The rules draw on these standards, laws and research. Last reviewed November 2026.
Humane design
- Center for Humane Technology: Humane Design Principles, AI Roadmap, Preserving What Makes Us Human, Foundations of Humane Technology course (free)
- Consequence Scanning (Open Data Institute)
- Deceptive Patterns catalogue
- Calm Technology principles
- US FTC, Bringing Dark Patterns to Light (2022)
- EDPB Guidelines 03/2022 on deceptive design patterns
Security
- NIST Secure Software Development Framework (SP 800-218)
- OWASP Application Security Verification Standard (ASVS)
- OWASP Mobile Application Security (MASVS / MASTG)
- OWASP Top 10 (2025) and API Security Top 10
- MITRE / CISA CWE Top 25 (2025)
- SLSA, Sigstore, CycloneDX, SPDX, OpenSSF Scorecard
- CISA Known Exploited Vulnerabilities catalog
- NIST SP 800-61 Rev. 3, Incident Response
- security.txt (RFC 9116)
AI
- OWASP Top 10 for LLM Applications
- NIST AI Risk Management Framework and Generative AI Profile (AI 600-1)
- Microsoft Guidelines for Human-AI Interaction
- C2PA Content Credentials
Engagement
- Nir Eyal, Hooked (2014) and Indistractable (2019); summaries by Farnam Street and Stanford GSB
- Eyal on the regret test: Behavioral Scientist, Quartz
- Big Think critique of variable rewards
Accessibility
- W3C WCAG 2.2
Law (summary only, not legal advice)
- EU: GDPR; ePrivacy Directive Art. 5(3) (cookies); Digital Services Act; AI Act (transparency duties from 2 August 2026); Cyber Resilience Act (vulnerability reporting from 11 September 2026); Product Liability Directive (software covered from 9 December 2026); European Accessibility Act.
- UK: UK GDPR; Data (Use and Access) Act 2025; Age Appropriate Design Code (Children's Code); Online Safety Act.
- US: FTC Act Section 5; COPPA (amended rule, full compliance 22 April 2026); TAKE IT DOWN Act (48-hour removals from 19 May 2026); ADA; state privacy laws (about 20 states, Global Privacy Control required in about 12); California SB 243 (companion chatbots) and other state AI laws.
- Elsewhere: Canada (PIPEDA, Quebec Law 25), Brazil (LGPD), China (PIPL, AI labelling rules), India (DPDP Act and Rules), South Korea (AI Basic Act), Japan (APPI).