Controls

One control, many legal duties

A law says what must be true. A control is what an organisation operates to make it true, and the evidence is how it proves it. Each control below is linked to every recorded duty it satisfies or supports, across every jurisdiction, so the work done once can be counted once.

Original catalogue. Standards are cited by clause number only; the official text of a duty decides whether a control is enough.

Controls: 16; original catalogue
Duties served: 98; recorded obligations
Jurisdictions: 13; with a duty a control meets
Evidence types: 20; from the evidence taxonomy

All kinds Policy 0 Process 16 Technical measure 0 Contractual term 0 Training programme 0

Process AI system owner · once per ai system

AI impact and fundamental-rights impact assessment

Examines how a planned AI use will affect the people, groups and communities it touches, with particular attention to discrimination and rights, and records the mitigations chosen before the system goes live.

Duties
11

Binding
8

Jurisdictions
7

European Union, India, South Korea, United Arab Emirates, United Kingdom, Colorado (United States) and 1 more

Evidence: AI impact assessment, Impact assessment approval, Impact assessment procedure and template
Process Incident coordinator · continuous

AI incident management and regulatory reporting

Ensures that harm or near-harm caused by an AI system is detected, contained, investigated and, where a rule requires it, reported to the right authority and affected people within the applicable time limit.

Duties
14

Binding
12

Jurisdictions
7

European Union, India, Singapore, South Korea, California (United States), Colorado (United States) and 1 more

Evidence: AI incident response playbook, AI incident record, Incident report to an authority
Process Product owner · at launch and on material change

AI interaction and use disclosure notices

Tells people, in plain language and at the right moment, that they are interacting with an AI system, that AI is being used in a decision about them or that their data feeds an AI system.

Duties
17

Binding
15

Jurisdictions
8

Australia, European Union, Singapore, South Korea, United Kingdom, Colorado (United States) and 2 more

Evidence: AI interaction or use notice, Notice catalogue, Notice wording approval
Process AI system owner · once per ai system

AI risk assessment and lifecycle risk register

Identifies, rates and treats the risks that a specific AI system poses to health, safety, rights and the organisation itself, and keeps that analysis alive from design through retirement.

Duties
12

Binding
5

Jurisdictions
8

Australia, European Union, India, Singapore, South Korea, United Kingdom and 2 more

Evidence: AI system risk assessment, Per-system AI risk register, Residual-risk acceptance
Process AI governance lead · continuous

AI system inventory and classification

Ensures the organisation knows every AI system it builds, buys or embeds, who owns it, what it is for and which legal risk tier it falls into, so that obligations can be assigned rather than discovered after the fact.

Duties
11

Binding
8

Jurisdictions
7

Australia, European Union, South Korea, United Kingdom, Colorado (United States), Texas (United States) and 1 more

Evidence: AI system register, Risk-tier classification sign-off, AI intake and classification procedure
Process Regulatory compliance lead · once per ai system

Conformity assessment, declaration and registration

Takes a regulated system through the applicable pre-market assessment, produces the signed declaration or certificate and completes any registration with authorities before the system is placed on the market.

Duties
4

Binding
4

Jurisdictions
1

European Union

Evidence: Declaration of conformity or certificate, Registration record in the relevant database, Conformity evidence pack
Process Data governance lead · once per ai system

Data governance and dataset documentation

Makes sure the data used to train, tune, validate and test an AI system is fit for purpose, understood and documented, so that quality and bias problems are found in the data before they surface in decisions.

Duties
8

Binding
6

Jurisdictions
5

European Union, India, Singapore, United Kingdom, New York (United States)

Evidence: Dataset documentation sheet, Data quality and bias check report, Dataset approval for use
Process Customer operations lead · once per ai system

Decision explanation, human review and appeal route

Gives people affected by a significant automated or AI-assisted decision a meaningful explanation, a way to correct the data behind it, and a route to have a person reconsider it.

Duties
10

Binding
7

Jurisdictions
7

Australia, European Union, South Korea, United Arab Emirates, United Kingdom, Colorado (United States) and 1 more

Evidence: Adverse-decision explanation template, AI decision challenge and human review procedure, Challenge and reversal log
Process AI system owner · once per ai system

Human oversight design and override procedure

Ensures that competent people can understand, question, correct, stop or decline to use an AI system's output, and that the degree of human involvement is chosen deliberately for each decision point.

Duties
11

Binding
9

Jurisdictions
8

Australia, European Union, Singapore, South Korea, United Arab Emirates, United Kingdom and 2 more

Evidence: Human oversight and override procedure, Human-involvement design rationale, Overseer training completion
Process Release manager · at launch and on material change

Model release and change-management gate

Makes every release, retraining and material change to an AI system pass through a documented decision that confirms the required assessments, tests and documentation are complete and current.

Duties
5

Binding
5

Jurisdictions
2

European Union, California (United States)

Evidence: Release or change approval record, Release and change-classification procedure
Process Data protection officer · once per ai system

Privacy and data-protection controls for AI

Ensures that personal data used to train, tune or run an AI system is processed on a documented lawful basis, with the assessments, notices, security and individual rights that data-protection law requires.

Duties
13

Binding
13

Jurisdictions
8

European Union, India, Nepal, Singapore, United Arab Emirates, United Kingdom and 2 more

Evidence: Data protection impact assessment for an AI system, AI data-flow and legal-basis record, Privacy notice section on AI use…
Process AI governance lead · once per ai system

Prohibited and unacceptable-use screening gate

Stops the organisation from building, buying or operating an AI use that the law bans or that its own policy rules out, by checking every proposed and existing use against a maintained list.

Duties
7

Binding
7

Jurisdictions
2

European Union, Texas (United States)

Evidence: Prohibited-use screening record, Screening list and escalation procedure
Process Agency AI officer · annual

Public-sector AI use-case register and algorithmic transparency

Lets a public body account for the AI it uses by keeping an inventory of use cases, flagging those that affect rights or services, and publishing what the public and oversight bodies are entitled to see.

Duties
6

Binding
5

Jurisdictions
4

European Union, Nepal, Texas (United States), United States

Evidence: Public AI use-case inventory, Algorithmic transparency statement for one use case, Inventory review and publication sign-off
Process Product or model owner · at launch and on material change

Technical documentation, model cards and instructions for use

Produces and maintains the documentation that lets a regulator, a customer or a deployer understand what a system is, how it was built and tested, what it is for and how to use it safely.

Duties
13

Binding
12

Jurisdictions
5

United Kingdom, European Union, South Korea, California (United States), Colorado (United States)

Evidence: Technical documentation file, Model card or deployer information pack, Instructions for use
Process Model development lead · at launch and on material change

Training-data provenance and copyright register

Records the origin, licence and rights status of every source used to train or fine-tune a model so that the organisation can honour opt-outs, answer downstream questions and publish a truthful summary of training content.

Duties
4

Binding
4

Jurisdictions
3

European Union, Nepal, Colorado (United States)

Evidence: Training source register, Copyright and rights-reservation policy, Public summary of training content
Process Procurement or vendor risk lead · once per ai system

Vendor and third-party AI due diligence

Checks, before an external model, dataset, component or AI service is adopted or resold, that the supplier has met its own duties and that the organisation understands what it is taking on.

Duties
6

Binding
4

Jurisdictions
3

European Union, New York (United States), United States

Evidence: AI supplier due-diligence assessment, AI supplier and component register, Supplier onboarding decision

Informational only, not legal advice. Verify every claim against the linked official sources and consult qualified counsel before acting.