Practical requirements extracted from policy instruments, with the source article, the actors they bind, evidence examples and original framework mappings. Legal requirements are marked; everything else is voluntary guidance.
ICO AI guidance · UK GDPR Article 22 as amended by the Data (Use and Access) Act 2025
Individuals have rights in relation to solely automated decisions that produce legal or similarly significant effects, including being told about the decision, obtaining human intervention, and contesting it. The Data (Use and Access) Act 2025 amended these rules; the reviewer must confirm the current wording.
Source-linked (a factual check against the official source, not a legal review)
The advance notice to candidates and employees must allow them to request an alternative selection process or a reasonable accommodation. The DCWP rules make clear that the law itself does not require the employer to provide an alternative process, but the request route must exist and accommodation requests remain governed by disability and human-rights law. Instructions for making the request must be included in the notice.
Verified (a factual check against the official source, not a legal review)Applies from 5 Jul 2023
EU AI Act · Article 14; Article 26(2) for deployers
High-risk systems must be designed with human-machine interface tools so natural persons can effectively oversee them, understand capacities and limitations, avoid automation bias, interpret output, decide not to use the system, and intervene or stop it. Deployers must assign oversight to people with the necessary competence, training and authority. For certain remote biometric identification systems, action requires verification by at least two competent persons.
Pending review (a factual check against the official source, not a legal review)Applies from 2 Dec 2027
A consumer who receives an adverse consequential decision may obtain meaningful review by a person with the authority and information to change the outcome. Scope and timing follow the enrolled bill.
Pending review (a factual check against the official source, not a legal review)Applies from 1 Jan 2027
Operators of high-impact AI must ensure that the AI is subject to human management and supervision, so that people remain able to monitor its operation and intervene in or override its outputs where those outputs may affect life, physical safety or fundamental rights.
Verified (a factual check against the official source, not a legal review)Applies from 22 Jan 2026
UAE PDPL · Article on data-subject rights relating to automated processing (reviewer to cite article number)
Data subjects may object to decisions based solely on automated processing, including profiling, that produce legal or similarly serious effects, subject to exceptions such as contractual necessity or consent.
Pending review (a factual check against the official source, not a legal review)
Using a risk-impact matrix (probability and severity of harm), organisations choose human-in-the-loop, human-over-the-loop or human-out-of-the-loop designs and document the rationale.
Source-linked (a factual check against the official source, not a legal review)
Test AI models and systems before deployment and monitor them in operation; enable meaningful human control and intervention; and inform end users about AI-enabled decisions, interactions with AI and AI-generated content.
Source-linked (a factual check against the official source, not a legal review)
A single practical requirement pulled out of an instrument and stated on its own: keep a risk management system, log incidents, document training data, provide human oversight, and so on. Each one cites the article or section it comes from so you can check it against the source.
Does a voluntary obligation have legal force?
No, and every obligation is labelled either a legal requirement or voluntary guidance. Voluntary items still matter in practice, because procurement questionnaires and auditors ask about them, but only the binding ones carry legal consequence.
How do I find the obligations that apply to my organisation?
Filter by jurisdiction, category, actor, sector or use case. The applicability check asks a short set of questions and returns the duties that may reach you. It is an educational screen, not a legal determination, and it says so.
Why do some instruments have no obligations listed?
Because nobody has broken them out yet. Most instruments are recorded at summary level first; obligations are added jurisdiction by jurisdiction. The coverage and open-gaps pages publish exactly what is missing rather than hiding it.
