Practical requirements extracted from policy instruments, with the source article, the actors they bind, evidence examples and original framework mappings. Legal requirements are marked; everything else is voluntary guidance.
Before putting a high-risk AI system into service or using it at the workplace, a deployer that is an employer must tell the workers' representatives and the affected workers that they will be subject to the system. The information is given following the procedures and rules on informing workers and their representatives under Union and national law and practice, which may include works-council consultation.
Verified (a factual check against the official source, not a legal review)Applies from 2 Dec 2027
A governmental agency that makes an AI system available to interact with consumers must disclose to each consumer, before or at the time of the interaction, that they are interacting with an AI system. The disclosure is owed even where the AI nature of the interaction would be obvious, must be clear and conspicuous, written in plain language and may not use a dark pattern; a hyperlink to the disclosure is acceptable for online services.
Verified (a factual check against the official source, not a legal review)Applies from 1 Jan 2026
A person who provides health-care services or treatment and uses an AI system in relation to those services must disclose that use to the patient, or to the patient's personal representative or guardian, no later than the date the service or treatment is first provided, with an exception for emergencies where the disclosure is made as soon as reasonably possible. The disclosure must be clear, conspicuous and in plain language.
Verified (a factual check against the official source, not a legal review)Applies from 1 Jan 2026
Before a high-risk system makes a consequential decision, deployers must notify the consumer that AI is used, describe its purpose and nature, and provide contact and opt-out information where applicable. After an adverse decision they must state the principal reasons, the data used and its sources, and offer an opportunity to correct data and to appeal for human review where feasible.
Pending review (a factual check against the official source, not a legal review)
Deployers must tell a consumer, before the decision is made, that automated decision-making technology will be used to make or materially influence a consequential decision about them. The exact content and timing of the notice follow the enrolled bill, which a reviewer must read.
Pending review (a factual check against the official source, not a legal review)Applies from 1 Jan 2027
Legal requirementTransparency and disclosure·Singapore
Organisations should inform individuals that AI systems use their personal data, the purposes, the relevant features and how they influence decisions, proportionate to the impact on the individual.
Source-linked (a factual check against the official source, not a legal review)
Legal requirementTransparency and disclosure·South Korea
Operators of high-impact AI must put in place measures to explain the AI's final results, the main criteria used to reach them, and an overview of the training data, to the extent that this is technically feasible. The duty targets explainability of the system's decisions to users and affected people rather than full disclosure of the model.
Verified (a factual check against the official source, not a legal review)Applies from 22 Jan 2026
Voluntary guidanceData governance and quality·Singapore
Covers data lineage and quality, minimising bias in datasets, model explainability, repeatability, robustness, regular tuning and active monitoring after deployment.
Source-linked (a factual check against the official source, not a legal review)
Voluntary guidanceGovernance and accountability·India
The guidelines encourage organisations to embed principles such as fairness, accountability, safety and transparency, to classify and mitigate risks proportionately, and to participate in voluntary frameworks and incident reporting.
Source-linked (a factual check against the official source, not a legal review)
Voluntary guidanceGovernance and accountability·United States
Govern covers policies and procedures for AI risk, roles and responsibilities, workforce diversity and training, organisational culture, stakeholder engagement, and third-party risk management. It is the cross-cutting function that supports the other three.
Source-linked (a factual check against the official source, not a legal review)
Voluntary guidanceGovernance and accountability·United Kingdom
Guardrail 1 asks organisations to set up accountability processes including governance, internal capability and a strategy for regulatory compliance; guardrail 2 asks for a risk-management process to identify and mitigate risks across the AI lifecycle.
Source-linked (a factual check against the official source, not a legal review)
Voluntary guidanceGovernance and accountability·Singapore
Organisations should adapt existing governance to AI: clear roles and responsibilities, board and senior management oversight, risk-management and internal controls, and staff training.
Source-linked (a factual check against the official source, not a legal review)
Voluntary guidanceGovernance and accountability·United Kingdom
AI systems should not undermine legal rights, discriminate unfairly or create unfair market outcomes. The Equality Act 2010 and UK GDPR fairness principle make key parts of this binding.
Source-linked (a factual check against the official source, not a legal review)
Using a risk-impact matrix (probability and severity of harm), organisations choose human-in-the-loop, human-over-the-loop or human-out-of-the-loop designs and document the rationale.
Source-linked (a factual check against the official source, not a legal review)
Test AI models and systems before deployment and monitor them in operation; enable meaningful human control and intervention; and inform end users about AI-enabled decisions, interactions with AI and AI-generated content.
Source-linked (a factual check against the official source, not a legal review)
Map establishes the context: intended purposes, users, deployment settings, legal requirements, risk categorisation, benefits and costs, and impacts on individuals, groups, communities and society.
Source-linked (a factual check against the official source, not a legal review)
An AI business operator that provides high-impact AI, or a product or service using it, is to make efforts to assess in advance the impact the AI may have on people's fundamental rights. The provision is drafted as an endeavour duty rather than a hard requirement, but public bodies procuring high-impact AI are directed to give preference to products that have undergone such an assessment, and the ministry may set assessment methods.
Verified (a factual check against the official source, not a legal review)Applies from 22 Jan 2026
Regulators are asked to ensure AI systems function in a robust, secure and safe way, with risks continually identified, assessed and managed. In practice this is enforced through existing safety, security and data-protection law rather than a new duty.
Source-linked (a factual check against the official source, not a legal review)
Manage allocates resources to mapped and measured risks, plans responses including decommissioning, manages third-party risks, and documents post-deployment monitoring, incident response and communication.
Source-linked (a factual check against the official source, not a legal review)
Voluntary guidanceTransparency and disclosure·United Kingdom
Organisations should communicate when and how AI is used and provide explanations proportionate to the risk, so that people can understand decisions affecting them. For personal data, UK GDPR transparency and automated decision-making rights make this binding in practice.
Source-linked (a factual check against the official source, not a legal review)
Voluntary guidanceTransparency and disclosure·Singapore
The generative-AI framework recommends incident-reporting channels and processes for AI harms, and content provenance measures such as digital watermarking and cryptographic provenance so that users can identify AI-generated content.
Source-linked (a factual check against the official source, not a legal review)
Voluntary guidanceVendor and supply-chain governance·Australia
Establish processes for people impacted by AI to challenge use or outcomes; be transparent with other organisations across the AI supply chain about data, models and systems; and keep and maintain records to allow third parties to assess compliance.
Source-linked (a factual check against the official source, not a legal review)
A single practical requirement pulled out of an instrument and stated on its own: keep a risk management system, log incidents, document training data, provide human oversight, and so on. Each one cites the article or section it comes from so you can check it against the source.
Does a voluntary obligation have legal force?
No, and every obligation is labelled either a legal requirement or voluntary guidance. Voluntary items still matter in practice, because procurement questionnaires and auditors ask about them, but only the binding ones carry legal consequence.
How do I find the obligations that apply to my organisation?
Filter by jurisdiction, category, actor, sector or use case. The applicability check asks a short set of questions and returns the duties that may reach you. It is an educational screen, not a legal determination, and it says so.
Why do some instruments have no obligations listed?
Because nobody has broken them out yet. Most instruments are recorded at summary level first; obligations are added jurisdiction by jurisdiction. The coverage and open-gaps pages publish exactly what is missing rather than hiding it.
