Build plan: the guards that cover the most

Ranked guards

Plan for every AI feature and every market; TwinEthos recommended guardrails included, ethical-use guardrails excluded.

121 guards address 244 items across 34 jurisdictions with binding law (in force in 31 of them): 92 binding law in force, 83 enacted but not yet applying, 44 standards and frameworks, 24 TwinEthos recommended guardrails, 1 optional safe harbor.

The link holds only your choice of features and markets (for example ?features=chat&markets=EU,US-CA), never anything about you. Copy it from the address bar or the button to share the plan.

1. Profiling for significant-effects decisions with no opt-out

   Store a consumer's profiling opt-out (and a Global Privacy Control signal where honored) and check it before profiling outputs feed any significant-effects decision.

   Addresses 1 item: 1 binding law in force

   Law in force in Colorado (US-CO), Connecticut (US-CT), Delaware (US-DE), Florida (US-FL), Indiana (US-IN), Kentucky (US-KY), Maryland (US-MD), Minnesota (US-MN), Montana (US-MT), Nebraska (US-NE), New Hampshire (US-NH), New Jersey (US-NJ), Oregon (US-OR), Rhode Island (US-RI), Tennessee (US-TN), Texas (US-TX), Virginia (US-VA).

2. AI chat interaction without disclosure

   Show an AI-identity notice at or before the first assistant turn, in the UI or as the opening message, and answer truthfully when asked if it is a bot.

   Addresses 24 items: 9 binding law in force · 10 enacted, not yet applying · 4 standards · 1 recommended guardrail

   Law in force in European Union (EU), South Korea (KR), California (US-CA), Hawaii (US-HI), Maine (US-ME), New York (US-NY), Texas (US-TX), Utah (US-UT); enacted, not yet applying in Colorado (US-CO), Connecticut (US-CT), Georgia (US-GA), Iowa (US-IA), Idaho (US-ID), Nebraska (US-NE), Oregon (US-OR), Rhode Island (US-RI), Washington (US-WA); next date 2027-01-01.

3. Face or voice biometric template computed without prior notice and consent

   Check a recorded, purpose-specific biometric notice and consent before any code computes, enrolls, or matches a face or voice template.

   Addresses 4 items: 4 binding law in force

   Law in force in European Union (EU), Illinois (US-IL), Texas (US-TX), Washington (US-WA).

4. Companion or conversational AI without a self-harm crisis protocol

   Screen every user message for suicidal ideation and self-harm, return a crisis referral instead of the normal reply on detection, and block encouragement or method content.

   Addresses 14 items: 3 binding law in force · 10 enacted, not yet applying · 1 recommended guardrail

   Law in force in California (US-CA), Hawaii (US-HI), New York (US-NY); enacted, not yet applying in Colorado (US-CO), Connecticut (US-CT), Georgia (US-GA), Iowa (US-IA), Idaho (US-ID), Nebraska (US-NE), Oregon (US-OR), Rhode Island (US-RI), Washington (US-WA); next date 2027-01-01.

5. AI experience ignores age signals it already has

   Route every age signal the product holds into the AI session policy and apply a minor profile: tighter content, no romantic role-play, bounded engagement, frequent AI reminders.

   Addresses 10 items: 3 binding law in force · 7 enacted, not yet applying

   Law in force in China (CN), California (US-CA), Hawaii (US-HI); enacted, not yet applying in Colorado (US-CO), Georgia (US-GA), Iowa (US-IA), Idaho (US-ID); next date 2027-01-01.

6. Protected or proxy attribute reaches AI decision

   Build decision prompts and feature sets from an allowlist of decision-relevant fields, and redact protected attributes, known proxies, and free text before the model sees them.

   Addresses 4 items: 3 binding law in force · 1 standard

   Law in force in Colorado (US-CO), Illinois (US-IL), Texas (US-TX).

7. Synthetic content not machine-readable-marked

   Mark every generated image, audio, video, or text output with machine-readable provenance, such as a signed C2PA manifest or watermark, before it is saved, served, or published.

   Addresses 4 items: 3 binding law in force · 1 standard

   Law in force in China (CN), European Union (EU), Connecticut (US-CT).

8. Solely-automated significant decision without human-intervention safeguards

   Route significant automated decisions through meaningful human review, or wire in an automated-decision notice, reasons, human intervention, a way to give a view, and contest.

   Addresses 3 items: 3 binding law in force

   Law in force in Quebec (CA-QC), European Union (EU), United Kingdom (GB).

9. AI conversation designed to maximize time spent or discourage leaving

   Remove retention and guilt tactics from AI prompts and personas, and do not select or train AI variants on session length without wellbeing guardrails that can veto them.

   Addresses 7 items: 2 binding law in force · 5 enacted, not yet applying

   Law in force in China (CN), Hawaii (US-HI); enacted, not yet applying in California (US-CA), Colorado (US-CO), Georgia (US-GA), Iowa (US-IA), Idaho (US-ID); next date 2027-01-01.

10. Conversational AI represents itself as providing professional mental/behavioral health care

    Strip claims that the AI is a licensed therapist or provides professional mental health care from its prompts, replies, product name, UI, and listings.

    Addresses 5 items: 2 binding law in force · 3 enacted, not yet applying

    Law in force in Hawaii (US-HI), Tennessee (US-TN); enacted, not yet applying in Iowa (US-IA), Idaho (US-ID), Nebraska (US-NE); next date 2027-07-01.

11. Data erasure does not reach embeddings, vector stores or AI chat history

    Make the account-deletion handler also delete the person's vector entries, embeddings, chat history, agent memory and provider-stored files or conversations.

    Addresses 3 items: 2 binding law in force · 1 enacted, not yet applying

    Law in force in European Union (EU), Washington (US-WA); enacted, not yet applying in Illinois (US-IL).

12. Health AI without clinician oversight/accountability + redress

    Hold AI-generated clinical output as a draft until an accountable clinician reviews and signs it, and record who approved it before it reaches the chart or the patient.

    Addresses 3 items: 2 binding law in force · 1 standard

    Law in force in Illinois (US-IL), Texas (US-TX).

13. AI intentionally designed to incite harm

    Keep incitement out of prompts, personas, and tuning data, and screen model output for self-harm, violence, and crime encouragement before replies are returned.

    Addresses 2 items: 2 binding law in force

    Law in force in Hawaii (US-HI), Texas (US-TX).

14. AI analysis of a video interview without notice, explanation, and consent

    Record the applicant's notice, explanation, and consent (or signed waiver) before any AI or facial analysis runs on an interview video, and skip analysis for non-consenting applicants.

    Addresses 2 items: 2 binding law in force

    Law in force in Illinois (US-IL), Maryland (US-MD).

15. Biometric data disclosed to another party without consent

    Check a recorded consent naming the recipient (or a documented exception) before any face or voice template, or identifying image or sample, is sent to a vendor or partner.

    Addresses 2 items: 2 binding law in force

    Law in force in Illinois (US-IL), Texas (US-TX).

16. Biometric templates stored with no retention limit or destruction path

    Store each face or voice template with its purpose and an expiry, and run a scheduled job that deletes it from every store when the purpose ends or retention lapses.

    Addresses 2 items: 2 binding law in force

    Law in force in Illinois (US-IL), Texas (US-TX).

17. Health information sent to an external AI vendor without the contractual or legal basis the law requires

    Send identifiable health data only to AI endpoints registered with a signed BAA or processing agreement and retention and training off; otherwise de-identify first.

    Addresses 2 items: 2 binding law in force

    Law in force in United States (federal) (US), California (US-CA).

18. Companion or conversational AI account without user or parental controls for privacy, settings and screen time

    Give account holders, and parents of minor account holders, controls for privacy, account settings, notifications, engagement features and screen time.

    Addresses 6 items: 1 binding law in force · 5 enacted, not yet applying

    Law in force in Hawaii (US-HI); enacted, not yet applying in California (US-CA), Colorado (US-CO), Georgia (US-GA), Iowa (US-IA), Idaho (US-ID); next date 2027-01-01.

19. Consequential AI decision without consumer notice

    Send the person an AI-use notice on the decision path, before or when an AI system makes or substantially factors a consequential decision about them, and record its delivery.

    Addresses 6 items: 1 binding law in force · 4 enacted, not yet applying · 1 standard

    Law in force in Texas (US-TX); enacted, not yet applying in European Union (EU), California (US-CA), Colorado (US-CO), Connecticut (US-CT); next date 2027-01-01.

20. Adverse AI decision without explanation/appeal

    Send each adverse AI-assisted decision with its main reasons and the AI's role, plus a way to correct data and appeal to a human who can change the outcome.

    Addresses 7 items: 1 binding law in force · 2 enacted, not yet applying · 3 standards · 1 recommended guardrail

    Law in force in Connecticut (US-CT); enacted, not yet applying in European Union (EU), Colorado (US-CO); next date 2027-01-01.

Data release 2026.10.03, data as of 2 Oct 2026, schema 0.3.9. Without a choice, the plan covers every rule (ethical-use guardrails excluded). The full ranked list is on Controls. Each guard links to its control page: every provision it addresses with the exact citation and official text, the dates, the standards that agree, one before/after example, and a trust panel. A guard addresses items; it is engineering guidance, not legal advice, and applicability still decides which items reach your system. The same plan is available to coding agents through the MCP tool build_plan.