Practical requirements extracted from policy instruments, with the source article, the actors they bind, evidence examples and original framework mappings. Legal requirements are marked; everything else is voluntary guidance.
Operators of high-impact AI must prepare and implement a plan to protect users, and must prepare and keep documents describing the measures they take to secure the AI's safety and reliability, so that they can be shown to the Ministry of Science and ICT on request. Further items may be added by Presidential Decree, and the ministry may publish guidelines on how to meet these duties.
Verified (a factual check against the official source, not a legal review)Applies from 22 Jan 2026
A consumer who receives an adverse consequential decision may obtain meaningful review by a person with the authority and information to change the outcome. Scope and timing follow the enrolled bill.
Pending review (a factual check against the official source, not a legal review)Applies from 1 Jan 2027
If a deployer discovers that a high-risk AI system it uses has caused algorithmic discrimination, it must send a notice to the Colorado Attorney General within 90 days of the discovery, in the form the Attorney General prescribes, without unreasonable delay.
Pending review (a factual check against the official source, not a legal review)
Within 90 days after a developer discovers, through ongoing testing or a credible report from a deployer, that a high-risk AI system it developed has caused or is reasonably likely to have caused algorithmic discrimination, it must disclose this to the Colorado Attorney General and to all known deployers or other developers of the system, without unreasonable delay.
Pending review (a factual check against the official source, not a legal review)
Article 5 bans placing on the market, putting into service or using AI for listed practices, including subliminal or manipulative techniques that cause significant harm, exploitation of vulnerabilities, social scoring by public or private actors leading to detrimental treatment, untargeted scraping of facial images to build recognition databases, emotion recognition in workplaces and education institutions except for medical or safety reasons, biometric categorisation to infer protected characteristics, and real-time remote biometric identification in publicly accessible spaces for law enforcement outside narrow exceptions.
Pending review (a factual check against the official source, not a legal review)Applies from 2 Feb 2025
Deployers must retain records showing how automated decision-making technology was used in consequential decisions, for three years, according to secondary reporting on the enrolled bill.
Pending review (a factual check against the official source, not a legal review)Applies from 1 Jan 2027
A deployer of a high-risk AI system must use reasonable care to protect consumers from known or reasonably foreseeable risks of algorithmic discrimination. A deployer that runs the required risk-management programme, completes impact assessments, gives consumer notices and makes the required disclosures benefits from a rebuttable presumption of reasonable care; some deployers with fewer than 50 employees are relieved of parts of the programme and assessment duties when they rely on the developer's impact assessment.
Pending review (a factual check against the official source, not a legal review)
A developer of a high-risk AI system must use reasonable care to protect consumers from any known or reasonably foreseeable risk of algorithmic discrimination arising from the intended and contracted uses of the system. A developer that meets the documentation, public-statement and Attorney General disclosure duties in the rest of section 6-1-1702 benefits from a rebuttable presumption that it used reasonable care.
Pending review (a factual check against the official source, not a legal review)
Providers of high-risk AI systems must establish, implement, document and maintain a continuous, iterative risk-management system across the system's lifecycle: identifying known and reasonably foreseeable risks to health, safety and fundamental rights, estimating and evaluating risks including from reasonably foreseeable misuse, evaluating post-market data, and adopting targeted risk-management measures, with testing before placing on the market.
Pending review (a factual check against the official source, not a legal review)Applies from 2 Dec 2027
An AI business operator that provides high-impact AI, or a product or service using it, must establish and operate a plan for managing the risks of that AI. High-impact AI is AI used in areas such as energy, drinking water, health care and medical devices, nuclear safety, biometric analysis for criminal investigation, decisions on recruitment or loans, transport, public services and education, where it may materially affect life, safety or fundamental rights.
Verified (a factual check against the official source, not a legal review)Applies from 22 Jan 2026
Developers of automated decision-making technology must provide deployers with the documentation the statute lists, so that deployers can meet their notice, disclosure and review duties.
Pending review (a factual check against the official source, not a legal review)Applies from 1 Jan 2027
A provider that considers a system listed in Annex III to be outside the high-risk tier because it meets one of the Article 6(3) conditions, such as performing a narrow procedural task or only preparing a human assessment, must write down that assessment before placing the system on the market or putting it into service, register the system in the EU database under Article 49(2), and hand over the assessment on request from a national competent authority.
Verified (a factual check against the official source, not a legal review)Applies from 2 Dec 2027
Legal requirementTransparency and disclosure·European Union
A person affected by a decision that a deployer took on the basis of the output of an Annex III high-risk AI system, other than critical-infrastructure systems, which produces legal effects or similarly significantly affects them in a way they consider adverse to their health, safety or fundamental rights, has the right to obtain from the deployer clear and meaningful explanations of the role the system played in the decision and the main elements of the decision. The right does not apply where Union or national law provides an exception.
Verified (a factual check against the official source, not a legal review)Applies from 2 Dec 2027
A deployer must make available on its website, or in another public way, a clear and readily available statement summarising the types of high-risk AI systems it currently deploys, how it manages known or reasonably foreseeable risks of algorithmic discrimination from those systems, and the nature, source and extent of the information it collects and uses. The statement must be updated periodically.
Pending review (a factual check against the official source, not a legal review)
Legal requirementTransparency and disclosure·European Union
Deployers of Annex III high-risk AI systems that take decisions about natural persons, or help take them, must inform those persons that they are subject to the system. The notice is separate from any explanation owed under Article 86 and from the worker notice in Article 26(7). In law-enforcement contexts the duty follows the information rules of the Law Enforcement Directive.
Verified (a factual check against the official source, not a legal review)Applies from 2 Dec 2027
After an adverse consequential decision, the deployer must tell the consumer that automated decision-making technology was used, give the principal reasons for the decision, and explain how to obtain human review.
Pending review (a factual check against the official source, not a legal review)Applies from 1 Jan 2027
Deployers must tell a consumer, before the decision is made, that automated decision-making technology will be used to make or materially influence a consequential decision about them. The exact content and timing of the notice follow the enrolled bill, which a reviewer must read.
Pending review (a factual check against the official source, not a legal review)Applies from 1 Jan 2027
Legal requirementTransparency and disclosure·South Korea
Operators of high-impact AI must put in place measures to explain the AI's final results, the main criteria used to reach them, and an overview of the training data, to the extent that this is technically feasible. The duty targets explainability of the system's decisions to users and affected people rather than full disclosure of the model.
Verified (a factual check against the official source, not a legal review)Applies from 22 Jan 2026
Legal requirementTransparency and disclosure·European Union
High-risk AI systems must be designed so their operation is sufficiently transparent for deployers to interpret output and use it appropriately, and must be accompanied by instructions for use covering the provider's identity, the system's characteristics, capabilities and limitations, performance for the intended purpose and known foreseeable misuse, human-oversight measures, expected lifetime and maintenance.
Pending review (a factual check against the official source, not a legal review)Applies from 2 Dec 2027
A single practical requirement pulled out of an instrument and stated on its own: keep a risk management system, log incidents, document training data, provide human oversight, and so on. Each one cites the article or section it comes from so you can check it against the source.
Does a voluntary obligation have legal force?
No, and every obligation is labelled either a legal requirement or voluntary guidance. Voluntary items still matter in practice, because procurement questionnaires and auditors ask about them, but only the binding ones carry legal consequence.
How do I find the obligations that apply to my organisation?
Filter by jurisdiction, category, actor, sector or use case. The applicability check asks a short set of questions and returns the duties that may reach you. It is an educational screen, not a legal determination, and it says so.
Why do some instruments have no obligations listed?
Because nobody has broken them out yet. Most instruments are recorded at summary level first; obligations are added jurisdiction by jurisdiction. The coverage and open-gaps pages publish exactly what is missing rather than hiding it.
