By role · Deployer / user organisation
A deployer uses an AI system under its own authority in the course of its business. Deployer duties are lighter than provider duties but they are the ones most organisations actually have: follow the instructions, keep humans in a position to oversee, retain logs, tell people when AI is used in decisions about them, and in some jurisdictions assess the impact before use.
Treating a purchased system as the vendor's problem. The vendor's documentation is an input to the deployer's own oversight, notice and logging duties, not a substitute for them, and a deployer who materially changes a system can become its provider.
An inventory of the systems in use, a named owner for each, the vendor documentation on file, a human oversight arrangement that can actually intervene, notices to affected people, and logs kept for the period the instrument names. The controls below cover that list and say which duty each one serves.
Sorted by how many of the duties on this page each control satisfies, so the ones worth building first are at the top. A control page lists every other duty it serves, in every jurisdiction.
| Control | Satisfies | Supports | Owner · frequency |
|---|---|---|---|
| AI interaction and use disclosure notices Process | 14 | 3 | Product owner · at launch and on material change |
| Privacy and data-protection controls for AI Process | 8 | 4 | Data protection officer · once per ai system |
| Decision explanation, human review and appeal route Process | 7 | 3 | Customer operations lead · once per ai system |
| AI governance policy and accountability structure Policy | 7 | 2 | Executive sponsor for AI · annual |
| AI risk assessment and lifecycle risk register Process | 5 | 5 | AI system owner · once per ai system |
| AI incident management and regulatory reporting Process | 5 | 1 | Incident coordinator · continuous |
| AI impact and fundamental-rights impact assessment Process | 4 | 6 | AI system owner · once per ai system |
| Prohibited and unacceptable-use screening gate Process | 4 | 1 | AI governance lead · once per ai system |
| Synthetic content labelling and provenance marking Technical measure | 4 | 0 | Engineering lead · continuous |
| Human oversight design and override procedure Process | 3 | 7 | AI system owner · once per ai system |
| Accuracy, robustness, fairness and security testing Technical measure | 3 | 5 | Quality or testing lead · at launch and on material change |
| Data governance and dataset documentation Process | 2 | 4 | Data governance lead · once per ai system |
| Post-deployment monitoring and drift detection Technical measure | 2 | 3 | AI system owner · continuous |
| Technical documentation, model cards and instructions for use Process | 1 | 3 | Product or model owner · at launch and on material change |
| Automatic event logging and record retention Technical measure | 1 | 3 | Engineering lead · continuous |
| AI literacy and role-based training programme Training programme | 1 | 3 | Learning and development lead · annual |
| Contractual allocation of AI duties across the supply chain Contractual term | 1 | 1 | Legal counsel · once per ai system |
| Public-sector AI use-case register and algorithmic transparency Process | 1 | 1 | Agency AI officer · annual |
| Conformity assessment, declaration and registration Process | 1 | 0 | Regulatory compliance lead · once per ai system |
| Model release and change-management gate Process | 1 | 0 | Release manager · at launch and on material change |
| AI system inventory and classification Process | 0 | 9 | AI governance lead · continuous |
| Vendor and third-party AI due diligence Process | 0 | 4 | Procurement or vendor risk lead · once per ai system |
| Adversarial and red-team testing for generative AI Technical measure | 0 | 2 | AI security or safety lead · at launch and on material change |
| Training-data provenance and copyright register Process | 0 | 1 | Model development lead · at launch and on material change |
| Quality management system for AI development and supply Policy | 0 | 1 | Quality lead · annual |
Every published duty whose record names this audience. It is the recorded set, not every rule in the world; a jurisdiction missing here may simply not be mapped yet (open gaps).
Informational only, not legal advice. Verify every claim against the linked official sources and consult qualified counsel before acting.
