Artificial Intelligence Policy Tracker

AI compliance obligations

Practical requirements extracted from policy instruments, with the source article, the actors they bind, evidence examples and original framework mappings. Legal requirements are marked; everything else is voluntary guidance.

Results

3 of 117 obligations match · Download these as CSV

Voluntary guidance Governance and accountability Australia

Establish accountability processes and a risk-management process (guardrails 1 and 2)

Australian Voluntary AI Safety Standard · Guardrails 1 and 2

Guardrail 1 asks organisations to set up accountability processes including governance, internal capability and a strategy for regulatory compliance; guardrail 2 asks for a risk-management process to identify and mitigate risks across the AI lifecycle.

Source-linked (a factual check against the official source, not a legal review)
Voluntary guidance Human oversight Australia

Test and monitor systems, enable human control, and be transparent with users (guardrails 4 to 6)

Australian Voluntary AI Safety Standard · Guardrails 4, 5 and 6

Test AI models and systems before deployment and monitor them in operation; enable meaningful human control and intervention; and inform end users about AI-enabled decisions, interactions with AI and AI-generated content.

Source-linked (a factual check against the official source, not a legal review)
Voluntary guidance Vendor and supply-chain governance Australia

Provide contestability, supply-chain transparency and records (guardrails 7 to 9)

Australian Voluntary AI Safety Standard · Guardrails 7, 8 and 9

Establish processes for people impacted by AI to challenge use or outcomes; be transparent with other organisations across the AI supply chain about data, models and systems; and keep and maintain records to allow third parties to assess compliance.

Source-linked (a factual check against the official source, not a legal review)

Frequently asked questions

What is an obligation on this site?

A single practical requirement pulled out of an instrument and stated on its own: keep a risk management system, log incidents, document training data, provide human oversight, and so on. Each one cites the article or section it comes from so you can check it against the source.

Does a voluntary obligation have legal force?

No, and every obligation is labelled either a legal requirement or voluntary guidance. Voluntary items still matter in practice, because procurement questionnaires and auditors ask about them, but only the binding ones carry legal consequence.

How do I find the obligations that apply to my organisation?

Filter by jurisdiction, category, actor, sector or use case. The applicability check asks a short set of questions and returns the duties that may reach you. It is an educational screen, not a legal determination, and it says so.

Why do some instruments have no obligations listed?

Because nobody has broken them out yet. Most instruments are recorded at summary level first; obligations are added jurisdiction by jurisdiction. The coverage and open-gaps pages publish exactly what is missing rather than hiding it.