One control, many legal duties

Controls

26

original catalogue

Duties served

112

recorded obligations

Jurisdictions

13

with a duty a control meets

Evidence types

23

from the evidence taxonomy

• Policy Executive sponsor for AI · annual

  AI governance policy and accountability structure

  Gives the organisation a single approved statement of how it will develop, buy and use AI, and names the people who are answerable for it, so that every other AI control has a mandate and an owner.

  Duties

  16

  Binding

  9

  Jurisdictions

  11

  Australia, European Union, India, Nepal, Singapore, South Korea and 5 more

  Evidence: AI policy, Board or executive approval of the AI policy, AI governance forum minutes…

• Process AI system owner · once per ai system

  AI impact and fundamental-rights impact assessment

  Examines how a planned AI use will affect the people, groups and communities it touches, with particular attention to discrimination and rights, and records the mitigations chosen before the system goes live.

  Duties

  11

  Binding

  8

  Jurisdictions

  7

  European Union, India, South Korea, United Arab Emirates, United Kingdom, Colorado (United States) and 1 more

  Evidence: AI impact assessment, Impact assessment approval, Impact assessment procedure and template

• Process Incident coordinator · continuous

  AI incident management and regulatory reporting

  Ensures that harm or near-harm caused by an AI system is detected, contained, investigated and, where a rule requires it, reported to the right authority and affected people within the applicable time limit.

  Duties

  14

  Binding

  12

  Jurisdictions

  7

  European Union, India, Singapore, South Korea, California (United States), Colorado (United States) and 1 more

  Evidence: AI incident response playbook, AI incident record, Incident report to an authority

• Process Product owner · at launch and on material change

  AI interaction and use disclosure notices

  Tells people, in plain language and at the right moment, that they are interacting with an AI system, that AI is being used in a decision about them or that their data feeds an AI system.

  Duties

  17

  Binding

  15

  Jurisdictions

  8

  Australia, European Union, Singapore, South Korea, United Kingdom, Colorado (United States) and 2 more

  Evidence: AI interaction or use notice, Notice catalogue, Notice wording approval

• Training programme Learning and development lead · annual

  AI literacy and role-based training programme

  Gives everyone who builds, buys, operates or is overseen by AI systems the knowledge they need for their role, from general awareness to the specific skills of overseeing a high-risk system.

  Duties

  4

  Binding

  2

  Jurisdictions

  3

  European Union, Singapore, United States

  Evidence: AI training completion records, Role-to-curriculum training matrix, AI training curriculum and materials

• Process AI system owner · once per ai system

  AI risk assessment and lifecycle risk register

  Identifies, rates and treats the risks that a specific AI system poses to health, safety, rights and the organisation itself, and keeps that analysis alive from design through retirement.

  Duties

  12

  Binding

  5

  Jurisdictions

  8

  Australia, European Union, India, Singapore, South Korea, United Kingdom and 2 more

  Evidence: AI system risk assessment, Per-system AI risk register, Residual-risk acceptance

• Process AI governance lead · continuous

  AI system inventory and classification

  Ensures the organisation knows every AI system it builds, buys or embeds, who owns it, what it is for and which legal risk tier it falls into, so that obligations can be assigned rather than discovered after the fact.

  Duties

  11

  Binding

  8

  Jurisdictions

  7

  Australia, European Union, South Korea, United Kingdom, Colorado (United States), Texas (United States) and 1 more

  Evidence: AI system register, Risk-tier classification sign-off, AI intake and classification procedure

• Technical measure Quality or testing lead · at launch and on material change

  Accuracy, robustness, fairness and security testing

  Verifies before release, and again after material change, that a system performs to declared accuracy levels, behaves consistently across groups and conditions, and resists the attacks specific to AI.

  Duties

  15

  Binding

  10

  Jurisdictions

  9

  Australia, European Union, India, Singapore, United Kingdom, Colorado (United States) and 3 more

  Evidence: Pre-release test report, Test plan and acceptance criteria, Release test sign-off

• Technical measure AI security or safety lead · at launch and on material change

  Adversarial and red-team testing for generative AI

  Finds the ways a generative or general-purpose model can be made to produce harmful, deceptive or dangerous output before users or attackers do, and feeds the findings back into mitigations.

  Duties

  8

  Binding

  7

  Jurisdictions

  5

  European Union, South Korea, California (United States), Texas (United States), United States

  Evidence: Red-team exercise report, Red-team rules of engagement and scenario library, Adversarial findings tracker

• Technical measure Engineering lead · continuous

  Automatic event logging and record retention

  Captures what an AI system did, when and with what inputs, and keeps those records long enough to reconstruct a decision, investigate an incident and demonstrate ongoing monitoring.

  Duties

  8

  Binding

  8

  Jurisdictions

  1

  European Union

  Evidence: AI system event logs, Log schema and retention standard, Log integrity and retention check

• Process Regulatory compliance lead · once per ai system

  Conformity assessment, declaration and registration

  Takes a regulated system through the applicable pre-market assessment, produces the signed declaration or certificate and completes any registration with authorities before the system is placed on the market.

  Duties

  4

  Binding

  4

  Jurisdictions

  1

  European Union

  Evidence: Declaration of conformity or certificate, Registration record in the relevant database, Conformity evidence pack

• Contractual term Legal counsel · once per ai system

  Contractual allocation of AI duties across the supply chain

  Writes into supplier and customer agreements who does what on documentation, testing, notification, data rights and cooperation, so that legal duties do not fall into the gap between organisations.

  Duties

  8

  Binding

  7

  Jurisdictions

  3

  Australia, European Union, South Korea

  Evidence: AI supplier clause set, AI customer or deployer clause set, Contract clause index against the AI register

• Process Data governance lead · once per ai system

  Data governance and dataset documentation

  Makes sure the data used to train, tune, validate and test an AI system is fit for purpose, understood and documented, so that quality and bias problems are found in the data before they surface in decisions.

  Duties

  8

  Binding

  6

  Jurisdictions

  5

  European Union, India, Singapore, United Kingdom, New York (United States)

  Evidence: Dataset documentation sheet, Data quality and bias check report, Dataset approval for use

• Process Customer operations lead · once per ai system

  Decision explanation, human review and appeal route

  Gives people affected by a significant automated or AI-assisted decision a meaningful explanation, a way to correct the data behind it, and a route to have a person reconsider it.

  Duties

  10

  Binding

  7

  Jurisdictions

  7

  Australia, European Union, South Korea, United Arab Emirates, United Kingdom, Colorado (United States) and 1 more

  Evidence: Adverse-decision explanation template, AI decision challenge and human review procedure, Challenge and reversal log

• Policy Head of AI safety · annual

  Frontier model safety and security framework

  Commits a developer of the most capable general-purpose models to a published, regularly reviewed description of how it identifies catastrophic and systemic risks, decides when a model is safe to train further or release, and protects model weights.

  Duties

  9

  Binding

  9

  Jurisdictions

  3

  European Union, South Korea, California (United States)

  Evidence: Published frontier safety framework, Dangerous-capability evaluation report, Threshold notification to an authority…

• Process AI system owner · once per ai system

  Human oversight design and override procedure

  Ensures that competent people can understand, question, correct, stop or decline to use an AI system's output, and that the degree of human involvement is chosen deliberately for each decision point.

  Duties

  11

  Binding

  9

  Jurisdictions

  8

  Australia, European Union, Singapore, South Korea, United Arab Emirates, United Kingdom and 2 more

  Evidence: Human oversight and override procedure, Human-involvement design rationale, Overseer training completion

• Process Release manager · at launch and on material change

  Model release and change-management gate

  Makes every release, retraining and material change to an AI system pass through a documented decision that confirms the required assessments, tests and documentation are complete and current.

  Duties

  5

  Binding

  5

  Jurisdictions

  2

  European Union, California (United States)

  Evidence: Release or change approval record, Release and change-classification procedure

• Technical measure AI system owner · continuous

  Post-deployment monitoring and drift detection

  Watches a live AI system for falling performance, shifting data, emerging bias and unexpected use, and turns what it sees into corrective action, incident reports and documentation updates.

  Duties

  10

  Binding

  8

  Jurisdictions

  4

  European Union, Singapore, Colorado (United States), United States

  Evidence: Post-market monitoring plan, Monitoring dashboard or periodic monitoring report, Monitoring review decision

• Process Data protection officer · once per ai system

  Privacy and data-protection controls for AI

  Ensures that personal data used to train, tune or run an AI system is processed on a documented lawful basis, with the assessments, notices, security and individual rights that data-protection law requires.

  Duties

  13

  Binding

  13

  Jurisdictions

  8

  European Union, India, Nepal, Singapore, United Arab Emirates, United Kingdom and 2 more

  Evidence: Data protection impact assessment for an AI system, AI data-flow and legal-basis record, Privacy notice section on AI use…

• Process AI governance lead · once per ai system

  Prohibited and unacceptable-use screening gate

  Stops the organisation from building, buying or operating an AI use that the law bans or that its own policy rules out, by checking every proposed and existing use against a maintained list.

  Duties

  7

  Binding

  7

  Jurisdictions

  2

  European Union, Texas (United States)

  Evidence: Prohibited-use screening record, Screening list and escalation procedure

• Process Agency AI officer · annual

  Public-sector AI use-case register and algorithmic transparency

  Lets a public body account for the AI it uses by keeping an inventory of use cases, flagging those that affect rights or services, and publishing what the public and oversight bodies are entitled to see.

  Duties

  6

  Binding

  5

  Jurisdictions

  4

  European Union, Nepal, Texas (United States), United States

  Evidence: Public AI use-case inventory, Algorithmic transparency statement for one use case, Inventory review and publication sign-off

• Policy Quality lead · annual

  Quality management system for AI development and supply

  Binds the organisation's AI processes into one documented, audited management system so that compliance is repeatable across products rather than reinvented for each one.

  Duties

  3

  Binding

  3

  Jurisdictions

  1

  European Union

  Evidence: AI quality management system manual, Internal audit of the AI management system, Management review minutes

• Technical measure Engineering lead · continuous

  Synthetic content labelling and provenance marking

  Makes AI-generated or manipulated audio, image, video and text identifiable as such, both to people looking at it and to software checking it, so that it cannot easily be passed off as authentic.

  Duties

  5

  Binding

  4

  Jurisdictions

  3

  European Union, Singapore, South Korea

  Evidence: Content labelling and provenance standard, Watermark and provenance robustness test, Visible AI-generated content label

• Process Product or model owner · at launch and on material change

  Technical documentation, model cards and instructions for use

  Produces and maintains the documentation that lets a regulator, a customer or a deployer understand what a system is, how it was built and tested, what it is for and how to use it safely.

  Duties

  13

  Binding

  12

  Jurisdictions

  5

  United Kingdom, European Union, South Korea, California (United States), Colorado (United States)

  Evidence: Technical documentation file, Model card or deployer information pack, Instructions for use

• Process Model development lead · at launch and on material change

  Training-data provenance and copyright register

  Records the origin, licence and rights status of every source used to train or fine-tune a model so that the organisation can honour opt-outs, answer downstream questions and publish a truthful summary of training content.

  Duties

  4

  Binding

  4

  Jurisdictions

  3

  European Union, Nepal, Colorado (United States)

  Evidence: Training source register, Copyright and rights-reservation policy, Public summary of training content

• Process Procurement or vendor risk lead · once per ai system

  Vendor and third-party AI due diligence

  Checks, before an external model, dataset, component or AI service is adopted or resold, that the supplier has met its own duties and that the organisation understands what it is taking on.

  Duties

  6

  Binding

  4

  Jurisdictions

  3

  European Union, New York (United States), United States

  Evidence: AI supplier due-diligence assessment, AI supplier and component register, Supplier onboarding decision

Informational only, not legal advice. Verify every claim against the linked official sources and consult qualified counsel before acting.