By role · Provider / developer
A provider is the organisation that develops an AI system, or has one developed, and puts it on a market or into service under its own name. Most binding AI law lands here first: risk management, data governance, technical documentation, logging, accuracy and security, conformity assessment and post-market monitoring are provider duties before they are anyone else's.
The provider carries the design-time duties and the paper trail. A deployer can rely on the provider's instructions and documentation; the provider has to have produced them. That makes the technical file, the risk management record and the quality management system the centre of gravity, and it makes a change to the system a regulatory event rather than an engineering one.
A risk assessment written once to the structure a management standard expects satisfies or supports the risk-management duty in several jurisdictions at once. The controls listed below are counted by the number of duties each one serves, so the ones worth building first are at the top.
Sorted by how many of the duties on this page each control satisfies, so the ones worth building first are at the top. A control page lists every other duty it serves, in every jurisdiction.
| Control | Satisfies | Supports | Owner · frequency |
|---|---|---|---|
| AI governance policy and accountability structure Policy | 7 | 3 | Executive sponsor for AI · annual |
| AI incident management and regulatory reporting Process | 6 | 4 | Incident coordinator · continuous |
| AI risk assessment and lifecycle risk register Process | 6 | 3 | AI system owner · once per ai system |
| Privacy and data-protection controls for AI Process | 6 | 1 | Data protection officer · once per ai system |
| Technical documentation, model cards and instructions for use Process | 5 | 5 | Product or model owner · at launch and on material change |
| Accuracy, robustness, fairness and security testing Technical measure | 4 | 7 | Quality or testing lead · at launch and on material change |
| Contractual allocation of AI duties across the supply chain Contractual term | 4 | 2 | Legal counsel · once per ai system |
| AI interaction and use disclosure notices Process | 4 | 1 | Product owner · at launch and on material change |
| Synthetic content labelling and provenance marking Technical measure | 4 | 0 | Engineering lead · continuous |
| Prohibited and unacceptable-use screening gate Process | 4 | 0 | AI governance lead · once per ai system |
| Automatic event logging and record retention Technical measure | 3 | 3 | Engineering lead · continuous |
| Post-deployment monitoring and drift detection Technical measure | 2 | 4 | AI system owner · continuous |
| Data governance and dataset documentation Process | 2 | 4 | Data governance lead · once per ai system |
| AI impact and fundamental-rights impact assessment Process | 2 | 4 | AI system owner · once per ai system |
| Human oversight design and override procedure Process | 2 | 1 | AI system owner · once per ai system |
| AI system inventory and classification Process | 1 | 7 | AI governance lead · continuous |
| Model release and change-management gate Process | 1 | 3 | Release manager · at launch and on material change |
| AI literacy and role-based training programme Training programme | 1 | 3 | Learning and development lead · annual |
| Conformity assessment, declaration and registration Process | 1 | 2 | Regulatory compliance lead · once per ai system |
| Quality management system for AI development and supply Policy | 1 | 2 | Quality lead · annual |
| Frontier model safety and security framework Policy | 1 | 2 | Head of AI safety · annual |
| Decision explanation, human review and appeal route Process | 1 | 2 | Customer operations lead · once per ai system |
| Adversarial and red-team testing for generative AI Technical measure | 0 | 5 | AI security or safety lead · at launch and on material change |
| Training-data provenance and copyright register Process | 0 | 3 | Model development lead · at launch and on material change |
| Vendor and third-party AI due diligence Process | 0 | 3 | Procurement or vendor risk lead · once per ai system |
Every published duty whose record names this audience. It is the recorded set, not every rule in the world; a jurisdiction missing here may simply not be mapped yet (open gaps).
Informational only, not legal advice. Verify every claim against the linked official sources and consult qualified counsel before acting.
