Appendix D. Reference documents

All documents were verified on each organization's official page on October 22, 2026.

National Law Information Center (Republic of Korea)

AI Basic Act [Enforced July 21, 2026] [Act No. 21311, Jan. 20, 2026, Partial Amendment]: Articles 2, 31, 33, 34, 35, 36.
Enforcement Decree of the AI Basic Act [Enforced Aug. 20, 2026] [Presidential Decree No. 36580, Aug. 18, 2026, Amendment by Other Acts]: Article 27.
Personal Information Protection Act (PIPA) [Enforced Sept. 11, 2026] [Act No. 21445, Mar. 10, 2026, Partial Amendment]: Articles 26, 37-2.

NIST (National Institute of Standards and Technology)

AI RMF — Core: Subcategories of GOVERN, MAP, MEASURE, and MANAGE.
AI RMF — AI Risks and Trustworthiness: Characteristics of trustworthy AI, three categories of bias.
NIST AI 600-1 — Generative AI Profile: Risks of generative AI (confabulation, Human-AI Configuration, etc.) and suggestions related to the GV-1.6 inventory.

GAO (U.S. Government Accountability Office)

Government Auditing Standards 2024 Revision (Yellow Book), GAO-24-106786: 2.02–2.04, 3.39, 3.78–3.81, 4.12–4.14, 8.30–8.33, 8.90–8.135, 9.12–9.29, 9.49–9.54. Financial audits, etc., apply to periods beginning on or after December 15, 2025, and performance audits apply to audits beginning on or after December 15, 2025.
Artificial Intelligence: An Accountability Framework, GAO-21-519SP: Governance, data, performance, and monitoring principles and key practices.

PCAOB (Public Company Accounting Oversight Board)

The IIA (Institute of Internal Auditors)

Global Internal Audit Standards (2024): Standards 2.2, 4.2, 7.1, 9.4, 11.5, 13.2, 13.4, 14.1, 14.3, 14.4, 14.5, 15.2.

ISO (International Organization for Standardization)

OWASP

Anthropic