority of Singapore","asia-pacific","https://www.mas.gov.sg/news/media-releases/2025/mas-guidelines-for-artificial-intelligence-risk-management","Singapore's supervisory expectations for AI risk management at financial institutions, building on the FEAT principles.",36,{"id":400,"label":401,"issuer":402,"region":395,"url":403,"description":404,"useCases":405,"indexable":220},"apra-cps-230","APRA CPS 230","Australian Prudential Regulation Authority","https://www.apra.gov.au/operational-risk-management","Australian operational risk standard covering critical operations and material service providers.",25,{"id":407,"label":408,"issuer":409,"region":363,"url":410,"description":411,"useCases":412,"indexable":220},"pci-dss","PCI DSS","PCI Security Standards Council","https://www.pcisecuritystandards.org/","Security standard for any system that stores, processes or transmits cardholder data.",20,{"id":414,"label":415,"issuer":416,"region":200,"url":417,"description":418,"useCases":412,"indexable":220},"us-sr-11-7","SR 11-7 model risk management","Federal Reserve and OCC","https://www.federalreserve.gov/boarddocs/srletters/2011/sr1107.htm","US supervisory guidance on model risk management, applied by banks to AI and machine learning models.",{"id":420,"label":421,"issuer":422,"region":149,"url":423,"description":424,"useCases":425,"indexable":220},"uk-atrs","UK Algorithmic Transparency Recording Standard","UK Government","https://www.gov.uk/government/collections/algorithmic-transparency-recording-standard-hub","Mandatory transparency records for algorithmic tools used by UK central government.",16,{"id":427,"label":428,"issuer":429,"region":363,"url":430,"description":431,"useCases":432,"indexable":220},"fatf-recommendations","FATF Recommendations","Financial Action Task Force","https://www.fatf-gafi.org/en/publications/Fatfrecommendations/Fatf-recommendations.html","Global standards for anti money laundering and counter terrorist financing that national rules implement.",15,{"id":434,"label":435,"issuer":148,"region":149,"url":436,"description":437,"useCases":438,"indexable":220},"eu-amlr","EU Anti Money Laundering Regulation","https://eur-lex.europa.eu/eli/reg/2024/1624/oj","Regulation (EU) 2024/1624: the single EU rulebook for customer due diligence, beneficial ownership and suspicious transaction reporting.",14,{"id":440,"label":441,"issuer":148,"region":149,"url":442,"description":443,"useCases":438,"indexable":220},"nis2","NIS2 Directive","https://eur-lex.europa.eu/eli/dir/2022/2555/oj","Directive (EU) 2022/2555 on cybersecurity for essential and important entities, including telecom networks, energy and public administration.",{"id":445,"label":446,"issuer":447,"region":200,"url":448,"description":449,"useCases":450,"indexable":220},"us-bsa","Bank Secrecy Act","FinCEN","https://www.fincen.gov/resources/statutes-and-regulations/bank-secrecy-act","US anti money laundering law: customer due diligence, suspicious activity reports and record keeping.",13,{"id":452,"label":453,"issuer":148,"region":149,"url":454,"description":455,"useCases":456,"indexable":220},"eu-accessibility-act","European Accessibility Act","https://eur-lex.europa.eu/eli/dir/2019/882/oj","Directive (EU) 2019/882: accessibility requirements for banking services, ecommerce and other digital services, applicable since June 2025.",12,{"id":458,"label":459,"issuer":460,"region":200,"url":461,"description":462,"useCases":456,"indexable":220},"hipaa","HIPAA","US Department of Health and Human Services","https://www.hhs.gov/hipaa/index.html","US rules for the privacy and security of protected health information.",{"id":464,"label":465,"issuer":466,"region":363,"url":467,"description":468,"useCases":456,"indexable":220},"telecom-consumer-rules","Telecom consumer protection rules","National telecom regulators","https://www.berec.europa.eu/","National rules on telecom contracts, switching, billing disputes and marketing consent.",{"id":470,"label":471,"issuer":148,"region":149,"url":472,"description":473,"useCases":474,"indexable":220},"eecc","European Electronic Communications Code","https://eur-lex.europa.eu/eli/dir/2018/1972/oj","Directive (EU) 2018/1972: consumer protection, contract, switching and security rules for telecom operators.",11,{"id":476,"label":477,"issuer":478,"region":200,"url":479,"description":480,"useCases":474,"indexable":220},"us-tcpa","Telephone Consumer Protection Act","Federal Communications Commission","https://www.fcc.gov/consumers/guides/stop-unwanted-robocalls-and-texts","US consent rules for automated and prerecorded calls and texts; the FCC has confirmed AI generated voices count as artificial voices.",{"id":482,"label":483,"issuer":394,"region":395,"url":484,"description":485,"useCases":486,"indexable":220},"mas-notice-626","MAS Notice 626","https://www.mas.gov.sg/regulation/notices/notice-626","Singapore's anti money laundering and counter terrorism financing requirements for banks.",10,{"id":488,"label":489,"issuer":148,"region":149,"url":490,"description":491,"useCases":486,"indexable":220},"mifid-ii","MiFID II","https://eur-lex.europa.eu/eli/dir/2014/65/oj","Directive 2014/65/EU on markets in financial instruments: suitability and appropriateness of advice, record keeping and product governance.",{"id":493,"label":494,"issuer":148,"region":149,"url":495,"description":496,"useCases":486,"indexable":220},"eu-psd2","PSD2","https://eur-lex.europa.eu/eli/dir/2015/2366/oj","Payment Services Directive 2: strong customer authentication, transaction risk analysis exemptions and open banking access.",{"id":498,"label":499,"issuer":500,"region":149,"url":501,"description":502,"useCases":503,"indexable":220},"eba-loan-origination","EBA Guidelines on loan origination and monitoring","European Banking Authority","https://www.eba.europa.eu/regulation-and-policy/credit-risk/guidelines-on-loan-origination-and-monitoring","Expectations for credit decisioning, including the use of automated models.",9,{"id":505,"label":506,"issuer":507,"region":200,"url":508,"description":509,"useCases":510,"indexable":220},"us-ecoa-reg-b","ECOA and Regulation B","Consumer Financial Protection Bureau","https://www.consumerfinance.gov/rules-policy/regulations/1002/9/","US fair lending rules, including specific reasons in adverse action notices, which also apply when credit decisions use AI models.",8,{"id":512,"label":513,"issuer":148,"region":149,"url":514,"description":515,"useCases":510,"indexable":220},"solvency-ii","Solvency II","https://eur-lex.europa.eu/eli/dir/2009/138/oj","Directive 2009/138/EC: risk based capital, governance and model requirements for insurers.",{"id":517,"label":518,"issuer":148,"region":149,"url":519,"description":520,"useCases":521,"indexable":220},"eu-idd","Insurance Distribution Directive","https://eur-lex.europa.eu/eli/dir/2016/97/oj","Directive (EU) 2016/97: conduct rules for selling insurance, including demands and needs testing and advice.",6,{"id":523,"label":524,"issuer":525,"region":526,"url":527,"description":528,"useCases":286,"indexable":220},"cbuae-ai-guidance","CBUAE guidance on AI and ML","Central Bank of the UAE","middle-east","https://www.centralbank.ae/","UAE central bank expectations for the enabling technologies, AI and machine learning used by licensed financial institutions.",{"id":530,"label":531,"issuer":532,"region":149,"url":533,"description":534,"useCases":287,"indexable":220},"pra-ss1-23","PRA SS1/23 model risk management","Prudential Regulation Authority","https://www.bankofengland.co.uk/prudential-regulation/publication/2023/may/model-risk-management-principles-for-banks-ss","UK model risk management principles for banks, covering AI and machine learning models.",{"id":536,"label":537,"issuer":538,"region":149,"url":539,"description":540,"useCases":287,"indexable":220},"uk-psr-app-reimbursement","UK APP scam reimbursement rules","Payment Systems Regulator","https://www.psr.org.uk/our-work/app-scams/","Mandatory reimbursement of authorised push payment scam victims by UK payment firms, which shifts scam losses onto banks.",{"id":542,"label":543,"issuer":544,"region":395,"url":545,"description":546,"useCases":60,"indexable":220},"au-scams-prevention-framework","Australian Scams Prevention Framework","Australian Treasury","https://treasury.gov.au/consultation/c2024-573813","Economy wide obligations for banks, telcos and digital platforms to prevent, detect, disrupt and respond to scams.",{"id":548,"label":549,"issuer":148,"region":149,"url":550,"description":551,"useCases":60,"indexable":220},"eu-mar","EU Market Abuse Regulation","https://eur-lex.europa.eu/eli/reg/2014/596/oj","Regulation (EU) 596/2014: insider dealing and market manipulation, including the duty to detect and report suspicious orders and transactions.",{"id":553,"label":554,"issuer":555,"region":200,"url":556,"description":557,"useCases":60,"indexable":220},"us-fcra","Fair Credit Reporting Act","Federal Trade Commission","https://www.ftc.gov/legal-library/browse/statutes/fair-credit-reporting-act","US rules on consumer reports, their accuracy and permissible use, relevant to credit scoring and screening.",1790598294662]