AIPolicyTracker
Menu

AI compliance obligations

Practical requirements extracted from policy instruments, with the source article, the actors they bind, evidence examples and original framework mappings. Legal requirements are marked; everything else is voluntary guidance.

sector: cross_sector ×

47 results · page 1 of 2

Legal requirement accuracy robustness security European Union

Achieve appropriate accuracy, robustness and cybersecurity

EU AI Act · Article 15

High-risk AI systems must achieve an appropriate level of accuracy, robustness and cybersecurity and perform consistently throughout their lifecycle. Accuracy levels and metrics must be declared in the instructions; systems must be resilient to errors, faults and inconsistencies, address feedback loops in continuously learning systems, and resist attempts to alter use or performance, including data poisoning, model poisoning, adversarial examples and confidentiality attacks.

Source-linked Applies from 2 Aug 2026
Legal requirement ai literacy European Union

Ensure AI literacy of staff operating AI systems

EU AI Act · Article 4

Providers and deployers must take measures to ensure, to their best extent, a sufficient level of AI literacy among their staff and other persons dealing with the operation and use of AI systems on their behalf, taking into account technical knowledge, experience, training, the context of use and the persons affected.

Source-linked Applies from 2 Feb 2025
Legal requirement conformity assessment European Union

Complete conformity assessment, CE marking and EU database registration

EU AI Act · Articles 43, 47, 48 and 49; Annex VIII

Before placing a high-risk system on the market, providers must complete the applicable conformity assessment (internal control or notified-body assessment depending on the system), draw up an EU declaration of conformity, affix the CE marking, and register the system in the EU database. Deployers that are public authorities must also register their use of Annex III systems.

Source-linked Applies from 2 Aug 2026
Legal requirement copyright training data European Union

Meet general-purpose AI model provider obligations

EU AI Act · Article 53 and Annexes XI–XII

Providers of general-purpose AI models must keep technical documentation (Annex XI), provide information to downstream providers integrating the model (Annex XII), put in place a policy to comply with EU copyright law including the text-and-data-mining opt-out, and publish a sufficiently detailed public summary of training content using the Commission's template. Free and open-source models are exempt from the first two duties unless they present systemic risk. Adherence to the General-Purpose AI Code of Practice can demonstrate compliance.

Source-linked Applies from 2 Aug 2025
Legal requirement data governance European Union

Apply data governance and quality criteria to training, validation and testing data

EU AI Act · Article 10

High-risk AI systems that use data-driven techniques must be developed on training, validation and testing data sets meeting quality criteria: appropriate governance practices covering design choices, data collection and origin, preparation, assumptions, availability and suitability, examination for possible biases, and measures to detect, prevent and mitigate bias. Data must be relevant, sufficiently representative and, to the best extent possible, free of errors and complete for the intended purpose.

Source-linked Applies from 2 Aug 2026
Legal requirement governance accountability European Union

Use high-risk AI as instructed, monitor it and inform affected people

EU AI Act · Article 26

Deployers of high-risk AI must take technical and organisational measures to use systems according to the instructions, assign human oversight, ensure input data is relevant where they control it, monitor operation, inform the provider and authorities of risks or serious incidents, keep logs, inform workers' representatives before deploying at the workplace, inform affected natural persons where decisions are made about them, and cooperate with authorities.

Source-linked Applies from 2 Aug 2026
Legal requirement human oversight United Kingdom

Apply safeguards to solely automated decisions with significant effects

ICO AI guidance · UK GDPR Article 22 as amended by the Data (Use and Access) Act 2025

Individuals have rights in relation to solely automated decisions that produce legal or similarly significant effects, including being told about the decision, obtaining human intervention, and contesting it. The Data (Use and Access) Act 2025 amended these rules; the reviewer must confirm the current wording.

Source-linked
Legal requirement human oversight European Union

Enable and assign effective human oversight

EU AI Act · Article 14; Article 26(2) for deployers

High-risk systems must be designed with human-machine interface tools so natural persons can effectively oversee them, understand capacities and limitations, avoid automation bias, interpret output, decide not to use the system, and intervene or stop it. Deployers must assign oversight to people with the necessary competence, training and authority. For certain remote biometric identification systems, action requires verification by at least two competent persons.

Source-linked Applies from 2 Aug 2026
Legal requirement incident handling India

Implement reasonable security safeguards and notify breaches

India DPDP Act · Section 8(5) and 8(6); DPDP Rules on breach intimation

Data Fiduciaries must protect personal data with reasonable security safeguards and, on a personal data breach, inform the Data Protection Board and each affected individual in the form and manner prescribed by the Rules.

Source-linked
Legal requirement incident handling European Union

Report serious incidents to market surveillance authorities

EU AI Act · Article 73

Providers of high-risk AI systems must report serious incidents to the market-surveillance authority of the Member State where the incident occurred, immediately after establishing a causal link (or reasonable likelihood) and no later than 15 days after becoming aware, with shorter limits for the most serious cases such as widespread infringements or death. Deployers must inform the provider and authorities when they identify a serious incident.

Source-linked Applies from 2 Aug 2026
Legal requirement post market monitoring European Union

Operate a post-market monitoring system

EU AI Act · Article 72

Providers must establish and document a post-market monitoring system proportionate to the nature of the AI technology and its risks, actively and systematically collecting and analysing performance data throughout the system's lifetime, based on a monitoring plan that is part of the technical documentation. The Commission is to adopt a template for the plan.

Source-linked Applies from 2 Aug 2026
Legal requirement privacy data protection Nepal

Collect and use personal information only with consent and for the stated purpose

Nepal Privacy Act 2075 · Chapter on collection and protection of personal information (reviewer to cite sections)

Personal information may be collected only by authorised persons for a lawful purpose with the individual's consent, and must not be used or disclosed for other purposes without consent, subject to statutory exceptions. AI systems trained on or processing personal data of people in Nepal must respect these limits.

Source-linked
Legal requirement privacy data protection Singapore

Identify consent or an applicable PDPA exception before using personal data in AI

PDPC AI advisory guidelines · Advisory guidelines, sections on consent, business improvement and research exceptions

Personal data used to train or operate AI systems requires consent unless an exception applies, such as the business improvement exception for improving products and services or the research exception for developing models, each subject to conditions.

Source-linked
Legal requirement prohibited practice European Union

Do not deploy or provide AI for prohibited practices

EU AI Act · Article 5

Article 5 bans placing on the market, putting into service or using AI for listed practices, including subliminal or manipulative techniques that cause significant harm, exploitation of vulnerabilities, social scoring by public or private actors leading to detrimental treatment, untargeted scraping of facial images to build recognition databases, emotion recognition in workplaces and education institutions except for medical or safety reasons, biometric categorisation to infer protected characteristics, and real-time remote biometric identification in publicly accessible spaces for law enforcement outside narrow exceptions.

Source-linked Applies from 2 Feb 2025
Legal requirement quality management European Union

Operate a quality management system

EU AI Act · Article 17

Providers of high-risk AI systems must put in place a documented quality management system covering regulatory-compliance strategy, design and development procedures, testing and validation, technical specifications and standards, data management, the risk-management system, post-market monitoring, incident reporting, communication with authorities, record keeping, resource management and an accountability framework.

Source-linked Applies from 2 Aug 2026
Legal requirement record keeping European Union

Design high-risk systems to log events automatically

EU AI Act · Article 12; Article 26(6) for deployers

High-risk AI systems must technically allow automatic recording of events (logs) over their lifetime to support traceability, post-market monitoring and operational monitoring. Deployers must keep the logs generated by the system, to the extent under their control, for a period appropriate to the intended purpose and at least six months unless other law provides otherwise.

Source-linked Applies from 2 Aug 2026
Legal requirement risk management European Union

Establish a risk management system for high-risk AI

EU AI Act · Article 9

Providers of high-risk AI systems must establish, implement, document and maintain a continuous, iterative risk-management system across the system's lifecycle: identifying known and reasonably foreseeable risks to health, safety and fundamental rights, estimating and evaluating risks including from reasonably foreseeable misuse, evaluating post-market data, and adopting targeted risk-management measures, with testing before placing on the market.

Source-linked Applies from 2 Aug 2026
Legal requirement safety testing California (United States)

Large frontier developers must publish a frontier AI framework

California SB 53 · Business and Professions Code, Chapter 25.1 (as added by SB 53)

Large frontier developers must publish and maintain a framework describing how they incorporate national and international standards, assess catastrophic risk, apply mitigations, secure model weights, and govern internal processes, and must review it at least annually.

Source-linked Applies from 1 Jan 2026
Legal requirement safety testing European Union

Manage systemic risk for high-impact general-purpose models

EU AI Act · Articles 51, 52 and 55

A general-purpose model is presumed to have systemic risk when the cumulative compute used for training exceeds 10^25 floating-point operations, or when the Commission designates it. Providers must notify the Commission, perform model evaluations including adversarial testing, assess and mitigate systemic risks, track and report serious incidents, and ensure adequate cybersecurity for the model and infrastructure.

Source-linked Applies from 2 Aug 2025
Search