AI compliance obligations

Practical requirements extracted from policy instruments, with the source article, the actors they bind, evidence examples and original framework mappings. Legal requirements are marked; everything else is voluntary guidance.

use case: education ×

Keyword

Jurisdiction

Obligation category

Sector

AI use case

Actor

Binding

Reset

3 results

Legal requirement prohibited practice European Union

Do not deploy or provide AI for prohibited practices

EU AI Act · Article 5

Article 5 bans placing on the market, putting into service or using AI for listed practices, including subliminal or manipulative techniques that cause significant harm, exploitation of vulnerabilities, social scoring by public or private actors leading to detrimental treatment, untargeted scraping of facial images to build recognition databases, emotion recognition in workplaces and education institutions except for medical or safety reasons, biometric categorisation to infer protected characteristics, and real-time remote biometric identification in publicly accessible spaces for law enforcement outside narrow exceptions.

Source-linked Applies from 2 Feb 2025

Legal requirement risk management European Union

Establish a risk management system for high-risk AI

EU AI Act · Article 9

Providers of high-risk AI systems must establish, implement, document and maintain a continuous, iterative risk-management system across the system's lifecycle: identifying known and reasonably foreseeable risks to health, safety and fundamental rights, estimating and evaluating risks including from reasonably foreseeable misuse, evaluating post-market data, and adopting targeted risk-management measures, with testing before placing on the market.

Source-linked Applies from 2 Aug 2026

Legal requirement transparency European Union

Provide deployers with clear instructions for use

EU AI Act · Article 13

High-risk AI systems must be designed so their operation is sufficiently transparent for deployers to interpret output and use it appropriately, and must be accompanied by instructions for use covering the provider's identity, the system's characteristics, capabilities and limitations, performance for the intended purpose and known foreseeable misuse, human-oversight measures, expected lifetime and maintenance.

Source-linked Applies from 2 Aug 2026