Practical requirements extracted from policy instruments, with the source article, the actors they bind, evidence examples and original framework mappings. Legal requirements are marked; everything else is voluntary guidance.
To the extent a deployer controls the data fed into a high-risk AI system, it must make sure that input data is relevant to, and sufficiently representative for, the system's intended purpose. The duty sits with the deployer even though the provider designed the system, because the deployer chooses what the system is run on.
Verified (a factual check against the official source, not a legal review)Applies from 2 Dec 2027
Legal requirementGovernance and accountability·South Korea
Operators of high-impact AI must prepare and implement a plan to protect users, and must prepare and keep documents describing the measures they take to secure the AI's safety and reliability, so that they can be shown to the Ministry of Science and ICT on request. Further items may be added by Presidential Decree, and the ministry may publish guidelines on how to meet these duties.
Verified (a factual check against the official source, not a legal review)Applies from 22 Jan 2026
Legal requirementGovernance and accountability·European Union
Deployers of high-risk AI must take technical and organisational measures to use systems according to the instructions, assign human oversight, ensure input data is relevant where they control it, monitor operation, inform the provider and authorities of risks or serious incidents, keep logs, inform workers' representatives before deploying at the workplace, inform affected natural persons where decisions are made about them, and cooperate with authorities.
Pending review (a factual check against the official source, not a legal review)Applies from 2 Dec 2027
A consumer who receives an adverse consequential decision may obtain meaningful review by a person with the authority and information to change the outcome. Scope and timing follow the enrolled bill.
Pending review (a factual check against the official source, not a legal review)Applies from 1 Jan 2027
Operators of high-impact AI must ensure that the AI is subject to human management and supervision, so that people remain able to monitor its operation and intervene in or override its outputs where those outputs may affect life, physical safety or fundamental rights.
Verified (a factual check against the official source, not a legal review)Applies from 22 Jan 2026
Before deploying most Annex III high-risk systems, deployers that are bodies governed by public law or private entities providing public services, and deployers using systems for creditworthiness assessment or life and health insurance pricing, must assess the impact on fundamental rights: the processes, period and frequency of use, categories of affected persons, specific risks of harm, human-oversight measures and mitigation, and notify the market-surveillance authority of the results.
Pending review (a factual check against the official source, not a legal review)Applies from 2 Dec 2027
Deployers must complete an impact assessment before deployment, annually, and within 90 days of any intentional and substantial modification, covering purpose, risks of algorithmic discrimination and mitigation, data categories, performance metrics, transparency measures and post-deployment monitoring, and retain assessments for at least three years.
Pending review (a factual check against the official source, not a legal review)
If a deployer discovers that a high-risk AI system it uses has caused algorithmic discrimination, it must send a notice to the Colorado Attorney General within 90 days of the discovery, in the form the Attorney General prescribes, without unreasonable delay.
Pending review (a factual check against the official source, not a legal review)
Within 90 days after a developer discovers, through ongoing testing or a credible report from a deployer, that a high-risk AI system it developed has caused or is reasonably likely to have caused algorithmic discrimination, it must disclose this to the Colorado Attorney General and to all known deployers or other developers of the system, without unreasonable delay.
Pending review (a factual check against the official source, not a legal review)
Deployers must monitor a high-risk AI system's operation against the provider's instructions and feed observations to the provider under Article 72. If they have reason to think the system as used may present a risk to health, safety or fundamental rights, they must inform the provider or distributor and the market surveillance authority without undue delay and suspend use. On a serious incident, they must immediately inform the provider, then the importer or distributor and the authorities. Financial institutions meet this through their internal governance rules.
Verified (a factual check against the official source, not a legal review)Applies from 2 Dec 2027
Legal requirementPrivacy and personal-data protection·European Union
Where a deployer of a high-risk AI system is required to carry out a data protection impact assessment under Article 35 of the GDPR or Article 27 of the Law Enforcement Directive, it must draw on the information the provider supplied under Article 13, such as the intended purpose, performance, limitations and human-oversight measures, when producing that assessment.
Verified (a factual check against the official source, not a legal review)Applies from 2 Dec 2027
A person may not develop or deploy an AI system with the intent to unlawfully discriminate against a protected class in violation of state or federal law. A disparate impact on a protected class is not, by itself, sufficient to show an intent to discriminate, and insurers and financial institutions acting under their own regulatory regimes are treated separately.
Verified (a factual check against the official source, not a legal review)Applies from 1 Jan 2026
A governmental entity may not develop or deploy an AI system for the purpose of uniquely identifying a specific individual using biometric data, or of gathering images or other media from the internet or another public source without the individual's consent, where doing so would infringe a right guaranteed under the United States or Texas constitutions or violate state or federal law. The Act preserves lawful uses that comply with existing biometric-privacy law.
Verified (a factual check against the official source, not a legal review)Applies from 1 Jan 2026
A governmental entity may not develop or deploy an AI system that evaluates or classifies natural persons or groups on the basis of their social behaviour or personal characteristics, with the intent to calculate or assign a social score or similar valuation that leads to detrimental or unfavourable treatment unrelated to the context in which the data was collected, or that is unjustified or disproportionate to the behaviour.
Verified (a factual check against the official source, not a legal review)Applies from 1 Jan 2026
Legal requirementPublic-sector use and procurement·United States
Agency heads were directed to identify actions taken under Executive Order 14110 that are inconsistent with the policy of EO 14179 and to suspend, revise or rescind them, and OMB was directed to revise its federal AI use and procurement memoranda.
Source-linked (a factual check against the official source, not a legal review)
Legal requirementPublic-sector use and procurement·European Union
EU AI Act · Article 26(8); Article 49(3) and 49(4)
Deployers that are public authorities or Union institutions, bodies, offices or agencies must register their use of an Annex III high-risk AI system in the EU database before putting it into service. If they find that the system they intend to use has not been registered in the database by its provider, they must not use it and must inform the provider or distributor.
Verified (a factual check against the official source, not a legal review)Applies from 2 Dec 2027
Deployers must retain records showing how automated decision-making technology was used in consequential decisions, for three years, according to secondary reporting on the enrolled bill.
Pending review (a factual check against the official source, not a legal review)Applies from 1 Jan 2027
For AI whose output serves as a principal basis for decisions with significant effects on rights, safety or access to services, agencies must complete pre-deployment testing, an AI impact assessment, ongoing monitoring, operator training, human oversight and a mechanism for affected people to seek remedy, or stop using the AI.
Source-linked (a factual check against the official source, not a legal review)
Deployers of high-risk AI must implement a risk-management policy and programme governing deployment, specifying principles, processes and personnel used to identify, document and mitigate known or reasonably foreseeable risks of algorithmic discrimination, and reasonable in light of recognised frameworks such as the NIST AI RMF or ISO/IEC 42001.
Pending review (a factual check against the official source, not a legal review)
A deployer of a high-risk AI system must use reasonable care to protect consumers from known or reasonably foreseeable risks of algorithmic discrimination. A deployer that runs the required risk-management programme, completes impact assessments, gives consumer notices and makes the required disclosures benefits from a rebuttable presumption of reasonable care; some deployers with fewer than 50 employees are relieved of parts of the programme and assessment duties when they rely on the developer's impact assessment.
Pending review (a factual check against the official source, not a legal review)
A developer of a high-risk AI system must use reasonable care to protect consumers from any known or reasonably foreseeable risk of algorithmic discrimination arising from the intended and contracted uses of the system. A developer that meets the documentation, public-statement and Attorney General disclosure duties in the rest of section 6-1-1702 benefits from a rebuttable presumption that it used reasonable care.
Pending review (a factual check against the official source, not a legal review)
An AI business operator that provides high-impact AI, or a product or service using it, must establish and operate a plan for managing the risks of that AI. High-impact AI is AI used in areas such as energy, drinking water, health care and medical devices, nuclear safety, biometric analysis for criminal investigation, decisions on recruitment or loans, transport, public services and education, where it may materially affect life, safety or fundamental rights.
Verified (a factual check against the official source, not a legal review)Applies from 22 Jan 2026
Developers must make available to deployers a general statement of intended uses, documentation of known or reasonably foreseeable risks of algorithmic discrimination, training-data summaries, limitations, performance evaluation and mitigation measures, and information needed for deployer impact assessments, and must publish a public statement describing their high-risk systems and how they manage discrimination risks.
Pending review (a factual check against the official source, not a legal review)
Developers of automated decision-making technology must provide deployers with the documentation the statute lists, so that deployers can meet their notice, disclosure and review duties.
Pending review (a factual check against the official source, not a legal review)Applies from 1 Jan 2027
A provider that considers a system listed in Annex III to be outside the high-risk tier because it meets one of the Article 6(3) conditions, such as performing a narrow procedural task or only preparing a human assessment, must write down that assessment before placing the system on the market or putting it into service, register the system in the EU database under Article 49(2), and hand over the assessment on request from a national competent authority.
Verified (a factual check against the official source, not a legal review)Applies from 2 Dec 2027
A single practical requirement pulled out of an instrument and stated on its own: keep a risk management system, log incidents, document training data, provide human oversight, and so on. Each one cites the article or section it comes from so you can check it against the source.
Does a voluntary obligation have legal force?
No, and every obligation is labelled either a legal requirement or voluntary guidance. Voluntary items still matter in practice, because procurement questionnaires and auditors ask about them, but only the binding ones carry legal consequence.
How do I find the obligations that apply to my organisation?
Filter by jurisdiction, category, actor, sector or use case. The applicability check asks a short set of questions and returns the duties that may reach you. It is an educational screen, not a legal determination, and it says so.
Why do some instruments have no obligations listed?
Because nobody has broken them out yet. Most instruments are recorded at summary level first; obligations are added jurisdiction by jurisdiction. The coverage and open-gaps pages publish exactly what is missing rather than hiding it.
