{"data":[{"slug":"eu-ai-act-accuracy-robustness-cybersecurity","id":"AIPT-OBL-0012","permanent_url":"https://aipolicytracker.org/id/AIPT-OBL-0012","title":"Achieve appropriate accuracy, robustness and cybersecurity","short_title":"Accuracy, robustness and cybersecurity","category":"accuracy_robustness_security","summary":"High-risk AI systems must achieve an appropriate level of accuracy, robustness and cybersecurity and perform consistently throughout their lifecycle. Accuracy levels and metrics must be declared in the instructions; systems must be resilient to errors, faults and inconsistencies, address feedback loops in continuously learning systems, and resist attempts to alter use or performance, including data poisoning, model poisoning, adversarial examples and confidentiality attacks.\n","practical_action":"Include AI-specific threat modelling and adversarial testing in your security programme.\n","is_binding":true,"applies_from":"2027-12-02","section":"Articles 8–15","source_reference":"Article 15","official_source_url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","review_status":"pending_review","confidence_level":"medium","last_verified_at":null,"reviewed_by":null,"actors":["provider"],"sectors":["cross_sector"],"use_cases":["safety_critical","finance_and_credit","biometrics"],"applicability":[{"description":"Providers of high-risk AI systems.","actors":["provider"],"conditions":null}],"evidence_examples":[{"title":"Accuracy metrics and test evidence","description":null,"artifact_type":"report"},{"title":"AI security assessment","description":null,"artifact_type":"report"}],"framework_mappings":[{"framework":"iso_42001","framework_name":"ISO/IEC 42001:2023","reference":"Annex A controls on AI system verification and validation","note":"Original editorial mapping.","confidence_level":"medium","is_original":true},{"framework":"iso_27001","framework_name":"ISO/IEC 27001:2022","reference":"Clause 8 and Annex A security controls","note":"Original editorial mapping for cybersecurity aspects.","confidence_level":"medium","is_original":true},{"framework":"nist_ai_rmf","framework_name":"NIST AI RMF 1.0","reference":"MEASURE 2.5, 2.6, 2.7","note":"Validity, safety, security and resilience measurement.","confidence_level":"high","is_original":true}],"controls":[{"slug":"genai-red-team-testing","title":"Adversarial and red-team testing for generative AI","kind":"technical","relationship":"supports","note":"Adversarial exercises cover poisoning, evasion and extraction attempts.","confidence_level":"medium","url":"https://aipolicytracker.org/controls/genai-red-team-testing"},{"slug":"accuracy-robustness-security-testing","title":"Accuracy, robustness, fairness and security testing","kind":"technical","relationship":"satisfies","note":"Declared accuracy metrics, robustness and AI-specific security testing come from the release test programme.","confidence_level":"high","url":"https://aipolicytracker.org/controls/accuracy-robustness-security-testing"},{"slug":"post-market-monitoring-and-drift-detection","title":"Post-deployment monitoring and drift detection","kind":"technical","relationship":"supports","note":"Consistent performance over the lifecycle is confirmed in operation.","confidence_level":"medium","url":"https://aipolicytracker.org/controls/post-market-monitoring-and-drift-detection"}],"url":"https://aipolicytracker.org/obligations/eu-ai-act-accuracy-robustness-cybersecurity","policy":{"slug":"eu-ai-act","title":"Regulation (EU) 2024/1689 — Artificial Intelligence Act","status":"partially_applicable","jurisdiction":"eu","url":"https://aipolicytracker.org/policies/eu-ai-act"}},{"slug":"us-new-york-city-local-law-144-bias-audit","id":"AIPT-OBL-0099","permanent_url":"https://aipolicytracker.org/id/AIPT-OBL-0099","title":"Employers and employment agencies must obtain an independent bias audit before using an automated employment decision tool","short_title":"Bias audit","category":"accuracy_robustness_security","summary":"An automated employment decision tool may not be used to screen candidates or employees for hiring or promotion in New York City unless it has been the subject of a bias audit by an independent auditor within the year before use. The audit calculates selection rates and impact ratios by sex, race/ethnicity and their intersections, and scoring-rate comparisons for tools that score rather than select, using the employer's historical data or, where insufficient, test data as the DCWP rules allow.\n","practical_action":"Commission an annual independent bias audit for each tool, supplying historical outcome data by protected category, and calendar the twelve-month expiry.\n","is_binding":true,"applies_from":"2023-07-05","section":null,"source_reference":"NYC Administrative Code Section 20-871(a)(1); 6 RCNY Section 5-301","official_source_url":"https://www.nyc.gov/site/dca/about/automated-employment-decision-tools.page","review_status":"verified","confidence_level":"high","last_verified_at":"2026-09-26","reviewed_by":"Bhaskar Bhatt","actors":["deployer"],"sectors":["employment"],"use_cases":["hiring_and_hr"],"applicability":[{"description":"Employers and employment agencies using an automated employment decision tool for candidates or employees who reside in New York City; vendors are not directly liable but commonly supply the audit.","actors":["deployer"],"conditions":null}],"evidence_examples":[{"title":"Independent bias audit report","description":"Impact ratios by category with audit date and auditor independence statement.","artifact_type":"report"},{"title":"Audit data extract and category mapping","description":null,"artifact_type":"record"}],"framework_mappings":[{"framework":"nist_ai_rmf","framework_name":"NIST AI RMF 1.0","reference":"MEASURE 2.11, MEASURE 1.3","note":"Fairness evaluation by independent assessors.","confidence_level":"high","is_original":true},{"framework":"iso_42001","framework_name":"ISO/IEC 42001:2023","reference":"Annex A.6.2.4; Clause 9.2","note":"Verification and validation; independent audit.","confidence_level":"medium","is_original":true}],"controls":[{"slug":"accuracy-robustness-security-testing","title":"Accuracy, robustness, fairness and security testing","kind":"technical","relationship":"satisfies","note":"Disparate-impact testing performed by an independent auditor on the statutory metrics.","confidence_level":"high","url":"https://aipolicytracker.org/controls/accuracy-robustness-security-testing"},{"slug":"third-party-ai-due-diligence","title":"Vendor and third-party AI due diligence","kind":"process","relationship":"supports","note":"Vendor supplies data and audit access for the tool.","confidence_level":"medium","url":"https://aipolicytracker.org/controls/third-party-ai-due-diligence"}],"url":"https://aipolicytracker.org/obligations/us-new-york-city-local-law-144-bias-audit","policy":{"slug":"us-new-york-city-local-law-144-automated-employment-decision-tools","title":"New York City Local Law 144 of 2021 on Automated Employment Decision Tools (AEDT) and DCWP implementing rules","status":"in_force","jurisdiction":"us-new-york","url":"https://aipolicytracker.org/policies/us-new-york-city-local-law-144-automated-employment-decision-tools"}},{"slug":"eu-ai-act-art-55-systemic-risk-cybersecurity","id":"AIPT-OBL-0046","permanent_url":"https://aipolicytracker.org/id/AIPT-OBL-0046","title":"Providers of systemic-risk GPAI models must secure the model and its infrastructure","short_title":"Systemic-risk model cybersecurity","category":"accuracy_robustness_security","summary":"Providers of general-purpose AI models with systemic risk must ensure an adequate level of cybersecurity protection for the model and for the physical infrastructure it runs on, which in practice covers protection of model weights, training and inference environments, and access controls against theft, tampering and unauthorised release. Codes of practice and harmonised standards may be used to show compliance.\n","practical_action":"Apply a documented security standard to weight storage, training clusters and inference endpoints, with penetration tests and insider-risk controls.\n","is_binding":true,"applies_from":"2025-08-02","section":"Articles 51–56","source_reference":"Article 55(1)(d)","official_source_url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","review_status":"verified","confidence_level":"high","last_verified_at":"2026-09-26","reviewed_by":null,"actors":["gpai_provider"],"sectors":["cross_sector"],"use_cases":["generative_ai"],"applicability":[{"description":"Providers of general-purpose AI models classified as having systemic risk under Article 51.","actors":["gpai_provider"],"conditions":null}],"evidence_examples":[{"title":"Model and infrastructure security assessment","description":null,"artifact_type":"report"},{"title":"Weight access control records","description":null,"artifact_type":"record"}],"framework_mappings":[{"framework":"iso_27001","framework_name":"ISO/IEC 27001:2022","reference":"Clause 8.1; Annex A 5.15, A 8.24","note":"Access control and cryptography applied to model assets.","confidence_level":"medium","is_original":true},{"framework":"nist_ai_rmf","framework_name":"NIST AI RMF 1.0","reference":"MEASURE 2.7, MANAGE 2.2","note":"Security and resilience of the system.","confidence_level":"medium","is_original":true},{"framework":"mitre_atlas","framework_name":"MITRE ATLAS","reference":"AML.M0005, AML.M0001","note":"Control access to models and limit artifact release.","confidence_level":"medium","is_original":true}],"controls":[{"slug":"accuracy-robustness-security-testing","title":"Accuracy, robustness, fairness and security testing","kind":"technical","relationship":"satisfies","note":"Security testing of the model and its serving infrastructure.","confidence_level":"medium","url":"https://aipolicytracker.org/controls/accuracy-robustness-security-testing"},{"slug":"frontier-model-safety-framework","title":"Frontier model safety and security framework","kind":"policy","relationship":"supports","note":"Framework commits to the weight-security measures.","confidence_level":"high","url":"https://aipolicytracker.org/controls/frontier-model-safety-framework"}],"url":"https://aipolicytracker.org/obligations/eu-ai-act-art-55-systemic-risk-cybersecurity","policy":{"slug":"eu-ai-act","title":"Regulation (EU) 2024/1689 — Artificial Intelligence Act","status":"partially_applicable","jurisdiction":"eu","url":"https://aipolicytracker.org/policies/eu-ai-act"}},{"slug":"eu-ai-act-ai-literacy","id":"AIPT-OBL-0005","permanent_url":"https://aipolicytracker.org/id/AIPT-OBL-0005","title":"Ensure AI literacy of staff operating AI systems","short_title":"AI literacy","category":"ai_literacy","summary":"Providers and deployers must take measures to ensure, to their best extent, a sufficient level of AI literacy among their staff and other persons dealing with the operation and use of AI systems on their behalf, taking into account technical knowledge, experience, training, the context of use and the persons affected.\n","practical_action":"Run role-based AI training and keep attendance and content records; the Commission's AI Office has indicated that literacy will be assessed proportionately.\n","is_binding":true,"applies_from":"2025-02-02","section":"Article 4","source_reference":"Article 4","official_source_url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","review_status":"pending_review","confidence_level":"medium","last_verified_at":null,"reviewed_by":null,"actors":["provider","deployer"],"sectors":["cross_sector"],"use_cases":["generative_ai","customer_service","hiring_and_hr"],"applicability":[{"description":"All providers and deployers of AI systems, regardless of risk level.","actors":["provider","deployer"],"conditions":null}],"evidence_examples":[{"title":"AI literacy training programme","description":"Curriculum by role, completion records and refresh cadence.","artifact_type":"record"}],"framework_mappings":[{"framework":"iso_42001","framework_name":"ISO/IEC 42001:2023","reference":"Clause 7.2 Competence and 7.3 Awareness","note":"Original editorial mapping.","confidence_level":"high","is_original":true},{"framework":"nist_ai_rmf","framework_name":"NIST AI RMF 1.0","reference":"GOVERN 2.2","note":"Workforce training and awareness.","confidence_level":"medium","is_original":true}],"controls":[{"slug":"ai-literacy-and-role-based-training","title":"AI literacy and role-based training programme","kind":"training","relationship":"satisfies","note":"Role-based curricula with completion records are the expected measure.","confidence_level":"high","url":"https://aipolicytracker.org/controls/ai-literacy-and-role-based-training"}],"url":"https://aipolicytracker.org/obligations/eu-ai-act-ai-literacy","policy":{"slug":"eu-ai-act","title":"Regulation (EU) 2024/1689 — Artificial Intelligence Act","status":"partially_applicable","jurisdiction":"eu","url":"https://aipolicytracker.org/policies/eu-ai-act"}},{"slug":"eu-ai-act-conformity-assessment-registration","id":"AIPT-OBL-0014","permanent_url":"https://aipolicytracker.org/id/AIPT-OBL-0014","title":"Complete conformity assessment, CE marking and EU database registration","short_title":"Conformity assessment and registration","category":"conformity_assessment","summary":"Before placing a high-risk system on the market, providers must complete the applicable conformity assessment (internal control or notified-body assessment depending on the system), draw up an EU declaration of conformity, affix the CE marking, and register the system in the EU database. Deployers that are public authorities must also register their use of Annex III systems.\n","practical_action":"Determine the assessment route early; notified-body capacity may be limited around application dates.\n","is_binding":true,"applies_from":"2027-12-02","section":"Articles 16–27","source_reference":"Articles 43, 47, 48 and 49; Annex VIII","official_source_url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","review_status":"pending_review","confidence_level":"medium","last_verified_at":null,"reviewed_by":null,"actors":["provider","deployer","public_authority"],"sectors":["cross_sector"],"use_cases":["biometrics","safety_critical","public_services"],"applicability":[{"description":"Providers of high-risk systems; public-authority deployers for registration.","actors":["provider","public_authority"],"conditions":null}],"evidence_examples":[{"title":"EU declaration of conformity","description":null,"artifact_type":"document"},{"title":"EU database registration record","description":null,"artifact_type":"record"}],"framework_mappings":[{"framework":"iso_42001","framework_name":"ISO/IEC 42001:2023","reference":"Clause 9 Performance evaluation; internal audit","note":"Original editorial mapping; not a substitute for legal conformity assessment.","confidence_level":"low","is_original":true}],"controls":[{"slug":"conformity-assessment-and-registration","title":"Conformity assessment, declaration and registration","kind":"process","relationship":"satisfies","note":"Covers route selection, declaration, marking and database registration.","confidence_level":"high","url":"https://aipolicytracker.org/controls/conformity-assessment-and-registration"},{"slug":"ai-quality-management-system","title":"Quality management system for AI development and supply","kind":"policy","relationship":"supports","note":"Internal-control assessment relies on the documented management system.","confidence_level":"medium","url":"https://aipolicytracker.org/controls/ai-quality-management-system"},{"slug":"technical-documentation-and-model-cards","title":"Technical documentation, model cards and instructions for use","kind":"process","relationship":"supports","note":"The technical file is the input to the assessment.","confidence_level":"high","url":"https://aipolicytracker.org/controls/technical-documentation-and-model-cards"}],"url":"https://aipolicytracker.org/obligations/eu-ai-act-conformity-assessment-registration","policy":{"slug":"eu-ai-act","title":"Regulation (EU) 2024/1689 — Artificial Intelligence Act","status":"partially_applicable","jurisdiction":"eu","url":"https://aipolicytracker.org/policies/eu-ai-act"}},{"slug":"eu-ai-act-gpai-provider-obligations","id":"AIPT-OBL-0018","permanent_url":"https://aipolicytracker.org/id/AIPT-OBL-0018","title":"Meet general-purpose AI model provider obligations","short_title":"Obligations of GPAI model providers","category":"copyright_training_data","summary":"Providers of general-purpose AI models must keep technical documentation (Annex XI), provide information to downstream providers integrating the model (Annex XII), put in place a policy to comply with EU copyright law including the text-and-data-mining opt-out, and publish a sufficiently detailed public summary of training content using the Commission's template. Free and open-source models are exempt from the first two duties unless they present systemic risk. Adherence to the General-Purpose AI Code of Practice can demonstrate compliance.\n","practical_action":"Prepare the Commission's training-content summary template and a documented copyright policy before release.\n","is_binding":true,"applies_from":"2025-08-02","section":"Articles 51–56","source_reference":"Article 53 and Annexes XI–XII","official_source_url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","review_status":"pending_review","confidence_level":"medium","last_verified_at":null,"reviewed_by":null,"actors":["gpai_provider"],"sectors":["cross_sector"],"use_cases":["generative_ai"],"applicability":[{"description":"Providers placing general-purpose AI models on the EU market, including via API.","actors":["gpai_provider"],"conditions":"Models placed on the market before 2 August 2025 have until 2 August 2027 under Article 111(3)."}],"evidence_examples":[{"title":"Public summary of training content","description":null,"artifact_type":"document"},{"title":"Copyright compliance policy","description":null,"artifact_type":"document"}],"framework_mappings":[{"framework":"iso_42001","framework_name":"ISO/IEC 42001:2023","reference":"Annex A controls on data provenance and documentation","note":"Original editorial mapping.","confidence_level":"medium","is_original":true},{"framework":"nist_ai_rmf","framework_name":"NIST AI RMF 1.0","reference":"NIST AI 600-1 (Generative AI profile) — intellectual property and data privacy risks","note":"Original editorial mapping.","confidence_level":"medium","is_original":true}],"controls":[{"slug":"technical-documentation-and-model-cards","title":"Technical documentation, model cards and instructions for use","kind":"process","relationship":"satisfies","note":"Provides the model documentation and the downstream information pack.","confidence_level":"medium","url":"https://aipolicytracker.org/controls/technical-documentation-and-model-cards"},{"slug":"training-data-provenance-and-copyright-register","title":"Training-data provenance and copyright register","kind":"process","relationship":"satisfies","note":"Produces the copyright policy and the public training-content summary.","confidence_level":"high","url":"https://aipolicytracker.org/controls/training-data-provenance-and-copyright-register"}],"url":"https://aipolicytracker.org/obligations/eu-ai-act-gpai-provider-obligations","policy":{"slug":"eu-ai-act","title":"Regulation (EU) 2024/1689 — Artificial Intelligence Act","status":"partially_applicable","jurisdiction":"eu","url":"https://aipolicytracker.org/policies/eu-ai-act"}},{"slug":"eu-ai-act-data-governance","id":"AIPT-OBL-0007","permanent_url":"https://aipolicytracker.org/id/AIPT-OBL-0007","title":"Apply data governance and quality criteria to training, validation and testing data","short_title":"Data and data governance","category":"data_governance","summary":"High-risk AI systems that use data-driven techniques must be developed on training, validation and testing data sets meeting quality criteria: appropriate governance practices covering design choices, data collection and origin, preparation, assumptions, availability and suitability, examination for possible biases, and measures to detect, prevent and mitigate bias. Data must be relevant, sufficiently representative and, to the best extent possible, free of errors and complete for the intended purpose.\n","practical_action":"Produce a data-provenance and bias-assessment record for each data set used to build the system.\n","is_binding":true,"applies_from":"2027-12-02","section":"Articles 8–15","source_reference":"Article 10","official_source_url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","review_status":"pending_review","confidence_level":"medium","last_verified_at":null,"reviewed_by":null,"actors":["provider"],"sectors":["cross_sector"],"use_cases":["hiring_and_hr","finance_and_credit","health","biometrics"],"applicability":[{"description":"Providers of high-risk AI systems that involve model training.","actors":["provider"],"conditions":null}],"evidence_examples":[{"title":"Dataset documentation (datasheet)","description":null,"artifact_type":"document"},{"title":"Bias examination report","description":null,"artifact_type":"report"}],"framework_mappings":[{"framework":"iso_42001","framework_name":"ISO/IEC 42001:2023","reference":"Annex A controls on data for AI systems","note":"Original editorial mapping.","confidence_level":"medium","is_original":true},{"framework":"nist_ai_rmf","framework_name":"NIST AI RMF 1.0","reference":"MAP 2.3, MEASURE 2.1, MEASURE 2.11","note":"Data quality and bias measurement.","confidence_level":"medium","is_original":true}],"controls":[{"slug":"data-governance-and-dataset-documentation","title":"Data governance and dataset documentation","kind":"process","relationship":"satisfies","note":"Dataset documentation, representativeness and bias checks per dataset.","confidence_level":"high","url":"https://aipolicytracker.org/controls/data-governance-and-dataset-documentation"},{"slug":"training-data-provenance-and-copyright-register","title":"Training-data provenance and copyright register","kind":"process","relationship":"supports","note":"Origin and collection records for each source.","confidence_level":"medium","url":"https://aipolicytracker.org/controls/training-data-provenance-and-copyright-register"}],"url":"https://aipolicytracker.org/obligations/eu-ai-act-data-governance","policy":{"slug":"eu-ai-act","title":"Regulation (EU) 2024/1689 — Artificial Intelligence Act","status":"partially_applicable","jurisdiction":"eu","url":"https://aipolicytracker.org/policies/eu-ai-act"}},{"slug":"eu-ai-act-art-26-4-deployer-input-data","id":"AIPT-OBL-0032","permanent_url":"https://aipolicytracker.org/id/AIPT-OBL-0032","title":"Deployers must ensure input data they control is relevant and representative","short_title":"Deployer control of input data","category":"data_governance","summary":"To the extent a deployer controls the data fed into a high-risk AI system, it must make sure that input data is relevant to, and sufficiently representative for, the system's intended purpose. The duty sits with the deployer even though the provider designed the system, because the deployer chooses what the system is run on.\n","practical_action":"Define input-data quality checks for each high-risk system, including population coverage and field validation, and review them with the provider's instructions.\n","is_binding":true,"applies_from":"2027-12-02","section":"Articles 16–27","source_reference":"Article 26(4)","official_source_url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","review_status":"verified","confidence_level":"high","last_verified_at":"2026-09-26","reviewed_by":null,"actors":["deployer","public_authority"],"sectors":["cross_sector","employment","financial_services","public_services"],"use_cases":["hiring_and_hr","finance_and_credit","public_services"],"applicability":[{"description":"Deployers of high-risk AI systems that select or supply the operational input data.","actors":["deployer","public_authority"],"conditions":null}],"evidence_examples":[{"title":"Input-data quality checklist","description":null,"artifact_type":"document"},{"title":"Input-data validation results","description":null,"artifact_type":"record"}],"framework_mappings":[{"framework":"iso_42001","framework_name":"ISO/IEC 42001:2023","reference":"Annex A.7.4, A.7.6","note":"Data quality and data preparation.","confidence_level":"medium","is_original":true},{"framework":"nist_ai_rmf","framework_name":"NIST AI RMF 1.0","reference":"MAP 2.3, MEASURE 2.2","note":"Data representativeness in context.","confidence_level":"medium","is_original":true}],"controls":[{"slug":"data-governance-and-dataset-documentation","title":"Data governance and dataset documentation","kind":"process","relationship":"satisfies","note":"Applied to operational input data rather than training data.","confidence_level":"medium","url":"https://aipolicytracker.org/controls/data-governance-and-dataset-documentation"},{"slug":"post-market-monitoring-and-drift-detection","title":"Post-deployment monitoring and drift detection","kind":"technical","relationship":"supports","note":"Detects input drift away from the intended population.","confidence_level":"medium","url":"https://aipolicytracker.org/controls/post-market-monitoring-and-drift-detection"}],"url":"https://aipolicytracker.org/obligations/eu-ai-act-art-26-4-deployer-input-data","policy":{"slug":"eu-ai-act","title":"Regulation (EU) 2024/1689 — Artificial Intelligence Act","status":"partially_applicable","jurisdiction":"eu","url":"https://aipolicytracker.org/policies/eu-ai-act"}},{"slug":"eu-ai-act-art-25-value-chain-becoming-provider","id":"AIPT-OBL-0029","permanent_url":"https://aipolicytracker.org/id/AIPT-OBL-0029","title":"Deployers, distributors and importers must assume provider duties when they rebrand or substantially modify high-risk AI","short_title":"Responsibilities along the AI value chain","category":"governance_accountability","summary":"A distributor, importer, deployer or other third party is treated as the provider of a high-risk AI system, with all Article 16 duties, if it puts its own name or trademark on a system already on the market, makes a substantial modification to a high-risk system that stays high-risk, or changes the intended purpose of a system so that it becomes high-risk. The original provider then ceases to be provider for that system but must cooperate and supply the information and access needed for the new provider to comply.\n","practical_action":"Add a reclassification check to change control so that white-labelling, fine-tuning or repurposing a high-risk system triggers the provider workstream.\n","is_binding":true,"applies_from":"2027-12-02","section":"Articles 16–27","source_reference":"Article 25(1) and 25(2)","official_source_url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","review_status":"verified","confidence_level":"high","last_verified_at":"2026-09-26","reviewed_by":null,"actors":["deployer","distributor","importer","provider"],"sectors":["cross_sector"],"use_cases":["hiring_and_hr","finance_and_credit","safety_critical"],"applicability":[{"description":"Any organisation in the value chain that rebrands, substantially modifies or repurposes a high-risk AI system; original providers owe the cooperation duty.","actors":["deployer","distributor","importer","provider"],"conditions":null}],"evidence_examples":[{"title":"Change-control reclassification assessment","description":"Documented decision on whether a modification or rebranding triggers provider status.","artifact_type":"record"},{"title":"Cooperation clause with original provider","description":null,"artifact_type":"document"}],"framework_mappings":[{"framework":"iso_42001","framework_name":"ISO/IEC 42001:2023","reference":"Clause 4.1; Annex A.10.2","note":"Determining the organisation's role and allocating responsibilities along the chain.","confidence_level":"medium","is_original":true},{"framework":"nist_ai_rmf","framework_name":"NIST AI RMF 1.0","reference":"GOVERN 6.1, MAP 1.1","note":"Roles across the AI supply chain and context of use.","confidence_level":"medium","is_original":true}],"controls":[{"slug":"contractual-allocation-of-ai-duties","title":"Contractual allocation of AI duties across the supply chain","kind":"contractual","relationship":"supports","note":"Contracts set out cooperation from the original provider.","confidence_level":"high","url":"https://aipolicytracker.org/controls/contractual-allocation-of-ai-duties"},{"slug":"ai-system-inventory","title":"AI system inventory and classification","kind":"process","relationship":"supports","note":"Inventory records the organisation's role for each system.","confidence_level":"medium","url":"https://aipolicytracker.org/controls/ai-system-inventory"},{"slug":"model-release-and-change-management-gate","title":"Model release and change-management gate","kind":"process","relationship":"satisfies","note":"The gate flags substantial modification, rebranding and repurposing and opens the provider duties.","confidence_level":"medium","url":"https://aipolicytracker.org/controls/model-release-and-change-management-gate"}],"url":"https://aipolicytracker.org/obligations/eu-ai-act-art-25-value-chain-becoming-provider","policy":{"slug":"eu-ai-act","title":"Regulation (EU) 2024/1689 — Artificial Intelligence Act","status":"partially_applicable","jurisdiction":"eu","url":"https://aipolicytracker.org/policies/eu-ai-act"}},{"slug":"south-korea-ai-basic-act-art-36-domestic-representative","id":"AIPT-OBL-0068","permanent_url":"https://aipolicytracker.org/id/AIPT-OBL-0068","title":"Foreign AI business operators above the threshold must designate a domestic representative in Korea","short_title":"Domestic representative","category":"governance_accountability","summary":"An AI business operator without an address or place of business in Korea, whose user numbers or revenue meet the thresholds set by Presidential Decree, must designate in writing a domestic representative with an address in Korea. The representative handles the operator's duties under the Act, including submitting the Article 32 safety results, supporting high-impact AI confirmation and cooperating with fact-finding investigations, and the operator is treated as responsible for the representative's acts.\n","practical_action":"Check user and revenue figures against the decree thresholds and appoint a Korean representative by written designation before the duty bites.\n","is_binding":true,"applies_from":"2026-01-22","section":null,"source_reference":"Article 36","official_source_url":"https://www.law.go.kr/lsInfoP.do?lsiSeq=268543","review_status":"verified","confidence_level":"medium","last_verified_at":"2026-09-26","reviewed_by":"Bhaskar Bhatt","actors":["provider","gpai_provider","authorized_representative"],"sectors":["cross_sector"],"use_cases":["generative_ai","customer_service"],"applicability":[{"description":"AI business operators established outside Korea that exceed the Presidential Decree user or revenue thresholds.","actors":["provider","gpai_provider","authorized_representative"],"conditions":null}],"evidence_examples":[{"title":"Written designation of domestic representative","description":null,"artifact_type":"document"}],"framework_mappings":[{"framework":"iso_42001","framework_name":"ISO/IEC 42001:2023","reference":"Clause 5.3; Annex A.10.2","note":"Allocation of responsibilities to an external party.","confidence_level":"medium","is_original":true},{"framework":"nist_ai_rmf","framework_name":"NIST AI RMF 1.0","reference":"GOVERN 2.1","note":"Roles and responsibilities.","confidence_level":"low","is_original":true}],"controls":[{"slug":"contractual-allocation-of-ai-duties","title":"Contractual allocation of AI duties across the supply chain","kind":"contractual","relationship":"satisfies","note":"The written designation and the representative's task list.","confidence_level":"high","url":"https://aipolicytracker.org/controls/contractual-allocation-of-ai-duties"}],"url":"https://aipolicytracker.org/obligations/south-korea-ai-basic-act-art-36-domestic-representative","policy":{"slug":"south-korea-framework-act-on-the-development-of-artificial-intelligence-and-establishment-of-a-foundation-for","title":"Framework Act on the Development of Artificial Intelligence and Establishment of a Foundation for Trust (AI Basic Act, Act No. 20676)","status":"in_force","jurisdiction":"south-korea","url":"https://aipolicytracker.org/policies/south-korea-framework-act-on-the-development-of-artificial-intelligence-and-establishment-of-a-foundation-for"}},{"slug":"us-california-sb-53-whistleblower-protections","id":"AIPT-OBL-0083","permanent_url":"https://aipolicytracker.org/id/AIPT-OBL-0083","title":"Frontier developers must protect employees who report catastrophic-risk concerns","short_title":"Whistleblower protections","category":"governance_accountability","summary":"A frontier developer must not adopt rules or take action that prevent or retaliate against a covered employee for disclosing to the Attorney General, a federal authority, a manager or another employee with authority that the developer's activities pose a specific and substantial danger to public health or safety from catastrophic risk, or that it has violated the Act. Covered employees must be given clear notice of these rights, and large frontier developers must run an anonymous internal reporting process with regular updates to the reporter and to officers and directors.\n","practical_action":"Publish a whistleblower policy covering catastrophic-risk concerns, stand up an anonymous channel and brief managers on the anti-retaliation rule.\n","is_binding":true,"applies_from":"2026-01-01","section":null,"source_reference":"Labor Code Section 1107 (as added by SB 53)","official_source_url":"https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202520260SB53","review_status":"verified","confidence_level":"medium","last_verified_at":"2026-09-26","reviewed_by":"Bhaskar Bhatt","actors":["gpai_provider","provider"],"sectors":["cross_sector"],"use_cases":["generative_ai"],"applicability":[{"description":"Frontier developers and their contractors and employees responsible for assessing, managing or responding to catastrophic risk; the anonymous internal process is required of large frontier developers.","actors":["gpai_provider","provider"],"conditions":null}],"evidence_examples":[{"title":"Whistleblower policy and employee notice","description":null,"artifact_type":"document"},{"title":"Anonymous reporting channel records","description":"Case log with status updates to reporters and board reporting.","artifact_type":"record"}],"framework_mappings":[{"framework":"nist_ai_rmf","framework_name":"NIST AI RMF 1.0","reference":"GOVERN 4.1, GOVERN 4.3","note":"Culture that surfaces risks and incident-sharing practices.","confidence_level":"medium","is_original":true},{"framework":"iso_42001","framework_name":"ISO/IEC 42001:2023","reference":"Clause 5.1, 7.4; Annex A.3.2","note":"Leadership, communication and roles.","confidence_level":"low","is_original":true}],"controls":[{"slug":"ai-governance-policy-and-accountability","title":"AI governance policy and accountability structure","kind":"policy","relationship":"satisfies","note":"Whistleblower policy, anonymous channel and escalation to the board.","confidence_level":"medium","url":"https://aipolicytracker.org/controls/ai-governance-policy-and-accountability"},{"slug":"ai-incident-management-and-reporting","title":"AI incident management and regulatory reporting","kind":"process","relationship":"supports","note":"Reports feed the incident process.","confidence_level":"medium","url":"https://aipolicytracker.org/controls/ai-incident-management-and-reporting"}],"url":"https://aipolicytracker.org/obligations/us-california-sb-53-whistleblower-protections","policy":{"slug":"us-california-sb-53","title":"California SB 53: Transparency in Frontier Artificial Intelligence Act","status":"in_force","jurisdiction":"us-california","url":"https://aipolicytracker.org/policies/us-california-sb-53"}},{"slug":"eu-ai-act-art-26-10-post-remote-biometric-identification-authorisation","id":"AIPT-OBL-0037","permanent_url":"https://aipolicytracker.org/id/AIPT-OBL-0037","title":"Law-enforcement deployers must obtain authorisation for post-remote biometric identification and report annually","short_title":"Post remote biometric identification","category":"governance_accountability","summary":"A deployer using a high-risk post-remote biometric identification system in a criminal investigation must request authorisation from a judicial or independent administrative authority in advance or within 48 hours, unless the use is only the initial identification of a potential suspect on objective and verifiable facts. Use is limited to a targeted search; if authorisation is refused, use stops and the data is deleted. No adverse legal decision may rest solely on the output, each use is documented, and the deployer reports annually to the market surveillance and data protection authorities.\n","practical_action":"Build the authorisation request, 48-hour clock and deletion step into the investigation workflow and schedule the annual report.\n","is_binding":true,"applies_from":"2027-12-02","section":"Articles 16–27","source_reference":"Article 26(10)","official_source_url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","review_status":"verified","confidence_level":"medium","last_verified_at":"2026-09-26","reviewed_by":null,"actors":["deployer","public_authority"],"sectors":["law_enforcement"],"use_cases":["law_enforcement","biometrics"],"applicability":[{"description":"Law enforcement authorities deploying post-remote biometric identification in criminal investigations; real-time use is governed by Article 5.","actors":["deployer","public_authority"],"conditions":null}],"evidence_examples":[{"title":"Authorisation request and decision record","description":null,"artifact_type":"record"},{"title":"Annual report on post-remote biometric identification use","description":null,"artifact_type":"report"}],"framework_mappings":[{"framework":"iso_42001","framework_name":"ISO/IEC 42001:2023","reference":"Annex A.9.2, A.9.4","note":"Processes for responsible use and intended use.","confidence_level":"low","is_original":true},{"framework":"nist_ai_rmf","framework_name":"NIST AI RMF 1.0","reference":"GOVERN 1.1, MANAGE 1.3","note":"Legal requirements and documented use decisions.","confidence_level":"low","is_original":true}],"controls":[{"slug":"record-keeping-and-logging","title":"Automatic event logging and record retention","kind":"technical","relationship":"supports","note":"Per-use documentation and annual reporting data.","confidence_level":"medium","url":"https://aipolicytracker.org/controls/record-keeping-and-logging"},{"slug":"ai-governance-policy-and-accountability","title":"AI governance policy and accountability structure","kind":"policy","relationship":"supports","note":"Authorisation workflow ownership.","confidence_level":"medium","url":"https://aipolicytracker.org/controls/ai-governance-policy-and-accountability"},{"slug":"human-oversight-and-override","title":"Human oversight design and override procedure","kind":"process","relationship":"supports","note":"No adverse decision solely on the system's output.","confidence_level":"medium","url":"https://aipolicytracker.org/controls/human-oversight-and-override"}],"url":"https://aipolicytracker.org/obligations/eu-ai-act-art-26-10-post-remote-biometric-identification-authorisation","policy":{"slug":"eu-ai-act","title":"Regulation (EU) 2024/1689 — Artificial Intelligence Act","status":"partially_applicable","jurisdiction":"eu","url":"https://aipolicytracker.org/policies/eu-ai-act"}},{"slug":"eu-ai-act-art-22-authorised-representative","id":"AIPT-OBL-0028","permanent_url":"https://aipolicytracker.org/id/AIPT-OBL-0028","title":"Non-EU providers must appoint an EU authorised representative for high-risk AI","short_title":"Authorised representatives","category":"governance_accountability","summary":"Before making a high-risk AI system available in the Union, a provider established outside the EU must appoint, by written mandate, an authorised representative established in the Union. The representative verifies that the EU declaration of conformity and technical documentation exist and that conformity assessment was done, keeps the provider's contact details and the documentation available for ten years, supplies information to authorities, cooperates with them, and must end the mandate if the provider acts contrary to the Regulation.\n","practical_action":"Sign a written mandate with an EU-established representative and give them a controlled copy of the technical file and declaration.\n","is_binding":true,"applies_from":"2027-12-02","section":"Articles 16–27","source_reference":"Article 22","official_source_url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","review_status":"verified","confidence_level":"high","last_verified_at":"2026-09-26","reviewed_by":null,"actors":["provider","authorized_representative"],"sectors":["cross_sector"],"use_cases":["safety_critical","hiring_and_hr","biometrics"],"applicability":[{"description":"Providers established in a third country that place high-risk AI systems on the EU market; the mandated representative carries the listed tasks.","actors":["provider","authorized_representative"],"conditions":null}],"evidence_examples":[{"title":"Written mandate of authorised representative","description":null,"artifact_type":"document"},{"title":"Representative's documentation checklist","description":"Verification that the declaration, technical file and conformity assessment are in place.","artifact_type":"record"}],"framework_mappings":[{"framework":"iso_42001","framework_name":"ISO/IEC 42001:2023","reference":"Clause 5.3; Annex A.10.2","note":"Allocation of responsibilities to an external party.","confidence_level":"medium","is_original":true},{"framework":"nist_ai_rmf","framework_name":"NIST AI RMF 1.0","reference":"GOVERN 2.1, GOVERN 6.1","note":"Roles and third-party arrangements.","confidence_level":"low","is_original":true}],"controls":[{"slug":"contractual-allocation-of-ai-duties","title":"Contractual allocation of AI duties across the supply chain","kind":"contractual","relationship":"satisfies","note":"The written mandate allocates the representative's tasks.","confidence_level":"high","url":"https://aipolicytracker.org/controls/contractual-allocation-of-ai-duties"},{"slug":"conformity-assessment-and-registration","title":"Conformity assessment, declaration and registration","kind":"process","relationship":"supports","note":"Items the representative must verify.","confidence_level":"medium","url":"https://aipolicytracker.org/controls/conformity-assessment-and-registration"}],"url":"https://aipolicytracker.org/obligations/eu-ai-act-art-22-authorised-representative","policy":{"slug":"eu-ai-act","title":"Regulation (EU) 2024/1689 — Artificial Intelligence Act","status":"partially_applicable","jurisdiction":"eu","url":"https://aipolicytracker.org/policies/eu-ai-act"}},{"slug":"eu-ai-act-art-54-gpai-authorised-representative","id":"AIPT-OBL-0044","permanent_url":"https://aipolicytracker.org/id/AIPT-OBL-0044","title":"Non-EU providers of GPAI models must appoint an EU authorised representative","short_title":"Authorised representatives for GPAI","category":"governance_accountability","summary":"Before placing a general-purpose AI model on the Union market, a provider established in a third country must appoint, by written mandate, an authorised representative established in the Union. The representative checks that the Annex XI documentation exists and the Article 53 duties are met, keeps a copy of the documentation and the provider's contact details for ten years after market placement, provides information to the AI Office on request, cooperates with authorities, and must end the mandate if the provider breaches the Regulation. Open-source models without systemic risk are exempt.\n","practical_action":"Appoint an EU representative under a written mandate covering document retention and AI Office liaison before the model reaches EU users.\n","is_binding":true,"applies_from":"2025-08-02","section":"Articles 51–56","source_reference":"Article 54","official_source_url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","review_status":"verified","confidence_level":"high","last_verified_at":"2026-09-26","reviewed_by":null,"actors":["gpai_provider","authorized_representative"],"sectors":["cross_sector"],"use_cases":["generative_ai"],"applicability":[{"description":"Providers of general-purpose AI models established outside the EU, unless the model is free and open-source and not of systemic risk.","actors":["gpai_provider","authorized_representative"],"conditions":null}],"evidence_examples":[{"title":"Written mandate of authorised representative for GPAI","description":null,"artifact_type":"document"},{"title":"Representative's verification of Annex XI documentation","description":null,"artifact_type":"record"}],"framework_mappings":[{"framework":"iso_42001","framework_name":"ISO/IEC 42001:2023","reference":"Clause 5.3; Annex A.10.2","note":"Responsibilities allocated to an external party.","confidence_level":"medium","is_original":true},{"framework":"nist_ai_rmf","framework_name":"NIST AI RMF 1.0","reference":"GOVERN 2.1, GOVERN 6.1","note":"Roles and third-party arrangements.","confidence_level":"low","is_original":true}],"controls":[{"slug":"contractual-allocation-of-ai-duties","title":"Contractual allocation of AI duties across the supply chain","kind":"contractual","relationship":"satisfies","note":"The mandate and its task list.","confidence_level":"high","url":"https://aipolicytracker.org/controls/contractual-allocation-of-ai-duties"},{"slug":"technical-documentation-and-model-cards","title":"Technical documentation, model cards and instructions for use","kind":"process","relationship":"supports","note":"The documentation the representative holds.","confidence_level":"high","url":"https://aipolicytracker.org/controls/technical-documentation-and-model-cards"}],"url":"https://aipolicytracker.org/obligations/eu-ai-act-art-54-gpai-authorised-representative","policy":{"slug":"eu-ai-act","title":"Regulation (EU) 2024/1689 — Artificial Intelligence Act","status":"partially_applicable","jurisdiction":"eu","url":"https://aipolicytracker.org/policies/eu-ai-act"}},{"slug":"south-korea-ai-basic-act-art-34-high-impact-ai-user-protection-and-documentation","id":"AIPT-OBL-0066","permanent_url":"https://aipolicytracker.org/id/AIPT-OBL-0066","title":"Operators of high-impact AI must prepare user-protection measures and keep records of their safety and trust measures","short_title":"User protection and records","category":"governance_accountability","summary":"Operators of high-impact AI must prepare and implement a plan to protect users, and must prepare and keep documents describing the measures they take to secure the AI's safety and reliability, so that they can be shown to the Ministry of Science and ICT on request. Further items may be added by Presidential Decree, and the ministry may publish guidelines on how to meet these duties.\n","practical_action":"Write a user-protection plan for each high-impact system and keep a dated file of the safety and trust measures applied to it.\n","is_binding":true,"applies_from":"2026-01-22","section":null,"source_reference":"Article 34(1)","official_source_url":"https://www.law.go.kr/lsInfoP.do?lsiSeq=268543","review_status":"verified","confidence_level":"medium","last_verified_at":"2026-09-26","reviewed_by":"Bhaskar Bhatt","actors":["provider","deployer","public_authority"],"sectors":["cross_sector","healthcare","employment","financial_services","public_services","education"],"use_cases":["health","hiring_and_hr","finance_and_credit","public_services","education"],"applicability":[{"description":"AI business operators providing high-impact AI or products and services based on it.","actors":["provider","deployer","public_authority"],"conditions":null}],"evidence_examples":[{"title":"User protection plan","description":null,"artifact_type":"document"},{"title":"Safety and reliability measures file","description":null,"artifact_type":"record"}],"framework_mappings":[{"framework":"iso_42001","framework_name":"ISO/IEC 42001:2023","reference":"Clause 7.5; Annex A.6.2.7, A.9.3","note":"Documented information, technical documentation and objectives for responsible use.","confidence_level":"medium","is_original":true},{"framework":"nist_ai_rmf","framework_name":"NIST AI RMF 1.0","reference":"GOVERN 1.4, MANAGE 4.1","note":"Documentation and post-deployment user protection.","confidence_level":"medium","is_original":true}],"controls":[{"slug":"technical-documentation-and-model-cards","title":"Technical documentation, model cards and instructions for use","kind":"process","relationship":"satisfies","note":"Documentation of safety and reliability measures.","confidence_level":"medium","url":"https://aipolicytracker.org/controls/technical-documentation-and-model-cards"},{"slug":"ai-governance-policy-and-accountability","title":"AI governance policy and accountability structure","kind":"policy","relationship":"supports","note":"User-protection plan and ownership.","confidence_level":"medium","url":"https://aipolicytracker.org/controls/ai-governance-policy-and-accountability"}],"url":"https://aipolicytracker.org/obligations/south-korea-ai-basic-act-art-34-high-impact-ai-user-protection-and-documentation","policy":{"slug":"south-korea-framework-act-on-the-development-of-artificial-intelligence-and-establishment-of-a-foundation-for","title":"Framework Act on the Development of Artificial Intelligence and Establishment of a Foundation for Trust (AI Basic Act, Act No. 20676)","status":"in_force","jurisdiction":"south-korea","url":"https://aipolicytracker.org/policies/south-korea-framework-act-on-the-development-of-artificial-intelligence-and-establishment-of-a-foundation-for"}},{"slug":"eu-ai-act-art-16-provider-obligations","id":"AIPT-OBL-0023","permanent_url":"https://aipolicytracker.org/id/AIPT-OBL-0023","title":"Providers must meet the full set of provider duties for high-risk AI","short_title":"Obligations of providers of high-risk AI","category":"governance_accountability","summary":"Article 16 lists what a provider of a high-risk AI system owes: compliance with the Section 2 requirements, its name and contact details on the system or its documentation, a quality management system, retention of documentation and logs, conformity assessment, an EU declaration of conformity, CE marking, registration, corrective action when needed, cooperation with authorities on request, and accessibility in line with the EU accessibility directives.\n","practical_action":"Map each Article 16 point to an owner and an evidence location in a compliance matrix for every high-risk system.\n","is_binding":true,"applies_from":"2027-12-02","section":"Articles 16–27","source_reference":"Article 16","official_source_url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","review_status":"verified","confidence_level":"high","last_verified_at":"2026-09-26","reviewed_by":null,"actors":["provider"],"sectors":["cross_sector"],"use_cases":["hiring_and_hr","finance_and_credit","biometrics","safety_critical"],"applicability":[{"description":"Any provider placing a high-risk AI system on the EU market or putting it into service, wherever established.","actors":["provider"],"conditions":null}],"evidence_examples":[{"title":"Provider compliance matrix","description":"Article 16 points (a)–(l) mapped to owners, status and evidence for each high-risk system.","artifact_type":"register"}],"framework_mappings":[{"framework":"iso_42001","framework_name":"ISO/IEC 42001:2023","reference":"Clause 5.3; Annex A.3.2","note":"Original editorial mapping to roles, responsibilities and authorities.","confidence_level":"medium","is_original":true},{"framework":"nist_ai_rmf","framework_name":"NIST AI RMF 1.0","reference":"GOVERN 1.1, GOVERN 2.1","note":"Legal requirements identified and roles assigned.","confidence_level":"medium","is_original":true}],"controls":[{"slug":"ai-governance-policy-and-accountability","title":"AI governance policy and accountability structure","kind":"policy","relationship":"satisfies","note":"Assigns each provider duty to a named owner with a reporting line.","confidence_level":"medium","url":"https://aipolicytracker.org/controls/ai-governance-policy-and-accountability"},{"slug":"ai-quality-management-system","title":"Quality management system for AI development and supply","kind":"policy","relationship":"supports","note":"The QMS is where most Article 16 duties are operated.","confidence_level":"high","url":"https://aipolicytracker.org/controls/ai-quality-management-system"}],"url":"https://aipolicytracker.org/obligations/eu-ai-act-art-16-provider-obligations","policy":{"slug":"eu-ai-act","title":"Regulation (EU) 2024/1689 — Artificial Intelligence Act","status":"partially_applicable","jurisdiction":"eu","url":"https://aipolicytracker.org/policies/eu-ai-act"}},{"slug":"eu-ai-act-art-21-cooperation-with-authorities","id":"AIPT-OBL-0027","permanent_url":"https://aipolicytracker.org/id/AIPT-OBL-0027","title":"Providers must supply conformity evidence and log access to authorities on request","short_title":"Cooperation with competent authorities","category":"governance_accountability","summary":"On a reasoned request from a national competent authority, a provider of a high-risk AI system must supply all the information and documentation needed to show that the system meets the Section 2 requirements, in a language the authority can readily understand, and must give the authority access to the automatically generated logs it holds. Authorities must treat what they receive as confidential under Article 78.\n","practical_action":"Keep an authority-request playbook with a named contact, the documentation index and a pre-agreed export format for logs.\n","is_binding":true,"applies_from":"2027-12-02","section":"Articles 16–27","source_reference":"Article 21","official_source_url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","review_status":"verified","confidence_level":"high","last_verified_at":"2026-09-26","reviewed_by":null,"actors":["provider"],"sectors":["cross_sector"],"use_cases":["safety_critical","biometrics","public_services"],"applicability":[{"description":"Providers of high-risk AI systems; requests may come from any national competent authority.","actors":["provider"],"conditions":null}],"evidence_examples":[{"title":"Regulator request handling procedure","description":null,"artifact_type":"document"},{"title":"Log of authority requests and responses","description":null,"artifact_type":"register"}],"framework_mappings":[{"framework":"iso_42001","framework_name":"ISO/IEC 42001:2023","reference":"Clause 7.5; Annex A.8.3","note":"Documented information available for external reporting.","confidence_level":"medium","is_original":true},{"framework":"nist_ai_rmf","framework_name":"NIST AI RMF 1.0","reference":"GOVERN 1.4, GOVERN 4.2","note":"Transparency and accountability records.","confidence_level":"medium","is_original":true}],"controls":[{"slug":"record-keeping-and-logging","title":"Automatic event logging and record retention","kind":"technical","relationship":"supports","note":"Logs must be retrievable in a usable format.","confidence_level":"high","url":"https://aipolicytracker.org/controls/record-keeping-and-logging"},{"slug":"ai-governance-policy-and-accountability","title":"AI governance policy and accountability structure","kind":"policy","relationship":"supports","note":"Names the regulator liaison and escalation path.","confidence_level":"medium","url":"https://aipolicytracker.org/controls/ai-governance-policy-and-accountability"},{"slug":"technical-documentation-and-model-cards","title":"Technical documentation, model cards and instructions for use","kind":"process","relationship":"supports","note":"The documentation set that is handed over.","confidence_level":"high","url":"https://aipolicytracker.org/controls/technical-documentation-and-model-cards"}],"url":"https://aipolicytracker.org/obligations/eu-ai-act-art-21-cooperation-with-authorities","policy":{"slug":"eu-ai-act","title":"Regulation (EU) 2024/1689 — Artificial Intelligence Act","status":"partially_applicable","jurisdiction":"eu","url":"https://aipolicytracker.org/policies/eu-ai-act"}},{"slug":"eu-ai-act-art-52-systemic-risk-notification","id":"AIPT-OBL-0042","permanent_url":"https://aipolicytracker.org/id/AIPT-OBL-0042","title":"Providers of GPAI models must notify the Commission within two weeks of meeting the systemic-risk threshold","short_title":"Notifying a systemic-risk GPAI model","category":"governance_accountability","summary":"A provider whose general-purpose AI model meets the Article 51(1)(a) high-impact capability condition, which is presumed once cumulative training compute exceeds 10^25 floating-point operations, must notify the Commission without delay and in any event within two weeks of the condition being met or of learning that it will be met. The notification may include arguments that the model nonetheless does not present systemic risk; the Commission decides and keeps a public list of designated models.\n","practical_action":"Track cumulative training compute per model against the threshold and pre-draft the notification and any rebuttal arguments.\n","is_binding":true,"applies_from":"2025-08-02","section":"Articles 51–56","source_reference":"Article 52(1)","official_source_url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","review_status":"verified","confidence_level":"high","last_verified_at":"2026-09-26","reviewed_by":null,"actors":["gpai_provider"],"sectors":["cross_sector"],"use_cases":["generative_ai"],"applicability":[{"description":"Providers of general-purpose AI models approaching or exceeding the compute threshold, including during training.","actors":["gpai_provider"],"conditions":null}],"evidence_examples":[{"title":"Training compute tracking record","description":null,"artifact_type":"register"},{"title":"Notification to the Commission","description":null,"artifact_type":"document"}],"framework_mappings":[{"framework":"iso_42001","framework_name":"ISO/IEC 42001:2023","reference":"Clause 4.2; Annex A.8.3","note":"Interested-party requirements and external reporting.","confidence_level":"low","is_original":true},{"framework":"nist_ai_rmf","framework_name":"NIST AI RMF 1.0","reference":"GOVERN 1.1, MAP 1.1","note":"Legal requirement tracking and system context.","confidence_level":"medium","is_original":true}],"controls":[{"slug":"frontier-model-safety-framework","title":"Frontier model safety and security framework","kind":"policy","relationship":"satisfies","note":"Compute tracking and threshold notification are part of the framework.","confidence_level":"high","url":"https://aipolicytracker.org/controls/frontier-model-safety-framework"}],"url":"https://aipolicytracker.org/obligations/eu-ai-act-art-52-systemic-risk-notification","policy":{"slug":"eu-ai-act","title":"Regulation (EU) 2024/1689 — Artificial Intelligence Act","status":"partially_applicable","jurisdiction":"eu","url":"https://aipolicytracker.org/policies/eu-ai-act"}},{"slug":"eu-ai-act-deployer-obligations","id":"AIPT-OBL-0015","permanent_url":"https://aipolicytracker.org/id/AIPT-OBL-0015","title":"Use high-risk AI as instructed, monitor it and inform affected people","short_title":"Obligations of deployers of high-risk AI","category":"governance_accountability","summary":"Deployers of high-risk AI must take technical and organisational measures to use systems according to the instructions, assign human oversight, ensure input data is relevant where they control it, monitor operation, inform the provider and authorities of risks or serious incidents, keep logs, inform workers' representatives before deploying at the workplace, inform affected natural persons where decisions are made about them, and cooperate with authorities.\n","practical_action":"Create a deployer checklist per high-risk system and a notice for affected individuals and workers.\n","is_binding":true,"applies_from":"2027-12-02","section":"Articles 16–27","source_reference":"Article 26","official_source_url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","review_status":"pending_review","confidence_level":"medium","last_verified_at":null,"reviewed_by":null,"actors":["deployer","public_authority"],"sectors":["cross_sector","employment","public_services"],"use_cases":["hiring_and_hr","public_services","finance_and_credit"],"applicability":[{"description":"Any organisation deploying a high-risk AI system in the EU.","actors":["deployer","public_authority"],"conditions":null}],"evidence_examples":[{"title":"Deployment checklist and oversight assignment","description":null,"artifact_type":"record"},{"title":"Worker and affected-person notices","description":null,"artifact_type":"document"}],"framework_mappings":[{"framework":"iso_42001","framework_name":"ISO/IEC 42001:2023","reference":"Annex A controls on responsible use of AI systems","note":"Original editorial mapping.","confidence_level":"medium","is_original":true},{"framework":"nist_ai_rmf","framework_name":"NIST AI RMF 1.0","reference":"MANAGE 3.x, GOVERN 5.x","note":"Deployment management and stakeholder engagement.","confidence_level":"medium","is_original":true}],"controls":[{"slug":"human-oversight-and-override","title":"Human oversight design and override procedure","kind":"process","relationship":"supports","note":"Assigning trained natural persons to oversee the system.","confidence_level":"high","url":"https://aipolicytracker.org/controls/human-oversight-and-override"},{"slug":"post-market-monitoring-and-drift-detection","title":"Post-deployment monitoring and drift detection","kind":"technical","relationship":"supports","note":"Monitoring operation and informing the provider of risks.","confidence_level":"medium","url":"https://aipolicytracker.org/controls/post-market-monitoring-and-drift-detection"},{"slug":"ai-interaction-and-use-disclosure","title":"AI interaction and use disclosure notices","kind":"process","relationship":"supports","note":"Informing workers and affected people that a high-risk system is used.","confidence_level":"medium","url":"https://aipolicytracker.org/controls/ai-interaction-and-use-disclosure"}],"url":"https://aipolicytracker.org/obligations/eu-ai-act-deployer-obligations","policy":{"slug":"eu-ai-act","title":"Regulation (EU) 2024/1689 — Artificial Intelligence Act","status":"partially_applicable","jurisdiction":"eu","url":"https://aipolicytracker.org/policies/eu-ai-act"}},{"slug":"uk-ico-automated-decision-safeguards","id":"AIPT-OBL-0078","permanent_url":"https://aipolicytracker.org/id/AIPT-OBL-0078","title":"Apply safeguards to solely automated decisions with significant effects","short_title":"Automated decision safeguards","category":"human_oversight","summary":"Individuals have rights in relation to solely automated decisions that produce legal or similarly significant effects, including being told about the decision, obtaining human intervention, and contesting it. The Data (Use and Access) Act 2025 amended these rules; the reviewer must confirm the current wording.\n","practical_action":"Map every significant automated decision, add a human-review route and a notice to affected people.\n","is_binding":true,"applies_from":null,"section":null,"source_reference":"UK GDPR Article 22 as amended by the Data (Use and Access) Act 2025","official_source_url":"https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/","review_status":"verified","confidence_level":"medium","last_verified_at":"2026-09-26","reviewed_by":"Bhaskar Bhatt","actors":["deployer","public_authority"],"sectors":["cross_sector","financial_services","employment"],"use_cases":["finance_and_credit","hiring_and_hr","public_services"],"applicability":[{"description":"Any controller making solely automated decisions with legal or similarly significant effects.","actors":["deployer","public_authority"],"conditions":null}],"evidence_examples":[{"title":"Automated decision register and review procedure","description":null,"artifact_type":"register"}],"framework_mappings":[{"framework":"nist_ai_rmf","framework_name":"NIST AI RMF 1.0","reference":"GOVERN 5.x, MANAGE 4.x","note":"Recourse mechanisms.","confidence_level":"medium","is_original":true}],"controls":[{"slug":"decision-explanation-and-appeal-route","title":"Decision explanation, human review and appeal route","kind":"process","relationship":"satisfies","note":"Notice, human intervention and contest route for significant automated decisions.","confidence_level":"high","url":"https://aipolicytracker.org/controls/decision-explanation-and-appeal-route"},{"slug":"human-oversight-and-override","title":"Human oversight design and override procedure","kind":"process","relationship":"supports","note":"Meaningful human intervention design.","confidence_level":"medium","url":"https://aipolicytracker.org/controls/human-oversight-and-override"},{"slug":"ai-interaction-and-use-disclosure","title":"AI interaction and use disclosure notices","kind":"process","relationship":"supports","note":"Telling people a solely automated decision was made.","confidence_level":"medium","url":"https://aipolicytracker.org/controls/ai-interaction-and-use-disclosure"}],"url":"https://aipolicytracker.org/obligations/uk-ico-automated-decision-safeguards","policy":{"slug":"uk-ico-ai-data-protection-guidance","title":"ICO Guidance on AI and data protection","status":"guidance","jurisdiction":"uk","url":"https://aipolicytracker.org/policies/uk-ico-ai-data-protection-guidance"}},{"slug":"us-new-york-city-local-law-144-alternative-process-request","id":"AIPT-OBL-0102","permanent_url":"https://aipolicytracker.org/id/AIPT-OBL-0102","title":"Employers and employment agencies must let candidates request an alternative selection process or accommodation","short_title":"Alternative selection process","category":"human_oversight","summary":"The advance notice to candidates and employees must allow them to request an alternative selection process or a reasonable accommodation. The DCWP rules make clear that the law itself does not require the employer to provide an alternative process, but the request route must exist and accommodation requests remain governed by disability and human-rights law. Instructions for making the request must be included in the notice.\n","practical_action":"Provide a request mechanism in the candidate notice and record how each request was handled under the accommodation policy.\n","is_binding":true,"applies_from":"2023-07-05","section":null,"source_reference":"NYC Administrative Code Section 20-871(b)(1); 6 RCNY Section 5-303","official_source_url":"https://www.nyc.gov/site/dca/about/automated-employment-decision-tools.page","review_status":"verified","confidence_level":"high","last_verified_at":"2026-09-26","reviewed_by":"Bhaskar Bhatt","actors":["deployer"],"sectors":["employment"],"use_cases":["hiring_and_hr"],"applicability":[{"description":"Employers and employment agencies giving the Section 20-871(b) notice.","actors":["deployer"],"conditions":null}],"evidence_examples":[{"title":"Alternative-process and accommodation request log","description":null,"artifact_type":"register"}],"framework_mappings":[{"framework":"nist_ai_rmf","framework_name":"NIST AI RMF 1.0","reference":"GOVERN 5.1, MANAGE 4.1","note":"Recourse route for affected individuals.","confidence_level":"medium","is_original":true},{"framework":"iso_42001","framework_name":"ISO/IEC 42001:2023","reference":"Annex A.9.2","note":"Processes for responsible use.","confidence_level":"low","is_original":true}],"controls":[{"slug":"decision-explanation-and-appeal-route","title":"Decision explanation, human review and appeal route","kind":"process","relationship":"satisfies","note":"Request channel and handling record for alternatives and accommodations.","confidence_level":"medium","url":"https://aipolicytracker.org/controls/decision-explanation-and-appeal-route"},{"slug":"human-oversight-and-override","title":"Human oversight design and override procedure","kind":"process","relationship":"supports","note":"Human-run alternative where one is offered.","confidence_level":"medium","url":"https://aipolicytracker.org/controls/human-oversight-and-override"}],"url":"https://aipolicytracker.org/obligations/us-new-york-city-local-law-144-alternative-process-request","policy":{"slug":"us-new-york-city-local-law-144-automated-employment-decision-tools","title":"New York City Local Law 144 of 2021 on Automated Employment Decision Tools (AEDT) and DCWP implementing rules","status":"in_force","jurisdiction":"us-new-york","url":"https://aipolicytracker.org/policies/us-new-york-city-local-law-144-automated-employment-decision-tools"}},{"slug":"eu-ai-act-human-oversight","id":"AIPT-OBL-0011","permanent_url":"https://aipolicytracker.org/id/AIPT-OBL-0011","title":"Enable and assign effective human oversight","short_title":"Human oversight","category":"human_oversight","summary":"High-risk systems must be designed with human-machine interface tools so natural persons can effectively oversee them, understand capacities and limitations, avoid automation bias, interpret output, decide not to use the system, and intervene or stop it. Deployers must assign oversight to people with the necessary competence, training and authority. For certain remote biometric identification systems, action requires verification by at least two competent persons.\n","practical_action":"Document oversight roles, the \"stop\" mechanism and override paths for each high-risk deployment.\n","is_binding":true,"applies_from":"2027-12-02","section":"Articles 8–15","source_reference":"Article 14; Article 26(2) for deployers","official_source_url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","review_status":"pending_review","confidence_level":"medium","last_verified_at":null,"reviewed_by":null,"actors":["provider","deployer"],"sectors":["cross_sector"],"use_cases":["hiring_and_hr","finance_and_credit","public_services","biometrics"],"applicability":[{"description":"Providers design oversight measures; deployers implement them.","actors":["provider","deployer"],"conditions":null}],"evidence_examples":[{"title":"Human oversight procedure and role assignment","description":null,"artifact_type":"document"}],"framework_mappings":[{"framework":"iso_42001","framework_name":"ISO/IEC 42001:2023","reference":"Annex A control on human oversight","note":"Original editorial mapping.","confidence_level":"medium","is_original":true},{"framework":"nist_ai_rmf","framework_name":"NIST AI RMF 1.0","reference":"GOVERN 3.2, MANAGE 2.x","note":"Roles and human-AI configuration.","confidence_level":"medium","is_original":true}],"controls":[{"slug":"human-oversight-and-override","title":"Human oversight design and override procedure","kind":"process","relationship":"satisfies","note":"Oversight roles, interface measures, stop mechanism and override paths per deployment.","confidence_level":"high","url":"https://aipolicytracker.org/controls/human-oversight-and-override"},{"slug":"ai-literacy-and-role-based-training","title":"AI literacy and role-based training programme","kind":"training","relationship":"supports","note":"Overseers must be competent and alert to automation bias.","confidence_level":"medium","url":"https://aipolicytracker.org/controls/ai-literacy-and-role-based-training"}],"url":"https://aipolicytracker.org/obligations/eu-ai-act-human-oversight","policy":{"slug":"eu-ai-act","title":"Regulation (EU) 2024/1689 — Artificial Intelligence Act","status":"partially_applicable","jurisdiction":"eu","url":"https://aipolicytracker.org/policies/eu-ai-act"}},{"slug":"us-colorado-admt-human-review","id":"AIPT-OBL-0096","permanent_url":"https://aipolicytracker.org/id/AIPT-OBL-0096","title":"Offer meaningful human review of an adverse consequential decision","short_title":"Human review of adverse decisions","category":"human_oversight","summary":"A consumer who receives an adverse consequential decision may obtain meaningful review by a person with the authority and information to change the outcome. Scope and timing follow the enrolled bill.\n","practical_action":"Staff and document a human-review channel with authority to reverse decisions.","is_binding":true,"applies_from":"2027-01-01","section":"Adverse outcomes","source_reference":null,"official_source_url":"https://leg.colorado.gov/bills/sb26-189","review_status":"pending_review","confidence_level":"medium","last_verified_at":null,"reviewed_by":null,"actors":["deployer"],"sectors":["employment","financial_services","healthcare","education","public_services"],"use_cases":["hiring_and_hr","finance_and_credit","health","education","public_services"],"applicability":[],"evidence_examples":[],"framework_mappings":[],"controls":[{"slug":"human-oversight-and-override","title":"Human oversight design and override procedure","kind":"process","relationship":"satisfies","note":"A reviewer with authority to change the outcome.","confidence_level":"high","url":"https://aipolicytracker.org/controls/human-oversight-and-override"},{"slug":"decision-explanation-and-appeal-route","title":"Decision explanation, human review and appeal route","kind":"process","relationship":"supports","note":"The request channel that leads to review.","confidence_level":"medium","url":"https://aipolicytracker.org/controls/decision-explanation-and-appeal-route"}],"url":"https://aipolicytracker.org/obligations/us-colorado-admt-human-review","policy":{"slug":"us-colorado-automated-decision-making-technology-act","title":"Colorado Senate Bill 26-189: Automated Decision-Making Technology (replacement of the Colorado AI Act)","status":"adopted","jurisdiction":"us-colorado","url":"https://aipolicytracker.org/policies/us-colorado-automated-decision-making-technology-act"}},{"slug":"south-korea-ai-basic-act-art-34-high-impact-ai-human-oversight","id":"AIPT-OBL-0065","permanent_url":"https://aipolicytracker.org/id/AIPT-OBL-0065","title":"Operators of high-impact AI must ensure human management and supervision","short_title":"Human oversight of high-impact AI","category":"human_oversight","summary":"Operators of high-impact AI must ensure that the AI is subject to human management and supervision, so that people remain able to monitor its operation and intervene in or override its outputs where those outputs may affect life, physical safety or fundamental rights.\n","practical_action":"Assign accountable supervisors for each high-impact system and design the interface so they can pause, correct or overrule outputs.\n","is_binding":true,"applies_from":"2026-01-22","section":null,"source_reference":"Article 34(1)","official_source_url":"https://www.law.go.kr/lsInfoP.do?lsiSeq=268543","review_status":"verified","confidence_level":"medium","last_verified_at":"2026-09-26","reviewed_by":"Bhaskar Bhatt","actors":["provider","deployer","public_authority"],"sectors":["cross_sector","healthcare","employment","financial_services","public_services","critical_infrastructure"],"use_cases":["health","hiring_and_hr","finance_and_credit","public_services","safety_critical"],"applicability":[{"description":"AI business operators providing high-impact AI or products and services based on it.","actors":["provider","deployer","public_authority"],"conditions":null}],"evidence_examples":[{"title":"Human supervision design and assigned supervisors","description":null,"artifact_type":"document"}],"framework_mappings":[{"framework":"iso_42001","framework_name":"ISO/IEC 42001:2023","reference":"Annex A.9.2","note":"Processes for responsible use including human oversight.","confidence_level":"medium","is_original":true},{"framework":"nist_ai_rmf","framework_name":"NIST AI RMF 1.0","reference":"GOVERN 3.2, MANAGE 2.4","note":"Human-AI configuration and override mechanisms.","confidence_level":"medium","is_original":true}],"controls":[{"slug":"human-oversight-and-override","title":"Human oversight design and override procedure","kind":"process","relationship":"satisfies","note":"Named supervisors with monitoring and override capability.","confidence_level":"high","url":"https://aipolicytracker.org/controls/human-oversight-and-override"}],"url":"https://aipolicytracker.org/obligations/south-korea-ai-basic-act-art-34-high-impact-ai-human-oversight","policy":{"slug":"south-korea-framework-act-on-the-development-of-artificial-intelligence-and-establishment-of-a-foundation-for","title":"Framework Act on the Development of Artificial Intelligence and Establishment of a Foundation for Trust (AI Basic Act, Act No. 20676)","status":"in_force","jurisdiction":"south-korea","url":"https://aipolicytracker.org/policies/south-korea-framework-act-on-the-development-of-artificial-intelligence-and-establishment-of-a-foundation-for"}},{"slug":"uae-pdpl-automated-decision-objection","id":"AIPT-OBL-0070","permanent_url":"https://aipolicytracker.org/id/AIPT-OBL-0070","title":"Respect the right to object to automated decision-making without human intervention","short_title":"Objecting to automated decisions","category":"human_oversight","summary":"Data subjects may object to decisions based solely on automated processing, including profiling, that produce legal or similarly serious effects, subject to exceptions such as contractual necessity or consent.\n","practical_action":"Provide a human-review route for significant automated decisions affecting UAE residents.","is_binding":true,"applies_from":null,"section":null,"source_reference":"Article on data-subject rights relating to automated processing (reviewer to cite article number)","official_source_url":"https://u.ae/en/about-the-uae/digital-uae/data/data-protection","review_status":"pending_review","confidence_level":"medium","last_verified_at":null,"reviewed_by":null,"actors":["deployer"],"sectors":["cross_sector"],"use_cases":["finance_and_credit","hiring_and_hr"],"applicability":[{"description":"Controllers making solely automated decisions with significant effects.","actors":["deployer"],"conditions":null}],"evidence_examples":[{"title":"Automated decision objection procedure","description":null,"artifact_type":"document"}],"framework_mappings":[{"framework":"nist_ai_rmf","framework_name":"NIST AI RMF 1.0","reference":"GOVERN 5.x, MANAGE 4.x","note":"Original editorial mapping.","confidence_level":"low","is_original":true}],"controls":[{"slug":"decision-explanation-and-appeal-route","title":"Decision explanation, human review and appeal route","kind":"process","relationship":"satisfies","note":"Provides the human-review route for solely automated decisions.","confidence_level":"high","url":"https://aipolicytracker.org/controls/decision-explanation-and-appeal-route"},{"slug":"human-oversight-and-override","title":"Human oversight design and override procedure","kind":"process","relationship":"supports","note":"Design of the human intervention step.","confidence_level":"medium","url":"https://aipolicytracker.org/controls/human-oversight-and-override"}],"url":"https://aipolicytracker.org/obligations/uae-pdpl-automated-decision-objection","policy":{"slug":"uae-personal-data-protection-law","title":"Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL)","status":"in_force","jurisdiction":"uae","url":"https://aipolicytracker.org/policies/uae-personal-data-protection-law"}}],"meta":{"total":117,"per_page":25,"current_page":1,"last_page":5,"filters":[],"license":"CC BY 4.0","license_url":"https://creativecommons.org/licenses/by/4.0/"},"links":{"next":"https://aipolicytracker.org/api/v1/obligations?per_page=25&page=2","prev":null}}