By use case · Generative AI and foundation models
Generative AI attracts three families of duty: transparency (tell people they are interacting with AI, label synthetic content), model governance (document the model, publish a training-data summary, respect copyright) and safety (evaluate, red-team, report incidents, secure the system). Several jurisdictions have rules specific to synthetic media even where they have no general AI law.
A duty to mark synthetic content is met by provenance and watermarking measures, a disclosure notice and a procedure for exceptions. The synthetic-content control below serves that duty wherever it appears.
For higher-capability models the evidence that matters is the evaluation and adversarial-testing record, tied to the risk areas it covers. The controls list those risk areas with the incidents recorded against them.
Sorted by how many of the duties on this page each control satisfies, so the ones worth building first are at the top. A control page lists every other duty it serves, in every jurisdiction.
| Control | Satisfies | Supports | Owner · frequency |
|---|---|---|---|
| AI governance policy and accountability structure Policy | 6 | 0 | Executive sponsor for AI · annual |
| Frontier model safety and security framework Policy | 5 | 4 | Head of AI safety · annual |
| Synthetic content labelling and provenance marking Technical measure | 5 | 0 | Engineering lead · continuous |
| AI incident management and regulatory reporting Process | 4 | 4 | Incident coordinator · continuous |
| AI interaction and use disclosure notices Process | 4 | 0 | Product owner · at launch and on material change |
| Accuracy, robustness, fairness and security testing Technical measure | 3 | 3 | Quality or testing lead · at launch and on material change |
| AI risk assessment and lifecycle risk register Process | 3 | 3 | AI system owner · once per ai system |
| Privacy and data-protection controls for AI Process | 3 | 1 | Data protection officer · once per ai system |
| Technical documentation, model cards and instructions for use Process | 3 | 1 | Product or model owner · at launch and on material change |
| Contractual allocation of AI duties across the supply chain Contractual term | 3 | 0 | Legal counsel · once per ai system |
| Prohibited and unacceptable-use screening gate Process | 2 | 0 | AI governance lead · once per ai system |
| Adversarial and red-team testing for generative AI Technical measure | 1 | 6 | AI security or safety lead · at launch and on material change |
| AI impact and fundamental-rights impact assessment Process | 1 | 2 | AI system owner · once per ai system |
| AI literacy and role-based training programme Training programme | 1 | 2 | Learning and development lead · annual |
| Data governance and dataset documentation Process | 1 | 1 | Data governance lead · once per ai system |
| Post-deployment monitoring and drift detection Technical measure | 1 | 1 | AI system owner · continuous |
| Training-data provenance and copyright register Process | 1 | 0 | Model development lead · at launch and on material change |
| AI system inventory and classification Process | 0 | 3 | AI governance lead · continuous |
| Vendor and third-party AI due diligence Process | 0 | 3 | Procurement or vendor risk lead · once per ai system |
| Model release and change-management gate Process | 0 | 2 | Release manager · at launch and on material change |
| Human oversight design and override procedure Process | 0 | 1 | AI system owner · once per ai system |
| Public-sector AI use-case register and algorithmic transparency Process | 0 | 1 | Agency AI officer · annual |
Every published duty whose record names this audience. It is the recorded set, not every rule in the world; a jurisdiction missing here may simply not be mapped yet (open gaps).
Informational only, not legal advice. Verify every claim against the linked official sources and consult qualified counsel before acting.
