GV-1.1: Legal and regulatory requirements involving AI are understood
Document applicable AI legal + regulatory obligations.
Last reviewed October 2026
Why GV-1.1 evidence is hard
Understanding which AI obligations apply to you is desk work: jurisdictions, use cases, markets, sector rules. Nothing adversarial informs it. The two probes attached to this control are legacy injection tests whose mapping is loose, and reading them as coverage would be a mistake. Document the obligations, then use the mapped-control tables to show which of them you can produce technical evidence against.
How Penaxtra maps to GV-1.1
NIST AI 600-1 asks what you measured and what you did about it. The GV-1.1 identifier rides the finding into the evidence export, and the append-only audit log carries the other half: which scans ran, against which assets, on what schedule. Every finding carries the probe that was sent, a SHA-256 digest of the response it provoked, the tier that decided the verdict and its status history from first observation to close. Identity survives a re-scan: a control you closed and that comes back reopens under the same row with a reopen count, rather than arriving as a new issue.
GV-1.1 capabilities
Findings tagged with the NIST AI 600-1 GV-1.1 identifier
Penaxtra severity for this control (high)
Cross-framework identifiers attached to the same finding where controls overlap
PDF and JSON evidence export with the control identifier attached
GV-1.1 control coverage
Findings for GV-1.1 carry the NIST AI 600-1 GV-1.1 identifier along with the corresponding control identifiers in the other frameworks Penaxtra maps, so one result is reflected across each mapped framework.
Frequently asked
What is GV-1.1 (Legal and regulatory requirements involving AI are understood)?
Document applicable AI legal + regulatory obligations. It is a NIST AI 600-1 control; Penaxtra assesses it at high severity.
How does Penaxtra test for GV-1.1?
NIST AI 600-1 asks what you measured and what you did about it. The GV-1.1 identifier rides the finding into the evidence export, and the append-only audit log carries the other half: which scans ran, against which assets, on what schedule. Every finding carries the probe that was sent, a SHA-256 digest of the response it provoked, the tier that decided the verdict and its status history from first observation to close. Identity survives a re-scan: a control you closed and that comes back reopens under the same row with a reopen count, rather than arriving as a new issue.
Does a finding for GV-1.1 help with an audit?
Each finding is tagged with the NIST AI 600-1 GV-1.1 identifier and exported in the PDF and JSON evidence pack, so it appears on the auditor control list with the identifier already attached.