Practical requirements extracted from policy instruments, with the source article, the actors they bind, evidence examples and original framework mappings. Legal requirements are marked; everything else is voluntary guidance.
High-risk AI systems must be designed so their operation is sufficiently transparent for deployers to interpret output and use it appropriately, and must be accompanied by instructions for use covering the provider's identity, the system's characteristics, capabilities and limitations, performance for the intended purpose and known foreseeable misuse, human-oversight measures, expected lifetime and maintenance.
Pending review (a factual check against the official source, not a legal review)Applies from 2 Dec 2027
Legal requirementTransparency and disclosure·European Union
Providers of AI systems, including general-purpose AI systems, that generate synthetic audio, image, video or text must ensure the output is marked in a machine-readable format and detectable as artificially generated or manipulated. The technical solution must be effective, interoperable, robust and reliable as far as the state of the art allows, taking account of content type and cost. Systems that only perform assistive editing or do not substantially alter the input, and law-authorised criminal-detection uses, are outside the duty.
Verified (a factual check against the official source, not a legal review)Applies from 2 Aug 2026
Legal requirementTransparency and disclosure·United States
The operator must publicly disclose the details of its section 5 protocols on its website or websites and within any mobile or web application through which the AI companion is offered. The disclosure covers the safeguards used to detect and respond to expressions of suicidal ideation or self-harm, and the number of crisis referral notifications issued to users in the preceding calendar year. The act does not set a date by which the disclosure must be updated.
Pending review (a factual check against the official source, not a legal review)Applies from 1 Jan 2027
An operator must give the user a clear and conspicuous notification, spoken or written, that the user is not communicating with a human. It is given at the beginning of any AI companion interaction, which the text says need not happen more than once a day, and at least every three hours during a continuing interaction. The Attorney General may seek an injunction and civil penalties of up to 15,000 dollars per day for a violation (section 1703).
Pending review (a factual check against the official source, not a legal review)
An operator (anyone who makes an AI companion chatbot available to users in Washington, or controls access to it) must give a clear and conspicuous disclosure that the chatbot is artificially generated and not human. The notice is given at the beginning of the interaction and again at least every three hours while the interaction continues. The operator must also take reasonable measures to stop the chatbot from claiming to be human, including when the user asks, and from producing any other output that contradicts the disclosure.
Pending review (a factual check against the official source, not a legal review)Applies from 1 Jan 2027
If the operator knows the user is a minor (under 18), or the AI companion chatbot is directed to minors, the operator must issue a clear and conspicuous notification that the chatbot is artificially generated and not human. It is given at the beginning of the interaction and at least every hour during continuous interaction, rather than the three-hour interval that applies to other users. The operator must take reasonable measures to stop the chatbot from claiming to be human, including when asked, and from producing output that conflicts with the notification.
Pending review (a factual check against the official source, not a legal review)Applies from 1 Jan 2027
Legal requirementVendor and supply-chain governance·European Union
A provider of a high-risk AI system and any third party that supplies AI systems, tools, services, components or processes used in or integrated into it must set out, in a written agreement, the information, capabilities, technical access and other assistance needed for the provider to meet its obligations, based on the generally acknowledged state of the art. Suppliers of free and open-source tools and components other than general-purpose AI models are outside this duty. The AI Office may publish voluntary model terms.
Verified (a factual check against the official source, not a legal review)Applies from 2 Dec 2027
Legal requirementVendor and supply-chain governance·European Union
Importers must verify that the provider completed conformity assessment, drew up technical documentation, affixed CE marking and appointed an authorised representative where required, and must indicate their name and contact details on the system. Distributors must verify CE marking, the declaration of conformity and instructions, and refrain from making non-compliant systems available.
Pending review (a factual check against the official source, not a legal review)Applies from 2 Dec 2027
Voluntary guidanceData governance and quality·Singapore
Covers data lineage and quality, minimising bias in datasets, model explainability, repeatability, robustness, regular tuning and active monitoring after deployment.
Pending review (a factual check against the official source, not a legal review)
Voluntary guidanceGovernance and accountability·India
The guidelines encourage organisations to embed principles such as fairness, accountability, safety and transparency, to classify and mitigate risks proportionately, and to participate in voluntary frameworks and incident reporting.
Pending review (a factual check against the official source, not a legal review)
Voluntary guidanceGovernance and accountability·United States
Govern covers policies and procedures for AI risk, roles and responsibilities, workforce diversity and training, organisational culture, stakeholder engagement, and third-party risk management. It is the cross-cutting function that supports the other three.
Pending review (a factual check against the official source, not a legal review)
Voluntary guidanceGovernance and accountability·United Kingdom
Guardrail 1 asks organisations to set up accountability processes including governance, internal capability and a strategy for regulatory compliance; guardrail 2 asks for a risk-management process to identify and mitigate risks across the AI lifecycle.
Pending review (a factual check against the official source, not a legal review)
Voluntary guidanceGovernance and accountability·Singapore
Organisations should adapt existing governance to AI: clear roles and responsibilities, board and senior management oversight, risk-management and internal controls, and staff training.
Pending review (a factual check against the official source, not a legal review)
Voluntary guidanceGovernance and accountability·Nepal
Nepal National AI Policy · Policy objectives and strategies (to be confirmed against the official text)
The policy commits the government to ethical, transparent and inclusive AI, data governance and institutional oversight. The specific strategies and any obligations on private actors must be confirmed from the official document; this record intentionally does not state details that could not be verified.
Pending review (a factual check against the official source, not a legal review)
UAE AI Strategy 2031 · Strategy objectives on governance and ethics (reviewer to cite the section)
The strategy commits the government to ensure effective governance and regulation of AI and to promote ethical AI, which led to the AI Ethics Principles and Guidelines and the 2024 UAE AI Charter.
Pending review (a factual check against the official source, not a legal review)
Voluntary guidanceGovernance and accountability·United Kingdom
AI systems should not undermine legal rights, discriminate unfairly or create unfair market outcomes. The Equality Act 2010 and UK GDPR fairness principle make key parts of this binding.
Pending review (a factual check against the official source, not a legal review)
Using a risk-impact matrix (probability and severity of harm), organisations choose human-in-the-loop, human-over-the-loop or human-out-of-the-loop designs and document the rationale.
Pending review (a factual check against the official source, not a legal review)
Test AI models and systems before deployment and monitor them in operation; enable meaningful human control and intervention; and inform end users about AI-enabled decisions, interactions with AI and AI-generated content.
Pending review (a factual check against the official source, not a legal review)
Map establishes the context: intended purposes, users, deployment settings, legal requirements, risk categorisation, benefits and costs, and impacts on individuals, groups, communities and society.
Pending review (a factual check against the official source, not a legal review)
An AI business operator that provides high-impact AI, or a product or service using it, is to make efforts to assess in advance the impact the AI may have on people's fundamental rights. The provision is drafted as an endeavour duty rather than a hard requirement, but public bodies procuring high-impact AI are directed to give preference to products that have undergone such an assessment, and the ministry may set assessment methods.
Verified (a factual check against the official source, not a legal review)Applies from 22 Jan 2026
Regulators are asked to ensure AI systems function in a robust, secure and safe way, with risks continually identified, assessed and managed. In practice this is enforced through existing safety, security and data-protection law rather than a new duty.
Pending review (a factual check against the official source, not a legal review)
Manage allocates resources to mapped and measured risks, plans responses including decommissioning, manages third-party risks, and documents post-deployment monitoring, incident response and communication.
Pending review (a factual check against the official source, not a legal review)
A single practical requirement pulled out of an instrument and stated on its own: keep a risk management system, log incidents, document training data, provide human oversight, and so on. Each one cites the article or section it comes from so you can check it against the source.
Does a voluntary obligation have legal force?
No, and every obligation is labelled either a legal requirement or voluntary guidance. Voluntary items still matter in practice, because procurement questionnaires and auditors ask about them, but only the binding ones carry legal consequence.
How do I find the obligations that apply to my organisation?
Filter by jurisdiction, category, actor, sector or use case. The applicability check asks a short set of questions and returns the duties that may reach you. It is an educational screen, not a legal determination, and it says so.
Why do some instruments have no obligations listed?
Because nobody has broken them out yet. Most instruments are recorded at summary level first; obligations are added jurisdiction by jurisdiction. The coverage and open-gaps pages publish exactly what is missing rather than hiding it.
