AIPolicyTracker
Menu

AI compliance obligations

Practical requirements extracted from policy instruments, with the source article, the actors they bind, evidence examples and original framework mappings. Legal requirements are marked; everything else is voluntary guidance.

use case: public_services ×

17 results

Legal requirement conformity assessment European Union

Complete conformity assessment, CE marking and EU database registration

EU AI Act · Articles 43, 47, 48 and 49; Annex VIII

Before placing a high-risk system on the market, providers must complete the applicable conformity assessment (internal control or notified-body assessment depending on the system), draw up an EU declaration of conformity, affix the CE marking, and register the system in the EU database. Deployers that are public authorities must also register their use of Annex III systems.

Source-linked Applies from 2 Aug 2026
Legal requirement governance accountability European Union

Use high-risk AI as instructed, monitor it and inform affected people

EU AI Act · Article 26

Deployers of high-risk AI must take technical and organisational measures to use systems according to the instructions, assign human oversight, ensure input data is relevant where they control it, monitor operation, inform the provider and authorities of risks or serious incidents, keep logs, inform workers' representatives before deploying at the workplace, inform affected natural persons where decisions are made about them, and cooperate with authorities.

Source-linked Applies from 2 Aug 2026
Legal requirement human oversight United Kingdom

Apply safeguards to solely automated decisions with significant effects

ICO AI guidance · UK GDPR Article 22 as amended by the Data (Use and Access) Act 2025

Individuals have rights in relation to solely automated decisions that produce legal or similarly significant effects, including being told about the decision, obtaining human intervention, and contesting it. The Data (Use and Access) Act 2025 amended these rules; the reviewer must confirm the current wording.

Source-linked
Legal requirement human oversight European Union

Enable and assign effective human oversight

EU AI Act · Article 14; Article 26(2) for deployers

High-risk systems must be designed with human-machine interface tools so natural persons can effectively oversee them, understand capacities and limitations, avoid automation bias, interpret output, decide not to use the system, and intervene or stop it. Deployers must assign oversight to people with the necessary competence, training and authority. For certain remote biometric identification systems, action requires verification by at least two competent persons.

Source-linked Applies from 2 Aug 2026
Legal requirement impact assessment European Union

Carry out a fundamental rights impact assessment before deployment

EU AI Act · Article 27

Before deploying most Annex III high-risk systems, deployers that are bodies governed by public law or private entities providing public services, and deployers using systems for creditworthiness assessment or life and health insurance pricing, must assess the impact on fundamental rights: the processes, period and frequency of use, categories of affected persons, specific risks of harm, human-oversight measures and mitigation, and notify the market-surveillance authority of the results.

Source-linked Applies from 2 Aug 2026
Legal requirement record keeping European Union

Design high-risk systems to log events automatically

EU AI Act · Article 12; Article 26(6) for deployers

High-risk AI systems must technically allow automatic recording of events (logs) over their lifetime to support traceability, post-market monitoring and operational monitoring. Deployers must keep the logs generated by the system, to the extent under their control, for a period appropriate to the intended purpose and at least six months unless other law provides otherwise.

Source-linked Applies from 2 Aug 2026
Legal requirement risk management United States

Apply minimum risk-management practices to high-impact AI

OMB M-25-21 · Section 4

For AI whose output serves as a principal basis for decisions with significant effects on rights, safety or access to services, agencies must complete pre-deployment testing, an AI impact assessment, ongoing monitoring, operator training, human oversight and a mechanism for affected people to seek remedy, or stop using the AI.

Source-linked
Legal requirement risk management European Union

Establish a risk management system for high-risk AI

EU AI Act · Article 9

Providers of high-risk AI systems must establish, implement, document and maintain a continuous, iterative risk-management system across the system's lifecycle: identifying known and reasonably foreseeable risks to health, safety and fundamental rights, estimating and evaluating risks including from reasonably foreseeable misuse, evaluating post-market data, and adopting targeted risk-management measures, with testing before placing on the market.

Source-linked Applies from 2 Aug 2026
Voluntary guidance governance accountability Nepal

Government bodies to promote ethical, responsible and inclusive AI (policy commitment)

Nepal National AI Policy · Policy objectives and strategies (to be confirmed against the official text)

The policy commits the government to ethical, transparent and inclusive AI, data governance and institutional oversight. The specific strategies and any obligations on private actors must be confirmed from the official document; this record intentionally does not state details that could not be verified.

Source-linked
Search