Practical requirements extracted from policy instruments, with the source article, the actors they bind, evidence examples and original framework mappings. Legal requirements are marked; everything else is voluntary guidance.
EU AI Act · Articles 43, 47, 48 and 49; Annex VIII
Before placing a high-risk system on the market, providers must complete the applicable conformity assessment (internal control or notified-body assessment depending on the system), draw up an EU declaration of conformity, affix the CE marking, and register the system in the EU database. Deployers that are public authorities must also register their use of Annex III systems.
Pending review (a factual check against the official source, not a legal review)Applies from 2 Dec 2027
Legal requirementData governance and quality·European Union
To the extent a deployer controls the data fed into a high-risk AI system, it must make sure that input data is relevant to, and sufficiently representative for, the system's intended purpose. The duty sits with the deployer even though the provider designed the system, because the deployer chooses what the system is run on.
Verified (a factual check against the official source, not a legal review)Applies from 2 Dec 2027
Legal requirementGovernance and accountability·European Union
A deployer using a high-risk post-remote biometric identification system in a criminal investigation must request authorisation from a judicial or independent administrative authority in advance or within 48 hours, unless the use is only the initial identification of a potential suspect on objective and verifiable facts. Use is limited to a targeted search; if authorisation is refused, use stops and the data is deleted. No adverse legal decision may rest solely on the output, each use is documented, and the deployer reports annually to the market surveillance and data protection authorities.
Verified (a factual check against the official source, not a legal review)Applies from 2 Dec 2027
Legal requirementGovernance and accountability·South Korea
Operators of high-impact AI must prepare and implement a plan to protect users, and must prepare and keep documents describing the measures they take to secure the AI's safety and reliability, so that they can be shown to the Ministry of Science and ICT on request. Further items may be added by Presidential Decree, and the ministry may publish guidelines on how to meet these duties.
Verified (a factual check against the official source, not a legal review)Applies from 22 Jan 2026
Legal requirementGovernance and accountability·European Union
Deployers of high-risk AI must take technical and organisational measures to use systems according to the instructions, assign human oversight, ensure input data is relevant where they control it, monitor operation, inform the provider and authorities of risks or serious incidents, keep logs, inform workers' representatives before deploying at the workplace, inform affected natural persons where decisions are made about them, and cooperate with authorities.
Pending review (a factual check against the official source, not a legal review)Applies from 2 Dec 2027
ICO AI guidance · UK GDPR Article 22 as amended by the Data (Use and Access) Act 2025
Individuals have rights in relation to solely automated decisions that produce legal or similarly significant effects, including being told about the decision, obtaining human intervention, and contesting it. The Data (Use and Access) Act 2025 amended these rules; the reviewer must confirm the current wording.
Source-linked (a factual check against the official source, not a legal review)
Operators of high-impact AI must ensure that the AI is subject to human management and supervision, so that people remain able to monitor its operation and intervene in or override its outputs where those outputs may affect life, physical safety or fundamental rights.
Verified (a factual check against the official source, not a legal review)Applies from 22 Jan 2026
ICO AI guidance · UK GDPR Article 35; ICO guidance, accountability and governance section
Where AI processing of personal data is likely to result in a high risk to individuals, UK GDPR requires a DPIA before processing begins. The ICO treats most AI involving profiling, large-scale processing or novel technology as meeting this threshold.
Source-linked (a factual check against the official source, not a legal review)
Before deploying most Annex III high-risk systems, deployers that are bodies governed by public law or private entities providing public services, and deployers using systems for creditworthiness assessment or life and health insurance pricing, must assess the impact on fundamental rights: the processes, period and frequency of use, categories of affected persons, specific risks of harm, human-oversight measures and mitigation, and notify the market-surveillance authority of the results.
Pending review (a factual check against the official source, not a legal review)Applies from 2 Dec 2027
Deployers must monitor a high-risk AI system's operation against the provider's instructions and feed observations to the provider under Article 72. If they have reason to think the system as used may present a risk to health, safety or fundamental rights, they must inform the provider or distributor and the market surveillance authority without undue delay and suspend use. On a serious incident, they must immediately inform the provider, then the importer or distributor and the authorities. Financial institutions meet this through their internal governance rules.
Verified (a factual check against the official source, not a legal review)Applies from 2 Dec 2027
Legal requirementPrivacy and personal-data protection·Nepal
Nepal Privacy Act 2075 · Chapter on collection and protection of personal information (reviewer to cite sections)
Personal information may be collected only by authorised persons for a lawful purpose with the individual's consent, and must not be used or disclosed for other purposes without consent, subject to statutory exceptions. AI systems trained on or processing personal data of people in Nepal must respect these limits.
Pending review (a factual check against the official source, not a legal review)
Legal requirementPrivacy and personal-data protection·European Union
Where a deployer of a high-risk AI system is required to carry out a data protection impact assessment under Article 35 of the GDPR or Article 27 of the Law Enforcement Directive, it must draw on the information the provider supplied under Article 13, such as the intended purpose, performance, limitations and human-oversight measures, when producing that assessment.
Verified (a factual check against the official source, not a legal review)Applies from 2 Dec 2027
A person may not develop or deploy an AI system with the intent to unlawfully discriminate against a protected class in violation of state or federal law. A disparate impact on a protected class is not, by itself, sufficient to show an intent to discriminate, and insurers and financial institutions acting under their own regulatory regimes are treated separately.
Verified (a factual check against the official source, not a legal review)Applies from 1 Jan 2026
Article 5 bans placing on the market, putting into service or using AI for listed practices, including subliminal or manipulative techniques that cause significant harm, exploitation of vulnerabilities, social scoring by public or private actors leading to detrimental treatment, untargeted scraping of facial images to build recognition databases, emotion recognition in workplaces and education institutions except for medical or safety reasons, biometric categorisation to infer protected characteristics, and real-time remote biometric identification in publicly accessible spaces for law enforcement outside narrow exceptions.
Pending review (a factual check against the official source, not a legal review)Applies from 2 Feb 2025
A governmental entity may not develop or deploy an AI system for the purpose of uniquely identifying a specific individual using biometric data, or of gathering images or other media from the internet or another public source without the individual's consent, where doing so would infringe a right guaranteed under the United States or Texas constitutions or violate state or federal law. The Act preserves lawful uses that comply with existing biometric-privacy law.
Verified (a factual check against the official source, not a legal review)Applies from 1 Jan 2026
A governmental entity may not develop or deploy an AI system that evaluates or classifies natural persons or groups on the basis of their social behaviour or personal characteristics, with the intent to calculate or assign a social score or similar valuation that leads to detrimental or unfavourable treatment unrelated to the context in which the data was collected, or that is unjustified or disproportionate to the behaviour.
Verified (a factual check against the official source, not a legal review)Applies from 1 Jan 2026
Legal requirementPublic-sector use and procurement·United States
Agency heads were directed to identify actions taken under Executive Order 14110 that are inconsistent with the policy of EO 14179 and to suspend, revise or rescind them, and OMB was directed to revise its federal AI use and procurement memoranda.
Source-linked (a factual check against the official source, not a legal review)
Legal requirementPublic-sector use and procurement·European Union
EU AI Act · Article 26(8); Article 49(3) and 49(4)
Deployers that are public authorities or Union institutions, bodies, offices or agencies must register their use of an Annex III high-risk AI system in the EU database before putting it into service. If they find that the system they intend to use has not been registered in the database by its provider, they must not use it and must inform the provider or distributor.
Verified (a factual check against the official source, not a legal review)Applies from 2 Dec 2027
For AI whose output serves as a principal basis for decisions with significant effects on rights, safety or access to services, agencies must complete pre-deployment testing, an AI impact assessment, ongoing monitoring, operator training, human oversight and a mechanism for affected people to seek remedy, or stop using the AI.
Source-linked (a factual check against the official source, not a legal review)
An AI business operator that provides high-impact AI, or a product or service using it, must establish and operate a plan for managing the risks of that AI. High-impact AI is AI used in areas such as energy, drinking water, health care and medical devices, nuclear safety, biometric analysis for criminal investigation, decisions on recruitment or loans, transport, public services and education, where it may materially affect life, safety or fundamental rights.
Verified (a factual check against the official source, not a legal review)Applies from 22 Jan 2026
Legal requirementTransparency and disclosure·European Union
A deployer that generates or manipulates image, audio or video content that is a deep fake must disclose that the content has been artificially generated or manipulated, with lighter treatment for evidently artistic, creative, satirical or fictional works so that the disclosure does not spoil the work. A deployer that publishes AI-generated text to inform the public on matters of public interest must disclose this unless the text passed human review or editorial control and someone holds editorial responsibility. The disclosure must reach people clearly at the latest at first exposure.
Verified (a factual check against the official source, not a legal review)Applies from 2 Aug 2026
Legal requirementTransparency and disclosure·European Union
A person affected by a decision that a deployer took on the basis of the output of an Annex III high-risk AI system, other than critical-infrastructure systems, which produces legal effects or similarly significantly affects them in a way they consider adverse to their health, safety or fundamental rights, has the right to obtain from the deployer clear and meaningful explanations of the role the system played in the decision and the main elements of the decision. The right does not apply where Union or national law provides an exception.
Verified (a factual check against the official source, not a legal review)Applies from 2 Dec 2027
Legal requirementTransparency and disclosure·European Union
Deployers of Annex III high-risk AI systems that take decisions about natural persons, or help take them, must inform those persons that they are subject to the system. The notice is separate from any explanation owed under Article 86 and from the worker notice in Article 26(7). In law-enforcement contexts the duty follows the information rules of the Law Enforcement Directive.
Verified (a factual check against the official source, not a legal review)Applies from 2 Dec 2027
Legal requirementTransparency and disclosure·European Union
A deployer of an emotion recognition system or a biometric categorisation system must inform the natural persons exposed to it that the system is operating and must process their personal data in line with the GDPR, the Law Enforcement Directive and the EU institutions data protection regulation. Systems permitted by law to detect, prevent or investigate criminal offences are excepted, subject to safeguards. Use in workplaces and schools is separately banned by Article 5 except for medical or safety reasons.
Verified (a factual check against the official source, not a legal review)Applies from 2 Aug 2026
Legal requirementTransparency and disclosure·European Union
Before putting a high-risk AI system into service or using it at the workplace, a deployer that is an employer must tell the workers' representatives and the affected workers that they will be subject to the system. The information is given following the procedures and rules on informing workers and their representatives under Union and national law and practice, which may include works-council consultation.
Verified (a factual check against the official source, not a legal review)Applies from 2 Dec 2027
A single practical requirement pulled out of an instrument and stated on its own: keep a risk management system, log incidents, document training data, provide human oversight, and so on. Each one cites the article or section it comes from so you can check it against the source.
Does a voluntary obligation have legal force?
No, and every obligation is labelled either a legal requirement or voluntary guidance. Voluntary items still matter in practice, because procurement questionnaires and auditors ask about them, but only the binding ones carry legal consequence.
How do I find the obligations that apply to my organisation?
Filter by jurisdiction, category, actor, sector or use case. The applicability check asks a short set of questions and returns the duties that may reach you. It is an educational screen, not a legal determination, and it says so.
Why do some instruments have no obligations listed?
Because nobody has broken them out yet. Most instruments are recorded at summary level first; obligations are added jurisdiction by jurisdiction. The coverage and open-gaps pages publish exactly what is missing rather than hiding it.
