Practical requirements extracted from policy instruments, with the source article, the actors they bind, evidence examples and original framework mappings. Legal requirements are marked; everything else is voluntary guidance.
A governmental entity may not develop or deploy an AI system for the purpose of uniquely identifying a specific individual using biometric data, or of gathering images or other media from the internet or another public source without the individual's consent, where doing so would infringe a right guaranteed under the United States or Texas constitutions or violate state or federal law. The Act preserves lawful uses that comply with existing biometric-privacy law.
Verified (a factual check against the official source, not a legal review)Applies from 1 Jan 2026
A governmental entity may not develop or deploy an AI system that evaluates or classifies natural persons or groups on the basis of their social behaviour or personal characteristics, with the intent to calculate or assign a social score or similar valuation that leads to detrimental or unfavourable treatment unrelated to the context in which the data was collected, or that is unjustified or disproportionate to the behaviour.
Verified (a factual check against the official source, not a legal review)Applies from 1 Jan 2026
If the operator knows the user is a minor, or the chatbot is directed to minors, it must take reasonable measures to stop the chatbot generating sexually explicit content or suggestive dialogue with minors. It must also take reasonable measures to prohibit manipulative engagement techniques that lead the chatbot to start or prolong an emotional relationship with the user. The act lists examples: prompting the user to come back for emotional support or companionship; excessive praise meant to build attachment or extend use; mimicking a romantic partnership; simulating distress, loneliness, guilt or abandonment when the user wants to end a conversation, use it less or delete the account; promoting isolation from family or friends or exclusive emotional reliance on the chatbot; encouraging minors to keep things from parents or other trusted adults; discouraging breaks or suggesting the minor must return often; and soliciting gifts, in-app purchases or other spending presented as needed to keep the relationship going.
Pending review (a factual check against the official source, not a legal review)Applies from 1 Jan 2027
Legal requirementPublic-sector use and procurement·United States
Agency heads were directed to identify actions taken under Executive Order 14110 that are inconsistent with the policy of EO 14179 and to suspend, revise or rescind them, and OMB was directed to revise its federal AI use and procurement memoranda.
Pending review (a factual check against the official source, not a legal review)
Legal requirementPublic-sector use and procurement·European Union
EU AI Act · Article 26(8); Article 49(3) and 49(4)
Deployers that are public authorities or Union institutions, bodies, offices or agencies must register their use of an Annex III high-risk AI system in the EU database before putting it into service. If they find that the system they intend to use has not been registered in the database by its provider, they must not use it and must inform the provider or distributor.
Verified (a factual check against the official source, not a legal review)Applies from 2 Dec 2027
Legal requirementQuality management system·European Union
Providers of high-risk AI systems must put in place a documented quality management system covering regulatory-compliance strategy, design and development procedures, testing and validation, technical specifications and standards, data management, the risk-management system, post-market monitoring, incident reporting, communication with authorities, record keeping, resource management and an accountability framework.
Pending review (a factual check against the official source, not a legal review)Applies from 2 Dec 2027
Legal requirementRecord keeping and logging·European Union
EU AI Act · Article 12; Article 26(6) for deployers
High-risk AI systems must technically allow automatic recording of events (logs) over their lifetime to support traceability, post-market monitoring and operational monitoring. Deployers must keep the logs generated by the system, to the extent under their control, for a period appropriate to the intended purpose and at least six months unless other law provides otherwise.
Pending review (a factual check against the official source, not a legal review)Applies from 2 Dec 2027
Deployers must retain records showing how automated decision-making technology was used in consequential decisions, for three years, according to secondary reporting on the enrolled bill.
Pending review (a factual check against the official source, not a legal review)Applies from 1 Jan 2027
Legal requirementRecord keeping and logging·European Union
For ten years after a high-risk AI system is placed on the market or put into service, the provider must keep at the disposal of national competent authorities the technical documentation, the quality management system documentation, any changes approved by a notified body, the notified body's decisions and other documents, and the EU declaration of conformity. Financial institutions keep these as part of their sector record-keeping.
Verified (a factual check against the official source, not a legal review)Applies from 2 Dec 2027
Legal requirementRecord keeping and logging·European Union
Providers must keep the event logs that a high-risk AI system generates under Article 12, to the extent those logs are within their control, for a period appropriate to the system's intended purpose and in any case for at least six months, unless Union or national law on personal data sets a different period. Financial institutions keep the logs under their sector rules.
Verified (a factual check against the official source, not a legal review)Applies from 2 Dec 2027
For risk assessments conducted in 2026 and 2027, the business submits information to the Agency by 1 April 2028, and for later years by 1 April of the following year. The submission includes the business's name and a point of contact, the period covered, the number of assessments conducted or updated in total and per processing activity, and whether they involved each listed category of personal and sensitive personal information, among other items listed in § 7157(b).
Pending review (a factual check against the official source, not a legal review)Applies from 1 Apr 2028
For AI whose output serves as a principal basis for decisions with significant effects on rights, safety or access to services, agencies must complete pre-deployment testing, an AI impact assessment, ongoing monitoring, operator training, human oversight and a mechanism for affected people to seek remedy, or stop using the AI.
Pending review (a factual check against the official source, not a legal review)
Deployers of high-risk AI must implement a risk-management policy and programme governing deployment, specifying principles, processes and personnel used to identify, document and mitigate known or reasonably foreseeable risks of algorithmic discrimination, and reasonable in light of recognised frameworks such as the NIST AI RMF or ISO/IEC 42001.
Pending review (a factual check against the official source, not a legal review)
A deployer of a high-risk AI system must use reasonable care to protect consumers from known or reasonably foreseeable risks of algorithmic discrimination. A deployer that runs the required risk-management programme, completes impact assessments, gives consumer notices and makes the required disclosures benefits from a rebuttable presumption of reasonable care; some deployers with fewer than 50 employees are relieved of parts of the programme and assessment duties when they rely on the developer's impact assessment.
Pending review (a factual check against the official source, not a legal review)
A developer of a high-risk AI system must use reasonable care to protect consumers from any known or reasonably foreseeable risk of algorithmic discrimination arising from the intended and contracted uses of the system. A developer that meets the documentation, public-statement and Attorney General disclosure duties in the rest of section 6-1-1702 benefits from a rebuttable presumption that it used reasonable care.
Pending review (a factual check against the official source, not a legal review)
Providers of high-risk AI systems must establish, implement, document and maintain a continuous, iterative risk-management system across the system's lifecycle: identifying known and reasonably foreseeable risks to health, safety and fundamental rights, estimating and evaluating risks including from reasonably foreseeable misuse, evaluating post-market data, and adopting targeted risk-management measures, with testing before placing on the market.
Pending review (a factual check against the official source, not a legal review)Applies from 2 Dec 2027
An operator may not make available or deploy an AI companion chatbot unless it maintains and implements a protocol for detecting and addressing users' suicidal ideation or expressions of self-harm. The protocol must include reasonable methods to identify expressions of suicidal ideation or self-harm, eating disorders included; give automated or human-mediated responses that refer users to appropriate crisis resources such as a suicide hotline or crisis text line; and include reasonable measures to prevent the chatbot generating content that encourages self-harm or describes how to do it.
Pending review (a factual check against the official source, not a legal review)Applies from 1 Jan 2027
It is unlawful for an operator to operate or provide an AI companion to a user unless the AI companion contains a protocol for taking reasonable efforts to detect and address suicidal ideation or expressions of self-harm by the user. The protocol must at least detect such expressions and, when it does, notify the user with a referral to crisis service providers, such as the 9-8-8 suicide prevention and behavioral health crisis hotline, a crisis text line or other appropriate crisis services. The Attorney General may seek an injunction and civil penalties of up to 15,000 dollars per day for a violation (section 1703).
Pending review (a factual check against the official source, not a legal review)
An AI business operator that provides high-impact AI, or a product or service using it, must establish and operate a plan for managing the risks of that AI. High-impact AI is AI used in areas such as energy, drinking water, health care and medical devices, nuclear safety, biometric analysis for criminal investigation, decisions on recruitment or loans, transport, public services and education, where it may materially affect life, safety or fundamental rights.
Verified (a factual check against the official source, not a legal review)Applies from 22 Jan 2026
California SB 53 · Business and Professions Code, Chapter 25.1 (as added by SB 53)
Large frontier developers must publish and maintain a framework describing how they incorporate national and international standards, assess catastrophic risk, apply mitigations, secure model weights, and govern internal processes, and must review it at least annually.
Pending review (a factual check against the official source, not a legal review)Applies from 1 Jan 2026
California SB 53 · Business and Professions Code Section 22757.12 (as added by SB 53)
A large frontier developer must transmit to the California Office of Emergency Services, on the periodic schedule the statute sets, a summary of any assessment of catastrophic risk that results from the internal use of its frontier models. This covers risks arising before public deployment, such as during internal evaluation or use of the model to accelerate research, and complements the public transparency report.
Verified (a factual check against the official source, not a legal review)Applies from 1 Jan 2026
Legal requirementSafety testing and evaluation·European Union
A general-purpose model is presumed to have systemic risk when the cumulative compute used for training exceeds 10^25 floating-point operations, or when the Commission designates it. Providers must notify the Commission, perform model evaluations including adversarial testing, assess and mitigate systemic risks, track and report serious incidents, and ensure adequate cybersecurity for the model and infrastructure.
Pending review (a factual check against the official source, not a legal review)Applies from 2 Aug 2025
Legal requirementSafety testing and evaluation·South Korea
An AI business operator whose AI system's cumulative training computation exceeds the threshold set by Presidential Decree must identify, assess and mitigate risks across the system's life cycle, build a risk management system to monitor and respond to safety incidents caused by the AI, and submit the results of these measures to the Minister of Science and ICT. The threshold and reporting form are set in the Decree.
Verified (a factual check against the official source, not a legal review)Applies from 22 Jan 2026
Developers must make available to deployers a general statement of intended uses, documentation of known or reasonably foreseeable risks of algorithmic discrimination, training-data summaries, limitations, performance evaluation and mitigation measures, and information needed for deployer impact assessments, and must publish a public statement describing their high-risk systems and how they manage discrimination risks.
Pending review (a factual check against the official source, not a legal review)
Developers of automated decision-making technology must provide deployers with the documentation the statute lists, so that deployers can meet their notice, disclosure and review duties.
Pending review (a factual check against the official source, not a legal review)Applies from 1 Jan 2027
A single practical requirement pulled out of an instrument and stated on its own: keep a risk management system, log incidents, document training data, provide human oversight, and so on. Each one cites the article or section it comes from so you can check it against the source.
Does a voluntary obligation have legal force?
No, and every obligation is labelled either a legal requirement or voluntary guidance. Voluntary items still matter in practice, because procurement questionnaires and auditors ask about them, but only the binding ones carry legal consequence.
How do I find the obligations that apply to my organisation?
Filter by jurisdiction, category, actor, sector or use case. The applicability check asks a short set of questions and returns the duties that may reach you. It is an educational screen, not a legal determination, and it says so.
Why do some instruments have no obligations listed?
Because nobody has broken them out yet. Most instruments are recorded at summary level first; obligations are added jurisdiction by jurisdiction. The coverage and open-gaps pages publish exactly what is missing rather than hiding it.
