{"data":[{"slug":"ai-governance-policy-and-accountability","id":"AIPT-CTL-0002","title":"AI governance policy and accountability structure","kind":"policy","kind_label":"Policy","purpose":"Gives the organisation a single approved statement of how it will develop, buy and use AI, and names the people who are answerable for it, so that every other AI control has a mandate and an owner.\n","description":"Senior management approves a short AI policy that sets the organisation's risk appetite, the principles it commits to, the scope of systems covered and the decisions that must be escalated. The policy is backed by a responsibility map: an executive sponsor, a governance lead, system owners and the committee or forum that reviews high-risk cases. Meeting cadence, escalation routes and the relationship to existing risk, privacy and security functions are written down. The policy is reviewed at least once a year and whenever a new law or a material incident changes the picture, and decisions of the governance forum are minuted so that a regulator or auditor can trace who decided what and when.\n","owner_role":"Executive sponsor for AI","frequency":"annual","frequency_label":"Annual","risk_subdomains":["6.5","5.2"],"evidence":[{"type":"policy_document","title":"AI policy","description":"Approved and versioned statement of scope, principles, risk appetite and escalation rules."},{"type":"approval_record","title":"Board or executive approval of the AI policy","description":null},{"type":"meeting_record","title":"AI governance forum minutes","description":"Decisions, attendees and actions from each governance meeting."},{"type":"register_entry","title":"AI responsibility map","description":"Named owner for each AI role and for each system."}],"framework_references":[{"framework":"iso_42001","framework_name":"ISO/IEC 42001:2023","reference":"Clause 5.1, 5.2, 5.3, 9.3; Annex A.2, A.3","note":"Editorial mapping to leadership, policy, roles and management review.","confidence_level":"high"},{"framework":"nist_ai_rmf","framework_name":"NIST AI RMF 1.0","reference":"GOVERN 1.1, 1.2, 1.3, 2.1, 3.1","note":null,"confidence_level":"high"},{"framework":"oecd_ai_principles","framework_name":"OECD AI Principles","reference":"Principle 1.5 Accountability","note":null,"confidence_level":"medium"}],"obligations":[{"slug":"eu-ai-act-quality-management-system","title":"Operate a quality management system","relationship":"supports","note":"Accountability and resource allocation.","confidence_level":"medium","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-quality-management-system"},{"slug":"australia-vaiss-accountability-and-risk-management","title":"Establish accountability processes and a risk-management process (guardrails 1 and 2)","relationship":"satisfies","note":"Guardrail 1: accountable owner, policy and compliance strategy.","confidence_level":"high","is_binding":false,"policy":"australia-voluntary-ai-safety-standard","jurisdiction":"australia","url":"https://aipolicytracker.org/obligations/australia-vaiss-accountability-and-risk-management"},{"slug":"eu-ai-act-art-16-provider-obligations","title":"Providers must meet the full set of provider duties for high-risk AI","relationship":"satisfies","note":"Assigns each provider duty to a named owner with a reporting line.","confidence_level":"medium","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-16-provider-obligations"},{"slug":"eu-ai-act-art-21-cooperation-with-authorities","title":"Providers must supply conformity evidence and log access to authorities on request","relationship":"supports","note":"Names the regulator liaison and escalation path.","confidence_level":"medium","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-21-cooperation-with-authorities"},{"slug":"eu-ai-act-art-26-10-post-remote-biometric-identification-authorisation","title":"Law-enforcement deployers must obtain authorisation for post-remote biometric identification and report annually","relationship":"supports","note":"Authorisation workflow ownership.","confidence_level":"medium","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-26-10-post-remote-biometric-identification-authorisation"},{"slug":"us-california-sb-53-whistleblower-protections","title":"Frontier developers must protect employees who report catastrophic-risk concerns","relationship":"satisfies","note":"Whistleblower policy, anonymous channel and escalation to the board.","confidence_level":"medium","is_binding":true,"policy":"us-california-sb-53","jurisdiction":"us-california","url":"https://aipolicytracker.org/obligations/us-california-sb-53-whistleblower-protections"},{"slug":"us-nist-ai-rmf-govern","title":"Establish AI governance policies, roles and accountability (Govern)","relationship":"satisfies","note":"Policy, roles, risk tolerance and culture map to the Govern outcomes.","confidence_level":"high","is_binding":false,"policy":"us-nist-ai-rmf","jurisdiction":"us","url":"https://aipolicytracker.org/obligations/us-nist-ai-rmf-govern"},{"slug":"nepal-ai-policy-responsible-ai-principles","title":"Government bodies to promote ethical, responsible and inclusive AI (policy commitment)","relationship":"supports","note":"A policy referencing the national principles positions public bodies and vendors for future measures.","confidence_level":"low","is_binding":false,"policy":"nepal-national-ai-policy","jurisdiction":"nepal","url":"https://aipolicytracker.org/obligations/nepal-ai-policy-responsible-ai-principles"},{"slug":"singapore-mgf-internal-governance","title":"Establish internal governance structures and measures for AI","relationship":"satisfies","note":"Roles, board oversight and internal controls for AI.","confidence_level":"high","is_binding":false,"policy":"singapore-model-ai-governance-framework","jurisdiction":"singapore","url":"https://aipolicytracker.org/obligations/singapore-mgf-internal-governance"},{"slug":"india-ai-guidelines-principles-and-risk-based-governance","title":"Adopt the guiding principles and risk-based governance (voluntary)","relationship":"satisfies","note":"Embeds the principles and proportionate risk classification in an approved policy.","confidence_level":"medium","is_binding":false,"policy":"india-ai-governance-guidelines","jurisdiction":"india","url":"https://aipolicytracker.org/obligations/india-ai-guidelines-principles-and-risk-based-governance"},{"slug":"south-korea-ai-basic-act-art-34-high-impact-ai-user-protection-and-documentation","title":"Operators of high-impact AI must prepare user-protection measures and keep records of their safety and trust measures","relationship":"supports","note":"User-protection plan and ownership.","confidence_level":"medium","is_binding":true,"policy":"south-korea-framework-act-on-the-development-of-artificial-intelligence-and-establishment-of-a-foundation-for","jurisdiction":"south-korea","url":"https://aipolicytracker.org/obligations/south-korea-ai-basic-act-art-34-high-impact-ai-user-protection-and-documentation"},{"slug":"uae-ai-strategy-ethics-and-governance-commitment","title":"Government commitment to AI ethics, governance and regulation (strategy objective)","relationship":"supports","note":"Referencing the UAE ethics principles and charter in the organisation's own AI policy.","confidence_level":"low","is_binding":false,"policy":"uae-national-ai-strategy-2031","jurisdiction":"uae","url":"https://aipolicytracker.org/obligations/uae-ai-strategy-ethics-and-governance-commitment"},{"slug":"uk-principles-accountability-governance","title":"Establish accountability and governance for AI","relationship":"satisfies","note":"Clear lines of accountability and a governance decision log.","confidence_level":"high","is_binding":false,"policy":"uk-ai-regulation-white-paper","jurisdiction":"uk","url":"https://aipolicytracker.org/obligations/uk-principles-accountability-governance"},{"slug":"us-colorado-deployer-risk-management-program","title":"Deployers must implement a risk management policy and programme","relationship":"satisfies","note":"The risk-management policy, principles and personnel the statute expects.","confidence_level":"medium","is_binding":true,"policy":"us-colorado-ai-act","jurisdiction":"us-colorado","url":"https://aipolicytracker.org/obligations/us-colorado-deployer-risk-management-program"},{"slug":"us-colorado-ai-act-deployer-reasonable-care","title":"Deployers must use reasonable care to avoid algorithmic discrimination","relationship":"satisfies","note":"Ownership and the standard of care documented for each system.","confidence_level":"medium","is_binding":true,"policy":"us-colorado-ai-act","jurisdiction":"us-colorado","url":"https://aipolicytracker.org/obligations/us-colorado-ai-act-deployer-reasonable-care"},{"slug":"us-eo-14179-agency-review-of-prior-actions","title":"Federal agencies must review and revise actions inconsistent with the new AI policy","relationship":"supports","note":"Vendors track which agency requirements still apply through their policy review.","confidence_level":"low","is_binding":true,"policy":"us-executive-order-14179","jurisdiction":"us","url":"https://aipolicytracker.org/obligations/us-eo-14179-agency-review-of-prior-actions"}],"related_controls":["ai-system-inventory","ai-risk-assessment","ai-literacy-and-role-based-training","ai-quality-management-system"],"review_status":"verified","confidence_level":"medium","last_verified_at":"2026-09-26","reviewed_by":"Bhaskar Bhatt","updated_at":"2026-10-15T06:46:22+00:00","url":"https://aipolicytracker.org/controls/ai-governance-policy-and-accountability","context_url":"https://aipolicytracker.org/controls/ai-governance-policy-and-accountability.md"},{"slug":"ai-impact-assessment","id":"AIPT-CTL-0003","title":"AI impact and fundamental-rights impact assessment","kind":"process","kind_label":"Process","purpose":"Examines how a planned AI use will affect the people, groups and communities it touches, with particular attention to discrimination and rights, and records the mitigations chosen before the system goes live.\n","description":"Before deployment, and again on material change or a set anniversary, the deploying team completes a templated assessment that describes the use, the decisions or outputs it influences, the people affected and the ways they could be harmed. It examines disparate effects across relevant groups, consults affected stakeholders where practical, and documents the transparency, oversight and monitoring measures that will accompany the deployment. The template is designed so that a single exercise can produce the outputs that data-protection, algorithmic-discrimination and rights-based regimes each expect. Completed assessments are retained for the period the strictest applicable rule requires and are available to regulators on request.\n","owner_role":"AI system owner","frequency":"per_system","frequency_label":"Once per AI system","risk_subdomains":["1.1","1.3","5.2","6.2"],"evidence":[{"type":"impact_assessment","title":"AI impact assessment","description":"Completed assessment of purpose, affected people, discrimination risk, mitigations and monitoring plan."},{"type":"approval_record","title":"Impact assessment approval","description":"Sign-off by the accountable owner and, where required, the privacy or legal function."},{"type":"procedure","title":"Impact assessment procedure and template","description":null}],"framework_references":[{"framework":"iso_42001","framework_name":"ISO/IEC 42001:2023","reference":"Clause 6.1.4, 8.4; Annex A.5","note":null,"confidence_level":"high"},{"framework":"iso_42005","framework_name":"ISO/IEC 42005:2025","reference":"ISO/IEC 42005 Clause 5, 6","note":"Guidance on running and documenting AI system impact assessments.","confidence_level":"medium"},{"framework":"nist_ai_rmf","framework_name":"NIST AI RMF 1.0","reference":"MAP 5.1, 5.2; MEASURE 2.11","note":null,"confidence_level":"high"},{"framework":"oecd_ai_principles","framework_name":"OECD AI Principles","reference":"Principle 1.2 Human-centred values and fairness","note":null,"confidence_level":"medium"}],"obligations":[{"slug":"eu-ai-act-fundamental-rights-impact-assessment","title":"Carry out a fundamental rights impact assessment before deployment","relationship":"satisfies","note":"A rights-focused assessment template covering the required elements.","confidence_level":"high","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-fundamental-rights-impact-assessment"},{"slug":"eu-ai-act-art-26-7-worker-information","title":"Employers must inform workers and their representatives before using high-risk AI at work","relationship":"supports","note":"Identifies the affected worker groups to notify.","confidence_level":"medium","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-26-7-worker-information"},{"slug":"eu-ai-act-art-26-9-dpia-using-provider-information","title":"Deployers must use the provider's transparency information in their data protection impact assessment","relationship":"supports","note":"Shared inputs with the fundamental rights impact assessment.","confidence_level":"medium","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-26-9-dpia-using-provider-information"},{"slug":"india-dpdp-significant-data-fiduciary-duties","title":"Significant Data Fiduciaries must appoint a DPO and run impact assessments and audits","relationship":"supports","note":"Assessment content can be shared with the DPIA.","confidence_level":"medium","is_binding":true,"policy":"india-dpdp-act","jurisdiction":"india","url":"https://aipolicytracker.org/obligations/india-dpdp-significant-data-fiduciary-duties"},{"slug":"uk-principles-fairness","title":"Use AI in ways that are fair and do not discriminate unlawfully","relationship":"supports","note":"Identifies groups at risk of unfair treatment.","confidence_level":"medium","is_binding":false,"policy":"uk-ai-regulation-white-paper","jurisdiction":"uk","url":"https://aipolicytracker.org/obligations/uk-principles-fairness"},{"slug":"uk-ico-dpia-for-ai","title":"Carry out a data protection impact assessment for high-risk AI processing","relationship":"supports","note":"Bias, explainability and oversight analysis reused in the DPIA.","confidence_level":"medium","is_binding":true,"policy":"uk-ico-ai-data-protection-guidance","jurisdiction":"uk","url":"https://aipolicytracker.org/obligations/uk-ico-dpia-for-ai"},{"slug":"us-nist-ai-rmf-map","title":"Map context, intended use and potential impacts (Map)","relationship":"satisfies","note":"Context, affected people and impact analysis produced before development.","confidence_level":"medium","is_binding":false,"policy":"us-nist-ai-rmf","jurisdiction":"us","url":"https://aipolicytracker.org/obligations/us-nist-ai-rmf-map"},{"slug":"south-korea-ai-basic-act-art-35-high-impact-ai-impact-assessment","title":"Operators of high-impact AI should assess its impact on fundamental rights before use","relationship":"satisfies","note":"Fundamental-rights assessment before deployment.","confidence_level":"high","is_binding":false,"policy":"south-korea-framework-act-on-the-development-of-artificial-intelligence-and-establishment-of-a-foundation-for","jurisdiction":"south-korea","url":"https://aipolicytracker.org/obligations/south-korea-ai-basic-act-art-35-high-impact-ai-impact-assessment"},{"slug":"uae-pdpl-impact-assessment-new-technologies","title":"Conduct a data protection impact assessment for high-risk processing using new technologies","relationship":"supports","note":"Broader impact analysis feeds the DPIA.","confidence_level":"medium","is_binding":true,"policy":"uae-personal-data-protection-law","jurisdiction":"uae","url":"https://aipolicytracker.org/obligations/uae-pdpl-impact-assessment-new-technologies"},{"slug":"us-colorado-deployer-impact-assessment","title":"Deployers must complete impact assessments for high-risk AI","relationship":"satisfies","note":"Templated assessment aligned to the statutory elements, refreshed annually and on material change.","confidence_level":"high","is_binding":true,"policy":"us-colorado-ai-act","jurisdiction":"us-colorado","url":"https://aipolicytracker.org/obligations/us-colorado-deployer-impact-assessment"},{"slug":"us-omb-m-25-21-high-impact-ai-practices","title":"Apply minimum risk-management practices to high-impact AI","relationship":"supports","note":"AI impact assessment content.","confidence_level":"medium","is_binding":true,"policy":"us-omb-m-25-21","jurisdiction":"us","url":"https://aipolicytracker.org/obligations/us-omb-m-25-21-high-impact-ai-practices"}],"related_controls":["ai-risk-assessment","privacy-and-data-protection-for-ai","human-oversight-and-override","ai-interaction-and-use-disclosure"],"review_status":"verified","confidence_level":"high","last_verified_at":"2026-09-26","reviewed_by":"Bhaskar Bhatt","updated_at":"2026-10-15T06:46:22+00:00","url":"https://aipolicytracker.org/controls/ai-impact-assessment","context_url":"https://aipolicytracker.org/controls/ai-impact-assessment.md"},{"slug":"ai-incident-management-and-reporting","id":"AIPT-CTL-0004","title":"AI incident management and regulatory reporting","kind":"process","kind_label":"Process","purpose":"Ensures that harm or near-harm caused by an AI system is detected, contained, investigated and, where a rule requires it, reported to the right authority and affected people within the applicable time limit.\n","description":"The existing incident-response playbook is extended with AI-specific triggers: harmful or discriminatory output, safety failures, security breaches involving models or training data, misuse of the system and loss of control over an agent. A severity scale maps each trigger to the reporting regimes that may apply and their clocks, and a named coordinator decides within a set time whether a report is due. Investigation records the timeline, impact, root cause and corrective action, and lessons feed back into testing, monitoring and the risk register. Reporting channels for staff, users and third parties are published, and reports made to authorities are logged.\n","owner_role":"Incident coordinator","frequency":"continuous","frequency_label":"Continuous","risk_subdomains":["6.5","7.3","2.2","4.2"],"evidence":[{"type":"procedure","title":"AI incident response playbook","description":"Triggers, severity scale, reporting clocks per regime, roles and escalation."},{"type":"incident_record","title":"AI incident record","description":"Timeline, impact, root cause, corrective action and reporting decisions for one incident."},{"type":"regulatory_filing","title":"Incident report to an authority","description":null}],"framework_references":[{"framework":"iso_42001","framework_name":"ISO/IEC 42001:2023","reference":"Clause 10.2; Annex A.8.3, A.8.4","note":null,"confidence_level":"high"},{"framework":"nist_ai_rmf","framework_name":"NIST AI RMF 1.0","reference":"MANAGE 4.1, 4.3; GOVERN 4.3, 6.2","note":null,"confidence_level":"high"},{"framework":"iso_27001","framework_name":"ISO/IEC 27001:2022","reference":"Annex A 5.24 to 5.28 Information security incident management","note":null,"confidence_level":"medium"}],"obligations":[{"slug":"eu-ai-act-gpai-systemic-risk","title":"Manage systemic risk for high-impact general-purpose models","relationship":"supports","note":"Tracking and reporting serious incidents to the AI Office.","confidence_level":"medium","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-gpai-systemic-risk"},{"slug":"eu-ai-act-serious-incident-reporting","title":"Report serious incidents to market surveillance authorities","relationship":"satisfies","note":"Serious-incident criteria, causal-link decision and the reporting clock in the playbook.","confidence_level":"high","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-serious-incident-reporting"},{"slug":"eu-ai-act-art-20-corrective-actions-and-information","title":"Providers must take corrective action and inform the supply chain about non-conforming high-risk AI","relationship":"satisfies","note":"Investigation, corrective action and notification of authorities and the supply chain.","confidence_level":"high","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-20-corrective-actions-and-information"},{"slug":"eu-ai-act-art-26-5-deployer-monitoring-and-suspension","title":"Deployers must monitor high-risk AI, suspend use on risk and report serious incidents","relationship":"satisfies","note":"Suspension decision and notifications to provider and authority.","confidence_level":"high","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-26-5-deployer-monitoring-and-suspension"},{"slug":"eu-ai-act-art-55-systemic-risk-incident-reporting","title":"Providers of systemic-risk GPAI models must track and report serious incidents to the AI Office","relationship":"satisfies","note":"Model-level incident criteria, log and AI Office reporting.","confidence_level":"high","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-55-systemic-risk-incident-reporting"},{"slug":"eu-ai-act-post-market-monitoring","title":"Operate a post-market monitoring system","relationship":"supports","note":"Monitoring findings escalate into incidents.","confidence_level":"medium","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-post-market-monitoring"},{"slug":"us-california-sb-53-critical-safety-incident-reporting","title":"Report critical safety incidents to the Office of Emergency Services","relationship":"satisfies","note":"Critical-safety-incident criteria and escalation to the state office within the statutory time.","confidence_level":"high","is_binding":true,"policy":"us-california-sb-53","jurisdiction":"us-california","url":"https://aipolicytracker.org/obligations/us-california-sb-53-critical-safety-incident-reporting"},{"slug":"india-dpdp-security-and-breach-notification","title":"Implement reasonable security safeguards and notify breaches","relationship":"satisfies","note":"Breach notification to the Board and individuals within the incident process.","confidence_level":"medium","is_binding":true,"policy":"india-dpdp-act","jurisdiction":"india","url":"https://aipolicytracker.org/obligations/india-dpdp-security-and-breach-notification"},{"slug":"us-california-sb-53-whistleblower-protections","title":"Frontier developers must protect employees who report catastrophic-risk concerns","relationship":"supports","note":"Reports feed the incident process.","confidence_level":"medium","is_binding":true,"policy":"us-california-sb-53","jurisdiction":"us-california","url":"https://aipolicytracker.org/obligations/us-california-sb-53-whistleblower-protections"},{"slug":"us-colorado-ai-act-developer-disclosure-to-attorney-general","title":"Developers must notify the Attorney General and deployers of discovered algorithmic discrimination","relationship":"satisfies","note":"Discrimination findings treated as reportable incidents with the 90-day clock.","confidence_level":"high","is_binding":true,"policy":"us-colorado-ai-act","jurisdiction":"us-colorado","url":"https://aipolicytracker.org/obligations/us-colorado-ai-act-developer-disclosure-to-attorney-general"},{"slug":"us-nist-ai-rmf-manage","title":"Prioritise, respond to and monitor AI risks (Manage)","relationship":"supports","note":"Incident response and communication outcomes.","confidence_level":"high","is_binding":false,"policy":"us-nist-ai-rmf","jurisdiction":"us","url":"https://aipolicytracker.org/obligations/us-nist-ai-rmf-manage"},{"slug":"singapore-mgf-genai-incident-reporting-and-provenance","title":"Report incidents and mark AI-generated content (generative AI framework)","relationship":"satisfies","note":"Incident reporting channel and process.","confidence_level":"medium","is_binding":false,"policy":"singapore-model-ai-governance-framework","jurisdiction":"singapore","url":"https://aipolicytracker.org/obligations/singapore-mgf-genai-incident-reporting-and-provenance"},{"slug":"south-korea-ai-basic-act-art-32-safety-measures-for-high-performance-ai","title":"Operators of AI above the compute threshold must run lifecycle risk management and report safety results","relationship":"supports","note":"Incident monitoring and response arm of the risk management system.","confidence_level":"medium","is_binding":true,"policy":"south-korea-framework-act-on-the-development-of-artificial-intelligence-and-establishment-of-a-foundation-for","jurisdiction":"south-korea","url":"https://aipolicytracker.org/obligations/south-korea-ai-basic-act-art-32-safety-measures-for-high-performance-ai"},{"slug":"us-colorado-ai-act-deployer-disclosure-to-attorney-general","title":"Deployers must notify the Attorney General of discovered algorithmic discrimination","relationship":"satisfies","note":"Discrimination discovery treated as a reportable incident with the statutory clock.","confidence_level":"high","is_binding":true,"policy":"us-colorado-ai-act","jurisdiction":"us-colorado","url":"https://aipolicytracker.org/obligations/us-colorado-ai-act-deployer-disclosure-to-attorney-general"}],"related_controls":["post-market-monitoring-and-drift-detection","record-keeping-and-logging","genai-red-team-testing","privacy-and-data-protection-for-ai"],"review_status":"verified","confidence_level":"high","last_verified_at":"2026-09-26","reviewed_by":"Bhaskar Bhatt","updated_at":"2026-10-15T06:46:22+00:00","url":"https://aipolicytracker.org/controls/ai-incident-management-and-reporting","context_url":"https://aipolicytracker.org/controls/ai-incident-management-and-reporting.md"},{"slug":"ai-interaction-and-use-disclosure","id":"AIPT-CTL-0005","title":"AI interaction and use disclosure notices","kind":"process","kind_label":"Process","purpose":"Tells people, in plain language and at the right moment, that they are interacting with an AI system, that AI is being used in a decision about them or that their data feeds an AI system.\n","description":"The organisation keeps a catalogue of the situations in which people meet its AI systems and, for each, approves a notice: a conversational banner, a pre-decision statement, a privacy-notice section or a product label. Notices say what the system does, what it is for, what it means for the person and where to ask questions or opt out where that right exists. Legal, product and accessibility reviewers sign off wording and placement, the live text is versioned, and a periodic check confirms that notices still appear where the system is used. Public notices about AI use are kept in a single, findable place.\n","owner_role":"Product owner","frequency":"on_material_change","frequency_label":"At launch and on material change","risk_subdomains":["7.4","4.3","5.2"],"evidence":[{"type":"disclosure_notice","title":"AI interaction or use notice","description":"The approved text and placement shown to people for each interaction or decision point."},{"type":"register_entry","title":"Notice catalogue","description":"Where each notice appears, its version and its owner."},{"type":"approval_record","title":"Notice wording approval","description":null}],"framework_references":[{"framework":"iso_42001","framework_name":"ISO/IEC 42001:2023","reference":"Annex A.8.2, A.8.5","note":null,"confidence_level":"medium"},{"framework":"nist_ai_rmf","framework_name":"NIST AI RMF 1.0","reference":"MEASURE 2.8; GOVERN 5.1","note":null,"confidence_level":"medium"},{"framework":"oecd_ai_principles","framework_name":"OECD AI Principles","reference":"Principle 1.3 Transparency and explainability","note":null,"confidence_level":"high"}],"obligations":[{"slug":"eu-ai-act-deployer-obligations","title":"Use high-risk AI as instructed, monitor it and inform affected people","relationship":"supports","note":"Informing workers and affected people that a high-risk system is used.","confidence_level":"medium","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-deployer-obligations"},{"slug":"australia-vaiss-testing-human-control-transparency","title":"Test and monitor systems, enable human control, and be transparent with users (guardrails 4 to 6)","relationship":"supports","note":"Guardrail 5: informing end users.","confidence_level":"high","is_binding":false,"policy":"australia-voluntary-ai-safety-standard","jurisdiction":"australia","url":"https://aipolicytracker.org/obligations/australia-vaiss-testing-human-control-transparency"},{"slug":"eu-ai-act-transparency-article-50","title":"Disclose AI interaction and label synthetic content","relationship":"satisfies","note":"User-facing AI interaction notices.","confidence_level":"high","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-transparency-article-50"},{"slug":"eu-ai-act-art-26-7-worker-information","title":"Employers must inform workers and their representatives before using high-risk AI at work","relationship":"satisfies","note":"Workforce-facing notice before go-live.","confidence_level":"high","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-26-7-worker-information"},{"slug":"eu-ai-act-art-26-11-notice-to-affected-persons","title":"Deployers must tell natural persons that a high-risk AI system is used in decisions about them","relationship":"satisfies","note":"Notice to decision subjects at the point of the decision process.","confidence_level":"high","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-26-11-notice-to-affected-persons"},{"slug":"eu-ai-act-art-50-3-emotion-recognition-notice","title":"Deployers of emotion recognition or biometric categorisation must inform exposed persons","relationship":"satisfies","note":"Notice to persons exposed to the system.","confidence_level":"high","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-50-3-emotion-recognition-notice"},{"slug":"uk-principles-transparency-explainability","title":"Provide appropriate transparency and explainability","relationship":"satisfies","note":"Public AI use notices.","confidence_level":"medium","is_binding":false,"policy":"uk-ai-regulation-white-paper","jurisdiction":"uk","url":"https://aipolicytracker.org/obligations/uk-principles-transparency-explainability"},{"slug":"uk-ico-automated-decision-safeguards","title":"Apply safeguards to solely automated decisions with significant effects","relationship":"supports","note":"Telling people a solely automated decision was made.","confidence_level":"medium","is_binding":true,"policy":"uk-ico-ai-data-protection-guidance","jurisdiction":"uk","url":"https://aipolicytracker.org/obligations/uk-ico-automated-decision-safeguards"},{"slug":"us-colorado-admt-advance-notice","title":"Notify consumers before automated decision-making technology influences a consequential decision","relationship":"satisfies","note":"Pre-decision notice that an automated tool will influence the decision.","confidence_level":"high","is_binding":true,"policy":"us-colorado-automated-decision-making-technology-act","jurisdiction":"us-colorado","url":"https://aipolicytracker.org/obligations/us-colorado-admt-advance-notice"},{"slug":"us-texas-responsible-ai-governance-act-traiga-health-care-ai-disclosure","title":"Health-care providers must disclose the use of AI in patient services","relationship":"satisfies","note":"Patient-facing disclosure before first service.","confidence_level":"high","is_binding":true,"policy":"us-texas-responsible-ai-governance-act-traiga","jurisdiction":"us-texas","url":"https://aipolicytracker.org/obligations/us-texas-responsible-ai-governance-act-traiga-health-care-ai-disclosure"},{"slug":"singapore-pdpc-ai-notification","title":"Notify individuals about the use of personal data in AI recommendations and decisions","relationship":"satisfies","note":"AI-specific disclosures in privacy notices and in product.","confidence_level":"high","is_binding":true,"policy":"singapore-pdpc-ai-advisory-guidelines","jurisdiction":"singapore","url":"https://aipolicytracker.org/obligations/singapore-pdpc-ai-notification"},{"slug":"south-korea-ai-basic-act-art-31-advance-notice-of-high-impact-and-generative-ai","title":"AI business operators must notify users in advance that a product or service runs on high-impact or generative AI","relationship":"satisfies","note":"Advance user notice of AI-based service.","confidence_level":"high","is_binding":true,"policy":"south-korea-framework-act-on-the-development-of-artificial-intelligence-and-establishment-of-a-foundation-for","jurisdiction":"south-korea","url":"https://aipolicytracker.org/obligations/south-korea-ai-basic-act-art-31-advance-notice-of-high-impact-and-generative-ai"},{"slug":"us-colorado-ai-act-consumer-ai-interaction-disclosure","title":"Deployers and developers must disclose to consumers that they are interacting with an AI system","relationship":"satisfies","note":"Point-of-interaction notice.","confidence_level":"high","is_binding":true,"policy":"us-colorado-ai-act","jurisdiction":"us-colorado","url":"https://aipolicytracker.org/obligations/us-colorado-ai-act-consumer-ai-interaction-disclosure"},{"slug":"us-colorado-consumer-notice-and-adverse-decision-explanation","title":"Notify consumers and explain adverse consequential decisions","relationship":"satisfies","note":"Pre-decision notice with purpose, nature and contact details.","confidence_level":"high","is_binding":true,"policy":"us-colorado-ai-act","jurisdiction":"us-colorado","url":"https://aipolicytracker.org/obligations/us-colorado-consumer-notice-and-adverse-decision-explanation"},{"slug":"us-colorado-ai-act-deployer-public-statement","title":"Deployers must publish a statement about the high-risk AI systems they use","relationship":"satisfies","note":"Organisation-level public statement rather than per-interaction notice.","confidence_level":"medium","is_binding":true,"policy":"us-colorado-ai-act","jurisdiction":"us-colorado","url":"https://aipolicytracker.org/obligations/us-colorado-ai-act-deployer-public-statement"},{"slug":"us-new-york-city-local-law-144-publish-audit-summary","title":"Employers and employment agencies must publish a summary of the bias audit results","relationship":"satisfies","note":"Public posting of audit results is a disclosure to candidates.","confidence_level":"medium","is_binding":true,"policy":"us-new-york-city-local-law-144-automated-employment-decision-tools","jurisdiction":"us-new-york","url":"https://aipolicytracker.org/obligations/us-new-york-city-local-law-144-publish-audit-summary"},{"slug":"us-new-york-city-local-law-144-candidate-notice","title":"Employers and employment agencies must notify candidates and employees before an automated tool is used","relationship":"satisfies","note":"Advance notice to candidates with the assessed criteria.","confidence_level":"high","is_binding":true,"policy":"us-new-york-city-local-law-144-automated-employment-decision-tools","jurisdiction":"us-new-york","url":"https://aipolicytracker.org/obligations/us-new-york-city-local-law-144-candidate-notice"},{"slug":"us-texas-responsible-ai-governance-act-traiga-government-agency-ai-interaction-disclosure","title":"Government agencies must disclose to consumers that they are interacting with an AI system","relationship":"satisfies","note":"Point-of-interaction notice in plain language.","confidence_level":"high","is_binding":true,"policy":"us-texas-responsible-ai-governance-act-traiga","jurisdiction":"us-texas","url":"https://aipolicytracker.org/obligations/us-texas-responsible-ai-governance-act-traiga-government-agency-ai-interaction-disclosure"}],"related_controls":["synthetic-content-labelling-and-provenance","decision-explanation-and-appeal-route","privacy-and-data-protection-for-ai"],"review_status":"verified","confidence_level":"high","last_verified_at":"2026-09-26","reviewed_by":"Bhaskar Bhatt","updated_at":"2026-10-15T06:46:22+00:00","url":"https://aipolicytracker.org/controls/ai-interaction-and-use-disclosure","context_url":"https://aipolicytracker.org/controls/ai-interaction-and-use-disclosure.md"},{"slug":"ai-literacy-and-role-based-training","id":"AIPT-CTL-0006","title":"AI literacy and role-based training programme","kind":"training","kind_label":"Training programme","purpose":"Gives everyone who builds, buys, operates or is overseen by AI systems the knowledge they need for their role, from general awareness to the specific skills of overseeing a high-risk system.\n","description":"A training matrix maps roles to curricula: a short awareness module for all staff, deeper content for developers, product owners, procurement, legal and risk, and system-specific instruction for people who operate or oversee a particular deployment. Content covers how the systems work, their limits, the organisation's rules, the risks of over-reliance and how to raise concerns. Completion is tracked in the learning system, refreshers are scheduled and material is revised when systems, rules or incidents change. Contractors and partners who operate systems on the organisation's behalf are included.\n","owner_role":"Learning and development lead","frequency":"annual","frequency_label":"Annual","risk_subdomains":["5.1","6.5","4.3"],"evidence":[{"type":"training_record","title":"AI training completion records","description":"Who completed which module, when, and the refresh due date."},{"type":"procedure","title":"Role-to-curriculum training matrix","description":null},{"type":"policy_document","title":"AI training curriculum and materials","description":null}],"framework_references":[{"framework":"iso_42001","framework_name":"ISO/IEC 42001:2023","reference":"Clause 7.2, 7.3; Annex A.4.6","note":null,"confidence_level":"high"},{"framework":"nist_ai_rmf","framework_name":"NIST AI RMF 1.0","reference":"GOVERN 2.2, 4.1","note":null,"confidence_level":"high"},{"framework":"mitre_atlas","framework_name":"MITRE ATLAS","reference":"AML.M0018 User Training","note":null,"confidence_level":"medium"}],"obligations":[{"slug":"eu-ai-act-human-oversight","title":"Enable and assign effective human oversight","relationship":"supports","note":"Overseers must be competent and alert to automation bias.","confidence_level":"medium","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-human-oversight"},{"slug":"eu-ai-act-ai-literacy","title":"Ensure AI literacy of staff operating AI systems","relationship":"satisfies","note":"Role-based curricula with completion records are the expected measure.","confidence_level":"high","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-ai-literacy"},{"slug":"us-nist-ai-rmf-govern","title":"Establish AI governance policies, roles and accountability (Govern)","relationship":"supports","note":"Workforce training outcomes.","confidence_level":"high","is_binding":false,"policy":"us-nist-ai-rmf","jurisdiction":"us","url":"https://aipolicytracker.org/obligations/us-nist-ai-rmf-govern"},{"slug":"singapore-mgf-internal-governance","title":"Establish internal governance structures and measures for AI","relationship":"supports","note":"Staff training component.","confidence_level":"medium","is_binding":false,"policy":"singapore-model-ai-governance-framework","jurisdiction":"singapore","url":"https://aipolicytracker.org/obligations/singapore-mgf-internal-governance"}],"related_controls":["ai-governance-policy-and-accountability","human-oversight-and-override"],"review_status":"verified","confidence_level":"high","last_verified_at":"2026-09-26","reviewed_by":"Bhaskar Bhatt","updated_at":"2026-10-15T06:46:22+00:00","url":"https://aipolicytracker.org/controls/ai-literacy-and-role-based-training","context_url":"https://aipolicytracker.org/controls/ai-literacy-and-role-based-training.md"},{"slug":"ai-risk-assessment","id":"AIPT-CTL-0008","title":"AI risk assessment and lifecycle risk register","kind":"process","kind_label":"Process","purpose":"Identifies, rates and treats the risks that a specific AI system poses to health, safety, rights and the organisation itself, and keeps that analysis alive from design through retirement.\n","description":"For each in-scope system a cross-functional team runs a structured assessment: it lists foreseeable harms under intended use and reasonably foreseeable misuse, rates likelihood and severity, records existing and planned mitigations and decides whether residual risk is acceptable. Findings feed a per-system risk register with an owner and review date for each item. The assessment is redone on material change, after significant incidents and on a fixed cadence, and its outputs feed the testing plan, the human-oversight design and the release decision. Residual-risk acceptance is signed by an accountable person rather than the delivery team.\n","owner_role":"AI system owner","frequency":"per_system","frequency_label":"Once per AI system","risk_subdomains":["1.1","1.3","5.1","7.3","6.5"],"evidence":[{"type":"risk_assessment","title":"AI system risk assessment","description":"Method, identified risks, ratings, treatments and residual-risk decision for one system."},{"type":"risk_register","title":"Per-system AI risk register","description":"Live list of risks with owner, rating, treatment status and next review."},{"type":"approval_record","title":"Residual-risk acceptance","description":null}],"framework_references":[{"framework":"iso_42001","framework_name":"ISO/IEC 42001:2023","reference":"Clause 6.1.2, 6.1.3, 8.2, 8.3","note":null,"confidence_level":"high"},{"framework":"iso_23894","framework_name":"ISO/IEC 23894:2023","reference":"Clause 6.4, 6.5, 6.6","note":"Risk identification, analysis, evaluation, treatment and monitoring.","confidence_level":"high"},{"framework":"nist_ai_rmf","framework_name":"NIST AI RMF 1.0","reference":"MAP 3, MAP 4, MANAGE 1.2, 1.3, 2.1","note":null,"confidence_level":"high"}],"obligations":[{"slug":"eu-ai-act-risk-management-system","title":"Establish a risk management system for high-risk AI","relationship":"satisfies","note":"Continuous lifecycle risk process with register, testing evidence and residual-risk acceptance.","confidence_level":"high","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-risk-management-system"},{"slug":"australia-vaiss-accountability-and-risk-management","title":"Establish accountability processes and a risk-management process (guardrails 1 and 2)","relationship":"satisfies","note":"Guardrail 2: per-use-case lifecycle risk process.","confidence_level":"high","is_binding":false,"policy":"australia-voluntary-ai-safety-standard","jurisdiction":"australia","url":"https://aipolicytracker.org/obligations/australia-vaiss-accountability-and-risk-management"},{"slug":"uk-principles-safety-security-robustness","title":"Ensure AI systems are safe, secure and robust throughout their lifecycle","relationship":"satisfies","note":"Lifecycle identification and management of risks.","confidence_level":"medium","is_binding":false,"policy":"uk-ai-regulation-white-paper","jurisdiction":"uk","url":"https://aipolicytracker.org/obligations/uk-principles-safety-security-robustness"},{"slug":"us-nist-ai-rmf-map","title":"Map context, intended use and potential impacts (Map)","relationship":"supports","note":"Risk categorisation and benefit-cost analysis.","confidence_level":"medium","is_binding":false,"policy":"us-nist-ai-rmf","jurisdiction":"us","url":"https://aipolicytracker.org/obligations/us-nist-ai-rmf-map"},{"slug":"us-nist-ai-rmf-manage","title":"Prioritise, respond to and monitor AI risks (Manage)","relationship":"satisfies","note":"Risk treatment planning and resource allocation for mapped and measured risks.","confidence_level":"medium","is_binding":false,"policy":"us-nist-ai-rmf","jurisdiction":"us","url":"https://aipolicytracker.org/obligations/us-nist-ai-rmf-manage"},{"slug":"singapore-mgf-internal-governance","title":"Establish internal governance structures and measures for AI","relationship":"supports","note":"Adding AI risks to enterprise risk management.","confidence_level":"medium","is_binding":false,"policy":"singapore-model-ai-governance-framework","jurisdiction":"singapore","url":"https://aipolicytracker.org/obligations/singapore-mgf-internal-governance"},{"slug":"south-korea-ai-basic-act-art-34-high-impact-ai-risk-management-plan","title":"Operators of high-impact AI must establish and operate a risk management plan","relationship":"satisfies","note":"Per-system risk plan with identified risks and treatments.","confidence_level":"high","is_binding":true,"policy":"south-korea-framework-act-on-the-development-of-artificial-intelligence-and-establishment-of-a-foundation-for","jurisdiction":"south-korea","url":"https://aipolicytracker.org/obligations/south-korea-ai-basic-act-art-34-high-impact-ai-risk-management-plan"},{"slug":"india-ai-guidelines-principles-and-risk-based-governance","title":"Adopt the guiding principles and risk-based governance (voluntary)","relationship":"supports","note":"Proportionate risk classification and mitigation per system.","confidence_level":"medium","is_binding":false,"policy":"india-ai-governance-guidelines","jurisdiction":"india","url":"https://aipolicytracker.org/obligations/india-ai-guidelines-principles-and-risk-based-governance"},{"slug":"singapore-mgf-human-involvement","title":"Determine the appropriate level of human involvement in AI decisions","relationship":"supports","note":"Probability and severity of harm drive the involvement level.","confidence_level":"medium","is_binding":false,"policy":"singapore-model-ai-governance-framework","jurisdiction":"singapore","url":"https://aipolicytracker.org/obligations/singapore-mgf-human-involvement"},{"slug":"us-colorado-deployer-risk-management-program","title":"Deployers must implement a risk management policy and programme","relationship":"satisfies","note":"Per-system identification, documentation and mitigation of algorithmic discrimination risk.","confidence_level":"high","is_binding":true,"policy":"us-colorado-ai-act","jurisdiction":"us-colorado","url":"https://aipolicytracker.org/obligations/us-colorado-deployer-risk-management-program"},{"slug":"us-colorado-ai-act-developer-reasonable-care","title":"Developers must use reasonable care to avoid algorithmic discrimination","relationship":"satisfies","note":"Identifies and treats discrimination risk per system.","confidence_level":"high","is_binding":true,"policy":"us-colorado-ai-act","jurisdiction":"us-colorado","url":"https://aipolicytracker.org/obligations/us-colorado-ai-act-developer-reasonable-care"},{"slug":"us-colorado-ai-act-deployer-reasonable-care","title":"Deployers must use reasonable care to avoid algorithmic discrimination","relationship":"supports","note":"Discrimination risk identified for each consequential-decision use.","confidence_level":"high","is_binding":true,"policy":"us-colorado-ai-act","jurisdiction":"us-colorado","url":"https://aipolicytracker.org/obligations/us-colorado-ai-act-deployer-reasonable-care"}],"related_controls":["ai-impact-assessment","accuracy-robustness-security-testing","human-oversight-and-override","post-market-monitoring-and-drift-detection"],"review_status":"verified","confidence_level":"high","last_verified_at":"2026-09-26","reviewed_by":"Bhaskar Bhatt","updated_at":"2026-10-15T06:46:22+00:00","url":"https://aipolicytracker.org/controls/ai-risk-assessment","context_url":"https://aipolicytracker.org/controls/ai-risk-assessment.md"},{"slug":"ai-system-inventory","id":"AIPT-CTL-0009","title":"AI system inventory and classification","kind":"process","kind_label":"Process","purpose":"Ensures the organisation knows every AI system it builds, buys or embeds, who owns it, what it is for and which legal risk tier it falls into, so that obligations can be assigned rather than discovered after the fact.\n","description":"A central register is populated through intake forms, procurement gates, code and vendor scans and periodic attestations from business units. Each entry records the owner, purpose, users and affected people, the jurisdictions it operates in, the models and vendors involved, the personal-data involvement and the current lifecycle status. A classification step assigns a risk tier using the organisation's own criteria and the categories defined by applicable law, and the tier drives which further controls apply. Shadow-AI discovery and a rule that nothing goes live without a register entry keep the inventory current.\n","owner_role":"AI governance lead","frequency":"continuous","frequency_label":"Continuous","risk_subdomains":["6.5","7.4"],"evidence":[{"type":"register_entry","title":"AI system register","description":"One row per system with owner, purpose, risk tier, jurisdictions, vendors and status."},{"type":"approval_record","title":"Risk-tier classification sign-off","description":"Reviewer confirmation of the assigned tier and the rationale."},{"type":"procedure","title":"AI intake and classification procedure","description":null}],"framework_references":[{"framework":"iso_42001","framework_name":"ISO/IEC 42001:2023","reference":"Clause 4.1, 4.3, 8.1; Annex A.6.2.2, A.9.4","note":"Editorial mapping to scope, operational planning and intended-use records.","confidence_level":"medium"},{"framework":"nist_ai_rmf","framework_name":"NIST AI RMF 1.0","reference":"MAP 1.1, 1.5; GOVERN 1.6","note":null,"confidence_level":"high"},{"framework":"mitre_atlas","framework_name":"MITRE ATLAS","reference":"AML.M0023 AI Bill of Materials","note":null,"confidence_level":"low"}],"obligations":[{"slug":"eu-ai-act-prohibited-practices","title":"Do not deploy or provide AI for prohibited practices","relationship":"supports","note":"A complete register is the population to be screened.","confidence_level":"high","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-prohibited-practices"},{"slug":"australia-vaiss-contestability-supply-chain-records","title":"Provide contestability, supply-chain transparency and records (guardrails 7 to 9)","relationship":"supports","note":"Register with evidence links for third-party review.","confidence_level":"high","is_binding":false,"policy":"australia-voluntary-ai-safety-standard","jurisdiction":"australia","url":"https://aipolicytracker.org/obligations/australia-vaiss-contestability-supply-chain-records"},{"slug":"eu-ai-act-art-25-value-chain-becoming-provider","title":"Deployers, distributors and importers must assume provider duties when they rebrand or substantially modify high-risk AI","relationship":"supports","note":"Inventory records the organisation's role for each system.","confidence_level":"medium","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-25-value-chain-becoming-provider"},{"slug":"eu-ai-act-art-6-4-non-high-risk-assessment-documentation","title":"Providers must document and register a conclusion that an Annex III system is not high-risk","relationship":"satisfies","note":"Classification with recorded rationale per system.","confidence_level":"medium","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-6-4-non-high-risk-assessment-documentation"},{"slug":"us-texas-responsible-ai-governance-act-traiga-health-care-ai-disclosure","title":"Health-care providers must disclose the use of AI in patient services","relationship":"supports","note":"Identifies clinical and administrative systems that use AI.","confidence_level":"medium","is_binding":true,"policy":"us-texas-responsible-ai-governance-act-traiga","jurisdiction":"us-texas","url":"https://aipolicytracker.org/obligations/us-texas-responsible-ai-governance-act-traiga-health-care-ai-disclosure"},{"slug":"us-nist-ai-rmf-map","title":"Map context, intended use and potential impacts (Map)","relationship":"supports","note":"Intended purpose, users and settings recorded at intake.","confidence_level":"high","is_binding":false,"policy":"us-nist-ai-rmf","jurisdiction":"us","url":"https://aipolicytracker.org/obligations/us-nist-ai-rmf-map"},{"slug":"south-korea-ai-basic-act-art-34-high-impact-ai-risk-management-plan","title":"Operators of high-impact AI must establish and operate a risk management plan","relationship":"supports","note":"Classification of systems against the high-impact list.","confidence_level":"high","is_binding":true,"policy":"south-korea-framework-act-on-the-development-of-artificial-intelligence-and-establishment-of-a-foundation-for","jurisdiction":"south-korea","url":"https://aipolicytracker.org/obligations/south-korea-ai-basic-act-art-34-high-impact-ai-risk-management-plan"},{"slug":"south-korea-ai-basic-act-art-31-advance-notice-of-high-impact-and-generative-ai","title":"AI business operators must notify users in advance that a product or service runs on high-impact or generative AI","relationship":"supports","note":"Classification identifies which products are high-impact or generative.","confidence_level":"medium","is_binding":true,"policy":"south-korea-framework-act-on-the-development-of-artificial-intelligence-and-establishment-of-a-foundation-for","jurisdiction":"south-korea","url":"https://aipolicytracker.org/obligations/south-korea-ai-basic-act-art-31-advance-notice-of-high-impact-and-generative-ai"},{"slug":"uk-principles-accountability-governance","title":"Establish accountability and governance for AI","relationship":"supports","note":"Named owner for each AI system.","confidence_level":"high","is_binding":false,"policy":"uk-ai-regulation-white-paper","jurisdiction":"uk","url":"https://aipolicytracker.org/obligations/uk-principles-accountability-governance"},{"slug":"us-colorado-ai-act-deployer-public-statement","title":"Deployers must publish a statement about the high-risk AI systems they use","relationship":"supports","note":"Source of the list of deployed high-risk systems.","confidence_level":"high","is_binding":true,"policy":"us-colorado-ai-act","jurisdiction":"us-colorado","url":"https://aipolicytracker.org/obligations/us-colorado-ai-act-deployer-public-statement"},{"slug":"us-omb-m-25-21-use-case-inventory","title":"Publish an annual AI use-case inventory","relationship":"supports","note":"Vendor-side register supplies the use-case descriptions agencies ask for.","confidence_level":"medium","is_binding":true,"policy":"us-omb-m-25-21","jurisdiction":"us","url":"https://aipolicytracker.org/obligations/us-omb-m-25-21-use-case-inventory"}],"related_controls":["ai-governance-policy-and-accountability","ai-risk-assessment","prohibited-use-screening-gate","public-sector-ai-use-case-register"],"review_status":"verified","confidence_level":"medium","last_verified_at":"2026-09-26","reviewed_by":"Bhaskar Bhatt","updated_at":"2026-10-15T06:46:22+00:00","url":"https://aipolicytracker.org/controls/ai-system-inventory","context_url":"https://aipolicytracker.org/controls/ai-system-inventory.md"},{"slug":"accuracy-robustness-security-testing","id":"AIPT-CTL-0001","title":"Accuracy, robustness, fairness and security testing","kind":"technical","kind_label":"Technical measure","purpose":"Verifies before release, and again after material change, that a system performs to declared accuracy levels, behaves consistently across groups and conditions, and resists the attacks specific to AI.\n","description":"A test plan defines the metrics, datasets, thresholds and acceptance criteria for each trustworthiness property the risk assessment flagged: accuracy and calibration, performance across demographic and operational subgroups, resilience to noisy or out-of-distribution input, and security against data and model poisoning, evasion and extraction. Tests are run by people independent of the developers where practical, results are compared against the criteria and failures block release until fixed or formally accepted. Declared performance figures in user documentation are drawn directly from the latest report, and the plan is re-run on retraining or a change in operating context.\n","owner_role":"Quality or testing lead","frequency":"on_material_change","frequency_label":"At launch and on material change","risk_subdomains":["7.3","1.3","2.2","1.1"],"evidence":[{"type":"evaluation_report","title":"Pre-release test report","description":"Metrics, subgroup results, robustness and security findings against acceptance criteria."},{"type":"procedure","title":"Test plan and acceptance criteria","description":null},{"type":"approval_record","title":"Release test sign-off","description":null}],"framework_references":[{"framework":"iso_42001","framework_name":"ISO/IEC 42001:2023","reference":"Annex A.6.2.4","note":"Verification and validation.","confidence_level":"high"},{"framework":"nist_ai_rmf","framework_name":"NIST AI RMF 1.0","reference":"MEASURE 2.5, 2.6, 2.7, 2.11","note":null,"confidence_level":"high"},{"framework":"iso_27001","framework_name":"ISO/IEC 27001:2022","reference":"Clause 8.1; Annex A 8.29 Security testing in development","note":null,"confidence_level":"medium"},{"framework":"mitre_atlas","framework_name":"MITRE ATLAS","reference":"AML.M0008 Validate ML Model, AML.M0003 Model Hardening, AML.M0015 Adversarial Input Detection","note":null,"confidence_level":"medium"},{"framework":"owasp_llm_top10","framework_name":"OWASP Top 10 for LLM Applications","reference":"LLM04 Data and Model Poisoning","note":null,"confidence_level":"medium"}],"obligations":[{"slug":"eu-ai-act-risk-management-system","title":"Establish a risk management system for high-risk AI","relationship":"supports","note":"Testing confirms that mitigations work.","confidence_level":"high","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-risk-management-system"},{"slug":"australia-vaiss-testing-human-control-transparency","title":"Test and monitor systems, enable human control, and be transparent with users (guardrails 4 to 6)","relationship":"supports","note":"Guardrail 3: pre-deployment testing.","confidence_level":"high","is_binding":false,"policy":"australia-voluntary-ai-safety-standard","jurisdiction":"australia","url":"https://aipolicytracker.org/obligations/australia-vaiss-testing-human-control-transparency"},{"slug":"eu-ai-act-art-50-2-synthetic-content-marking","title":"Providers of generative AI must mark synthetic output as artificially generated in a machine-readable way","relationship":"supports","note":"Tests that the mark is robust and reliable.","confidence_level":"medium","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-50-2-synthetic-content-marking"},{"slug":"uk-principles-safety-security-robustness","title":"Ensure AI systems are safe, secure and robust throughout their lifecycle","relationship":"satisfies","note":"Security and robustness evidence to show a regulator.","confidence_level":"medium","is_binding":false,"policy":"uk-ai-regulation-white-paper","jurisdiction":"uk","url":"https://aipolicytracker.org/obligations/uk-principles-safety-security-robustness"},{"slug":"uk-principles-fairness","title":"Use AI in ways that are fair and do not discriminate unlawfully","relationship":"satisfies","note":"Disparate-outcome testing across protected characteristics before and after deployment.","confidence_level":"medium","is_binding":false,"policy":"uk-ai-regulation-white-paper","jurisdiction":"uk","url":"https://aipolicytracker.org/obligations/uk-principles-fairness"},{"slug":"india-dpdp-security-and-breach-notification","title":"Implement reasonable security safeguards and notify breaches","relationship":"supports","note":"Reasonable security safeguards evidenced by testing.","confidence_level":"medium","is_binding":true,"policy":"india-dpdp-act","jurisdiction":"india","url":"https://aipolicytracker.org/obligations/india-dpdp-security-and-breach-notification"},{"slug":"eu-ai-act-accuracy-robustness-cybersecurity","title":"Achieve appropriate accuracy, robustness and cybersecurity","relationship":"satisfies","note":"Declared accuracy metrics, robustness and AI-specific security testing come from the release test programme.","confidence_level":"high","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-accuracy-robustness-cybersecurity"},{"slug":"us-new-york-city-local-law-144-bias-audit","title":"Employers and employment agencies must obtain an independent bias audit before using an automated employment decision tool","relationship":"satisfies","note":"Disparate-impact testing performed by an independent auditor on the statutory metrics.","confidence_level":"high","is_binding":true,"policy":"us-new-york-city-local-law-144-automated-employment-decision-tools","jurisdiction":"us-new-york","url":"https://aipolicytracker.org/obligations/us-new-york-city-local-law-144-bias-audit"},{"slug":"eu-ai-act-art-55-systemic-risk-cybersecurity","title":"Providers of systemic-risk GPAI models must secure the model and its infrastructure","relationship":"satisfies","note":"Security testing of the model and its serving infrastructure.","confidence_level":"medium","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-55-systemic-risk-cybersecurity"},{"slug":"singapore-mgf-operations-management","title":"Manage data quality, model development and monitoring across the lifecycle","relationship":"supports","note":"Repeatability and robustness evidence before release.","confidence_level":"medium","is_binding":false,"policy":"singapore-model-ai-governance-framework","jurisdiction":"singapore","url":"https://aipolicytracker.org/obligations/singapore-mgf-operations-management"},{"slug":"us-colorado-ai-act-developer-reasonable-care","title":"Developers must use reasonable care to avoid algorithmic discrimination","relationship":"supports","note":"Disparate-impact testing across protected classes.","confidence_level":"high","is_binding":true,"policy":"us-colorado-ai-act","jurisdiction":"us-colorado","url":"https://aipolicytracker.org/obligations/us-colorado-ai-act-developer-reasonable-care"},{"slug":"us-new-york-city-local-law-144-publish-audit-summary","title":"Employers and employment agencies must publish a summary of the bias audit results","relationship":"supports","note":"Produces the results being summarised.","confidence_level":"high","is_binding":true,"policy":"us-new-york-city-local-law-144-automated-employment-decision-tools","jurisdiction":"us-new-york","url":"https://aipolicytracker.org/obligations/us-new-york-city-local-law-144-publish-audit-summary"},{"slug":"us-nist-ai-rmf-measure","title":"Measure and test trustworthiness characteristics (Measure)","relationship":"satisfies","note":"Metrics and test methods for each trustworthiness characteristic.","confidence_level":"medium","is_binding":false,"policy":"us-nist-ai-rmf","jurisdiction":"us","url":"https://aipolicytracker.org/obligations/us-nist-ai-rmf-measure"},{"slug":"us-texas-responsible-ai-governance-act-traiga-unlawful-discrimination-prohibition","title":"Developers and deployers must not use AI with the intent to unlawfully discriminate against a protected class","relationship":"supports","note":"Fairness testing evidence supports the absence of intent.","confidence_level":"medium","is_binding":true,"policy":"us-texas-responsible-ai-governance-act-traiga","jurisdiction":"us-texas","url":"https://aipolicytracker.org/obligations/us-texas-responsible-ai-governance-act-traiga-unlawful-discrimination-prohibition"},{"slug":"us-omb-m-25-21-high-impact-ai-practices","title":"Apply minimum risk-management practices to high-impact AI","relationship":"supports","note":"Pre-deployment test evidence agencies can reuse.","confidence_level":"medium","is_binding":true,"policy":"us-omb-m-25-21","jurisdiction":"us","url":"https://aipolicytracker.org/obligations/us-omb-m-25-21-high-impact-ai-practices"}],"related_controls":["ai-risk-assessment","genai-red-team-testing","post-market-monitoring-and-drift-detection","model-release-and-change-management-gate"],"review_status":"verified","confidence_level":"high","last_verified_at":"2026-09-26","reviewed_by":"Bhaskar Bhatt","updated_at":"2026-10-15T06:46:22+00:00","url":"https://aipolicytracker.org/controls/accuracy-robustness-security-testing","context_url":"https://aipolicytracker.org/controls/accuracy-robustness-security-testing.md"},{"slug":"genai-red-team-testing","id":"AIPT-CTL-0015","title":"Adversarial and red-team testing for generative AI","kind":"technical","kind_label":"Technical measure","purpose":"Finds the ways a generative or general-purpose model can be made to produce harmful, deceptive or dangerous output before users or attackers do, and feeds the findings back into mitigations.\n","description":"A red team with a mix of security, domain and safety expertise, drawn partly from outside the development group, attacks the model and the product around it using scenario libraries that cover prompt injection, jailbreaks, data leakage, harmful-capability elicitation, bias provocation and misuse of tools or agents. Exercises are scoped and rules of engagement agreed in advance; findings are rated, tracked to closure and regression-tested in the next round. For the largest models the programme includes structured evaluations of dangerous capabilities and the organisation's mitigations are recorded in the safety framework. Results are summarised for governance and, where required, for authorities or downstream integrators.\n","owner_role":"AI security or safety lead","frequency":"on_material_change","frequency_label":"At launch and on material change","risk_subdomains":["2.2","4.2","4.3","1.2","7.2"],"evidence":[{"type":"evaluation_report","title":"Red-team exercise report","description":"Scope, methods, findings by severity and remediation status for one exercise."},{"type":"procedure","title":"Red-team rules of engagement and scenario library","description":null},{"type":"risk_register","title":"Adversarial findings tracker","description":null}],"framework_references":[{"framework":"nist_ai_rmf","framework_name":"NIST AI RMF 1.0","reference":"MEASURE 2.6, 2.7; MANAGE 2.2","note":"Testing safety, security and resilience, including structured adversarial exercises for generative AI.","confidence_level":"high"},{"framework":"iso_42001","framework_name":"ISO/IEC 42001:2023","reference":"Annex A.6.2.4","note":null,"confidence_level":"medium"},{"framework":"owasp_llm_top10","framework_name":"OWASP Top 10 for LLM Applications","reference":"LLM01 Prompt Injection, LLM02 Sensitive Information Disclosure, LLM05 Improper Output Handling, LLM06 Excessive Agency, LLM07 System Prompt Leakage","note":null,"confidence_level":"high"},{"framework":"mitre_atlas","framework_name":"MITRE ATLAS","reference":"AML.M0020 Generative AI Guardrails, AML.M0022 Generative AI Model Alignment","note":null,"confidence_level":"medium"}],"obligations":[{"slug":"eu-ai-act-gpai-systemic-risk","title":"Manage systemic risk for high-impact general-purpose models","relationship":"satisfies","note":"Model evaluation including adversarial testing.","confidence_level":"medium","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-gpai-systemic-risk"},{"slug":"us-california-sb-53-frontier-ai-framework","title":"Large frontier developers must publish a frontier AI framework","relationship":"supports","note":"Catastrophic-risk assessment evidence.","confidence_level":"medium","is_binding":true,"policy":"us-california-sb-53","jurisdiction":"us-california","url":"https://aipolicytracker.org/obligations/us-california-sb-53-frontier-ai-framework"},{"slug":"us-california-sb-53-catastrophic-risk-assessment-summaries","title":"Large frontier developers must send periodic summaries of catastrophic-risk assessments to the state","relationship":"supports","note":"Dangerous-capability evaluations feed the assessment.","confidence_level":"medium","is_binding":true,"policy":"us-california-sb-53","jurisdiction":"us-california","url":"https://aipolicytracker.org/obligations/us-california-sb-53-catastrophic-risk-assessment-summaries"},{"slug":"eu-ai-act-accuracy-robustness-cybersecurity","title":"Achieve appropriate accuracy, robustness and cybersecurity","relationship":"supports","note":"Adversarial exercises cover poisoning, evasion and extraction attempts.","confidence_level":"medium","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-accuracy-robustness-cybersecurity"},{"slug":"south-korea-ai-basic-act-art-32-safety-measures-for-high-performance-ai","title":"Operators of AI above the compute threshold must run lifecycle risk management and report safety results","relationship":"supports","note":"Evidence for the risk identification step.","confidence_level":"medium","is_binding":true,"policy":"south-korea-framework-act-on-the-development-of-artificial-intelligence-and-establishment-of-a-foundation-for","jurisdiction":"south-korea","url":"https://aipolicytracker.org/obligations/south-korea-ai-basic-act-art-32-safety-measures-for-high-performance-ai"},{"slug":"us-texas-responsible-ai-governance-act-traiga-manipulation-prohibition","title":"Developers and deployers must not use AI to incite self-harm, harm to others or crime","relationship":"supports","note":"Tests for harmful-incitement behaviour in generative systems.","confidence_level":"medium","is_binding":true,"policy":"us-texas-responsible-ai-governance-act-traiga","jurisdiction":"us-texas","url":"https://aipolicytracker.org/obligations/us-texas-responsible-ai-governance-act-traiga-manipulation-prohibition"},{"slug":"us-nist-ai-rmf-measure","title":"Measure and test trustworthiness characteristics (Measure)","relationship":"supports","note":"Red-teaming and independent review for generative AI.","confidence_level":"high","is_binding":false,"policy":"us-nist-ai-rmf","jurisdiction":"us","url":"https://aipolicytracker.org/obligations/us-nist-ai-rmf-measure"},{"slug":"us-texas-responsible-ai-governance-act-traiga-sexual-content-and-csam-prohibition","title":"Developers and distributors must not build AI intended to produce child sexual abuse material or unlawful sexual deepfakes","relationship":"supports","note":"Tests that safeguards block sexual content involving minors.","confidence_level":"high","is_binding":true,"policy":"us-texas-responsible-ai-governance-act-traiga","jurisdiction":"us-texas","url":"https://aipolicytracker.org/obligations/us-texas-responsible-ai-governance-act-traiga-sexual-content-and-csam-prohibition"}],"related_controls":["accuracy-robustness-security-testing","frontier-model-safety-framework","ai-incident-management-and-reporting"],"review_status":"verified","confidence_level":"high","last_verified_at":"2026-09-26","reviewed_by":"Bhaskar Bhatt","updated_at":"2026-10-15T06:46:22+00:00","url":"https://aipolicytracker.org/controls/genai-red-team-testing","context_url":"https://aipolicytracker.org/controls/genai-red-team-testing.md"},{"slug":"record-keeping-and-logging","id":"AIPT-CTL-0022","title":"Automatic event logging and record retention","kind":"technical","kind_label":"Technical measure","purpose":"Captures what an AI system did, when and with what inputs, and keeps those records long enough to reconstruct a decision, investigate an incident and demonstrate ongoing monitoring.\n","description":"Engineers define a log schema for each system that covers at minimum the time of use, the version of model and configuration, the inputs or their references, the output produced and any human intervention. Logs are written automatically, protected against tampering, access-controlled and retained for a period set by the strictest applicable rule and the organisation's own needs. Deployers confirm that logs generated under their control are retained and can be handed to the provider or an authority. Retention, deletion and access are reviewed periodically and the schema is updated when the system changes.\n","owner_role":"Engineering lead","frequency":"continuous","frequency_label":"Continuous","risk_subdomains":["7.4","6.5","2.2"],"evidence":[{"type":"access_log","title":"AI system event logs","description":"System-generated records of use, versions, inputs, outputs and interventions, retained for the defined period."},{"type":"procedure","title":"Log schema and retention standard","description":null},{"type":"audit_report","title":"Log integrity and retention check","description":null}],"framework_references":[{"framework":"iso_42001","framework_name":"ISO/IEC 42001:2023","reference":"Annex A.6.2.8","note":"Recording of event logs.","confidence_level":"high"},{"framework":"iso_27001","framework_name":"ISO/IEC 27001:2022","reference":"Annex A 8.15 Logging, 8.16 Monitoring activities","note":null,"confidence_level":"medium"},{"framework":"nist_ai_rmf","framework_name":"NIST AI RMF 1.0","reference":"MEASURE 2.4; MANAGE 4.1","note":null,"confidence_level":"medium"},{"framework":"mitre_atlas","framework_name":"MITRE ATLAS","reference":"AML.M0024 AI Telemetry Logging","note":null,"confidence_level":"medium"}],"obligations":[{"slug":"eu-ai-act-record-keeping","title":"Design high-risk systems to log events automatically","relationship":"satisfies","note":"Automatic logging with a defined schema, retention and access controls.","confidence_level":"high","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-record-keeping"},{"slug":"eu-ai-act-serious-incident-reporting","title":"Report serious incidents to market surveillance authorities","relationship":"supports","note":"Logs support the investigation and report.","confidence_level":"medium","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-serious-incident-reporting"},{"slug":"eu-ai-act-art-18-documentation-keeping","title":"Providers must keep high-risk AI documentation for ten years","relationship":"satisfies","note":"Retention classes and archive controls for the listed documents.","confidence_level":"high","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-18-documentation-keeping"},{"slug":"eu-ai-act-art-19-provider-log-retention","title":"Providers must retain automatically generated logs under their control","relationship":"satisfies","note":"Retention of Article 12 logs for the required period.","confidence_level":"high","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-19-provider-log-retention"},{"slug":"eu-ai-act-art-21-cooperation-with-authorities","title":"Providers must supply conformity evidence and log access to authorities on request","relationship":"supports","note":"Logs must be retrievable in a usable format.","confidence_level":"high","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-21-cooperation-with-authorities"},{"slug":"eu-ai-act-art-26-10-post-remote-biometric-identification-authorisation","title":"Law-enforcement deployers must obtain authorisation for post-remote biometric identification and report annually","relationship":"supports","note":"Per-use documentation and annual reporting data.","confidence_level":"medium","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-26-10-post-remote-biometric-identification-authorisation"},{"slug":"eu-ai-act-post-market-monitoring","title":"Operate a post-market monitoring system","relationship":"supports","note":"Logs are the primary data source.","confidence_level":"high","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-post-market-monitoring"},{"slug":"eu-ai-act-art-86-right-to-explanation","title":"Deployers must explain individual decisions taken with high-risk AI on request","relationship":"supports","note":"Logs supply the inputs cited in the explanation.","confidence_level":"medium","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-86-right-to-explanation"},{"slug":"us-colorado-admt-record-keeping","title":"Keep records of consequential decisions influenced by the technology for three years","relationship":"satisfies","note":"Decision records retained for the statutory period.","confidence_level":"high","is_binding":true,"policy":"us-colorado-automated-decision-making-technology-act","jurisdiction":"us-colorado","url":"https://aipolicytracker.org/obligations/us-colorado-admt-record-keeping"}],"related_controls":["post-market-monitoring-and-drift-detection","ai-incident-management-and-reporting","human-oversight-and-override"],"review_status":"verified","confidence_level":"high","last_verified_at":"2026-09-26","reviewed_by":"Bhaskar Bhatt","updated_at":"2026-10-15T06:46:23+00:00","url":"https://aipolicytracker.org/controls/record-keeping-and-logging","context_url":"https://aipolicytracker.org/controls/record-keeping-and-logging.md"},{"slug":"conformity-assessment-and-registration","id":"AIPT-CTL-0010","title":"Conformity assessment, declaration and registration","kind":"process","kind_label":"Process","purpose":"Takes a regulated system through the applicable pre-market assessment, produces the signed declaration or certificate and completes any registration with authorities before the system is placed on the market.\n","description":"Early in the project the compliance lead determines which assessment route applies, whether an outside body must be involved and what registrations follow, and books notified-body capacity if needed. A conformity checklist maps each legal requirement to the evidence in the technical file, and a gap review is completed before the assessment is formally started. On a successful outcome the declaration is signed by an authorised person, markings are applied, registrations are filed and the records are retained for the required period. A re-assessment trigger list defines which changes require the exercise to be repeated.\n","owner_role":"Regulatory compliance lead","frequency":"per_system","frequency_label":"Once per AI system","risk_subdomains":["6.5","7.3"],"evidence":[{"type":"conformity_declaration","title":"Declaration of conformity or certificate","description":null},{"type":"regulatory_filing","title":"Registration record in the relevant database","description":null},{"type":"technical_file","title":"Conformity evidence pack","description":"Requirement-to-evidence map with the supporting documents."}],"framework_references":[{"framework":"iso_42001","framework_name":"ISO/IEC 42001:2023","reference":"Clause 9.2; Annex A.6.2.7","note":null,"confidence_level":"medium"},{"framework":"nist_ai_rmf","framework_name":"NIST AI RMF 1.0","reference":"GOVERN 1.1; MAP 4.1","note":null,"confidence_level":"low"}],"obligations":[{"slug":"eu-ai-act-importer-distributor-obligations","title":"Verify conformity before importing or distributing high-risk AI","relationship":"supports","note":"Knowledge of the assessment route needed to verify it.","confidence_level":"low","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-importer-distributor-obligations"},{"slug":"eu-ai-act-art-22-authorised-representative","title":"Non-EU providers must appoint an EU authorised representative for high-risk AI","relationship":"supports","note":"Items the representative must verify.","confidence_level":"medium","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-22-authorised-representative"},{"slug":"eu-ai-act-conformity-assessment-registration","title":"Complete conformity assessment, CE marking and EU database registration","relationship":"satisfies","note":"Covers route selection, declaration, marking and database registration.","confidence_level":"high","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-conformity-assessment-registration"},{"slug":"eu-ai-act-art-6-4-non-high-risk-assessment-documentation","title":"Providers must document and register a conclusion that an Annex III system is not high-risk","relationship":"supports","note":"Registration under Article 49(2).","confidence_level":"high","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-6-4-non-high-risk-assessment-documentation"}],"related_controls":["technical-documentation-and-model-cards","ai-quality-management-system","accuracy-robustness-security-testing","model-release-and-change-management-gate"],"review_status":"verified","confidence_level":"medium","last_verified_at":"2026-09-26","reviewed_by":"Bhaskar Bhatt","updated_at":"2026-10-15T06:46:22+00:00","url":"https://aipolicytracker.org/controls/conformity-assessment-and-registration","context_url":"https://aipolicytracker.org/controls/conformity-assessment-and-registration.md"},{"slug":"contractual-allocation-of-ai-duties","id":"AIPT-CTL-0011","title":"Contractual allocation of AI duties across the supply chain","kind":"contractual","kind_label":"Contractual term","purpose":"Writes into supplier and customer agreements who does what on documentation, testing, notification, data rights and cooperation, so that legal duties do not fall into the gap between organisations.\n","description":"Legal maintains a set of AI clauses for supplier, customer and partner agreements. Supplier terms cover the information and documentation to be provided, notice of material changes and incidents, cooperation with regulators, audit rights and restrictions on repurposing data. Customer and deployer terms cover permitted uses, the instructions to be followed, feedback channels and the logs and records each side keeps. Deal teams select clauses based on the system's risk tier and the counterparty's role, deviations are approved by legal, and signed clauses are indexed against the register entry for the system.\n","owner_role":"Legal counsel","frequency":"per_system","frequency_label":"Once per AI system","risk_subdomains":["6.5","6.4"],"evidence":[{"type":"contract_clause","title":"AI supplier clause set","description":"Agreed terms on documentation, change and incident notice, cooperation, audit and data use."},{"type":"contract_clause","title":"AI customer or deployer clause set","description":null},{"type":"register_entry","title":"Contract clause index against the AI register","description":null}],"framework_references":[{"framework":"iso_42001","framework_name":"ISO/IEC 42001:2023","reference":"Annex A.10.2, A.10.3, A.10.4","note":null,"confidence_level":"high"},{"framework":"nist_ai_rmf","framework_name":"NIST AI RMF 1.0","reference":"GOVERN 6.1; MANAGE 3.1","note":null,"confidence_level":"medium"}],"obligations":[{"slug":"eu-ai-act-importer-distributor-obligations","title":"Verify conformity before importing or distributing high-risk AI","relationship":"supports","note":"Supplier terms require the paperwork and notice of changes.","confidence_level":"medium","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-importer-distributor-obligations"},{"slug":"australia-vaiss-contestability-supply-chain-records","title":"Provide contestability, supply-chain transparency and records (guardrails 7 to 9)","relationship":"satisfies","note":"AI clauses make supply-chain transparency and record sharing enforceable.","confidence_level":"medium","is_binding":false,"policy":"australia-voluntary-ai-safety-standard","jurisdiction":"australia","url":"https://aipolicytracker.org/obligations/australia-vaiss-contestability-supply-chain-records"},{"slug":"eu-ai-act-art-22-authorised-representative","title":"Non-EU providers must appoint an EU authorised representative for high-risk AI","relationship":"satisfies","note":"The written mandate allocates the representative's tasks.","confidence_level":"high","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-22-authorised-representative"},{"slug":"eu-ai-act-art-25-value-chain-becoming-provider","title":"Deployers, distributors and importers must assume provider duties when they rebrand or substantially modify high-risk AI","relationship":"supports","note":"Contracts set out cooperation from the original provider.","confidence_level":"high","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-25-value-chain-becoming-provider"},{"slug":"eu-ai-act-art-25-4-written-agreements-with-component-suppliers","title":"Providers of high-risk AI must have written agreements with suppliers of components, tools and services","relationship":"satisfies","note":"The written agreement itself.","confidence_level":"high","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-25-4-written-agreements-with-component-suppliers"},{"slug":"eu-ai-act-art-54-gpai-authorised-representative","title":"Non-EU providers of GPAI models must appoint an EU authorised representative","relationship":"satisfies","note":"The mandate and its task list.","confidence_level":"high","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-54-gpai-authorised-representative"},{"slug":"eu-ai-act-transparency-to-deployers","title":"Provide deployers with clear instructions for use","relationship":"supports","note":"Customer terms carry the instructions and feedback channels.","confidence_level":"medium","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-transparency-to-deployers"},{"slug":"south-korea-ai-basic-act-art-36-domestic-representative","title":"Foreign AI business operators above the threshold must designate a domestic representative in Korea","relationship":"satisfies","note":"The written designation and the representative's task list.","confidence_level":"high","is_binding":true,"policy":"south-korea-framework-act-on-the-development-of-artificial-intelligence-and-establishment-of-a-foundation-for","jurisdiction":"south-korea","url":"https://aipolicytracker.org/obligations/south-korea-ai-basic-act-art-36-domestic-representative"},{"slug":"us-colorado-admt-developer-documentation","title":"Developers must supply deployers with documentation of the technology","relationship":"supports","note":"Contract terms that deliver the documentation to deployers.","confidence_level":"medium","is_binding":true,"policy":"us-colorado-automated-decision-making-technology-act","jurisdiction":"us-colorado","url":"https://aipolicytracker.org/obligations/us-colorado-admt-developer-documentation"}],"related_controls":["third-party-ai-due-diligence","technical-documentation-and-model-cards","ai-system-inventory"],"review_status":"verified","confidence_level":"medium","last_verified_at":"2026-09-26","reviewed_by":"Bhaskar Bhatt","updated_at":"2026-10-15T06:46:22+00:00","url":"https://aipolicytracker.org/controls/contractual-allocation-of-ai-duties","context_url":"https://aipolicytracker.org/controls/contractual-allocation-of-ai-duties.md"},{"slug":"data-governance-and-dataset-documentation","id":"AIPT-CTL-0012","title":"Data governance and dataset documentation","kind":"process","kind_label":"Process","purpose":"Makes sure the data used to train, tune, validate and test an AI system is fit for purpose, understood and documented, so that quality and bias problems are found in the data before they surface in decisions.\n","description":"Each dataset used in building a system gets a documentation sheet describing where it came from, how it was collected and labelled, what it is meant to represent, known gaps and the cleaning and transformation steps applied. Data owners check representativeness against the intended population and run bias and quality checks before a dataset is approved for use. Access, retention and change control apply to datasets in the same way as to code, and the documentation is versioned alongside the model that consumed it. Deployers who supply their own input data apply a lighter version of the same checks to confirm relevance.\n","owner_role":"Data governance lead","frequency":"per_system","frequency_label":"Once per AI system","risk_subdomains":["1.1","1.3","7.3","2.1"],"evidence":[{"type":"dataset_documentation","title":"Dataset documentation sheet","description":"Provenance, collection, labelling, representativeness, limitations and preparation steps for one dataset."},{"type":"evaluation_report","title":"Data quality and bias check report","description":null},{"type":"approval_record","title":"Dataset approval for use","description":null}],"framework_references":[{"framework":"iso_42001","framework_name":"ISO/IEC 42001:2023","reference":"Annex A.7.2, A.7.3, A.7.4, A.7.6","note":null,"confidence_level":"high"},{"framework":"nist_ai_rmf","framework_name":"NIST AI RMF 1.0","reference":"MAP 2.3; MEASURE 2.1, 2.2, 2.11","note":null,"confidence_level":"medium"},{"framework":"mitre_atlas","framework_name":"MITRE ATLAS","reference":"AML.M0007 Sanitize Training Data","note":null,"confidence_level":"medium"},{"framework":"owasp_llm_top10","framework_name":"OWASP Top 10 for LLM Applications","reference":"LLM04 Data and Model Poisoning","note":null,"confidence_level":"medium"}],"obligations":[{"slug":"eu-ai-act-data-governance","title":"Apply data governance and quality criteria to training, validation and testing data","relationship":"satisfies","note":"Dataset documentation, representativeness and bias checks per dataset.","confidence_level":"high","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-data-governance"},{"slug":"eu-ai-act-technical-documentation","title":"Draw up technical documentation before placing a high-risk system on the market","relationship":"supports","note":"Dataset sheets supply the data sections.","confidence_level":"high","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-technical-documentation"},{"slug":"eu-ai-act-art-26-4-deployer-input-data","title":"Deployers must ensure input data they control is relevant and representative","relationship":"satisfies","note":"Applied to operational input data rather than training data.","confidence_level":"medium","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-26-4-deployer-input-data"},{"slug":"uk-principles-fairness","title":"Use AI in ways that are fair and do not discriminate unlawfully","relationship":"supports","note":"Bias checks on training data.","confidence_level":"medium","is_binding":false,"policy":"uk-ai-regulation-white-paper","jurisdiction":"uk","url":"https://aipolicytracker.org/obligations/uk-principles-fairness"},{"slug":"india-dpdp-consent-and-notice","title":"Process personal data only with valid consent or a legitimate use, after notice","relationship":"supports","note":"Dataset documentation records consent status per source.","confidence_level":"medium","is_binding":true,"policy":"india-dpdp-act","jurisdiction":"india","url":"https://aipolicytracker.org/obligations/india-dpdp-consent-and-notice"},{"slug":"singapore-mgf-operations-management","title":"Manage data quality, model development and monitoring across the lifecycle","relationship":"satisfies","note":"Data lineage and dataset bias minimisation.","confidence_level":"medium","is_binding":false,"policy":"singapore-model-ai-governance-framework","jurisdiction":"singapore","url":"https://aipolicytracker.org/obligations/singapore-mgf-operations-management"},{"slug":"singapore-pdpc-consent-or-exception-for-ai-data","title":"Identify consent or an applicable PDPA exception before using personal data in AI","relationship":"supports","note":"Dataset sheets record the legal basis alongside provenance.","confidence_level":"medium","is_binding":true,"policy":"singapore-pdpc-ai-advisory-guidelines","jurisdiction":"singapore","url":"https://aipolicytracker.org/obligations/singapore-pdpc-consent-or-exception-for-ai-data"},{"slug":"us-new-york-city-local-law-144-data-policy-disclosure","title":"Employers and employment agencies must disclose the data collected and their retention policy for the tool","relationship":"supports","note":"Source of the data inventory disclosed.","confidence_level":"medium","is_binding":true,"policy":"us-new-york-city-local-law-144-automated-employment-decision-tools","jurisdiction":"us-new-york","url":"https://aipolicytracker.org/obligations/us-new-york-city-local-law-144-data-policy-disclosure"}],"related_controls":["training-data-provenance-and-copyright-register","technical-documentation-and-model-cards","privacy-and-data-protection-for-ai","accuracy-robustness-security-testing"],"review_status":"verified","confidence_level":"high","last_verified_at":"2026-09-26","reviewed_by":"Bhaskar Bhatt","updated_at":"2026-10-15T06:46:22+00:00","url":"https://aipolicytracker.org/controls/data-governance-and-dataset-documentation","context_url":"https://aipolicytracker.org/controls/data-governance-and-dataset-documentation.md"},{"slug":"decision-explanation-and-appeal-route","id":"AIPT-CTL-0013","title":"Decision explanation, human review and appeal route","kind":"process","kind_label":"Process","purpose":"Gives people affected by a significant automated or AI-assisted decision a meaningful explanation, a way to correct the data behind it, and a route to have a person reconsider it.\n","description":"For each decision point that has legal or similarly significant effects, the owner defines what the person is told after the decision: the main reasons, the data relied on and its sources, and how to challenge the outcome. Complaint and customer-service procedures are extended with an AI-decision challenge path staffed by people with the authority and information to change the result, and with target response times. Requests, outcomes and reversals are logged and reviewed, both to satisfy individual rights and to detect systematic problems that should feed back into the model or the oversight design.\n","owner_role":"Customer operations lead","frequency":"per_system","frequency_label":"Once per AI system","risk_subdomains":["5.2","1.1","7.4"],"evidence":[{"type":"disclosure_notice","title":"Adverse-decision explanation template","description":null},{"type":"procedure","title":"AI decision challenge and human review procedure","description":"Intake route, reviewer authority, response times and record-keeping for challenges."},{"type":"monitoring_record","title":"Challenge and reversal log","description":null}],"framework_references":[{"framework":"iso_42001","framework_name":"ISO/IEC 42001:2023","reference":"Annex A.8.2, A.8.3, A.9.2","note":null,"confidence_level":"medium"},{"framework":"nist_ai_rmf","framework_name":"NIST AI RMF 1.0","reference":"MEASURE 2.9; GOVERN 5.1; MANAGE 4.1","note":null,"confidence_level":"medium"},{"framework":"oecd_ai_principles","framework_name":"OECD AI Principles","reference":"Principle 1.3 Transparency and explainability","note":null,"confidence_level":"high"}],"obligations":[{"slug":"australia-vaiss-contestability-supply-chain-records","title":"Provide contestability, supply-chain transparency and records (guardrails 7 to 9)","relationship":"supports","note":"Challenge process for impacted people.","confidence_level":"high","is_binding":false,"policy":"australia-voluntary-ai-safety-standard","jurisdiction":"australia","url":"https://aipolicytracker.org/obligations/australia-vaiss-contestability-supply-chain-records"},{"slug":"eu-ai-act-art-26-11-notice-to-affected-persons","title":"Deployers must tell natural persons that a high-risk AI system is used in decisions about them","relationship":"supports","note":"Notice links to the Article 86 explanation route.","confidence_level":"medium","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-26-11-notice-to-affected-persons"},{"slug":"uk-principles-transparency-explainability","title":"Provide appropriate transparency and explainability","relationship":"supports","note":"Explanations of decisions about individuals.","confidence_level":"high","is_binding":false,"policy":"uk-ai-regulation-white-paper","jurisdiction":"uk","url":"https://aipolicytracker.org/obligations/uk-principles-transparency-explainability"},{"slug":"uk-principles-contestability-redress","title":"Provide routes to contest AI outcomes and seek redress","relationship":"satisfies","note":"An AI-decision challenge path within complaint procedures.","confidence_level":"high","is_binding":false,"policy":"uk-ai-regulation-white-paper","jurisdiction":"uk","url":"https://aipolicytracker.org/obligations/uk-principles-contestability-redress"},{"slug":"uk-ico-automated-decision-safeguards","title":"Apply safeguards to solely automated decisions with significant effects","relationship":"satisfies","note":"Notice, human intervention and contest route for significant automated decisions.","confidence_level":"high","is_binding":true,"policy":"uk-ico-ai-data-protection-guidance","jurisdiction":"uk","url":"https://aipolicytracker.org/obligations/uk-ico-automated-decision-safeguards"},{"slug":"eu-ai-act-art-86-right-to-explanation","title":"Deployers must explain individual decisions taken with high-risk AI on request","relationship":"satisfies","note":"Request channel and explanation of the system's role and main decision elements.","confidence_level":"high","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-86-right-to-explanation"},{"slug":"us-colorado-admt-adverse-decision-disclosure","title":"Disclose the use of the technology and the principal reasons after an adverse consequential decision","relationship":"satisfies","note":"Adverse-decision reasons, the role of the tool and the review route.","confidence_level":"high","is_binding":true,"policy":"us-colorado-automated-decision-making-technology-act","jurisdiction":"us-colorado","url":"https://aipolicytracker.org/obligations/us-colorado-admt-adverse-decision-disclosure"},{"slug":"us-colorado-admt-human-review","title":"Offer meaningful human review of an adverse consequential decision","relationship":"supports","note":"The request channel that leads to review.","confidence_level":"medium","is_binding":true,"policy":"us-colorado-automated-decision-making-technology-act","jurisdiction":"us-colorado","url":"https://aipolicytracker.org/obligations/us-colorado-admt-human-review"},{"slug":"uae-pdpl-automated-decision-objection","title":"Respect the right to object to automated decision-making without human intervention","relationship":"satisfies","note":"Provides the human-review route for solely automated decisions.","confidence_level":"high","is_binding":true,"policy":"uae-personal-data-protection-law","jurisdiction":"uae","url":"https://aipolicytracker.org/obligations/uae-pdpl-automated-decision-objection"},{"slug":"south-korea-ai-basic-act-art-34-high-impact-ai-explanation-measures","title":"Operators of high-impact AI must be able to explain outputs and the main criteria behind them","relationship":"satisfies","note":"Explanation of results and criteria to affected people.","confidence_level":"medium","is_binding":true,"policy":"south-korea-framework-act-on-the-development-of-artificial-intelligence-and-establishment-of-a-foundation-for","jurisdiction":"south-korea","url":"https://aipolicytracker.org/obligations/south-korea-ai-basic-act-art-34-high-impact-ai-explanation-measures"},{"slug":"us-colorado-consumer-notice-and-adverse-decision-explanation","title":"Notify consumers and explain adverse consequential decisions","relationship":"satisfies","note":"Adverse-decision reasons, data correction and appeal for human review.","confidence_level":"high","is_binding":true,"policy":"us-colorado-ai-act","jurisdiction":"us-colorado","url":"https://aipolicytracker.org/obligations/us-colorado-consumer-notice-and-adverse-decision-explanation"},{"slug":"us-new-york-city-local-law-144-alternative-process-request","title":"Employers and employment agencies must let candidates request an alternative selection process or accommodation","relationship":"satisfies","note":"Request channel and handling record for alternatives and accommodations.","confidence_level":"medium","is_binding":true,"policy":"us-new-york-city-local-law-144-automated-employment-decision-tools","jurisdiction":"us-new-york","url":"https://aipolicytracker.org/obligations/us-new-york-city-local-law-144-alternative-process-request"}],"related_controls":["human-oversight-and-override","ai-interaction-and-use-disclosure","record-keeping-and-logging"],"review_status":"verified","confidence_level":"high","last_verified_at":"2026-09-26","reviewed_by":"Bhaskar Bhatt","updated_at":"2026-10-15T06:46:22+00:00","url":"https://aipolicytracker.org/controls/decision-explanation-and-appeal-route","context_url":"https://aipolicytracker.org/controls/decision-explanation-and-appeal-route.md"},{"slug":"frontier-model-safety-framework","id":"AIPT-CTL-0014","title":"Frontier model safety and security framework","kind":"policy","kind_label":"Policy","purpose":"Commits a developer of the most capable general-purpose models to a published, regularly reviewed description of how it identifies catastrophic and systemic risks, decides when a model is safe to train further or release, and protects model weights.\n","description":"The developer writes and publishes a framework that sets capability thresholds of concern, the evaluations used to detect them, the mitigations that must be in place before crossing each threshold, the security measures for weights and infrastructure, and the internal governance that makes go or no-go decisions. Training compute is tracked against regulatory thresholds so that notification duties are met on time. The framework is reviewed at least annually and after significant capability jumps or incidents, changes are recorded in a version log, and summaries of evaluations and mitigations are shared with authorities and downstream providers as required.\n","owner_role":"Head of AI safety","frequency":"annual","frequency_label":"Annual","risk_subdomains":["7.2","7.1","4.2","6.1"],"evidence":[{"type":"policy_document","title":"Published frontier safety framework","description":"Capability thresholds, evaluations, mitigations, security measures and governance, with a version log."},{"type":"evaluation_report","title":"Dangerous-capability evaluation report","description":null},{"type":"regulatory_filing","title":"Threshold notification to an authority","description":null},{"type":"register_entry","title":"Training compute tracking record","description":null}],"framework_references":[{"framework":"nist_ai_rmf","framework_name":"NIST AI RMF 1.0","reference":"GOVERN 1.3, 1.4; MAP 5.1; MEASURE 2.6; MANAGE 1.3","note":null,"confidence_level":"medium"},{"framework":"iso_42001","framework_name":"ISO/IEC 42001:2023","reference":"Clause 5.2, 6.1.2; Annex A.6.1.2","note":null,"confidence_level":"low"},{"framework":"mitre_atlas","framework_name":"MITRE ATLAS","reference":"AML.M0001 Limit Model Artifact Release, AML.M0005 Control Access to ML Models and Data at Rest","note":null,"confidence_level":"medium"}],"obligations":[{"slug":"eu-ai-act-gpai-systemic-risk","title":"Manage systemic risk for high-impact general-purpose models","relationship":"satisfies","note":"Compute tracking, notification and the safety and security framework.","confidence_level":"medium","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-gpai-systemic-risk"},{"slug":"eu-ai-act-art-52-systemic-risk-notification","title":"Providers of GPAI models must notify the Commission within two weeks of meeting the systemic-risk threshold","relationship":"satisfies","note":"Compute tracking and threshold notification are part of the framework.","confidence_level":"high","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-52-systemic-risk-notification"},{"slug":"eu-ai-act-art-55-systemic-risk-incident-reporting","title":"Providers of systemic-risk GPAI models must track and report serious incidents to the AI Office","relationship":"supports","note":"Framework defines the incident types and escalation.","confidence_level":"medium","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-55-systemic-risk-incident-reporting"},{"slug":"us-california-sb-53-frontier-ai-framework","title":"Large frontier developers must publish a frontier AI framework","relationship":"satisfies","note":"The published, annually reviewed framework with a change log.","confidence_level":"high","is_binding":true,"policy":"us-california-sb-53","jurisdiction":"us-california","url":"https://aipolicytracker.org/obligations/us-california-sb-53-frontier-ai-framework"},{"slug":"us-california-sb-53-critical-safety-incident-reporting","title":"Report critical safety incidents to the Office of Emergency Services","relationship":"supports","note":"Defines the incident types the framework is meant to prevent.","confidence_level":"medium","is_binding":true,"policy":"us-california-sb-53","jurisdiction":"us-california","url":"https://aipolicytracker.org/obligations/us-california-sb-53-critical-safety-incident-reporting"},{"slug":"us-california-sb-53-transparency-report","title":"Frontier developers must publish a transparency report before deploying a new frontier model","relationship":"supports","note":"Report describes steps taken under the framework.","confidence_level":"medium","is_binding":true,"policy":"us-california-sb-53","jurisdiction":"us-california","url":"https://aipolicytracker.org/obligations/us-california-sb-53-transparency-report"},{"slug":"us-california-sb-53-catastrophic-risk-assessment-summaries","title":"Large frontier developers must send periodic summaries of catastrophic-risk assessments to the state","relationship":"satisfies","note":"Framework defines the catastrophic-risk assessment whose summaries are submitted.","confidence_level":"medium","is_binding":true,"policy":"us-california-sb-53","jurisdiction":"us-california","url":"https://aipolicytracker.org/obligations/us-california-sb-53-catastrophic-risk-assessment-summaries"},{"slug":"eu-ai-act-art-55-systemic-risk-cybersecurity","title":"Providers of systemic-risk GPAI models must secure the model and its infrastructure","relationship":"supports","note":"Framework commits to the weight-security measures.","confidence_level":"high","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-55-systemic-risk-cybersecurity"},{"slug":"south-korea-ai-basic-act-art-32-safety-measures-for-high-performance-ai","title":"Operators of AI above the compute threshold must run lifecycle risk management and report safety results","relationship":"satisfies","note":"Compute tracking, lifecycle risk assessment and reporting to the authority.","confidence_level":"medium","is_binding":true,"policy":"south-korea-framework-act-on-the-development-of-artificial-intelligence-and-establishment-of-a-foundation-for","jurisdiction":"south-korea","url":"https://aipolicytracker.org/obligations/south-korea-ai-basic-act-art-32-safety-measures-for-high-performance-ai"}],"related_controls":["genai-red-team-testing","ai-risk-assessment","ai-incident-management-and-reporting"],"review_status":"verified","confidence_level":"medium","last_verified_at":"2026-09-26","reviewed_by":"Bhaskar Bhatt","updated_at":"2026-10-15T06:46:22+00:00","url":"https://aipolicytracker.org/controls/frontier-model-safety-framework","context_url":"https://aipolicytracker.org/controls/frontier-model-safety-framework.md"},{"slug":"human-oversight-and-override","id":"AIPT-CTL-0016","title":"Human oversight design and override procedure","kind":"process","kind_label":"Process","purpose":"Ensures that competent people can understand, question, correct, stop or decline to use an AI system's output, and that the degree of human involvement is chosen deliberately for each decision point.\n","description":"For every decision point the system influences, the owner records whether a person decides with the system's help, reviews after the fact, or is only alerted on exceptions, and why that level is proportionate to the harm at stake. The interface exposes confidence, limitations and the reasons for an output where feasible, and includes a documented way to override, pause or shut the system down. Overseers are named, trained against automation bias and given the time and authority to intervene. Override events are logged and reviewed so that the oversight design can be tightened if interventions are rare or ineffective.\n","owner_role":"AI system owner","frequency":"per_system","frequency_label":"Once per AI system","risk_subdomains":["5.1","5.2","7.3"],"evidence":[{"type":"procedure","title":"Human oversight and override procedure","description":"Named overseers, the involvement level per decision point, escalation and stop mechanisms."},{"type":"approval_record","title":"Human-involvement design rationale","description":"Signed record of the oversight level chosen for each decision point and the reasoning."},{"type":"training_record","title":"Overseer training completion","description":null}],"framework_references":[{"framework":"iso_42001","framework_name":"ISO/IEC 42001:2023","reference":"Annex A.6.2.5, A.9.2, A.9.3","note":null,"confidence_level":"medium"},{"framework":"nist_ai_rmf","framework_name":"NIST AI RMF 1.0","reference":"GOVERN 3.2; MAP 3.5; MANAGE 2.4","note":null,"confidence_level":"high"},{"framework":"oecd_ai_principles","framework_name":"OECD AI Principles","reference":"Principle 1.2 Human-centred values and fairness","note":null,"confidence_level":"medium"},{"framework":"owasp_llm_top10","framework_name":"OWASP Top 10 for LLM Applications","reference":"LLM06 Excessive Agency","note":null,"confidence_level":"medium"}],"obligations":[{"slug":"eu-ai-act-deployer-obligations","title":"Use high-risk AI as instructed, monitor it and inform affected people","relationship":"supports","note":"Assigning trained natural persons to oversee the system.","confidence_level":"high","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-deployer-obligations"},{"slug":"australia-vaiss-testing-human-control-transparency","title":"Test and monitor systems, enable human control, and be transparent with users (guardrails 4 to 6)","relationship":"supports","note":"Guardrail 4: meaningful human control.","confidence_level":"high","is_binding":false,"policy":"australia-voluntary-ai-safety-standard","jurisdiction":"australia","url":"https://aipolicytracker.org/obligations/australia-vaiss-testing-human-control-transparency"},{"slug":"eu-ai-act-art-26-10-post-remote-biometric-identification-authorisation","title":"Law-enforcement deployers must obtain authorisation for post-remote biometric identification and report annually","relationship":"supports","note":"No adverse decision solely on the system's output.","confidence_level":"medium","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-26-10-post-remote-biometric-identification-authorisation"},{"slug":"eu-ai-act-art-50-4-deepfake-and-public-interest-text-disclosure","title":"Deployers must disclose deepfakes and AI-generated text published on matters of public interest","relationship":"supports","note":"Editorial control that lifts the text-disclosure duty.","confidence_level":"medium","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-50-4-deepfake-and-public-interest-text-disclosure"},{"slug":"uk-ico-automated-decision-safeguards","title":"Apply safeguards to solely automated decisions with significant effects","relationship":"supports","note":"Meaningful human intervention design.","confidence_level":"medium","is_binding":true,"policy":"uk-ico-ai-data-protection-guidance","jurisdiction":"uk","url":"https://aipolicytracker.org/obligations/uk-ico-automated-decision-safeguards"},{"slug":"eu-ai-act-human-oversight","title":"Enable and assign effective human oversight","relationship":"satisfies","note":"Oversight roles, interface measures, stop mechanism and override paths per deployment.","confidence_level":"high","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-human-oversight"},{"slug":"us-colorado-admt-human-review","title":"Offer meaningful human review of an adverse consequential decision","relationship":"satisfies","note":"A reviewer with authority to change the outcome.","confidence_level":"high","is_binding":true,"policy":"us-colorado-automated-decision-making-technology-act","jurisdiction":"us-colorado","url":"https://aipolicytracker.org/obligations/us-colorado-admt-human-review"},{"slug":"uae-pdpl-automated-decision-objection","title":"Respect the right to object to automated decision-making without human intervention","relationship":"supports","note":"Design of the human intervention step.","confidence_level":"medium","is_binding":true,"policy":"uae-personal-data-protection-law","jurisdiction":"uae","url":"https://aipolicytracker.org/obligations/uae-pdpl-automated-decision-objection"},{"slug":"singapore-mgf-human-involvement","title":"Determine the appropriate level of human involvement in AI decisions","relationship":"satisfies","note":"Records the in-the-loop, over-the-loop or out-of-the-loop choice and rationale.","confidence_level":"high","is_binding":false,"policy":"singapore-model-ai-governance-framework","jurisdiction":"singapore","url":"https://aipolicytracker.org/obligations/singapore-mgf-human-involvement"},{"slug":"south-korea-ai-basic-act-art-34-high-impact-ai-human-oversight","title":"Operators of high-impact AI must ensure human management and supervision","relationship":"satisfies","note":"Named supervisors with monitoring and override capability.","confidence_level":"high","is_binding":true,"policy":"south-korea-framework-act-on-the-development-of-artificial-intelligence-and-establishment-of-a-foundation-for","jurisdiction":"south-korea","url":"https://aipolicytracker.org/obligations/south-korea-ai-basic-act-art-34-high-impact-ai-human-oversight"},{"slug":"us-new-york-city-local-law-144-alternative-process-request","title":"Employers and employment agencies must let candidates request an alternative selection process or accommodation","relationship":"supports","note":"Human-run alternative where one is offered.","confidence_level":"medium","is_binding":true,"policy":"us-new-york-city-local-law-144-automated-employment-decision-tools","jurisdiction":"us-new-york","url":"https://aipolicytracker.org/obligations/us-new-york-city-local-law-144-alternative-process-request"},{"slug":"us-omb-m-25-21-high-impact-ai-practices","title":"Apply minimum risk-management practices to high-impact AI","relationship":"supports","note":"Human oversight and operator arrangements.","confidence_level":"medium","is_binding":true,"policy":"us-omb-m-25-21","jurisdiction":"us","url":"https://aipolicytracker.org/obligations/us-omb-m-25-21-high-impact-ai-practices"}],"related_controls":["ai-risk-assessment","decision-explanation-and-appeal-route","ai-literacy-and-role-based-training","record-keeping-and-logging"],"review_status":"verified","confidence_level":"high","last_verified_at":"2026-09-26","reviewed_by":"Bhaskar Bhatt","updated_at":"2026-10-15T06:46:22+00:00","url":"https://aipolicytracker.org/controls/human-oversight-and-override","context_url":"https://aipolicytracker.org/controls/human-oversight-and-override.md"},{"slug":"model-release-and-change-management-gate","id":"AIPT-CTL-0017","title":"Model release and change-management gate","kind":"process","kind_label":"Process","purpose":"Makes every release, retraining and material change to an AI system pass through a documented decision that confirms the required assessments, tests and documentation are complete and current.\n","description":"A release checklist tied to the system's risk tier lists the artefacts that must exist and be current before go-live: risk and impact assessments, test reports, documentation, oversight design, notices, monitoring plan and, where relevant, conformity and registration records. A change-classification rule distinguishes routine updates from material changes that re-open the assessments. The gate is applied in the deployment pipeline where possible, with a human approver for higher tiers, and decisions, deferrals and conditions are recorded. Decommissioning follows the same path in reverse, with data, logs and documentation retained as required.\n","owner_role":"Release manager","frequency":"on_material_change","frequency_label":"At launch and on material change","risk_subdomains":["7.3","6.5"],"evidence":[{"type":"approval_record","title":"Release or change approval record","description":"Checklist outcome, approver, conditions and date for one release or material change."},{"type":"procedure","title":"Release and change-classification procedure","description":null}],"framework_references":[{"framework":"iso_42001","framework_name":"ISO/IEC 42001:2023","reference":"Clause 8.1; Annex A.6.2.5, A.6.1.3","note":null,"confidence_level":"medium"},{"framework":"nist_ai_rmf","framework_name":"NIST AI RMF 1.0","reference":"MANAGE 1.1, 2.3; GOVERN 1.7","note":null,"confidence_level":"medium"},{"framework":"iso_27001","framework_name":"ISO/IEC 27001:2022","reference":"Annex A 8.32 Change management","note":null,"confidence_level":"medium"}],"obligations":[{"slug":"eu-ai-act-art-25-value-chain-becoming-provider","title":"Deployers, distributors and importers must assume provider duties when they rebrand or substantially modify high-risk AI","relationship":"satisfies","note":"The gate flags substantial modification, rebranding and repurposing and opens the provider duties.","confidence_level":"medium","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-25-value-chain-becoming-provider"},{"slug":"eu-ai-act-art-53-gpai-technical-and-downstream-documentation","title":"Providers of GPAI models must maintain technical documentation and inform downstream providers","relationship":"supports","note":"Release requires the documentation to be current.","confidence_level":"medium","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-53-gpai-technical-and-downstream-documentation"},{"slug":"eu-ai-act-art-20-corrective-actions-and-information","title":"Providers must take corrective action and inform the supply chain about non-conforming high-risk AI","relationship":"supports","note":"Withdrawal, disabling and re-release pass through the gate.","confidence_level":"medium","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-20-corrective-actions-and-information"},{"slug":"eu-ai-act-quality-management-system","title":"Operate a quality management system","relationship":"supports","note":"Design, release and change procedures within the system.","confidence_level":"medium","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-quality-management-system"},{"slug":"us-california-sb-53-transparency-report","title":"Frontier developers must publish a transparency report before deploying a new frontier model","relationship":"supports","note":"Release is gated on the report being published.","confidence_level":"high","is_binding":true,"policy":"us-california-sb-53","jurisdiction":"us-california","url":"https://aipolicytracker.org/obligations/us-california-sb-53-transparency-report"}],"related_controls":["accuracy-robustness-security-testing","technical-documentation-and-model-cards","conformity-assessment-and-registration","ai-quality-management-system"],"review_status":"verified","confidence_level":"medium","last_verified_at":"2026-09-26","reviewed_by":"Bhaskar Bhatt","updated_at":"2026-10-15T06:46:23+00:00","url":"https://aipolicytracker.org/controls/model-release-and-change-management-gate","context_url":"https://aipolicytracker.org/controls/model-release-and-change-management-gate.md"},{"slug":"post-market-monitoring-and-drift-detection","id":"AIPT-CTL-0018","title":"Post-deployment monitoring and drift detection","kind":"technical","kind_label":"Technical measure","purpose":"Watches a live AI system for falling performance, shifting data, emerging bias and unexpected use, and turns what it sees into corrective action, incident reports and documentation updates.\n","description":"Each deployed system has a monitoring plan that names the indicators to be tracked, the thresholds that trigger review, the feedback channels open to users and deployers, and who looks at the results and how often. Telemetry from logs, sampled human review of outputs, complaint data and periodic re-testing feed a dashboard or report. When an indicator breaches its threshold the owner opens a ticket, decides whether retraining, rollback, extra oversight or an incident report is needed and records the outcome. Monitoring findings are reviewed at governance meetings and feed the annual refresh of the risk and impact assessments.\n","owner_role":"AI system owner","frequency":"continuous","frequency_label":"Continuous","risk_subdomains":["7.3","1.3","5.1","6.5"],"evidence":[{"type":"procedure","title":"Post-market monitoring plan","description":"Indicators, thresholds, feedback channels, review cadence and responsibilities for one system."},{"type":"monitoring_record","title":"Monitoring dashboard or periodic monitoring report","description":null},{"type":"approval_record","title":"Monitoring review decision","description":"Recorded decision on retraining, rollback or escalation after a threshold breach."}],"framework_references":[{"framework":"iso_42001","framework_name":"ISO/IEC 42001:2023","reference":"Clause 9.1; Annex A.6.2.6","note":null,"confidence_level":"high"},{"framework":"nist_ai_rmf","framework_name":"NIST AI RMF 1.0","reference":"MEASURE 3.1, 3.3; MANAGE 4.1","note":null,"confidence_level":"high"},{"framework":"iso_23894","framework_name":"ISO/IEC 23894:2023","reference":"Clause 6.6","note":"Monitoring and review of AI risks.","confidence_level":"medium"}],"obligations":[{"slug":"eu-ai-act-risk-management-system","title":"Establish a risk management system for high-risk AI","relationship":"supports","note":"Post-market data feeds risk re-evaluation.","confidence_level":"medium","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-risk-management-system"},{"slug":"eu-ai-act-deployer-obligations","title":"Use high-risk AI as instructed, monitor it and inform affected people","relationship":"supports","note":"Monitoring operation and informing the provider of risks.","confidence_level":"medium","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-deployer-obligations"},{"slug":"eu-ai-act-art-26-4-deployer-input-data","title":"Deployers must ensure input data they control is relevant and representative","relationship":"supports","note":"Detects input drift away from the intended population.","confidence_level":"medium","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-26-4-deployer-input-data"},{"slug":"eu-ai-act-art-26-5-deployer-monitoring-and-suspension","title":"Deployers must monitor high-risk AI, suspend use on risk and report serious incidents","relationship":"satisfies","note":"Deployer-side monitoring with feedback to the provider.","confidence_level":"high","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-26-5-deployer-monitoring-and-suspension"},{"slug":"eu-ai-act-post-market-monitoring","title":"Operate a post-market monitoring system","relationship":"satisfies","note":"Documented monitoring plan with indicators, feedback channels and review cadence.","confidence_level":"high","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-post-market-monitoring"},{"slug":"eu-ai-act-accuracy-robustness-cybersecurity","title":"Achieve appropriate accuracy, robustness and cybersecurity","relationship":"supports","note":"Consistent performance over the lifecycle is confirmed in operation.","confidence_level":"medium","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-accuracy-robustness-cybersecurity"},{"slug":"us-colorado-ai-act-developer-disclosure-to-attorney-general","title":"Developers must notify the Attorney General and deployers of discovered algorithmic discrimination","relationship":"supports","note":"Ongoing testing is one of the discovery routes the statute names.","confidence_level":"medium","is_binding":true,"policy":"us-colorado-ai-act","jurisdiction":"us-colorado","url":"https://aipolicytracker.org/obligations/us-colorado-ai-act-developer-disclosure-to-attorney-general"},{"slug":"singapore-mgf-operations-management","title":"Manage data quality, model development and monitoring across the lifecycle","relationship":"satisfies","note":"Active monitoring and regular tuning after deployment.","confidence_level":"medium","is_binding":false,"policy":"singapore-model-ai-governance-framework","jurisdiction":"singapore","url":"https://aipolicytracker.org/obligations/singapore-mgf-operations-management"},{"slug":"us-colorado-deployer-impact-assessment","title":"Deployers must complete impact assessments for high-risk AI","relationship":"supports","note":"Post-deployment monitoring described in the assessment.","confidence_level":"medium","is_binding":true,"policy":"us-colorado-ai-act","jurisdiction":"us-colorado","url":"https://aipolicytracker.org/obligations/us-colorado-deployer-impact-assessment"},{"slug":"us-nist-ai-rmf-measure","title":"Measure and test trustworthiness characteristics (Measure)","relationship":"supports","note":"Tracking metrics over time.","confidence_level":"high","is_binding":false,"policy":"us-nist-ai-rmf","jurisdiction":"us","url":"https://aipolicytracker.org/obligations/us-nist-ai-rmf-measure"}],"related_controls":["record-keeping-and-logging","ai-incident-management-and-reporting","accuracy-robustness-security-testing","ai-risk-assessment"],"review_status":"verified","confidence_level":"high","last_verified_at":"2026-09-26","reviewed_by":"Bhaskar Bhatt","updated_at":"2026-10-15T06:46:23+00:00","url":"https://aipolicytracker.org/controls/post-market-monitoring-and-drift-detection","context_url":"https://aipolicytracker.org/controls/post-market-monitoring-and-drift-detection.md"},{"slug":"privacy-and-data-protection-for-ai","id":"AIPT-CTL-0019","title":"Privacy and data-protection controls for AI","kind":"process","kind_label":"Process","purpose":"Ensures that personal data used to train, tune or run an AI system is processed on a documented lawful basis, with the assessments, notices, security and individual rights that data-protection law requires.\n","description":"The privacy function maps every AI data flow to a legal basis or recognised exception and records the conditions relied on, such as consent wording, the scope of a business-improvement or research exception, or a legitimate-interest balancing. Where the processing is high-risk, a data protection impact assessment is completed before it starts and merged with the wider AI impact assessment where possible. Privacy notices are updated to describe AI uses, minimisation and retention rules are applied to training and inference data, and rights requests and breach handling are extended to cover model outputs that could reveal personal data. Where a regime designates the organisation for enhanced duties, the officer, auditor and periodic assessment requirements are scheduled.\n","owner_role":"Data protection officer","frequency":"per_system","frequency_label":"Once per AI system","risk_subdomains":["2.1","1.1","4.1"],"evidence":[{"type":"data_protection_assessment","title":"Data protection impact assessment for an AI system","description":null},{"type":"register_entry","title":"AI data-flow and legal-basis record","description":"Each dataset or inference flow with its purpose, legal basis or exception and the conditions met."},{"type":"disclosure_notice","title":"Privacy notice section on AI use","description":null},{"type":"audit_report","title":"Independent data audit or DPO review","description":null}],"framework_references":[{"framework":"iso_42001","framework_name":"ISO/IEC 42001:2023","reference":"Annex A.7.2, A.7.3; Clause 6.1.4","note":null,"confidence_level":"medium"},{"framework":"nist_ai_rmf","framework_name":"NIST AI RMF 1.0","reference":"MEASURE 2.10; MAP 4.1; GOVERN 1.1","note":null,"confidence_level":"medium"},{"framework":"iso_27001","framework_name":"ISO/IEC 27001:2022","reference":"Annex A 5.34 Privacy and protection of PII","note":null,"confidence_level":"medium"},{"framework":"owasp_llm_top10","framework_name":"OWASP Top 10 for LLM Applications","reference":"LLM02 Sensitive Information Disclosure","note":null,"confidence_level":"medium"}],"obligations":[{"slug":"eu-ai-act-fundamental-rights-impact-assessment","title":"Carry out a fundamental rights impact assessment before deployment","relationship":"supports","note":"Reuse of the DPIA workflow and findings.","confidence_level":"high","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-fundamental-rights-impact-assessment"},{"slug":"eu-ai-act-art-26-9-dpia-using-provider-information","title":"Deployers must use the provider's transparency information in their data protection impact assessment","relationship":"satisfies","note":"DPIA built on the provider's documentation.","confidence_level":"high","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-26-9-dpia-using-provider-information"},{"slug":"eu-ai-act-art-50-3-emotion-recognition-notice","title":"Deployers of emotion recognition or biometric categorisation must inform exposed persons","relationship":"supports","note":"Lawful basis and safeguards for biometric data.","confidence_level":"high","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-50-3-emotion-recognition-notice"},{"slug":"india-dpdp-significant-data-fiduciary-duties","title":"Significant Data Fiduciaries must appoint a DPO and run impact assessments and audits","relationship":"satisfies","note":"Schedules the DPO, independent audit and periodic DPIA duties.","confidence_level":"medium","is_binding":true,"policy":"india-dpdp-act","jurisdiction":"india","url":"https://aipolicytracker.org/obligations/india-dpdp-significant-data-fiduciary-duties"},{"slug":"nepal-privacy-act-consent-and-purpose","title":"Collect and use personal information only with consent and for the stated purpose","relationship":"satisfies","note":"Consent and purpose documentation for Nepal personal data.","confidence_level":"high","is_binding":true,"policy":"nepal-individual-privacy-act","jurisdiction":"nepal","url":"https://aipolicytracker.org/obligations/nepal-privacy-act-consent-and-purpose"},{"slug":"uk-ico-dpia-for-ai","title":"Carry out a data protection impact assessment for high-risk AI processing","relationship":"satisfies","note":"DPIA with AI-specific sections before processing starts.","confidence_level":"high","is_binding":true,"policy":"uk-ico-ai-data-protection-guidance","jurisdiction":"uk","url":"https://aipolicytracker.org/obligations/uk-ico-dpia-for-ai"},{"slug":"india-dpdp-security-and-breach-notification","title":"Implement reasonable security safeguards and notify breaches","relationship":"supports","note":"Breach handling extended to model outputs and training data.","confidence_level":"medium","is_binding":true,"policy":"india-dpdp-act","jurisdiction":"india","url":"https://aipolicytracker.org/obligations/india-dpdp-security-and-breach-notification"},{"slug":"india-dpdp-consent-and-notice","title":"Process personal data only with valid consent or a legitimate use, after notice","relationship":"satisfies","note":"Legal basis and notice recorded for each training and inference data source.","confidence_level":"high","is_binding":true,"policy":"india-dpdp-act","jurisdiction":"india","url":"https://aipolicytracker.org/obligations/india-dpdp-consent-and-notice"},{"slug":"singapore-pdpc-ai-notification","title":"Notify individuals about the use of personal data in AI recommendations and decisions","relationship":"supports","note":"Privacy notice content on AI data use.","confidence_level":"high","is_binding":true,"policy":"singapore-pdpc-ai-advisory-guidelines","jurisdiction":"singapore","url":"https://aipolicytracker.org/obligations/singapore-pdpc-ai-notification"},{"slug":"singapore-pdpc-consent-or-exception-for-ai-data","title":"Identify consent or an applicable PDPA exception before using personal data in AI","relationship":"satisfies","note":"Maps each AI data use to consent or a named exception and records the conditions.","confidence_level":"high","is_binding":true,"policy":"singapore-pdpc-ai-advisory-guidelines","jurisdiction":"singapore","url":"https://aipolicytracker.org/obligations/singapore-pdpc-consent-or-exception-for-ai-data"},{"slug":"uae-pdpl-impact-assessment-new-technologies","title":"Conduct a data protection impact assessment for high-risk processing using new technologies","relationship":"satisfies","note":"DPIA before high-risk processing with new technologies.","confidence_level":"high","is_binding":true,"policy":"uae-personal-data-protection-law","jurisdiction":"uae","url":"https://aipolicytracker.org/obligations/uae-pdpl-impact-assessment-new-technologies"},{"slug":"us-new-york-city-local-law-144-data-policy-disclosure","title":"Employers and employment agencies must disclose the data collected and their retention policy for the tool","relationship":"satisfies","note":"Data notice with types, sources and retention.","confidence_level":"high","is_binding":true,"policy":"us-new-york-city-local-law-144-automated-employment-decision-tools","jurisdiction":"us-new-york","url":"https://aipolicytracker.org/obligations/us-new-york-city-local-law-144-data-policy-disclosure"},{"slug":"us-texas-responsible-ai-governance-act-traiga-government-biometric-identification-prohibition","title":"Governmental entities must not use AI for biometric identification from public data without consent where it infringes rights","relationship":"supports","note":"Consent and lawful basis for biometric data.","confidence_level":"high","is_binding":true,"policy":"us-texas-responsible-ai-governance-act-traiga","jurisdiction":"us-texas","url":"https://aipolicytracker.org/obligations/us-texas-responsible-ai-governance-act-traiga-government-biometric-identification-prohibition"}],"related_controls":["ai-impact-assessment","data-governance-and-dataset-documentation","ai-interaction-and-use-disclosure","ai-incident-management-and-reporting"],"review_status":"verified","confidence_level":"high","last_verified_at":"2026-09-26","reviewed_by":"Bhaskar Bhatt","updated_at":"2026-10-15T06:46:23+00:00","url":"https://aipolicytracker.org/controls/privacy-and-data-protection-for-ai","context_url":"https://aipolicytracker.org/controls/privacy-and-data-protection-for-ai.md"},{"slug":"prohibited-use-screening-gate","id":"AIPT-CTL-0020","title":"Prohibited and unacceptable-use screening gate","kind":"process","kind_label":"Process","purpose":"Stops the organisation from building, buying or operating an AI use that the law bans or that its own policy rules out, by checking every proposed and existing use against a maintained list.\n","description":"The governance lead maintains a screening list that combines the practices prohibited in each jurisdiction the organisation operates in with the uses its own policy excludes. Intake, design review and vendor onboarding each include the screen, and every existing system in the register is screened once and re-screened when its purpose, users or jurisdictions change. Borderline cases go to legal and the governance forum, and the outcome, reasoning and any conditions are recorded against the register entry. The list is reviewed whenever the law or official guidance changes.\n","owner_role":"AI governance lead","frequency":"per_system","frequency_label":"Once per AI system","risk_subdomains":["4.1","5.2","1.1","6.5"],"evidence":[{"type":"approval_record","title":"Prohibited-use screening record","description":"Dated checklist outcome per system with reviewer and rationale."},{"type":"procedure","title":"Screening list and escalation procedure","description":null}],"framework_references":[{"framework":"iso_42001","framework_name":"ISO/IEC 42001:2023","reference":"Clause 6.1.4; Annex A.5.2, A.9.3","note":null,"confidence_level":"medium"},{"framework":"nist_ai_rmf","framework_name":"NIST AI RMF 1.0","reference":"GOVERN 1.1; MAP 1.1","note":null,"confidence_level":"medium"}],"obligations":[{"slug":"eu-ai-act-prohibited-practices","title":"Do not deploy or provide AI for prohibited practices","relationship":"satisfies","note":"Screens every new and existing system against the banned practices with a recorded outcome.","confidence_level":"high","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-prohibited-practices"},{"slug":"eu-ai-act-art-50-3-emotion-recognition-notice","title":"Deployers of emotion recognition or biometric categorisation must inform exposed persons","relationship":"supports","note":"Confirms the use is not banned by Article 5.","confidence_level":"medium","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-50-3-emotion-recognition-notice"},{"slug":"us-texas-responsible-ai-governance-act-traiga-manipulation-prohibition","title":"Developers and deployers must not use AI to incite self-harm, harm to others or crime","relationship":"satisfies","note":"Screens intent and design against the banned purposes.","confidence_level":"high","is_binding":true,"policy":"us-texas-responsible-ai-governance-act-traiga","jurisdiction":"us-texas","url":"https://aipolicytracker.org/obligations/us-texas-responsible-ai-governance-act-traiga-manipulation-prohibition"},{"slug":"us-texas-responsible-ai-governance-act-traiga-government-social-scoring-prohibition","title":"Governmental entities must not use AI for social scoring","relationship":"satisfies","note":"Screens public-sector scoring tools against the ban.","confidence_level":"high","is_binding":true,"policy":"us-texas-responsible-ai-governance-act-traiga","jurisdiction":"us-texas","url":"https://aipolicytracker.org/obligations/us-texas-responsible-ai-governance-act-traiga-government-social-scoring-prohibition"},{"slug":"us-texas-responsible-ai-governance-act-traiga-government-biometric-identification-prohibition","title":"Governmental entities must not use AI for biometric identification from public data without consent where it infringes rights","relationship":"satisfies","note":"Screens biometric projects against the ban.","confidence_level":"high","is_binding":true,"policy":"us-texas-responsible-ai-governance-act-traiga","jurisdiction":"us-texas","url":"https://aipolicytracker.org/obligations/us-texas-responsible-ai-governance-act-traiga-government-biometric-identification-prohibition"},{"slug":"us-texas-responsible-ai-governance-act-traiga-unlawful-discrimination-prohibition","title":"Developers and deployers must not use AI with the intent to unlawfully discriminate against a protected class","relationship":"satisfies","note":"Screens purpose against the discrimination ban.","confidence_level":"high","is_binding":true,"policy":"us-texas-responsible-ai-governance-act-traiga","jurisdiction":"us-texas","url":"https://aipolicytracker.org/obligations/us-texas-responsible-ai-governance-act-traiga-unlawful-discrimination-prohibition"},{"slug":"us-texas-responsible-ai-governance-act-traiga-sexual-content-and-csam-prohibition","title":"Developers and distributors must not build AI intended to produce child sexual abuse material or unlawful sexual deepfakes","relationship":"satisfies","note":"Screens product intent against the ban.","confidence_level":"high","is_binding":true,"policy":"us-texas-responsible-ai-governance-act-traiga","jurisdiction":"us-texas","url":"https://aipolicytracker.org/obligations/us-texas-responsible-ai-governance-act-traiga-sexual-content-and-csam-prohibition"}],"related_controls":["ai-system-inventory","ai-impact-assessment","ai-governance-policy-and-accountability"],"review_status":"verified","confidence_level":"medium","last_verified_at":"2026-09-26","reviewed_by":"Bhaskar Bhatt","updated_at":"2026-10-15T06:46:23+00:00","url":"https://aipolicytracker.org/controls/prohibited-use-screening-gate","context_url":"https://aipolicytracker.org/controls/prohibited-use-screening-gate.md"},{"slug":"public-sector-ai-use-case-register","id":"AIPT-CTL-0021","title":"Public-sector AI use-case register and algorithmic transparency","kind":"process","kind_label":"Process","purpose":"Lets a public body account for the AI it uses by keeping an inventory of use cases, flagging those that affect rights or services, and publishing what the public and oversight bodies are entitled to see.\n","description":"Each agency or department nominates a responsible official who collects use cases from programme teams through a standard form covering purpose, stage, data, vendors, affected people and whether the use is high-impact. Entries are reviewed for completeness and consistency with the procurement record, exclusions are documented, and the resulting inventory is published on the required cadence with sensitive items summarised. Vendors are asked at contract time for the descriptions and evidence the agency will need, and the register is used to track that high-impact uses have the extra assessments and safeguards required.\n","owner_role":"Agency AI officer","frequency":"annual","frequency_label":"Annual","risk_subdomains":["6.5","7.4","5.2"],"evidence":[{"type":"register_entry","title":"Public AI use-case inventory","description":"Published list of use cases with purpose, stage and high-impact flag."},{"type":"disclosure_notice","title":"Algorithmic transparency statement for one use case","description":null},{"type":"approval_record","title":"Inventory review and publication sign-off","description":null}],"framework_references":[{"framework":"nist_ai_rmf","framework_name":"NIST AI RMF 1.0","reference":"MAP 1.1, 1.5; GOVERN 1.6, 5.1","note":null,"confidence_level":"medium"},{"framework":"iso_42001","framework_name":"ISO/IEC 42001:2023","reference":"Clause 4.1; Annex A.8.5","note":null,"confidence_level":"low"},{"framework":"oecd_ai_principles","framework_name":"OECD AI Principles","reference":"Principle 1.3 Transparency and explainability","note":null,"confidence_level":"medium"}],"obligations":[{"slug":"eu-ai-act-art-26-8-public-authority-registration-before-use","title":"Public authorities must register their use of high-risk AI and must not use unregistered systems","relationship":"satisfies","note":"Registration of public-authority use with the required Annex VIII information.","confidence_level":"high","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-26-8-public-authority-registration-before-use"},{"slug":"us-texas-responsible-ai-governance-act-traiga-government-social-scoring-prohibition","title":"Governmental entities must not use AI for social scoring","relationship":"supports","note":"Register is the population to be screened.","confidence_level":"medium","is_binding":true,"policy":"us-texas-responsible-ai-governance-act-traiga","jurisdiction":"us-texas","url":"https://aipolicytracker.org/obligations/us-texas-responsible-ai-governance-act-traiga-government-social-scoring-prohibition"},{"slug":"us-eo-14179-agency-review-of-prior-actions","title":"Federal agencies must review and revise actions inconsistent with the new AI policy","relationship":"supports","note":"Agency inventories are where superseded requirements are identified.","confidence_level":"low","is_binding":true,"policy":"us-executive-order-14179","jurisdiction":"us","url":"https://aipolicytracker.org/obligations/us-eo-14179-agency-review-of-prior-actions"},{"slug":"us-texas-responsible-ai-governance-act-traiga-government-agency-ai-interaction-disclosure","title":"Government agencies must disclose to consumers that they are interacting with an AI system","relationship":"supports","note":"Register identifies the consumer-facing systems that need the notice.","confidence_level":"medium","is_binding":true,"policy":"us-texas-responsible-ai-governance-act-traiga","jurisdiction":"us-texas","url":"https://aipolicytracker.org/obligations/us-texas-responsible-ai-governance-act-traiga-government-agency-ai-interaction-disclosure"},{"slug":"us-omb-m-25-21-use-case-inventory","title":"Publish an annual AI use-case inventory","relationship":"satisfies","note":"Annual collection, review and publication of use cases with high-impact flags.","confidence_level":"high","is_binding":true,"policy":"us-omb-m-25-21","jurisdiction":"us","url":"https://aipolicytracker.org/obligations/us-omb-m-25-21-use-case-inventory"},{"slug":"nepal-ai-policy-responsible-ai-principles","title":"Government bodies to promote ethical, responsible and inclusive AI (policy commitment)","relationship":"supports","note":"Institutional oversight of government AI use.","confidence_level":"low","is_binding":false,"policy":"nepal-national-ai-policy","jurisdiction":"nepal","url":"https://aipolicytracker.org/obligations/nepal-ai-policy-responsible-ai-principles"}],"related_controls":["ai-system-inventory","ai-impact-assessment","ai-interaction-and-use-disclosure"],"review_status":"verified","confidence_level":"medium","last_verified_at":"2026-09-26","reviewed_by":"Bhaskar Bhatt","updated_at":"2026-10-15T06:46:23+00:00","url":"https://aipolicytracker.org/controls/public-sector-ai-use-case-register","context_url":"https://aipolicytracker.org/controls/public-sector-ai-use-case-register.md"},{"slug":"ai-quality-management-system","id":"AIPT-CTL-0007","title":"Quality management system for AI development and supply","kind":"policy","kind_label":"Policy","purpose":"Binds the organisation's AI processes into one documented, audited management system so that compliance is repeatable across products rather than reinvented for each one.\n","description":"Building on an existing quality or information-security management system, the organisation documents the procedures that cover the AI lifecycle: how regulatory requirements are identified, how systems are designed, built, tested and released, how data and documentation are managed, how post-market monitoring and incidents are run, how suppliers are controlled and how corrective action is tracked. Roles and resources are assigned, internal audits check that procedures are followed, and management reviews the system's performance at least annually. Records of the system itself are retained for the period authorities expect.\n","owner_role":"Quality lead","frequency":"annual","frequency_label":"Annual","risk_subdomains":["6.5","7.3"],"evidence":[{"type":"policy_document","title":"AI quality management system manual","description":"Scope, procedures, roles and records that make up the management system."},{"type":"audit_report","title":"Internal audit of the AI management system","description":null},{"type":"meeting_record","title":"Management review minutes","description":null}],"framework_references":[{"framework":"iso_42001","framework_name":"ISO/IEC 42001:2023","reference":"Clause 4 to 10","note":"The management-system structure as a whole; certification is optional.","confidence_level":"high"},{"framework":"nist_ai_rmf","framework_name":"NIST AI RMF 1.0","reference":"GOVERN 1.4, 1.5, 1.7","note":null,"confidence_level":"medium"}],"obligations":[{"slug":"eu-ai-act-art-16-provider-obligations","title":"Providers must meet the full set of provider duties for high-risk AI","relationship":"supports","note":"The QMS is where most Article 16 duties are operated.","confidence_level":"high","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-16-provider-obligations"},{"slug":"eu-ai-act-quality-management-system","title":"Operate a quality management system","relationship":"satisfies","note":"A documented management system covering the required elements.","confidence_level":"high","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-quality-management-system"},{"slug":"eu-ai-act-conformity-assessment-registration","title":"Complete conformity assessment, CE marking and EU database registration","relationship":"supports","note":"Internal-control assessment relies on the documented management system.","confidence_level":"medium","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-conformity-assessment-registration"}],"related_controls":["ai-governance-policy-and-accountability","technical-documentation-and-model-cards","model-release-and-change-management-gate","conformity-assessment-and-registration"],"review_status":"verified","confidence_level":"high","last_verified_at":"2026-09-26","reviewed_by":"Bhaskar Bhatt","updated_at":"2026-10-15T06:46:22+00:00","url":"https://aipolicytracker.org/controls/ai-quality-management-system","context_url":"https://aipolicytracker.org/controls/ai-quality-management-system.md"},{"slug":"synthetic-content-labelling-and-provenance","id":"AIPT-CTL-0023","title":"Synthetic content labelling and provenance marking","kind":"technical","kind_label":"Technical measure","purpose":"Makes AI-generated or manipulated audio, image, video and text identifiable as such, both to people looking at it and to software checking it, so that it cannot easily be passed off as authentic.\n","description":"Generation pipelines attach a machine-readable provenance signal to output, for example a content credential manifest, an invisible watermark or metadata, using a method that survives the common ways the content will be shared. Where the audience needs to see it, a visible label or spoken notice is added as well. The team documents which methods are used for which modality, tests detectability and robustness to editing, and keeps a verification tool or endpoint available. Downstream products that display deepfakes or AI-written material of public interest apply the label rules set by the organisation's editorial policy.\n","owner_role":"Engineering lead","frequency":"continuous","frequency_label":"Continuous","risk_subdomains":["3.1","3.2","4.1","4.3"],"evidence":[{"type":"procedure","title":"Content labelling and provenance standard","description":"Methods used per modality, label wording and exceptions."},{"type":"evaluation_report","title":"Watermark and provenance robustness test","description":null},{"type":"disclosure_notice","title":"Visible AI-generated content label","description":null}],"framework_references":[{"framework":"iso_42001","framework_name":"ISO/IEC 42001:2023","reference":"Annex A.8.2, A.9.3","note":null,"confidence_level":"low"},{"framework":"nist_ai_rmf","framework_name":"NIST AI RMF 1.0","reference":"MEASURE 2.8; MANAGE 4.1","note":"Transparency measures for generative AI outputs.","confidence_level":"medium"},{"framework":"owasp_llm_top10","framework_name":"OWASP Top 10 for LLM Applications","reference":"LLM09 Misinformation","note":null,"confidence_level":"medium"}],"obligations":[{"slug":"south-korea-ai-basic-act-art-31-generative-output-labelling-and-deepfake-notice","title":"AI business operators must label generative AI output and clearly flag realistic synthetic media","relationship":"satisfies","note":"Labels and provenance marks on generated output and realistic synthetic media.","confidence_level":"high","is_binding":true,"policy":"south-korea-framework-act-on-the-development-of-artificial-intelligence-and-establishment-of-a-foundation-for","jurisdiction":"south-korea","url":"https://aipolicytracker.org/obligations/south-korea-ai-basic-act-art-31-generative-output-labelling-and-deepfake-notice"},{"slug":"singapore-mgf-genai-incident-reporting-and-provenance","title":"Report incidents and mark AI-generated content (generative AI framework)","relationship":"satisfies","note":"Watermarking and cryptographic provenance for generated media.","confidence_level":"medium","is_binding":false,"policy":"singapore-model-ai-governance-framework","jurisdiction":"singapore","url":"https://aipolicytracker.org/obligations/singapore-mgf-genai-incident-reporting-and-provenance"},{"slug":"eu-ai-act-art-50-2-synthetic-content-marking","title":"Providers of generative AI must mark synthetic output as artificially generated in a machine-readable way","relationship":"satisfies","note":"Machine-readable marking with robustness evidence.","confidence_level":"high","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-50-2-synthetic-content-marking"},{"slug":"eu-ai-act-art-50-4-deepfake-and-public-interest-text-disclosure","title":"Deployers must disclose deepfakes and AI-generated text published on matters of public interest","relationship":"satisfies","note":"User-facing labels on deepfakes and public-interest text.","confidence_level":"high","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-50-4-deepfake-and-public-interest-text-disclosure"},{"slug":"eu-ai-act-transparency-article-50","title":"Disclose AI interaction and label synthetic content","relationship":"satisfies","note":"Machine-readable marking of synthetic output and deepfake labels.","confidence_level":"high","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-transparency-article-50"}],"related_controls":["ai-interaction-and-use-disclosure","genai-red-team-testing"],"review_status":"verified","confidence_level":"medium","last_verified_at":"2026-09-26","reviewed_by":"Bhaskar Bhatt","updated_at":"2026-10-15T06:46:23+00:00","url":"https://aipolicytracker.org/controls/synthetic-content-labelling-and-provenance","context_url":"https://aipolicytracker.org/controls/synthetic-content-labelling-and-provenance.md"},{"slug":"technical-documentation-and-model-cards","id":"AIPT-CTL-0024","title":"Technical documentation, model cards and instructions for use","kind":"process","kind_label":"Process","purpose":"Produces and maintains the documentation that lets a regulator, a customer or a deployer understand what a system is, how it was built and tested, what it is for and how to use it safely.\n","description":"A documentation set is started at design time and grows with the system: intended purpose and out-of-scope uses, architecture and dependencies, training and evaluation data, performance results and their limits, known risks and mitigations, oversight measures and the resources needed to operate it. From the same source the team derives a shorter model card or deployer information pack and the instructions for use that ship with each release. Documents live under version control, each release tags the version it was assessed against, and an owner is responsible for updating them whenever the system changes materially.\n","owner_role":"Product or model owner","frequency":"on_material_change","frequency_label":"At launch and on material change","risk_subdomains":["7.4","5.1","7.3"],"evidence":[{"type":"technical_file","title":"Technical documentation file","description":"Assembled, versioned documentation of design, data, testing, risks and oversight for one system."},{"type":"model_documentation","title":"Model card or deployer information pack","description":null},{"type":"disclosure_notice","title":"Instructions for use","description":"User-facing document describing purpose, limits, oversight measures and how to interpret output."}],"framework_references":[{"framework":"iso_42001","framework_name":"ISO/IEC 42001:2023","reference":"Clause 7.5; Annex A.6.2.3, A.6.2.7, A.8.2","note":null,"confidence_level":"high"},{"framework":"nist_ai_rmf","framework_name":"NIST AI RMF 1.0","reference":"GOVERN 1.4; MAP 2.2; MEASURE 2.8","note":null,"confidence_level":"medium"}],"obligations":[{"slug":"eu-ai-act-technical-documentation","title":"Draw up technical documentation before placing a high-risk system on the market","relationship":"satisfies","note":"Versioned technical file structured to the required elements.","confidence_level":"high","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-technical-documentation"},{"slug":"eu-ai-act-conformity-assessment-registration","title":"Complete conformity assessment, CE marking and EU database registration","relationship":"supports","note":"The technical file is the input to the assessment.","confidence_level":"high","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-conformity-assessment-registration"},{"slug":"eu-ai-act-gpai-provider-obligations","title":"Meet general-purpose AI model provider obligations","relationship":"satisfies","note":"Provides the model documentation and the downstream information pack.","confidence_level":"medium","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-gpai-provider-obligations"},{"slug":"eu-ai-act-art-18-documentation-keeping","title":"Providers must keep high-risk AI documentation for ten years","relationship":"supports","note":"Produces the technical file that must be retained.","confidence_level":"high","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-18-documentation-keeping"},{"slug":"eu-ai-act-art-21-cooperation-with-authorities","title":"Providers must supply conformity evidence and log access to authorities on request","relationship":"supports","note":"The documentation set that is handed over.","confidence_level":"high","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-21-cooperation-with-authorities"},{"slug":"eu-ai-act-art-53-gpai-technical-and-downstream-documentation","title":"Providers of GPAI models must maintain technical documentation and inform downstream providers","relationship":"satisfies","note":"Model card and technical file structured to Annexes XI and XII.","confidence_level":"high","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-53-gpai-technical-and-downstream-documentation"},{"slug":"eu-ai-act-art-54-gpai-authorised-representative","title":"Non-EU providers of GPAI models must appoint an EU authorised representative","relationship":"supports","note":"The documentation the representative holds.","confidence_level":"high","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-54-gpai-authorised-representative"},{"slug":"uk-principles-transparency-explainability","title":"Provide appropriate transparency and explainability","relationship":"supports","note":"Explainability documentation.","confidence_level":"medium","is_binding":false,"policy":"uk-ai-regulation-white-paper","jurisdiction":"uk","url":"https://aipolicytracker.org/obligations/uk-principles-transparency-explainability"},{"slug":"us-california-sb-53-transparency-report","title":"Frontier developers must publish a transparency report before deploying a new frontier model","relationship":"satisfies","note":"The model card content the report is built from.","confidence_level":"high","is_binding":true,"policy":"us-california-sb-53","jurisdiction":"us-california","url":"https://aipolicytracker.org/obligations/us-california-sb-53-transparency-report"},{"slug":"eu-ai-act-transparency-to-deployers","title":"Provide deployers with clear instructions for use","relationship":"satisfies","note":"Instructions for use derived from the technical documentation.","confidence_level":"medium","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-transparency-to-deployers"},{"slug":"south-korea-ai-basic-act-art-34-high-impact-ai-user-protection-and-documentation","title":"Operators of high-impact AI must prepare user-protection measures and keep records of their safety and trust measures","relationship":"satisfies","note":"Documentation of safety and reliability measures.","confidence_level":"medium","is_binding":true,"policy":"south-korea-framework-act-on-the-development-of-artificial-intelligence-and-establishment-of-a-foundation-for","jurisdiction":"south-korea","url":"https://aipolicytracker.org/obligations/south-korea-ai-basic-act-art-34-high-impact-ai-user-protection-and-documentation"},{"slug":"south-korea-ai-basic-act-art-34-high-impact-ai-explanation-measures","title":"Operators of high-impact AI must be able to explain outputs and the main criteria behind them","relationship":"supports","note":"Training-data overview and decision logic documented.","confidence_level":"high","is_binding":true,"policy":"south-korea-framework-act-on-the-development-of-artificial-intelligence-and-establishment-of-a-foundation-for","jurisdiction":"south-korea","url":"https://aipolicytracker.org/obligations/south-korea-ai-basic-act-art-34-high-impact-ai-explanation-measures"},{"slug":"us-colorado-developer-documentation-and-disclosure","title":"Developers must document high-risk systems and disclose known risks","relationship":"satisfies","note":"Deployer information pack and public statement derived from the documentation set.","confidence_level":"high","is_binding":true,"policy":"us-colorado-ai-act","jurisdiction":"us-colorado","url":"https://aipolicytracker.org/obligations/us-colorado-developer-documentation-and-disclosure"},{"slug":"us-colorado-admt-developer-documentation","title":"Developers must supply deployers with documentation of the technology","relationship":"satisfies","note":"Deployer-facing documentation of each tool.","confidence_level":"high","is_binding":true,"policy":"us-colorado-automated-decision-making-technology-act","jurisdiction":"us-colorado","url":"https://aipolicytracker.org/obligations/us-colorado-admt-developer-documentation"}],"related_controls":["data-governance-and-dataset-documentation","accuracy-robustness-security-testing","conformity-assessment-and-registration","model-release-and-change-management-gate"],"review_status":"verified","confidence_level":"high","last_verified_at":"2026-09-26","reviewed_by":"Bhaskar Bhatt","updated_at":"2026-10-15T06:46:23+00:00","url":"https://aipolicytracker.org/controls/technical-documentation-and-model-cards","context_url":"https://aipolicytracker.org/controls/technical-documentation-and-model-cards.md"},{"slug":"training-data-provenance-and-copyright-register","id":"AIPT-CTL-0026","title":"Training-data provenance and copyright register","kind":"process","kind_label":"Process","purpose":"Records the origin, licence and rights status of every source used to train or fine-tune a model so that the organisation can honour opt-outs, answer downstream questions and publish a truthful summary of training content.\n","description":"Model developers keep a register of training sources that captures the source, the acquisition route, the licence or legal basis relied on, whether machine-readable rights reservations were checked and honoured, and the date of collection. A written copyright and rights policy sets out how crawls respect opt-out signals, how licensed and public-domain material is distinguished and how takedown or objection requests are handled. From the register the team generates the public summary of training content and the information pack that downstream integrators need. The register is updated on every new training run and reviewed by legal before a model is released.\n","owner_role":"Model development lead","frequency":"on_material_change","frequency_label":"At launch and on material change","risk_subdomains":["6.3","2.1","6.5"],"evidence":[{"type":"register_entry","title":"Training source register","description":"Source, acquisition route, licence or legal basis, opt-out check and collection date per source."},{"type":"policy_document","title":"Copyright and rights-reservation policy","description":null},{"type":"disclosure_notice","title":"Public summary of training content","description":null}],"framework_references":[{"framework":"iso_42001","framework_name":"ISO/IEC 42001:2023","reference":"Annex A.7.3, A.7.5","note":"Data acquisition and provenance records.","confidence_level":"medium"},{"framework":"nist_ai_rmf","framework_name":"NIST AI RMF 1.0","reference":"MAP 4.1; GOVERN 6.1","note":null,"confidence_level":"medium"},{"framework":"mitre_atlas","framework_name":"MITRE ATLAS","reference":"AML.M0025 Maintain AI Dataset Provenance","note":null,"confidence_level":"medium"}],"obligations":[{"slug":"eu-ai-act-data-governance","title":"Apply data governance and quality criteria to training, validation and testing data","relationship":"supports","note":"Origin and collection records for each source.","confidence_level":"medium","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-data-governance"},{"slug":"eu-ai-act-gpai-provider-obligations","title":"Meet general-purpose AI model provider obligations","relationship":"satisfies","note":"Produces the copyright policy and the public training-content summary.","confidence_level":"high","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-gpai-provider-obligations"},{"slug":"us-colorado-developer-documentation-and-disclosure","title":"Developers must document high-risk systems and disclose known risks","relationship":"supports","note":"Training-data summaries.","confidence_level":"medium","is_binding":true,"policy":"us-colorado-ai-act","jurisdiction":"us-colorado","url":"https://aipolicytracker.org/obligations/us-colorado-developer-documentation-and-disclosure"},{"slug":"nepal-privacy-act-consent-and-purpose","title":"Collect and use personal information only with consent and for the stated purpose","relationship":"supports","note":"Source register records the basis for each training source.","confidence_level":"medium","is_binding":true,"policy":"nepal-individual-privacy-act","jurisdiction":"nepal","url":"https://aipolicytracker.org/obligations/nepal-privacy-act-consent-and-purpose"}],"related_controls":["data-governance-and-dataset-documentation","technical-documentation-and-model-cards","privacy-and-data-protection-for-ai"],"review_status":"verified","confidence_level":"medium","last_verified_at":"2026-09-26","reviewed_by":"Bhaskar Bhatt","updated_at":"2026-10-15T06:46:23+00:00","url":"https://aipolicytracker.org/controls/training-data-provenance-and-copyright-register","context_url":"https://aipolicytracker.org/controls/training-data-provenance-and-copyright-register.md"},{"slug":"third-party-ai-due-diligence","id":"AIPT-CTL-0025","title":"Vendor and third-party AI due diligence","kind":"process","kind_label":"Process","purpose":"Checks, before an external model, dataset, component or AI service is adopted or resold, that the supplier has met its own duties and that the organisation understands what it is taking on.\n","description":"Procurement and onboarding include an AI questionnaire and evidence request tailored to the supplier's role: documentation and test results for a model, provenance for a dataset, conformity evidence and markings for a regulated system, security posture for a hosted service. Reviewers verify the answers against the organisation's minimum requirements, record findings and residual risks and decide whether to proceed, proceed with conditions or decline. Importers and distributors confirm the upstream party's paperwork is complete before the product moves. Supplier entries in the AI register are re-assessed at renewal and when the supplier reports a material change.\n","owner_role":"Procurement or vendor risk lead","frequency":"per_system","frequency_label":"Once per AI system","risk_subdomains":["6.5","2.2","7.3"],"evidence":[{"type":"supplier_assessment","title":"AI supplier due-diligence assessment","description":"Completed questionnaire, evidence review and decision for one supplier or component."},{"type":"register_entry","title":"AI supplier and component register","description":null},{"type":"approval_record","title":"Supplier onboarding decision","description":null}],"framework_references":[{"framework":"iso_42001","framework_name":"ISO/IEC 42001:2023","reference":"Annex A.10.2, A.10.3","note":null,"confidence_level":"high"},{"framework":"nist_ai_rmf","framework_name":"NIST AI RMF 1.0","reference":"GOVERN 6.1, 6.2; MAP 4.1, 4.2; MANAGE 3.1","note":null,"confidence_level":"high"},{"framework":"iso_27001","framework_name":"ISO/IEC 27001:2022","reference":"Annex A 5.19 to 5.22 Supplier relationships","note":null,"confidence_level":"medium"},{"framework":"owasp_llm_top10","framework_name":"OWASP Top 10 for LLM Applications","reference":"LLM03 Supply Chain","note":null,"confidence_level":"high"}],"obligations":[{"slug":"eu-ai-act-art-25-4-written-agreements-with-component-suppliers","title":"Providers of high-risk AI must have written agreements with suppliers of components, tools and services","relationship":"supports","note":"Identifies which suppliers fall within Article 25(4).","confidence_level":"medium","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-25-4-written-agreements-with-component-suppliers"},{"slug":"eu-ai-act-art-26-8-public-authority-registration-before-use","title":"Public authorities must register their use of high-risk AI and must not use unregistered systems","relationship":"supports","note":"Verifies the provider's registration before purchase.","confidence_level":"medium","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-26-8-public-authority-registration-before-use"},{"slug":"us-nist-ai-rmf-govern","title":"Establish AI governance policies, roles and accountability (Govern)","relationship":"supports","note":"Third-party risk management outcomes.","confidence_level":"high","is_binding":false,"policy":"us-nist-ai-rmf","jurisdiction":"us","url":"https://aipolicytracker.org/obligations/us-nist-ai-rmf-govern"},{"slug":"eu-ai-act-importer-distributor-obligations","title":"Verify conformity before importing or distributing high-risk AI","relationship":"satisfies","note":"Onboarding verifies the provider's conformity assessment, documentation, marking and representative.","confidence_level":"high","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-importer-distributor-obligations"},{"slug":"us-nist-ai-rmf-manage","title":"Prioritise, respond to and monitor AI risks (Manage)","relationship":"supports","note":"Third-party risk management outcomes.","confidence_level":"medium","is_binding":false,"policy":"us-nist-ai-rmf","jurisdiction":"us","url":"https://aipolicytracker.org/obligations/us-nist-ai-rmf-manage"},{"slug":"us-new-york-city-local-law-144-bias-audit","title":"Employers and employment agencies must obtain an independent bias audit before using an automated employment decision tool","relationship":"supports","note":"Vendor supplies data and audit access for the tool.","confidence_level":"medium","is_binding":true,"policy":"us-new-york-city-local-law-144-automated-employment-decision-tools","jurisdiction":"us-new-york","url":"https://aipolicytracker.org/obligations/us-new-york-city-local-law-144-bias-audit"}],"related_controls":["contractual-allocation-of-ai-duties","ai-system-inventory","conformity-assessment-and-registration"],"review_status":"verified","confidence_level":"high","last_verified_at":"2026-09-26","reviewed_by":"Bhaskar Bhatt","updated_at":"2026-10-15T06:46:23+00:00","url":"https://aipolicytracker.org/controls/third-party-ai-due-diligence","context_url":"https://aipolicytracker.org/controls/third-party-ai-due-diligence.md"}],"meta":{"kinds":{"policy":"Policy","process":"Process","technical":"Technical measure","contractual":"Contractual term","training":"Training programme"},"filters":[],"license":"CC BY 4.0","license_url":"https://creativecommons.org/licenses/by/4.0/"}}