AI compliance obligations

Practical requirements extracted from policy instruments, with the source article, the actors they bind, evidence examples and original framework mappings. Legal requirements are marked; everything else is voluntary guidance.

actor: gpai_provider ×

Keyword

Jurisdiction

Obligation category

Sector

AI use case

Actor

Binding

Reset

5 results

Legal requirement copyright training data European Union

Meet general-purpose AI model provider obligations

EU AI Act · Article 53 and Annexes XI–XII

Providers of general-purpose AI models must keep technical documentation (Annex XI), provide information to downstream providers integrating the model (Annex XII), put in place a policy to comply with EU copyright law including the text-and-data-mining opt-out, and publish a sufficiently detailed public summary of training content using the Commission's template. Free and open-source models are exempt from the first two duties unless they present systemic risk. Adherence to the General-Purpose AI Code of Practice can demonstrate compliance.

Source-linked Applies from 2 Aug 2025

Legal requirement incident handling California (United States)

Report critical safety incidents to the Office of Emergency Services

California SB 53 · Business and Professions Code, Chapter 25.1 (as added by SB 53)

Frontier developers must report critical safety incidents to the California Office of Emergency Services within the statutory time limit after discovery, and the Office is to establish a reporting mechanism.

Source-linked Applies from 1 Jan 2026

Legal requirement safety testing California (United States)

Large frontier developers must publish a frontier AI framework

California SB 53 · Business and Professions Code, Chapter 25.1 (as added by SB 53)

Large frontier developers must publish and maintain a framework describing how they incorporate national and international standards, assess catastrophic risk, apply mitigations, secure model weights, and govern internal processes, and must review it at least annually.

Source-linked Applies from 1 Jan 2026

Legal requirement safety testing European Union

Manage systemic risk for high-impact general-purpose models

EU AI Act · Articles 51, 52 and 55

A general-purpose model is presumed to have systemic risk when the cumulative compute used for training exceeds 10^25 floating-point operations, or when the Commission designates it. Providers must notify the Commission, perform model evaluations including adversarial testing, assess and mitigate systemic risks, track and report serious incidents, and ensure adequate cybersecurity for the model and infrastructure.

Source-linked Applies from 2 Aug 2025

Voluntary guidance transparency Singapore

Report incidents and mark AI-generated content (generative AI framework)

Singapore Model AI Governance Framework · Generative AI framework, dimensions on incident reporting and content provenance

The generative-AI framework recommends incident-reporting channels and processes for AI harms, and content provenance measures such as digital watermarking and cryptographic provenance so that users can identify AI-generated content.

Source-linked