By role · Public authority / government body
Public bodies are deployers with extra duties: impact assessment before use, public registers of systems, procurement rules that pass duties to suppliers, and explanations to people affected by automated decisions. Several jurisdictions regulate government use of AI before, or instead of, private use.
For a public body most AI arrives through a contract. The contractual allocation of duties, the supplier's documentation and the right to audit are where governance is won or lost, which is why contractual controls carry as much weight below as technical ones.
Registers, notices and explanations are duties in their own right, and they are the evidence an auditor or a court will ask for first.
Sorted by how many of the duties on this page each control satisfies, so the ones worth building first are at the top. A control page lists every other duty it serves, in every jurisdiction.
| Control | Satisfies | Supports | Owner · frequency |
|---|---|---|---|
| AI interaction and use disclosure notices Process | 4 | 2 | Product owner · at launch and on material change |
| Decision explanation, human review and appeal route Process | 4 | 1 | Customer operations lead · once per ai system |
| Prohibited and unacceptable-use screening gate Process | 4 | 1 | AI governance lead · once per ai system |
| Privacy and data-protection controls for AI Process | 3 | 3 | Data protection officer · once per ai system |
| AI impact and fundamental-rights impact assessment Process | 2 | 4 | AI system owner · once per ai system |
| Public-sector AI use-case register and algorithmic transparency Process | 2 | 4 | Agency AI officer · annual |
| Human oversight design and override procedure Process | 1 | 5 | AI system owner · once per ai system |
| Technical documentation, model cards and instructions for use Process | 1 | 2 | Product or model owner · at launch and on material change |
| Post-deployment monitoring and drift detection Technical measure | 1 | 2 | AI system owner · continuous |
| Conformity assessment, declaration and registration Process | 1 | 0 | Regulatory compliance lead · once per ai system |
| Synthetic content labelling and provenance marking Technical measure | 1 | 0 | Engineering lead · continuous |
| Data governance and dataset documentation Process | 1 | 0 | Data governance lead · once per ai system |
| AI incident management and regulatory reporting Process | 1 | 0 | Incident coordinator · continuous |
| AI risk assessment and lifecycle risk register Process | 1 | 0 | AI system owner · once per ai system |
| AI governance policy and accountability structure Policy | 0 | 5 | Executive sponsor for AI · annual |
| AI system inventory and classification Process | 0 | 3 | AI governance lead · continuous |
| Accuracy, robustness, fairness and security testing Technical measure | 0 | 2 | Quality or testing lead · at launch and on material change |
| Automatic event logging and record retention Technical measure | 0 | 2 | Engineering lead · continuous |
| Training-data provenance and copyright register Process | 0 | 1 | Model development lead · at launch and on material change |
| Quality management system for AI development and supply Policy | 0 | 1 | Quality lead · annual |
| Vendor and third-party AI due diligence Process | 0 | 1 | Procurement or vendor risk lead · once per ai system |
Every published duty whose record names this audience. It is the recorded set, not every rule in the world; a jurisdiction missing here may simply not be mapped yet (open gaps).
Informational only, not legal advice. Verify every claim against the linked official sources and consult qualified counsel before acting.
