AIPolicyTracker
Menu

AI compliance obligations

Practical requirements extracted from policy instruments, with the source article, the actors they bind, evidence examples and original framework mappings. Legal requirements are marked; everything else is voluntary guidance.

use case: health ×

4 results

Legal requirement data governance European Union

Apply data governance and quality criteria to training, validation and testing data

EU AI Act · Article 10

High-risk AI systems that use data-driven techniques must be developed on training, validation and testing data sets meeting quality criteria: appropriate governance practices covering design choices, data collection and origin, preparation, assumptions, availability and suitability, examination for possible biases, and measures to detect, prevent and mitigate bias. Data must be relevant, sufficiently representative and, to the best extent possible, free of errors and complete for the intended purpose.

Source-linked Applies from 2 Aug 2026
Legal requirement impact assessment Colorado (United States)

Deployers must complete impact assessments for high-risk AI

Colorado AI Act · C.R.S. 6-1-1703(3)

Deployers must complete an impact assessment before deployment, annually, and within 90 days of any intentional and substantial modification, covering purpose, risks of algorithmic discrimination and mitigation, data categories, performance metrics, transparency measures and post-deployment monitoring, and retain assessments for at least three years.

Source-linked Applies from 30 Jun 2026
Legal requirement incident handling India

Implement reasonable security safeguards and notify breaches

India DPDP Act · Section 8(5) and 8(6); DPDP Rules on breach intimation

Data Fiduciaries must protect personal data with reasonable security safeguards and, on a personal data breach, inform the Data Protection Board and each affected individual in the form and manner prescribed by the Rules.

Source-linked
Legal requirement incident handling European Union

Report serious incidents to market surveillance authorities

EU AI Act · Article 73

Providers of high-risk AI systems must report serious incidents to the market-surveillance authority of the Member State where the incident occurred, immediately after establishing a causal link (or reasonable likelihood) and no later than 15 days after becoming aware, with shorter limits for the most serious cases such as widespread infringements or death. Deployers must inform the provider and authorities when they identify a serious incident.

Source-linked Applies from 2 Aug 2026
Search