Practical requirements extracted from policy instruments, with the source article, the actors they bind, evidence examples and original framework mappings. Legal requirements are marked; everything else is voluntary guidance.
Providers of general-purpose AI models with systemic risk must ensure an adequate level of cybersecurity protection for the model and for the physical infrastructure it runs on, which in practice covers protection of model weights, training and inference environments, and access controls against theft, tampering and unauthorised release. Codes of practice and harmonised standards may be used to show compliance.
Verified (a factual check against the official source, not a legal review)Applies from 2 Aug 2025
Legal requirementAI literacy and training·European Union
Providers and deployers must take measures to ensure, to their best extent, a sufficient level of AI literacy among their staff and other persons dealing with the operation and use of AI systems on their behalf, taking into account technical knowledge, experience, training, the context of use and the persons affected.
Pending review (a factual check against the official source, not a legal review)Applies from 2 Feb 2025
Legal requirementCopyright and training-data transparency·European Union
Providers of general-purpose AI models must keep technical documentation (Annex XI), provide information to downstream providers integrating the model (Annex XII), put in place a policy to comply with EU copyright law including the text-and-data-mining opt-out, and publish a sufficiently detailed public summary of training content using the Commission's template. Free and open-source models are exempt from the first two duties unless they present systemic risk. Adherence to the General-Purpose AI Code of Practice can demonstrate compliance.
Pending review (a factual check against the official source, not a legal review)Applies from 2 Aug 2025
Legal requirementGovernance and accountability·South Korea
An AI business operator without an address or place of business in Korea, whose user numbers or revenue meet the thresholds set by Presidential Decree, must designate in writing a domestic representative with an address in Korea. The representative handles the operator's duties under the Act, including submitting the Article 32 safety results, supporting high-impact AI confirmation and cooperating with fact-finding investigations, and the operator is treated as responsible for the representative's acts.
Verified (a factual check against the official source, not a legal review)Applies from 22 Jan 2026
A frontier developer must not adopt rules or take action that prevent or retaliate against a covered employee for disclosing to the Attorney General, a federal authority, a manager or another employee with authority that the developer's activities pose a specific and substantial danger to public health or safety from catastrophic risk, or that it has violated the Act. Covered employees must be given clear notice of these rights, and large frontier developers must run an anonymous internal reporting process with regular updates to the reporter and to officers and directors.
Verified (a factual check against the official source, not a legal review)Applies from 1 Jan 2026
Legal requirementGovernance and accountability·European Union
Before placing a general-purpose AI model on the Union market, a provider established in a third country must appoint, by written mandate, an authorised representative established in the Union. The representative checks that the Annex XI documentation exists and the Article 53 duties are met, keeps a copy of the documentation and the provider's contact details for ten years after market placement, provides information to the AI Office on request, cooperates with authorities, and must end the mandate if the provider breaches the Regulation. Open-source models without systemic risk are exempt.
Verified (a factual check against the official source, not a legal review)Applies from 2 Aug 2025
Legal requirementGovernance and accountability·European Union
A provider whose general-purpose AI model meets the Article 51(1)(a) high-impact capability condition, which is presumed once cumulative training compute exceeds 10^25 floating-point operations, must notify the Commission without delay and in any event within two weeks of the condition being met or of learning that it will be met. The notification may include arguments that the model nonetheless does not present systemic risk; the Commission decides and keeps a public list of designated models.
Verified (a factual check against the official source, not a legal review)Applies from 2 Aug 2025
UAE PDPL · Article on data protection impact assessment (reviewer to cite article number)
Before processing that uses modern technologies and is likely to pose a high risk to privacy, controllers must assess the impact on personal data protection, covering the processing, its purposes, risks and safeguards.
Pending review (a factual check against the official source, not a legal review)
Entities notified as Significant Data Fiduciaries, based on factors such as volume and sensitivity of data and risk to individuals, must appoint a Data Protection Officer based in India, an independent data auditor, and periodically undertake data protection impact assessments and audits.
Source-linked (a factual check against the official source, not a legal review)
Legal requirementIncident reporting and handling·India
India DPDP Act · Section 8(5) and 8(6); DPDP Rules on breach intimation
Data Fiduciaries must protect personal data with reasonable security safeguards and, on a personal data breach, inform the Data Protection Board and each affected individual in the form and manner prescribed by the Rules.
Source-linked (a factual check against the official source, not a legal review)
Legal requirementIncident reporting and handling·European Union
Providers of general-purpose AI models with systemic risk must keep track of, document and report without undue delay to the AI Office and, where relevant, to national competent authorities the relevant information about serious incidents and the possible corrective measures to address them. The General-Purpose AI Code of Practice sets out timelines and content that providers may follow to demonstrate compliance.
Verified (a factual check against the official source, not a legal review)Applies from 2 Aug 2025
California SB 53 · Business and Professions Code, Chapter 25.1 (as added by SB 53)
Frontier developers must report critical safety incidents to the California Office of Emergency Services within the statutory time limit after discovery, and the Office is to establish a reporting mechanism.
Source-linked (a factual check against the official source, not a legal review)Applies from 1 Jan 2026
Legal requirementPrivacy and personal-data protection·India
Personal data may be processed only for a lawful purpose with the individual's free, specific, informed and unambiguous consent, or for certain legitimate uses listed in the Act. A notice must describe the data, purpose, and how to exercise rights and complain.
Source-linked (a factual check against the official source, not a legal review)
A person may not develop or deploy an AI system in a manner that intentionally aims to incite or encourage a person to commit physical self-harm, including suicide, to harm another person, or to engage in criminal activity. The prohibition turns on the developer's or deployer's intent rather than on the system's effects, which is the pattern followed throughout the Act's prohibited-use provisions.
Verified (a factual check against the official source, not a legal review)Applies from 1 Jan 2026
A person may not develop or distribute an AI system with the sole intent of producing, assisting or aiding in producing, or distributing child pornography or unlawful deep-fake videos or images, including sexually explicit deepfakes of a person without consent, or of engaging in sexually explicit text-based conversations while impersonating or imitating a child, in violation of the Texas Penal Code.
Verified (a factual check against the official source, not a legal review)Applies from 1 Jan 2026
California SB 53 · Business and Professions Code, Chapter 25.1 (as added by SB 53)
Large frontier developers must publish and maintain a framework describing how they incorporate national and international standards, assess catastrophic risk, apply mitigations, secure model weights, and govern internal processes, and must review it at least annually.
Source-linked (a factual check against the official source, not a legal review)Applies from 1 Jan 2026
California SB 53 · Business and Professions Code Section 22757.12 (as added by SB 53)
A large frontier developer must transmit to the California Office of Emergency Services, on the periodic schedule the statute sets, a summary of any assessment of catastrophic risk that results from the internal use of its frontier models. This covers risks arising before public deployment, such as during internal evaluation or use of the model to accelerate research, and complements the public transparency report.
Verified (a factual check against the official source, not a legal review)Applies from 1 Jan 2026
Legal requirementSafety testing and evaluation·European Union
A general-purpose model is presumed to have systemic risk when the cumulative compute used for training exceeds 10^25 floating-point operations, or when the Commission designates it. Providers must notify the Commission, perform model evaluations including adversarial testing, assess and mitigate systemic risks, track and report serious incidents, and ensure adequate cybersecurity for the model and infrastructure.
Pending review (a factual check against the official source, not a legal review)Applies from 2 Aug 2025
Legal requirementSafety testing and evaluation·South Korea
An AI business operator whose AI system's cumulative training computation exceeds the threshold set by Presidential Decree must identify, assess and mitigate risks across the system's life cycle, build a risk management system to monitor and respond to safety incidents caused by the AI, and submit the results of these measures to the Minister of Science and ICT. The threshold and reporting form are set in the Decree.
Verified (a factual check against the official source, not a legal review)Applies from 22 Jan 2026
EU AI Act · Article 53(1)(a) and 53(1)(b); Annexes XI and XII
Providers of general-purpose AI models must draw up and keep up to date technical documentation covering the training and testing process and evaluation results, as set in Annex XI, and supply it to the AI Office or national authorities on request. They must also keep current the Annex XII information for providers that integrate the model into their own AI systems, so those providers understand its capabilities and limitations and can meet their own duties. Free and open-source models without systemic risk are exempt from both duties.
Verified (a factual check against the official source, not a legal review)Applies from 2 Aug 2025
Legal requirementTransparency and disclosure·South Korea
An AI business operator that provides generative AI or a product or service using it must indicate that the output was generated by generative AI. Where the operator provides content such as virtual sound, images or video that is hard to distinguish from reality, it must clearly notify users that the content is AI-generated, in a manner that does not impair a work's artistic or creative expression where that applies. Detailed methods are left to Presidential Decree and ministry guidance.
Verified (a factual check against the official source, not a legal review)Applies from 22 Jan 2026
Legal requirementTransparency and disclosure·South Korea
An AI business operator that provides a product or service operated by high-impact AI or by generative AI must notify users in advance that the product or service is based on such AI. The notice is owed before use and is the entry point of the Act's transparency chapter; failure to give it can attract an administrative fine after a corrective order.
Verified (a factual check against the official source, not a legal review)Applies from 22 Jan 2026
Any developer or deployer that makes an AI system available to consumers that is intended to interact with them must disclose to each consumer that they are interacting with an AI system, unless that would be obvious to a reasonable person. This duty is not limited to high-risk systems and covers chatbots and voice agents offered to Colorado consumers.
Pending review (a factual check against the official source, not a legal review)
Legal requirementTransparency and disclosure·European Union
A deployer that generates or manipulates image, audio or video content that is a deep fake must disclose that the content has been artificially generated or manipulated, with lighter treatment for evidently artistic, creative, satirical or fictional works so that the disclosure does not spoil the work. A deployer that publishes AI-generated text to inform the public on matters of public interest must disclose this unless the text passed human review or editorial control and someone holds editorial responsibility. The disclosure must reach people clearly at the latest at first exposure.
Verified (a factual check against the official source, not a legal review)Applies from 2 Aug 2026
Legal requirementTransparency and disclosure·European Union
Providers must ensure AI systems intended to interact with people inform them they are dealing with AI unless obvious; providers of systems generating synthetic audio, image, video or text must mark output in a machine-readable, detectable format; deployers of emotion-recognition or biometric-categorisation systems must inform exposed persons; deployers must disclose deepfakes and AI-generated text published to inform the public on matters of public interest, subject to exceptions.
Pending review (a factual check against the official source, not a legal review)Applies from 2 Aug 2026
A single practical requirement pulled out of an instrument and stated on its own: keep a risk management system, log incidents, document training data, provide human oversight, and so on. Each one cites the article or section it comes from so you can check it against the source.
Does a voluntary obligation have legal force?
No, and every obligation is labelled either a legal requirement or voluntary guidance. Voluntary items still matter in practice, because procurement questionnaires and auditors ask about them, but only the binding ones carry legal consequence.
How do I find the obligations that apply to my organisation?
Filter by jurisdiction, category, actor, sector or use case. The applicability check asks a short set of questions and returns the duties that may reach you. It is an educational screen, not a legal determination, and it says so.
Why do some instruments have no obligations listed?
Because nobody has broken them out yet. Most instruments are recorded at summary level first; obligations are added jurisdiction by jurisdiction. The coverage and open-gaps pages publish exactly what is missing rather than hiding it.
