Artificial Intelligence Policy Tracker
Search
Menu

AI compliance obligations

Practical requirements extracted from policy instruments, with the source article, the actors they bind, evidence examples and original framework mappings. Legal requirements are marked; everything else is voluntary guidance.

Results

5 of 117 obligations match · Download these as CSV

Legal requirement Governance and accountability California (United States)

Frontier developers must protect employees who report catastrophic-risk concerns

California SB 53 · Labor Code Section 1107 (as added by SB 53)

A frontier developer must not adopt rules or take action that prevent or retaliate against a covered employee for disclosing to the Attorney General, a federal authority, a manager or another employee with authority that the developer's activities pose a specific and substantial danger to public health or safety from catastrophic risk, or that it has violated the Act. Covered employees must be given clear notice of these rights, and large frontier developers must run an anonymous internal reporting process with regular updates to the reporter and to officers and directors.

Verified (a factual check against the official source, not a legal review) Applies from 1 Jan 2026
Legal requirement Incident reporting and handling California (United States)

Report critical safety incidents to the Office of Emergency Services

California SB 53 · Business and Professions Code, Chapter 25.1 (as added by SB 53)

Frontier developers must report critical safety incidents to the California Office of Emergency Services within the statutory time limit after discovery, and the Office is to establish a reporting mechanism.

Source-linked (a factual check against the official source, not a legal review) Applies from 1 Jan 2026
Legal requirement Safety testing and evaluation California (United States)

Large frontier developers must publish a frontier AI framework

California SB 53 · Business and Professions Code, Chapter 25.1 (as added by SB 53)

Large frontier developers must publish and maintain a framework describing how they incorporate national and international standards, assess catastrophic risk, apply mitigations, secure model weights, and govern internal processes, and must review it at least annually.

Source-linked (a factual check against the official source, not a legal review) Applies from 1 Jan 2026
Legal requirement Safety testing and evaluation California (United States)

Large frontier developers must send periodic summaries of catastrophic-risk assessments to the state

California SB 53 · Business and Professions Code Section 22757.12 (as added by SB 53)

A large frontier developer must transmit to the California Office of Emergency Services, on the periodic schedule the statute sets, a summary of any assessment of catastrophic risk that results from the internal use of its frontier models. This covers risks arising before public deployment, such as during internal evaluation or use of the model to accelerate research, and complements the public transparency report.

Verified (a factual check against the official source, not a legal review) Applies from 1 Jan 2026
Legal requirement Transparency and disclosure California (United States)

Frontier developers must publish a transparency report before deploying a new frontier model

California SB 53 · Business and Professions Code Section 22757.12 (as added by SB 53)

Before or at the time a frontier developer deploys a new frontier model, or a substantially modified version, it must publish a transparency report on its website describing the model, its intended uses and restrictions, the release date and modalities, and how to contact the developer. A large frontier developer must add a summary of its catastrophic-risk assessment for the model, the results, any third-party evaluators involved and the steps taken under its frontier AI framework, with trade-secret and security redactions explained.

Verified (a factual check against the official source, not a legal review) Applies from 1 Jan 2026

Frequently asked questions

What is an obligation on this site?

A single practical requirement pulled out of an instrument and stated on its own: keep a risk management system, log incidents, document training data, provide human oversight, and so on. Each one cites the article or section it comes from so you can check it against the source.

Does a voluntary obligation have legal force?

No, and every obligation is labelled either a legal requirement or voluntary guidance. Voluntary items still matter in practice, because procurement questionnaires and auditors ask about them, but only the binding ones carry legal consequence.

How do I find the obligations that apply to my organisation?

Filter by jurisdiction, category, actor, sector or use case. The applicability check asks a short set of questions and returns the duties that may reach you. It is an educational screen, not a legal determination, and it says so.

Why do some instruments have no obligations listed?

Because nobody has broken them out yet. Most instruments are recorded at summary level first; obligations are added jurisdiction by jurisdiction. The coverage and open-gaps pages publish exactly what is missing rather than hiding it.