Practical requirements extracted from policy instruments, with the source article, the actors they bind, evidence examples and original framework mappings. Legal requirements are marked; everything else is voluntary guidance.
Operators of high-impact AI must prepare and implement a plan to protect users, and must prepare and keep documents describing the measures they take to secure the AI's safety and reliability, so that they can be shown to the Ministry of Science and ICT on request. Further items may be added by Presidential Decree, and the ministry may publish guidelines on how to meet these duties.
Verified (a factual check against the official source, not a legal review)Applies from 22 Jan 2026
A consumer who receives an adverse consequential decision may obtain meaningful review by a person with the authority and information to change the outcome. Scope and timing follow the enrolled bill.
Pending review (a factual check against the official source, not a legal review)Applies from 1 Jan 2027
Operators of high-impact AI must ensure that the AI is subject to human management and supervision, so that people remain able to monitor its operation and intervene in or override its outputs where those outputs may affect life, physical safety or fundamental rights.
Verified (a factual check against the official source, not a legal review)Applies from 22 Jan 2026
Deployers must complete an impact assessment before deployment, annually, and within 90 days of any intentional and substantial modification, covering purpose, risks of algorithmic discrimination and mitigation, data categories, performance metrics, transparency measures and post-deployment monitoring, and retain assessments for at least three years.
Pending review (a factual check against the official source, not a legal review)
If a deployer discovers that a high-risk AI system it uses has caused algorithmic discrimination, it must send a notice to the Colorado Attorney General within 90 days of the discovery, in the form the Attorney General prescribes, without unreasonable delay.
Pending review (a factual check against the official source, not a legal review)
Within 90 days after a developer discovers, through ongoing testing or a credible report from a deployer, that a high-risk AI system it developed has caused or is reasonably likely to have caused algorithmic discrimination, it must disclose this to the Colorado Attorney General and to all known deployers or other developers of the system, without unreasonable delay.
Pending review (a factual check against the official source, not a legal review)
Deployers must retain records showing how automated decision-making technology was used in consequential decisions, for three years, according to secondary reporting on the enrolled bill.
Pending review (a factual check against the official source, not a legal review)Applies from 1 Jan 2027
Deployers of high-risk AI must implement a risk-management policy and programme governing deployment, specifying principles, processes and personnel used to identify, document and mitigate known or reasonably foreseeable risks of algorithmic discrimination, and reasonable in light of recognised frameworks such as the NIST AI RMF or ISO/IEC 42001.
Pending review (a factual check against the official source, not a legal review)
A deployer of a high-risk AI system must use reasonable care to protect consumers from known or reasonably foreseeable risks of algorithmic discrimination. A deployer that runs the required risk-management programme, completes impact assessments, gives consumer notices and makes the required disclosures benefits from a rebuttable presumption of reasonable care; some deployers with fewer than 50 employees are relieved of parts of the programme and assessment duties when they rely on the developer's impact assessment.
Pending review (a factual check against the official source, not a legal review)
A developer of a high-risk AI system must use reasonable care to protect consumers from any known or reasonably foreseeable risk of algorithmic discrimination arising from the intended and contracted uses of the system. A developer that meets the documentation, public-statement and Attorney General disclosure duties in the rest of section 6-1-1702 benefits from a rebuttable presumption that it used reasonable care.
Pending review (a factual check against the official source, not a legal review)
An AI business operator that provides high-impact AI, or a product or service using it, must establish and operate a plan for managing the risks of that AI. High-impact AI is AI used in areas such as energy, drinking water, health care and medical devices, nuclear safety, biometric analysis for criminal investigation, decisions on recruitment or loans, transport, public services and education, where it may materially affect life, safety or fundamental rights.
Verified (a factual check against the official source, not a legal review)Applies from 22 Jan 2026
Developers must make available to deployers a general statement of intended uses, documentation of known or reasonably foreseeable risks of algorithmic discrimination, training-data summaries, limitations, performance evaluation and mitigation measures, and information needed for deployer impact assessments, and must publish a public statement describing their high-risk systems and how they manage discrimination risks.
Pending review (a factual check against the official source, not a legal review)
Developers of automated decision-making technology must provide deployers with the documentation the statute lists, so that deployers can meet their notice, disclosure and review duties.
Pending review (a factual check against the official source, not a legal review)Applies from 1 Jan 2027
Any developer or deployer that makes an AI system available to consumers that is intended to interact with them must disclose to each consumer that they are interacting with an AI system, unless that would be obvious to a reasonable person. This duty is not limited to high-risk systems and covers chatbots and voice agents offered to Colorado consumers.
Pending review (a factual check against the official source, not a legal review)
A deployer must make available on its website, or in another public way, a clear and readily available statement summarising the types of high-risk AI systems it currently deploys, how it manages known or reasonably foreseeable risks of algorithmic discrimination from those systems, and the nature, source and extent of the information it collects and uses. The statement must be updated periodically.
Pending review (a factual check against the official source, not a legal review)
Legal requirementTransparency and disclosure·European Union
A deployer of an emotion recognition system or a biometric categorisation system must inform the natural persons exposed to it that the system is operating and must process their personal data in line with the GDPR, the Law Enforcement Directive and the EU institutions data protection regulation. Systems permitted by law to detect, prevent or investigate criminal offences are excepted, subject to safeguards. Use in workplaces and schools is separately banned by Article 5 except for medical or safety reasons.
Verified (a factual check against the official source, not a legal review)Applies from 2 Aug 2026
After an adverse consequential decision, the deployer must tell the consumer that automated decision-making technology was used, give the principal reasons for the decision, and explain how to obtain human review.
Pending review (a factual check against the official source, not a legal review)Applies from 1 Jan 2027
A person who provides health-care services or treatment and uses an AI system in relation to those services must disclose that use to the patient, or to the patient's personal representative or guardian, no later than the date the service or treatment is first provided, with an exception for emergencies where the disclosure is made as soon as reasonably possible. The disclosure must be clear, conspicuous and in plain language.
Verified (a factual check against the official source, not a legal review)Applies from 1 Jan 2026
Before a high-risk system makes a consequential decision, deployers must notify the consumer that AI is used, describe its purpose and nature, and provide contact and opt-out information where applicable. After an adverse decision they must state the principal reasons, the data used and its sources, and offer an opportunity to correct data and to appeal for human review where feasible.
Pending review (a factual check against the official source, not a legal review)
Deployers must tell a consumer, before the decision is made, that automated decision-making technology will be used to make or materially influence a consequential decision about them. The exact content and timing of the notice follow the enrolled bill, which a reviewer must read.
Pending review (a factual check against the official source, not a legal review)Applies from 1 Jan 2027
Legal requirementTransparency and disclosure·South Korea
Operators of high-impact AI must put in place measures to explain the AI's final results, the main criteria used to reach them, and an overview of the training data, to the extent that this is technically feasible. The duty targets explainability of the system's decisions to users and affected people rather than full disclosure of the model.
Verified (a factual check against the official source, not a legal review)Applies from 22 Jan 2026
An AI business operator that provides high-impact AI, or a product or service using it, is to make efforts to assess in advance the impact the AI may have on people's fundamental rights. The provision is drafted as an endeavour duty rather than a hard requirement, but public bodies procuring high-impact AI are directed to give preference to products that have undergone such an assessment, and the ministry may set assessment methods.
Verified (a factual check against the official source, not a legal review)Applies from 22 Jan 2026
A single practical requirement pulled out of an instrument and stated on its own: keep a risk management system, log incidents, document training data, provide human oversight, and so on. Each one cites the article or section it comes from so you can check it against the source.
Does a voluntary obligation have legal force?
No, and every obligation is labelled either a legal requirement or voluntary guidance. Voluntary items still matter in practice, because procurement questionnaires and auditors ask about them, but only the binding ones carry legal consequence.
How do I find the obligations that apply to my organisation?
Filter by jurisdiction, category, actor, sector or use case. The applicability check asks a short set of questions and returns the duties that may reach you. It is an educational screen, not a legal determination, and it says so.
Why do some instruments have no obligations listed?
Because nobody has broken them out yet. Most instruments are recorded at summary level first; obligations are added jurisdiction by jurisdiction. The coverage and open-gaps pages publish exactly what is missing rather than hiding it.
