# GOV-12 Jurisdictional dependency register

Domain: GOV Governance & Accountability · HI-AAF v1.3 · Public review · https://humanintel.net/standard/gov/gov-12

A register of regulatory and jurisdictional dependencies that could force loss of a model or provider is maintained, reviewed on a documented cadence, and feeds the Agent Risk Register.

The organization maintains a register of regulatory and jurisdictional dependencies that could force loss of a model or provider, including export controls and sanctions exposure, data-localization mandates, and restrictions on access by the nationality or location of the user or operator. Each dependency is mapped, per model provider, to the affected agents and to the organization's own operating entities and personnel, including non-domestic subsidiaries and staff, whose access may be restricted independently of the agent's technical posture. The register is reviewed at a documented cadence and on notice of relevant regulatory change, and feeds the Agent Risk Register (GOV-03).

## Maturity

- L1 Ad hoc: Controls exist informally; documentation is incomplete; no consistent review.
- L2 Documented: Controls are written down; ownership is assigned; review cadence is defined.
- L3 Operated: Controls are followed in practice; evidence is collected; deviations are tracked. Published criterion for GOV-12: Register covers all material model providers; each dependency is mapped to affected agents and operating entities; review has occurred within the documented cadence: semi-annual at minimum and on notice of relevant regulatory change; identified dependencies appear in the Agent Risk Register.
- L4 Measured: Control effectiveness is measured against documented thresholds; trends are reported.
- L5 Continuously Improved: Controls evolve based on incident learning; maturity gains are evidenced over time.

## Evidence an assessor asks for

- Register covers all material model providers.
- Each dependency is mapped to affected agents and operating entities.
- Review has occurred within the documented cadence: semi-annual at minimum and on notice of relevant regulatory change.
- Identified dependencies appear in the Agent Risk Register.

## Framework mappings

- NIST AI RMF: GOVERN 1.1, MAP 4.1
- EU AI Act: Art. 9, Art. 17, Art. 25
- Singapore: MAIGF Internal Governance

Mappings are directional: meeting this control evidences but does not by itself satisfy the external requirement.

## Related

- Cites GOV-03 Agent Risk Register: https://humanintel.net/standard/gov/gov-03

## Cite this control

Human Intelligence. HI-AAF v1.3, GOV-12 Jurisdictional dependency register. Public review edition, July 2026. https://humanintel.net/standard/gov/gov-12