{"slug":"australia-vaiss-accountability-and-risk-management","title":"Establish accountability processes and a risk-management process (guardrails 1 and 2)","policy":"australia-voluntary-ai-safety-standard","jurisdiction":"australia","category":"governance_accountability","is_binding":false,"applies_from":null,"summary":"Guardrail 1 asks organisations to set up accountability processes including governance, internal capability and a strategy for regulatory compliance; guardrail 2 asks for a risk-management process to identify and mitigate risks across the AI lifecycle.","practical_action":"Adopt an AI policy, assign an accountable owner and run per-use-case risk assessments.","url":"https://aipolicytracker.org/obligations/australia-vaiss-accountability-and-risk-management","context_url":"https://aipolicytracker.org/obligations/australia-vaiss-accountability-and-risk-management.md","official_source_url":"https://www.industry.gov.au/publications/voluntary-ai-safety-standard","source_publisher":null,"source_reference":"Guardrails 1 and 2","review_status":"verified","confidence_level":"high","last_verified_at":null,"reviewed_by":null}
{"slug":"australia-vaiss-testing-human-control-transparency","title":"Test and monitor systems, enable human control, and be transparent with users (guardrails 4 to 6)","policy":"australia-voluntary-ai-safety-standard","jurisdiction":"australia","category":"human_oversight","is_binding":false,"applies_from":null,"summary":"Test AI models and systems before deployment and monitor them in operation; enable meaningful human control and intervention; and inform end users about AI-enabled decisions, interactions with AI and AI-generated content.","practical_action":"Publish AI disclosures, define override paths and keep test and monitoring records.","url":"https://aipolicytracker.org/obligations/australia-vaiss-testing-human-control-transparency","context_url":"https://aipolicytracker.org/obligations/australia-vaiss-testing-human-control-transparency.md","official_source_url":"https://www.industry.gov.au/publications/voluntary-ai-safety-standard","source_publisher":null,"source_reference":"Guardrails 4, 5 and 6","review_status":"verified","confidence_level":"high","last_verified_at":null,"reviewed_by":null}
{"slug":"australia-vaiss-contestability-supply-chain-records","title":"Provide contestability, supply-chain transparency and records (guardrails 7 to 9)","policy":"australia-voluntary-ai-safety-standard","jurisdiction":"australia","category":"vendor_governance","is_binding":false,"applies_from":null,"summary":"Establish processes for people impacted by AI to challenge use or outcomes; be transparent with other organisations across the AI supply chain about data, models and systems; and keep and maintain records to allow third parties to assess compliance.","practical_action":"Add AI clauses to supplier contracts and keep an AI system register with evidence links.","url":"https://aipolicytracker.org/obligations/australia-vaiss-contestability-supply-chain-records","context_url":"https://aipolicytracker.org/obligations/australia-vaiss-contestability-supply-chain-records.md","official_source_url":"https://www.industry.gov.au/publications/voluntary-ai-safety-standard","source_publisher":null,"source_reference":"Guardrails 7, 8 and 9","review_status":"verified","confidence_level":"high","last_verified_at":null,"reviewed_by":null}
{"slug":"eu-ai-act-prohibited-practices","title":"Do not deploy or provide AI for prohibited practices","policy":"eu-ai-act","jurisdiction":"eu","category":"prohibited_practice","is_binding":true,"applies_from":"2025-02-02","summary":"Article 5 bans placing on the market, putting into service or using AI for listed practices, including subliminal or manipulative techniques that cause significant harm, exploitation of vulnerabilities, social scoring by public or private actors leading to detrimental treatment, untargeted scraping of facial images to build recognition databases, emotion recognition in workplaces and education institutions except for medical or safety reasons, biometric categorisation to infer protected characteristics, and real-time remote biometric identification in publicly accessible spaces for law enforcement outside narrow exceptions.","practical_action":"Add a prohibited-practice screen to your AI intake or design-review process and document the outcome for every system already in use.","url":"https://aipolicytracker.org/obligations/eu-ai-act-prohibited-practices","context_url":"https://aipolicytracker.org/obligations/eu-ai-act-prohibited-practices.md","official_source_url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","source_publisher":null,"source_reference":"Article 5","review_status":"pending_review","confidence_level":"medium","last_verified_at":null,"reviewed_by":null}
{"slug":"eu-ai-act-ai-literacy","title":"Ensure AI literacy of staff operating AI systems","policy":"eu-ai-act","jurisdiction":"eu","category":"ai_literacy","is_binding":true,"applies_from":"2025-02-02","summary":"Providers and deployers must take measures to ensure, to their best extent, a sufficient level of AI literacy among their staff and other persons dealing with the operation and use of AI systems on their behalf, taking into account technical knowledge, experience, training, the context of use and the persons affected.","practical_action":"Run role-based AI training and keep attendance and content records; the Commission's AI Office has indicated that literacy will be assessed proportionately.","url":"https://aipolicytracker.org/obligations/eu-ai-act-ai-literacy","context_url":"https://aipolicytracker.org/obligations/eu-ai-act-ai-literacy.md","official_source_url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","source_publisher":null,"source_reference":"Article 4","review_status":"pending_review","confidence_level":"medium","last_verified_at":null,"reviewed_by":null}
{"slug":"eu-ai-act-risk-management-system","title":"Establish a risk management system for high-risk AI","policy":"eu-ai-act","jurisdiction":"eu","category":"risk_management","is_binding":true,"applies_from":"2027-12-02","summary":"Providers of high-risk AI systems must establish, implement, document and maintain a continuous, iterative risk-management system across the system's lifecycle: identifying known and reasonably foreseeable risks to health, safety and fundamental rights, estimating and evaluating risks including from reasonably foreseeable misuse, evaluating post-market data, and adopting targeted risk-management measures, with testing before placing on the market.","practical_action":"Set up a lifecycle risk register per high-risk system with test evidence and residual-risk acceptance.","url":"https://aipolicytracker.org/obligations/eu-ai-act-risk-management-system","context_url":"https://aipolicytracker.org/obligations/eu-ai-act-risk-management-system.md","official_source_url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","source_publisher":null,"source_reference":"Article 9","review_status":"pending_review","confidence_level":"medium","last_verified_at":null,"reviewed_by":null}
{"slug":"eu-ai-act-data-governance","title":"Apply data governance and quality criteria to training, validation and testing data","policy":"eu-ai-act","jurisdiction":"eu","category":"data_governance","is_binding":true,"applies_from":"2027-12-02","summary":"High-risk AI systems that use data-driven techniques must be developed on training, validation and testing data sets meeting quality criteria: appropriate governance practices covering design choices, data collection and origin, preparation, assumptions, availability and suitability, examination for possible biases, and measures to detect, prevent and mitigate bias. Data must be relevant, sufficiently representative and, to the best extent possible, free of errors and complete for the intended purpose.","practical_action":"Produce a data-provenance and bias-assessment record for each data set used to build the system.","url":"https://aipolicytracker.org/obligations/eu-ai-act-data-governance","context_url":"https://aipolicytracker.org/obligations/eu-ai-act-data-governance.md","official_source_url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","source_publisher":null,"source_reference":"Article 10","review_status":"pending_review","confidence_level":"medium","last_verified_at":null,"reviewed_by":null}
{"slug":"eu-ai-act-technical-documentation","title":"Draw up technical documentation before placing a high-risk system on the market","policy":"eu-ai-act","jurisdiction":"eu","category":"technical_documentation","is_binding":true,"applies_from":"2027-12-02","summary":"Technical documentation must be drawn up before a high-risk system is placed on the market or put into service and kept up to date. It must demonstrate compliance with the Section 2 requirements and contain at least the elements in Annex IV, including a general description, development process, monitoring and control, risk-management description, and the applied standards. SMEs may use a simplified form provided by the Commission.","practical_action":"Maintain an Annex IV-structured technical file under version control.","url":"https://aipolicytracker.org/obligations/eu-ai-act-technical-documentation","context_url":"https://aipolicytracker.org/obligations/eu-ai-act-technical-documentation.md","official_source_url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","source_publisher":null,"source_reference":"Article 11 and Annex IV","review_status":"pending_review","confidence_level":"medium","last_verified_at":null,"reviewed_by":null}
{"slug":"eu-ai-act-record-keeping","title":"Design high-risk systems to log events automatically","policy":"eu-ai-act","jurisdiction":"eu","category":"record_keeping","is_binding":true,"applies_from":"2027-12-02","summary":"High-risk AI systems must technically allow automatic recording of events (logs) over their lifetime to support traceability, post-market monitoring and operational monitoring. Deployers must keep the logs generated by the system, to the extent under their control, for a period appropriate to the intended purpose and at least six months unless other law provides otherwise.","practical_action":"Define the log schema, retention and access controls, and confirm deployer retention meets the minimum.","url":"https://aipolicytracker.org/obligations/eu-ai-act-record-keeping","context_url":"https://aipolicytracker.org/obligations/eu-ai-act-record-keeping.md","official_source_url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","source_publisher":null,"source_reference":"Article 12; Article 26(6) for deployers","review_status":"pending_review","confidence_level":"medium","last_verified_at":null,"reviewed_by":null}
{"slug":"eu-ai-act-transparency-to-deployers","title":"Provide deployers with clear instructions for use","policy":"eu-ai-act","jurisdiction":"eu","category":"transparency","is_binding":true,"applies_from":"2027-12-02","summary":"High-risk AI systems must be designed so their operation is sufficiently transparent for deployers to interpret output and use it appropriately, and must be accompanied by instructions for use covering the provider's identity, the system's characteristics, capabilities and limitations, performance for the intended purpose and known foreseeable misuse, human-oversight measures, expected lifetime and maintenance.","practical_action":"Ship an Article 13-structured instructions-for-use document with every high-risk system release.","url":"https://aipolicytracker.org/obligations/eu-ai-act-transparency-to-deployers","context_url":"https://aipolicytracker.org/obligations/eu-ai-act-transparency-to-deployers.md","official_source_url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","source_publisher":null,"source_reference":"Article 13","review_status":"pending_review","confidence_level":"medium","last_verified_at":null,"reviewed_by":null}
{"slug":"eu-ai-act-human-oversight","title":"Enable and assign effective human oversight","policy":"eu-ai-act","jurisdiction":"eu","category":"human_oversight","is_binding":true,"applies_from":"2027-12-02","summary":"High-risk systems must be designed with human-machine interface tools so natural persons can effectively oversee them, understand capacities and limitations, avoid automation bias, interpret output, decide not to use the system, and intervene or stop it. Deployers must assign oversight to people with the necessary competence, training and authority. For certain remote biometric identification systems, action requires verification by at least two competent persons.","practical_action":"Document oversight roles, the \"stop\" mechanism and override paths for each high-risk deployment.","url":"https://aipolicytracker.org/obligations/eu-ai-act-human-oversight","context_url":"https://aipolicytracker.org/obligations/eu-ai-act-human-oversight.md","official_source_url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","source_publisher":null,"source_reference":"Article 14; Article 26(2) for deployers","review_status":"pending_review","confidence_level":"medium","last_verified_at":null,"reviewed_by":null}
{"slug":"eu-ai-act-accuracy-robustness-cybersecurity","title":"Achieve appropriate accuracy, robustness and cybersecurity","policy":"eu-ai-act","jurisdiction":"eu","category":"accuracy_robustness_security","is_binding":true,"applies_from":"2027-12-02","summary":"High-risk AI systems must achieve an appropriate level of accuracy, robustness and cybersecurity and perform consistently throughout their lifecycle. Accuracy levels and metrics must be declared in the instructions; systems must be resilient to errors, faults and inconsistencies, address feedback loops in continuously learning systems, and resist attempts to alter use or performance, including data poisoning, model poisoning, adversarial examples and confidentiality attacks.","practical_action":"Include AI-specific threat modelling and adversarial testing in your security programme.","url":"https://aipolicytracker.org/obligations/eu-ai-act-accuracy-robustness-cybersecurity","context_url":"https://aipolicytracker.org/obligations/eu-ai-act-accuracy-robustness-cybersecurity.md","official_source_url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","source_publisher":null,"source_reference":"Article 15","review_status":"pending_review","confidence_level":"medium","last_verified_at":null,"reviewed_by":null}
{"slug":"eu-ai-act-quality-management-system","title":"Operate a quality management system","policy":"eu-ai-act","jurisdiction":"eu","category":"quality_management","is_binding":true,"applies_from":"2027-12-02","summary":"Providers of high-risk AI systems must put in place a documented quality management system covering regulatory-compliance strategy, design and development procedures, testing and validation, technical specifications and standards, data management, the risk-management system, post-market monitoring, incident reporting, communication with authorities, record keeping, resource management and an accountability framework.","practical_action":"Extend an existing ISO 9001 or ISO/IEC 42001 management system to cover the Article 17 elements.","url":"https://aipolicytracker.org/obligations/eu-ai-act-quality-management-system","context_url":"https://aipolicytracker.org/obligations/eu-ai-act-quality-management-system.md","official_source_url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","source_publisher":null,"source_reference":"Article 17","review_status":"pending_review","confidence_level":"medium","last_verified_at":null,"reviewed_by":null}
{"slug":"eu-ai-act-conformity-assessment-registration","title":"Complete conformity assessment, CE marking and EU database registration","policy":"eu-ai-act","jurisdiction":"eu","category":"conformity_assessment","is_binding":true,"applies_from":"2027-12-02","summary":"Before placing a high-risk system on the market, providers must complete the applicable conformity assessment (internal control or notified-body assessment depending on the system), draw up an EU declaration of conformity, affix the CE marking, and register the system in the EU database. Deployers that are public authorities must also register their use of Annex III systems.","practical_action":"Determine the assessment route early; notified-body capacity may be limited around application dates.","url":"https://aipolicytracker.org/obligations/eu-ai-act-conformity-assessment-registration","context_url":"https://aipolicytracker.org/obligations/eu-ai-act-conformity-assessment-registration.md","official_source_url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","source_publisher":null,"source_reference":"Articles 43, 47, 48 and 49; Annex VIII","review_status":"pending_review","confidence_level":"medium","last_verified_at":null,"reviewed_by":null}
{"slug":"eu-ai-act-deployer-obligations","title":"Use high-risk AI as instructed, monitor it and inform affected people","policy":"eu-ai-act","jurisdiction":"eu","category":"governance_accountability","is_binding":true,"applies_from":"2027-12-02","summary":"Deployers of high-risk AI must take technical and organisational measures to use systems according to the instructions, assign human oversight, ensure input data is relevant where they control it, monitor operation, inform the provider and authorities of risks or serious incidents, keep logs, inform workers' representatives before deploying at the workplace, inform affected natural persons where decisions are made about them, and cooperate with authorities.","practical_action":"Create a deployer checklist per high-risk system and a notice for affected individuals and workers.","url":"https://aipolicytracker.org/obligations/eu-ai-act-deployer-obligations","context_url":"https://aipolicytracker.org/obligations/eu-ai-act-deployer-obligations.md","official_source_url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","source_publisher":null,"source_reference":"Article 26","review_status":"pending_review","confidence_level":"medium","last_verified_at":null,"reviewed_by":null}
{"slug":"eu-ai-act-fundamental-rights-impact-assessment","title":"Carry out a fundamental rights impact assessment before deployment","policy":"eu-ai-act","jurisdiction":"eu","category":"impact_assessment","is_binding":true,"applies_from":"2027-12-02","summary":"Before deploying most Annex III high-risk systems, deployers that are bodies governed by public law or private entities providing public services, and deployers using systems for creditworthiness assessment or life and health insurance pricing, must assess the impact on fundamental rights: the processes, period and frequency of use, categories of affected persons, specific risks of harm, human-oversight measures and mitigation, and notify the market-surveillance authority of the results.","practical_action":"Reuse GDPR DPIA workflows and extend them with the Article 27 elements; the AI Office is to provide a template.","url":"https://aipolicytracker.org/obligations/eu-ai-act-fundamental-rights-impact-assessment","context_url":"https://aipolicytracker.org/obligations/eu-ai-act-fundamental-rights-impact-assessment.md","official_source_url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","source_publisher":null,"source_reference":"Article 27","review_status":"pending_review","confidence_level":"medium","last_verified_at":null,"reviewed_by":null}
{"slug":"eu-ai-act-transparency-article-50","title":"Disclose AI interaction and label synthetic content","policy":"eu-ai-act","jurisdiction":"eu","category":"transparency","is_binding":true,"applies_from":"2026-08-02","summary":"Providers must ensure AI systems intended to interact with people inform them they are dealing with AI unless obvious; providers of systems generating synthetic audio, image, video or text must mark output in a machine-readable, detectable format; deployers of emotion-recognition or biometric-categorisation systems must inform exposed persons; deployers must disclose deepfakes and AI-generated text published to inform the public on matters of public interest, subject to exceptions.","practical_action":"Implement provenance marking (for example content credentials) and user-facing AI disclosures in product UX.","url":"https://aipolicytracker.org/obligations/eu-ai-act-transparency-article-50","context_url":"https://aipolicytracker.org/obligations/eu-ai-act-transparency-article-50.md","official_source_url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","source_publisher":null,"source_reference":"Article 50","review_status":"pending_review","confidence_level":"medium","last_verified_at":null,"reviewed_by":null}
{"slug":"eu-ai-act-gpai-provider-obligations","title":"Meet general-purpose AI model provider obligations","policy":"eu-ai-act","jurisdiction":"eu","category":"copyright_training_data","is_binding":true,"applies_from":"2025-08-02","summary":"Providers of general-purpose AI models must keep technical documentation (Annex XI), provide information to downstream providers integrating the model (Annex XII), put in place a policy to comply with EU copyright law including the text-and-data-mining opt-out, and publish a sufficiently detailed public summary of training content using the Commission's template. Free and open-source models are exempt from the first two duties unless they present systemic risk. Adherence to the General-Purpose AI Code of Practice can demonstrate compliance.","practical_action":"Prepare the Commission's training-content summary template and a documented copyright policy before release.","url":"https://aipolicytracker.org/obligations/eu-ai-act-gpai-provider-obligations","context_url":"https://aipolicytracker.org/obligations/eu-ai-act-gpai-provider-obligations.md","official_source_url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","source_publisher":null,"source_reference":"Article 53 and Annexes XI–XII","review_status":"pending_review","confidence_level":"medium","last_verified_at":null,"reviewed_by":null}
{"slug":"eu-ai-act-gpai-systemic-risk","title":"Manage systemic risk for high-impact general-purpose models","policy":"eu-ai-act","jurisdiction":"eu","category":"safety_testing","is_binding":true,"applies_from":"2025-08-02","summary":"A general-purpose model is presumed to have systemic risk when the cumulative compute used for training exceeds 10^25 floating-point operations, or when the Commission designates it. Providers must notify the Commission, perform model evaluations including adversarial testing, assess and mitigate systemic risks, track and report serious incidents, and ensure adequate cybersecurity for the model and infrastructure.","practical_action":"Track training compute against the threshold and prepare a safety and security framework before launch.","url":"https://aipolicytracker.org/obligations/eu-ai-act-gpai-systemic-risk","context_url":"https://aipolicytracker.org/obligations/eu-ai-act-gpai-systemic-risk.md","official_source_url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","source_publisher":null,"source_reference":"Articles 51, 52 and 55","review_status":"pending_review","confidence_level":"medium","last_verified_at":null,"reviewed_by":null}
{"slug":"eu-ai-act-post-market-monitoring","title":"Operate a post-market monitoring system","policy":"eu-ai-act","jurisdiction":"eu","category":"post_market_monitoring","is_binding":true,"applies_from":"2027-12-02","summary":"Providers must establish and document a post-market monitoring system proportionate to the nature of the AI technology and its risks, actively and systematically collecting and analysing performance data throughout the system's lifetime, based on a monitoring plan that is part of the technical documentation. The Commission is to adopt a template for the plan.","practical_action":"Define performance and drift indicators, feedback channels and review cadence in a monitoring plan.","url":"https://aipolicytracker.org/obligations/eu-ai-act-post-market-monitoring","context_url":"https://aipolicytracker.org/obligations/eu-ai-act-post-market-monitoring.md","official_source_url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","source_publisher":null,"source_reference":"Article 72","review_status":"pending_review","confidence_level":"medium","last_verified_at":null,"reviewed_by":null}
{"slug":"eu-ai-act-serious-incident-reporting","title":"Report serious incidents to market surveillance authorities","policy":"eu-ai-act","jurisdiction":"eu","category":"incident_handling","is_binding":true,"applies_from":"2027-12-02","summary":"Providers of high-risk AI systems must report serious incidents to the market-surveillance authority of the Member State where the incident occurred, immediately after establishing a causal link (or reasonable likelihood) and no later than 15 days after becoming aware, with shorter limits for the most serious cases such as widespread infringements or death. Deployers must inform the provider and authorities when they identify a serious incident.","practical_action":"Add AI serious-incident criteria and time limits to your existing incident-response playbook.","url":"https://aipolicytracker.org/obligations/eu-ai-act-serious-incident-reporting","context_url":"https://aipolicytracker.org/obligations/eu-ai-act-serious-incident-reporting.md","official_source_url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","source_publisher":null,"source_reference":"Article 73","review_status":"pending_review","confidence_level":"medium","last_verified_at":null,"reviewed_by":null}
{"slug":"eu-ai-act-importer-distributor-obligations","title":"Verify conformity before importing or distributing high-risk AI","policy":"eu-ai-act","jurisdiction":"eu","category":"vendor_governance","is_binding":true,"applies_from":"2027-12-02","summary":"Importers must verify that the provider completed conformity assessment, drew up technical documentation, affixed CE marking and appointed an authorised representative where required, and must indicate their name and contact details on the system. Distributors must verify CE marking, the declaration of conformity and instructions, and refrain from making non-compliant systems available.","practical_action":"Build AI Act checks into supplier onboarding and contract clauses.","url":"https://aipolicytracker.org/obligations/eu-ai-act-importer-distributor-obligations","context_url":"https://aipolicytracker.org/obligations/eu-ai-act-importer-distributor-obligations.md","official_source_url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","source_publisher":null,"source_reference":"Articles 23 and 24","review_status":"pending_review","confidence_level":"medium","last_verified_at":null,"reviewed_by":null}
{"slug":"india-ai-guidelines-principles-and-risk-based-governance","title":"Adopt the guiding principles and risk-based governance (voluntary)","policy":"india-ai-governance-guidelines","jurisdiction":"india","category":"governance_accountability","is_binding":false,"applies_from":null,"summary":"The guidelines encourage organisations to embed principles such as fairness, accountability, safety and transparency, to classify and mitigate risks proportionately, and to participate in voluntary frameworks and incident reporting.","practical_action":"Map your existing AI governance programme to the guidelines' principles and note the gaps.","url":"https://aipolicytracker.org/obligations/india-ai-guidelines-principles-and-risk-based-governance","context_url":"https://aipolicytracker.org/obligations/india-ai-guidelines-principles-and-risk-based-governance.md","official_source_url":"https://indiaai.gov.in/","source_publisher":null,"source_reference":"Guiding principles and recommendations sections","review_status":"verified","confidence_level":"low","last_verified_at":null,"reviewed_by":null}
{"slug":"india-dpdp-consent-and-notice","title":"Process personal data only with valid consent or a legitimate use, after notice","policy":"india-dpdp-act","jurisdiction":"india","category":"privacy_data_protection","is_binding":true,"applies_from":null,"summary":"Personal data may be processed only for a lawful purpose with the individual's free, specific, informed and unambiguous consent, or for certain legitimate uses listed in the Act. A notice must describe the data, purpose, and how to exercise rights and complain.","practical_action":"Inventory training and inference data sources and document the consent or legitimate use for each.","url":"https://aipolicytracker.org/obligations/india-dpdp-consent-and-notice","context_url":"https://aipolicytracker.org/obligations/india-dpdp-consent-and-notice.md","official_source_url":"https://www.meity.gov.in/data-protection-framework","source_publisher":null,"source_reference":"Sections 4 to 7","review_status":"verified","confidence_level":"medium","last_verified_at":null,"reviewed_by":null}
{"slug":"india-dpdp-security-and-breach-notification","title":"Implement reasonable security safeguards and notify breaches","policy":"india-dpdp-act","jurisdiction":"india","category":"incident_handling","is_binding":true,"applies_from":null,"summary":"Data Fiduciaries must protect personal data with reasonable security safeguards and, on a personal data breach, inform the Data Protection Board and each affected individual in the form and manner prescribed by the Rules.","practical_action":"Extend incident response to cover AI training data and model outputs that reveal personal data.","url":"https://aipolicytracker.org/obligations/india-dpdp-security-and-breach-notification","context_url":"https://aipolicytracker.org/obligations/india-dpdp-security-and-breach-notification.md","official_source_url":"https://www.meity.gov.in/data-protection-framework","source_publisher":null,"source_reference":"Section 8(5) and 8(6); DPDP Rules on breach intimation","review_status":"verified","confidence_level":"medium","last_verified_at":null,"reviewed_by":null}
{"slug":"india-dpdp-significant-data-fiduciary-duties","title":"Significant Data Fiduciaries must appoint a DPO and run impact assessments and audits","policy":"india-dpdp-act","jurisdiction":"india","category":"impact_assessment","is_binding":true,"applies_from":null,"summary":"Entities notified as Significant Data Fiduciaries, based on factors such as volume and sensitivity of data and risk to individuals, must appoint a Data Protection Officer based in India, an independent data auditor, and periodically undertake data protection impact assessments and audits.","practical_action":"Assess whether your AI data processing could trigger SDF designation and prepare DPIA tooling.","url":"https://aipolicytracker.org/obligations/india-dpdp-significant-data-fiduciary-duties","context_url":"https://aipolicytracker.org/obligations/india-dpdp-significant-data-fiduciary-duties.md","official_source_url":"https://www.meity.gov.in/data-protection-framework","source_publisher":null,"source_reference":"Section 10","review_status":"verified","confidence_level":"medium","last_verified_at":null,"reviewed_by":null}
{"slug":"nepal-privacy-act-consent-and-purpose","title":"Collect and use personal information only with consent and for the stated purpose","policy":"nepal-individual-privacy-act","jurisdiction":"nepal","category":"privacy_data_protection","is_binding":true,"applies_from":null,"summary":"Personal information may be collected only by authorised persons for a lawful purpose with the individual's consent, and must not be used or disclosed for other purposes without consent, subject to statutory exceptions. AI systems trained on or processing personal data of people in Nepal must respect these limits.","practical_action":"Document consent and purpose for any Nepal personal data used in AI training or inference.","url":"https://aipolicytracker.org/obligations/nepal-privacy-act-consent-and-purpose","context_url":"https://aipolicytracker.org/obligations/nepal-privacy-act-consent-and-purpose.md","official_source_url":"https://lawcommission.gov.np/","source_publisher":null,"source_reference":"Chapter on collection and protection of personal information (reviewer to cite sections)","review_status":"pending_review","confidence_level":"medium","last_verified_at":null,"reviewed_by":null}
{"slug":"nepal-ai-policy-responsible-ai-principles","title":"Government bodies to promote ethical, responsible and inclusive AI (policy commitment)","policy":"nepal-national-ai-policy","jurisdiction":"nepal","category":"governance_accountability","is_binding":false,"applies_from":null,"summary":"The policy commits the government to ethical, transparent and inclusive AI, data governance and institutional oversight. The specific strategies and any obligations on private actors must be confirmed from the official document; this record intentionally does not state details that could not be verified.","practical_action":"Public bodies and vendors should track implementing measures from MoCIT.","url":"https://aipolicytracker.org/obligations/nepal-ai-policy-responsible-ai-principles","context_url":"https://aipolicytracker.org/obligations/nepal-ai-policy-responsible-ai-principles.md","official_source_url":"https://mocit.gov.np/","source_publisher":null,"source_reference":"Policy objectives and strategies (to be confirmed against the official text)","review_status":"pending_review","confidence_level":"medium","last_verified_at":null,"reviewed_by":null}
{"slug":"singapore-mgf-internal-governance","title":"Establish internal governance structures and measures for AI","policy":"singapore-model-ai-governance-framework","jurisdiction":"singapore","category":"governance_accountability","is_binding":false,"applies_from":null,"summary":"Organisations should adapt existing governance to AI: clear roles and responsibilities, board and senior management oversight, risk-management and internal controls, and staff training.","practical_action":"Assign an AI governance owner and add AI risks to the enterprise risk register.","url":"https://aipolicytracker.org/obligations/singapore-mgf-internal-governance","context_url":"https://aipolicytracker.org/obligations/singapore-mgf-internal-governance.md","official_source_url":"https://www.pdpc.gov.sg/help-and-resources/2020/01/model-ai-governance-framework","source_publisher":null,"source_reference":"Second edition, Part on internal governance structures and measures","review_status":"verified","confidence_level":"high","last_verified_at":null,"reviewed_by":null}
{"slug":"singapore-mgf-human-involvement","title":"Determine the appropriate level of human involvement in AI decisions","policy":"singapore-model-ai-governance-framework","jurisdiction":"singapore","category":"human_oversight","is_binding":false,"applies_from":null,"summary":"Using a risk-impact matrix (probability and severity of harm), organisations choose human-in-the-loop, human-over-the-loop or human-out-of-the-loop designs and document the rationale.","practical_action":"Record the human-involvement choice and rationale for each AI decision point.","url":"https://aipolicytracker.org/obligations/singapore-mgf-human-involvement","context_url":"https://aipolicytracker.org/obligations/singapore-mgf-human-involvement.md","official_source_url":"https://www.pdpc.gov.sg/help-and-resources/2020/01/model-ai-governance-framework","source_publisher":null,"source_reference":"Second edition, Part on human involvement in AI-augmented decision-making","review_status":"verified","confidence_level":"high","last_verified_at":null,"reviewed_by":null}
{"slug":"singapore-mgf-operations-management","title":"Manage data quality, model development and monitoring across the lifecycle","policy":"singapore-model-ai-governance-framework","jurisdiction":"singapore","category":"data_governance","is_binding":false,"applies_from":null,"summary":"Covers data lineage and quality, minimising bias in datasets, model explainability, repeatability, robustness, regular tuning and active monitoring after deployment.","practical_action":"Maintain data lineage records and a model monitoring plan.","url":"https://aipolicytracker.org/obligations/singapore-mgf-operations-management","context_url":"https://aipolicytracker.org/obligations/singapore-mgf-operations-management.md","official_source_url":"https://www.pdpc.gov.sg/help-and-resources/2020/01/model-ai-governance-framework","source_publisher":null,"source_reference":"Second edition, Part on operations management","review_status":"verified","confidence_level":"high","last_verified_at":null,"reviewed_by":null}
{"slug":"singapore-mgf-genai-incident-reporting-and-provenance","title":"Report incidents and mark AI-generated content (generative AI framework)","policy":"singapore-model-ai-governance-framework","jurisdiction":"singapore","category":"transparency","is_binding":false,"applies_from":null,"summary":"The generative-AI framework recommends incident-reporting channels and processes for AI harms, and content provenance measures such as digital watermarking and cryptographic provenance so that users can identify AI-generated content.","practical_action":"Implement provenance markers for generated media and an AI incident reporting channel.","url":"https://aipolicytracker.org/obligations/singapore-mgf-genai-incident-reporting-and-provenance","context_url":"https://aipolicytracker.org/obligations/singapore-mgf-genai-incident-reporting-and-provenance.md","official_source_url":"https://www.pdpc.gov.sg/help-and-resources/2020/01/model-ai-governance-framework","source_publisher":null,"source_reference":"Generative AI framework, dimensions on incident reporting and content provenance","review_status":"verified","confidence_level":"high","last_verified_at":null,"reviewed_by":null}
{"slug":"singapore-pdpc-consent-or-exception-for-ai-data","title":"Identify consent or an applicable PDPA exception before using personal data in AI","policy":"singapore-pdpc-ai-advisory-guidelines","jurisdiction":"singapore","category":"privacy_data_protection","is_binding":true,"applies_from":null,"summary":"Personal data used to train or operate AI systems requires consent unless an exception applies, such as the business improvement exception for improving products and services or the research exception for developing models, each subject to conditions.","practical_action":"Map AI data uses to consent or a specific exception and record the conditions met.","url":"https://aipolicytracker.org/obligations/singapore-pdpc-consent-or-exception-for-ai-data","context_url":"https://aipolicytracker.org/obligations/singapore-pdpc-consent-or-exception-for-ai-data.md","official_source_url":"https://www.pdpc.gov.sg/guidelines-and-consultation/2024/02/advisory-guidelines-on-use-of-personal-data-in-ai-recommendation-and-decision-systems","source_publisher":null,"source_reference":"Advisory guidelines, sections on consent, business improvement and research exceptions","review_status":"verified","confidence_level":"medium","last_verified_at":null,"reviewed_by":null}
{"slug":"singapore-pdpc-ai-notification","title":"Notify individuals about the use of personal data in AI recommendations and decisions","policy":"singapore-pdpc-ai-advisory-guidelines","jurisdiction":"singapore","category":"transparency","is_binding":true,"applies_from":null,"summary":"Organisations should inform individuals that AI systems use their personal data, the purposes, the relevant features and how they influence decisions, proportionate to the impact on the individual.","practical_action":"Add AI-specific disclosures to privacy notices and in-product notifications.","url":"https://aipolicytracker.org/obligations/singapore-pdpc-ai-notification","context_url":"https://aipolicytracker.org/obligations/singapore-pdpc-ai-notification.md","official_source_url":"https://www.pdpc.gov.sg/guidelines-and-consultation/2024/02/advisory-guidelines-on-use-of-personal-data-in-ai-recommendation-and-decision-systems","source_publisher":null,"source_reference":"Advisory guidelines, section on notification obligation","review_status":"verified","confidence_level":"medium","last_verified_at":null,"reviewed_by":null}
{"slug":"uae-ai-strategy-ethics-and-governance-commitment","title":"Government commitment to AI ethics, governance and regulation (strategy objective)","policy":"uae-national-ai-strategy-2031","jurisdiction":"uae","category":"governance_accountability","is_binding":false,"applies_from":null,"summary":"The strategy commits the government to ensure effective governance and regulation of AI and to promote ethical AI, which led to the AI Ethics Principles and Guidelines and the 2024 UAE AI Charter.","practical_action":"Reference the UAE AI Ethics Principles and AI Charter in proposals to UAE government entities.","url":"https://aipolicytracker.org/obligations/uae-ai-strategy-ethics-and-governance-commitment","context_url":"https://aipolicytracker.org/obligations/uae-ai-strategy-ethics-and-governance-commitment.md","official_source_url":"https://ai.gov.ae/","source_publisher":null,"source_reference":"Strategy objectives on governance and ethics (reviewer to cite the section)","review_status":"pending_review","confidence_level":"medium","last_verified_at":null,"reviewed_by":null}
{"slug":"uae-pdpl-automated-decision-objection","title":"Respect the right to object to automated decision-making without human intervention","policy":"uae-personal-data-protection-law","jurisdiction":"uae","category":"human_oversight","is_binding":true,"applies_from":null,"summary":"Data subjects may object to decisions based solely on automated processing, including profiling, that produce legal or similarly serious effects, subject to exceptions such as contractual necessity or consent.","practical_action":"Provide a human-review route for significant automated decisions affecting UAE residents.","url":"https://aipolicytracker.org/obligations/uae-pdpl-automated-decision-objection","context_url":"https://aipolicytracker.org/obligations/uae-pdpl-automated-decision-objection.md","official_source_url":"https://u.ae/en/about-the-uae/digital-uae/data/data-protection","source_publisher":null,"source_reference":"Article on data-subject rights relating to automated processing (reviewer to cite article number)","review_status":"pending_review","confidence_level":"medium","last_verified_at":null,"reviewed_by":null}
{"slug":"uae-pdpl-impact-assessment-new-technologies","title":"Conduct a data protection impact assessment for high-risk processing using new technologies","policy":"uae-personal-data-protection-law","jurisdiction":"uae","category":"impact_assessment","is_binding":true,"applies_from":null,"summary":"Before processing that uses modern technologies and is likely to pose a high risk to privacy, controllers must assess the impact on personal data protection, covering the processing, its purposes, risks and safeguards.","practical_action":"Run a DPIA for AI systems processing personal data of UAE residents and keep it on file.","url":"https://aipolicytracker.org/obligations/uae-pdpl-impact-assessment-new-technologies","context_url":"https://aipolicytracker.org/obligations/uae-pdpl-impact-assessment-new-technologies.md","official_source_url":"https://u.ae/en/about-the-uae/digital-uae/data/data-protection","source_publisher":null,"source_reference":"Article on data protection impact assessment (reviewer to cite article number)","review_status":"pending_review","confidence_level":"medium","last_verified_at":null,"reviewed_by":null}
{"slug":"uk-principles-safety-security-robustness","title":"Ensure AI systems are safe, secure and robust throughout their lifecycle","policy":"uk-ai-regulation-white-paper","jurisdiction":"uk","category":"risk_management","is_binding":false,"applies_from":null,"summary":"Regulators are asked to ensure AI systems function in a robust, secure and safe way, with risks continually identified, assessed and managed. In practice this is enforced through existing safety, security and data-protection law rather than a new duty.","practical_action":"Run lifecycle risk assessments and keep security testing evidence that you can show a regulator.","url":"https://aipolicytracker.org/obligations/uk-principles-safety-security-robustness","context_url":"https://aipolicytracker.org/obligations/uk-principles-safety-security-robustness.md","official_source_url":"https://www.gov.uk/government/publications/ai-regulation-a-pro-innovation-approach","source_publisher":null,"source_reference":"Principle 1, Part 3","review_status":"verified","confidence_level":"high","last_verified_at":null,"reviewed_by":null}
{"slug":"uk-principles-transparency-explainability","title":"Provide appropriate transparency and explainability","policy":"uk-ai-regulation-white-paper","jurisdiction":"uk","category":"transparency","is_binding":false,"applies_from":null,"summary":"Organisations should communicate when and how AI is used and provide explanations proportionate to the risk, so that people can understand decisions affecting them. For personal data, UK GDPR transparency and automated decision-making rights make this binding in practice.","practical_action":"Publish AI use notices and keep explainability documentation for decisions about individuals.","url":"https://aipolicytracker.org/obligations/uk-principles-transparency-explainability","context_url":"https://aipolicytracker.org/obligations/uk-principles-transparency-explainability.md","official_source_url":"https://www.gov.uk/government/publications/ai-regulation-a-pro-innovation-approach","source_publisher":null,"source_reference":"Principle 2, Part 3","review_status":"verified","confidence_level":"high","last_verified_at":null,"reviewed_by":null}
{"slug":"uk-principles-fairness","title":"Use AI in ways that are fair and do not discriminate unlawfully","policy":"uk-ai-regulation-white-paper","jurisdiction":"uk","category":"governance_accountability","is_binding":false,"applies_from":null,"summary":"AI systems should not undermine legal rights, discriminate unfairly or create unfair market outcomes. The Equality Act 2010 and UK GDPR fairness principle make key parts of this binding.","practical_action":"Test for disparate outcomes across protected characteristics before and after deployment.","url":"https://aipolicytracker.org/obligations/uk-principles-fairness","context_url":"https://aipolicytracker.org/obligations/uk-principles-fairness.md","official_source_url":"https://www.gov.uk/government/publications/ai-regulation-a-pro-innovation-approach","source_publisher":null,"source_reference":"Principle 3, Part 3","review_status":"verified","confidence_level":"high","last_verified_at":null,"reviewed_by":null}
{"slug":"uk-principles-accountability-governance","title":"Establish accountability and governance for AI","policy":"uk-ai-regulation-white-paper","jurisdiction":"uk","category":"governance_accountability","is_binding":false,"applies_from":null,"summary":"Governance measures should ensure effective oversight of AI supply and use with clear lines of accountability across the lifecycle.","practical_action":"Name an accountable owner for each AI system and record decisions in a governance log.","url":"https://aipolicytracker.org/obligations/uk-principles-accountability-governance","context_url":"https://aipolicytracker.org/obligations/uk-principles-accountability-governance.md","official_source_url":"https://www.gov.uk/government/publications/ai-regulation-a-pro-innovation-approach","source_publisher":null,"source_reference":"Principle 4, Part 3","review_status":"verified","confidence_level":"high","last_verified_at":null,"reviewed_by":null}
{"slug":"uk-principles-contestability-redress","title":"Provide routes to contest AI outcomes and seek redress","policy":"uk-ai-regulation-white-paper","jurisdiction":"uk","category":"human_oversight","is_binding":false,"applies_from":null,"summary":"Affected people should be able to contest harmful AI decisions or outcomes and obtain redress, through existing complaint routes and regulators.","practical_action":"Add an AI-decision challenge route to customer complaint procedures.","url":"https://aipolicytracker.org/obligations/uk-principles-contestability-redress","context_url":"https://aipolicytracker.org/obligations/uk-principles-contestability-redress.md","official_source_url":"https://www.gov.uk/government/publications/ai-regulation-a-pro-innovation-approach","source_publisher":null,"source_reference":"Principle 5, Part 3","review_status":"verified","confidence_level":"high","last_verified_at":null,"reviewed_by":null}
{"slug":"uk-ico-dpia-for-ai","title":"Carry out a data protection impact assessment for high-risk AI processing","policy":"uk-ico-ai-data-protection-guidance","jurisdiction":"uk","category":"impact_assessment","is_binding":true,"applies_from":null,"summary":"Where AI processing of personal data is likely to result in a high risk to individuals, UK GDPR requires a DPIA before processing begins. The ICO treats most AI involving profiling, large-scale processing or novel technology as meeting this threshold.","practical_action":"Use the ICO's DPIA template and add AI-specific sections on bias, explainability and human oversight.","url":"https://aipolicytracker.org/obligations/uk-ico-dpia-for-ai","context_url":"https://aipolicytracker.org/obligations/uk-ico-dpia-for-ai.md","official_source_url":"https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/","source_publisher":null,"source_reference":"UK GDPR Article 35; ICO guidance, accountability and governance section","review_status":"verified","confidence_level":"medium","last_verified_at":null,"reviewed_by":null}
{"slug":"uk-ico-automated-decision-safeguards","title":"Apply safeguards to solely automated decisions with significant effects","policy":"uk-ico-ai-data-protection-guidance","jurisdiction":"uk","category":"human_oversight","is_binding":true,"applies_from":null,"summary":"Individuals have rights in relation to solely automated decisions that produce legal or similarly significant effects, including being told about the decision, obtaining human intervention, and contesting it. The Data (Use and Access) Act 2025 amended these rules; the reviewer must confirm the current wording.","practical_action":"Map every significant automated decision, add a human-review route and a notice to affected people.","url":"https://aipolicytracker.org/obligations/uk-ico-automated-decision-safeguards","context_url":"https://aipolicytracker.org/obligations/uk-ico-automated-decision-safeguards.md","official_source_url":"https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/","source_publisher":null,"source_reference":"UK GDPR Article 22 as amended by the Data (Use and Access) Act 2025","review_status":"verified","confidence_level":"medium","last_verified_at":null,"reviewed_by":null}
{"slug":"us-california-sb-53-frontier-ai-framework","title":"Large frontier developers must publish a frontier AI framework","policy":"us-california-sb-53","jurisdiction":"us-california","category":"safety_testing","is_binding":true,"applies_from":"2026-01-01","summary":"Large frontier developers must publish and maintain a framework describing how they incorporate national and international standards, assess catastrophic risk, apply mitigations, secure model weights, and govern internal processes, and must review it at least annually.","practical_action":"Publish a safety framework and keep a change log of revisions.","url":"https://aipolicytracker.org/obligations/us-california-sb-53-frontier-ai-framework","context_url":"https://aipolicytracker.org/obligations/us-california-sb-53-frontier-ai-framework.md","official_source_url":"https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202520260SB53","source_publisher":null,"source_reference":"Business and Professions Code, Chapter 25.1 (as added by SB 53)","review_status":"verified","confidence_level":"medium","last_verified_at":null,"reviewed_by":null}
{"slug":"us-california-sb-53-critical-safety-incident-reporting","title":"Report critical safety incidents to the Office of Emergency Services","policy":"us-california-sb-53","jurisdiction":"us-california","category":"incident_handling","is_binding":true,"applies_from":"2026-01-01","summary":"Frontier developers must report critical safety incidents to the California Office of Emergency Services within the statutory time limit after discovery, and the Office is to establish a reporting mechanism.","practical_action":"Define critical-safety-incident criteria and an escalation path with the statutory clock.","url":"https://aipolicytracker.org/obligations/us-california-sb-53-critical-safety-incident-reporting","context_url":"https://aipolicytracker.org/obligations/us-california-sb-53-critical-safety-incident-reporting.md","official_source_url":"https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202520260SB53","source_publisher":null,"source_reference":"Business and Professions Code, Chapter 25.1 (as added by SB 53)","review_status":"verified","confidence_level":"medium","last_verified_at":null,"reviewed_by":null}
{"slug":"us-colorado-deployer-risk-management-program","title":"Deployers must implement a risk management policy and programme","policy":"us-colorado-ai-act","jurisdiction":"us-colorado","category":"risk_management","is_binding":true,"applies_from":null,"summary":"Deployers of high-risk AI must implement a risk-management policy and programme governing deployment, specifying principles, processes and personnel used to identify, document and mitigate known or reasonably foreseeable risks of algorithmic discrimination, and reasonable in light of recognised frameworks such as the NIST AI RMF or ISO/IEC 42001.","practical_action":"Adopt an AI risk policy referencing NIST AI RMF or ISO/IEC 42001 and keep programme records.","url":"https://aipolicytracker.org/obligations/us-colorado-deployer-risk-management-program","context_url":"https://aipolicytracker.org/obligations/us-colorado-deployer-risk-management-program.md","official_source_url":"https://leg.colorado.gov/bills/sb24-205","source_publisher":null,"source_reference":"C.R.S. 6-1-1703(2)","review_status":"pending_review","confidence_level":"medium","last_verified_at":null,"reviewed_by":null}
{"slug":"us-colorado-deployer-impact-assessment","title":"Deployers must complete impact assessments for high-risk AI","policy":"us-colorado-ai-act","jurisdiction":"us-colorado","category":"impact_assessment","is_binding":true,"applies_from":null,"summary":"Deployers must complete an impact assessment before deployment, annually, and within 90 days of any intentional and substantial modification, covering purpose, risks of algorithmic discrimination and mitigation, data categories, performance metrics, transparency measures and post-deployment monitoring, and retain assessments for at least three years.","practical_action":"Build an impact-assessment template aligned with the statutory elements and calendar the annual refresh.","url":"https://aipolicytracker.org/obligations/us-colorado-deployer-impact-assessment","context_url":"https://aipolicytracker.org/obligations/us-colorado-deployer-impact-assessment.md","official_source_url":"https://leg.colorado.gov/bills/sb24-205","source_publisher":null,"source_reference":"C.R.S. 6-1-1703(3)","review_status":"pending_review","confidence_level":"medium","last_verified_at":null,"reviewed_by":null}
{"slug":"us-colorado-consumer-notice-and-adverse-decision-explanation","title":"Notify consumers and explain adverse consequential decisions","policy":"us-colorado-ai-act","jurisdiction":"us-colorado","category":"transparency","is_binding":true,"applies_from":null,"summary":"Before a high-risk system makes a consequential decision, deployers must notify the consumer that AI is used, describe its purpose and nature, and provide contact and opt-out information where applicable. After an adverse decision they must state the principal reasons, the data used and its sources, and offer an opportunity to correct data and to appeal for human review where feasible.","practical_action":"Add pre-decision AI notices and an adverse-decision explanation and appeal workflow.","url":"https://aipolicytracker.org/obligations/us-colorado-consumer-notice-and-adverse-decision-explanation","context_url":"https://aipolicytracker.org/obligations/us-colorado-consumer-notice-and-adverse-decision-explanation.md","official_source_url":"https://leg.colorado.gov/bills/sb24-205","source_publisher":null,"source_reference":"C.R.S. 6-1-1703(4)","review_status":"pending_review","confidence_level":"medium","last_verified_at":null,"reviewed_by":null}
{"slug":"us-colorado-developer-documentation-and-disclosure","title":"Developers must document high-risk systems and disclose known risks","policy":"us-colorado-ai-act","jurisdiction":"us-colorado","category":"technical_documentation","is_binding":true,"applies_from":null,"summary":"Developers must make available to deployers a general statement of intended uses, documentation of known or reasonably foreseeable risks of algorithmic discrimination, training-data summaries, limitations, performance evaluation and mitigation measures, and information needed for deployer impact assessments, and must publish a public statement describing their high-risk systems and how they manage discrimination risks.","practical_action":"Prepare a deployer information pack and a public high-risk systems statement.","url":"https://aipolicytracker.org/obligations/us-colorado-developer-documentation-and-disclosure","context_url":"https://aipolicytracker.org/obligations/us-colorado-developer-documentation-and-disclosure.md","official_source_url":"https://leg.colorado.gov/bills/sb24-205","source_publisher":null,"source_reference":"C.R.S. 6-1-1702","review_status":"pending_review","confidence_level":"medium","last_verified_at":null,"reviewed_by":null}
{"slug":"us-eo-14179-agency-review-of-prior-actions","title":"Federal agencies must review and revise actions inconsistent with the new AI policy","policy":"us-executive-order-14179","jurisdiction":"us","category":"public_sector_use","is_binding":true,"applies_from":null,"summary":"Agency heads were directed to identify actions taken under Executive Order 14110 that are inconsistent with the policy of EO 14179 and to suspend, revise or rescind them, and OMB was directed to revise its federal AI use and procurement memoranda.","practical_action":"Vendors should check which prior agency AI requirements remain in force before bidding.","url":"https://aipolicytracker.org/obligations/us-eo-14179-agency-review-of-prior-actions","context_url":"https://aipolicytracker.org/obligations/us-eo-14179-agency-review-of-prior-actions.md","official_source_url":"https://www.whitehouse.gov/presidential-actions/2025/01/removing-barriers-to-american-leadership-in-artificial-intelligence/","source_publisher":null,"source_reference":"Section 5","review_status":"verified","confidence_level":"high","last_verified_at":null,"reviewed_by":null}
{"slug":"us-nist-ai-rmf-govern","title":"Establish AI governance policies, roles and accountability (Govern)","policy":"us-nist-ai-rmf","jurisdiction":"us","category":"governance_accountability","is_binding":false,"applies_from":null,"summary":"Govern covers policies and procedures for AI risk, roles and responsibilities, workforce diversity and training, organisational culture, stakeholder engagement, and third-party risk management. It is the cross-cutting function that supports the other three.","practical_action":"Adopt an AI policy, assign owners, and set a risk-tolerance statement approved by leadership.","url":"https://aipolicytracker.org/obligations/us-nist-ai-rmf-govern","context_url":"https://aipolicytracker.org/obligations/us-nist-ai-rmf-govern.md","official_source_url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.100-1.pdf","source_publisher":null,"source_reference":"GOVERN function","review_status":"verified","confidence_level":"high","last_verified_at":null,"reviewed_by":null}
{"slug":"us-nist-ai-rmf-map","title":"Map context, intended use and potential impacts (Map)","policy":"us-nist-ai-rmf","jurisdiction":"us","category":"impact_assessment","is_binding":false,"applies_from":null,"summary":"Map establishes the context: intended purposes, users, deployment settings, legal requirements, risk categorisation, benefits and costs, and impacts on individuals, groups, communities and society.","practical_action":"Produce a system card or context document before development starts.","url":"https://aipolicytracker.org/obligations/us-nist-ai-rmf-map","context_url":"https://aipolicytracker.org/obligations/us-nist-ai-rmf-map.md","official_source_url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.100-1.pdf","source_publisher":null,"source_reference":"MAP function","review_status":"verified","confidence_level":"high","last_verified_at":null,"reviewed_by":null}
{"slug":"us-nist-ai-rmf-measure","title":"Measure and test trustworthiness characteristics (Measure)","policy":"us-nist-ai-rmf","jurisdiction":"us","category":"safety_testing","is_binding":false,"applies_from":null,"summary":"Measure covers selecting metrics and test methods, evaluating validity, safety, security, resilience, explainability, privacy, fairness and bias, and monitoring these over time, including through independent review and red-teaming for generative AI.","practical_action":"Define a test plan with metrics for each trustworthiness characteristic and record results.","url":"https://aipolicytracker.org/obligations/us-nist-ai-rmf-measure","context_url":"https://aipolicytracker.org/obligations/us-nist-ai-rmf-measure.md","official_source_url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.100-1.pdf","source_publisher":null,"source_reference":"MEASURE function","review_status":"verified","confidence_level":"high","last_verified_at":null,"reviewed_by":null}
{"slug":"us-nist-ai-rmf-manage","title":"Prioritise, respond to and monitor AI risks (Manage)","policy":"us-nist-ai-rmf","jurisdiction":"us","category":"risk_management","is_binding":false,"applies_from":null,"summary":"Manage allocates resources to mapped and measured risks, plans responses including decommissioning, manages third-party risks, and documents post-deployment monitoring, incident response and communication.","practical_action":"Maintain a risk-treatment plan and an incident and monitoring log per system.","url":"https://aipolicytracker.org/obligations/us-nist-ai-rmf-manage","context_url":"https://aipolicytracker.org/obligations/us-nist-ai-rmf-manage.md","official_source_url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.100-1.pdf","source_publisher":null,"source_reference":"MANAGE function","review_status":"verified","confidence_level":"high","last_verified_at":null,"reviewed_by":null}
{"slug":"us-omb-m-25-21-high-impact-ai-practices","title":"Apply minimum risk-management practices to high-impact AI","policy":"us-omb-m-25-21","jurisdiction":"us","category":"risk_management","is_binding":true,"applies_from":null,"summary":"For AI whose output serves as a principal basis for decisions with significant effects on rights, safety or access to services, agencies must complete pre-deployment testing, an AI impact assessment, ongoing monitoring, operator training, human oversight and a mechanism for affected people to seek remedy, or stop using the AI.","practical_action":"Vendors should prepare test evidence and documentation that agencies can reuse in impact assessments.","url":"https://aipolicytracker.org/obligations/us-omb-m-25-21-high-impact-ai-practices","context_url":"https://aipolicytracker.org/obligations/us-omb-m-25-21-high-impact-ai-practices.md","official_source_url":"https://www.whitehouse.gov/omb/information-for-agencies/memoranda/","source_publisher":null,"source_reference":"Section 4","review_status":"verified","confidence_level":"medium","last_verified_at":null,"reviewed_by":null}
{"slug":"us-omb-m-25-21-use-case-inventory","title":"Publish an annual AI use-case inventory","policy":"us-omb-m-25-21","jurisdiction":"us","category":"transparency","is_binding":true,"applies_from":null,"summary":"Agencies must inventory their AI use cases annually and publish the inventory, identifying high-impact uses, with limited exclusions.","practical_action":"Agencies maintain the inventory; vendors may be asked for use-case descriptions.","url":"https://aipolicytracker.org/obligations/us-omb-m-25-21-use-case-inventory","context_url":"https://aipolicytracker.org/obligations/us-omb-m-25-21-use-case-inventory.md","official_source_url":"https://www.whitehouse.gov/omb/information-for-agencies/memoranda/","source_publisher":null,"source_reference":"Section 3","review_status":"verified","confidence_level":"medium","last_verified_at":null,"reviewed_by":null}
{"slug":"eu-ai-act-art-16-provider-obligations","title":"Providers must meet the full set of provider duties for high-risk AI","policy":"eu-ai-act","jurisdiction":"eu","category":"governance_accountability","is_binding":true,"applies_from":"2027-12-02","summary":"Article 16 lists what a provider of a high-risk AI system owes: compliance with the Section 2 requirements, its name and contact details on the system or its documentation, a quality management system, retention of documentation and logs, conformity assessment, an EU declaration of conformity, CE marking, registration, corrective action when needed, cooperation with authorities on request, and accessibility in line with the EU accessibility directives.","practical_action":"Map each Article 16 point to an owner and an evidence location in a compliance matrix for every high-risk system.","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-16-provider-obligations","context_url":"https://aipolicytracker.org/obligations/eu-ai-act-art-16-provider-obligations.md","official_source_url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","source_publisher":null,"source_reference":"Article 16","review_status":"verified","confidence_level":"high","last_verified_at":"2026-09-26","reviewed_by":null}
{"slug":"eu-ai-act-art-18-documentation-keeping","title":"Providers must keep high-risk AI documentation for ten years","policy":"eu-ai-act","jurisdiction":"eu","category":"record_keeping","is_binding":true,"applies_from":"2027-12-02","summary":"For ten years after a high-risk AI system is placed on the market or put into service, the provider must keep at the disposal of national competent authorities the technical documentation, the quality management system documentation, any changes approved by a notified body, the notified body's decisions and other documents, and the EU declaration of conformity. Financial institutions keep these as part of their sector record-keeping.","practical_action":"Set a ten-year retention class for the technical file, QMS records and conformity documents of each high-risk system.","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-18-documentation-keeping","context_url":"https://aipolicytracker.org/obligations/eu-ai-act-art-18-documentation-keeping.md","official_source_url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","source_publisher":null,"source_reference":"Article 18","review_status":"verified","confidence_level":"high","last_verified_at":"2026-09-26","reviewed_by":null}
{"slug":"eu-ai-act-art-19-provider-log-retention","title":"Providers must retain automatically generated logs under their control","policy":"eu-ai-act","jurisdiction":"eu","category":"record_keeping","is_binding":true,"applies_from":"2027-12-02","summary":"Providers must keep the event logs that a high-risk AI system generates under Article 12, to the extent those logs are within their control, for a period appropriate to the system's intended purpose and in any case for at least six months, unless Union or national law on personal data sets a different period. Financial institutions keep the logs under their sector rules.","practical_action":"Configure log retention for hosted or API-served high-risk systems to at least six months with a documented rationale for any longer period.","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-19-provider-log-retention","context_url":"https://aipolicytracker.org/obligations/eu-ai-act-art-19-provider-log-retention.md","official_source_url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","source_publisher":null,"source_reference":"Article 19","review_status":"verified","confidence_level":"high","last_verified_at":"2026-09-26","reviewed_by":null}
{"slug":"eu-ai-act-art-20-corrective-actions-and-information","title":"Providers must take corrective action and inform the supply chain about non-conforming high-risk AI","policy":"eu-ai-act","jurisdiction":"eu","category":"incident_handling","is_binding":true,"applies_from":"2027-12-02","summary":"A provider that considers, or has reason to consider, that a high-risk system it has placed on the market is not in conformity must immediately correct it, withdraw it, disable it or recall it as appropriate, and inform the distributors, deployers, authorised representative and importers. Where the system presents a risk to health, safety or fundamental rights and the provider becomes aware of that risk, it must immediately investigate the causes together with the reporting deployer and inform the market surveillance authorities and, where relevant, the notified body.","practical_action":"Add a non-conformity and recall procedure for AI products with a supply-chain notification list and an authority-notification step.","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-20-corrective-actions-and-information","context_url":"https://aipolicytracker.org/obligations/eu-ai-act-art-20-corrective-actions-and-information.md","official_source_url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","source_publisher":null,"source_reference":"Article 20","review_status":"verified","confidence_level":"high","last_verified_at":"2026-09-26","reviewed_by":null}
{"slug":"eu-ai-act-art-21-cooperation-with-authorities","title":"Providers must supply conformity evidence and log access to authorities on request","policy":"eu-ai-act","jurisdiction":"eu","category":"governance_accountability","is_binding":true,"applies_from":"2027-12-02","summary":"On a reasoned request from a national competent authority, a provider of a high-risk AI system must supply all the information and documentation needed to show that the system meets the Section 2 requirements, in a language the authority can readily understand, and must give the authority access to the automatically generated logs it holds. Authorities must treat what they receive as confidential under Article 78.","practical_action":"Keep an authority-request playbook with a named contact, the documentation index and a pre-agreed export format for logs.","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-21-cooperation-with-authorities","context_url":"https://aipolicytracker.org/obligations/eu-ai-act-art-21-cooperation-with-authorities.md","official_source_url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","source_publisher":null,"source_reference":"Article 21","review_status":"verified","confidence_level":"high","last_verified_at":"2026-09-26","reviewed_by":null}
{"slug":"eu-ai-act-art-22-authorised-representative","title":"Non-EU providers must appoint an EU authorised representative for high-risk AI","policy":"eu-ai-act","jurisdiction":"eu","category":"governance_accountability","is_binding":true,"applies_from":"2027-12-02","summary":"Before making a high-risk AI system available in the Union, a provider established outside the EU must appoint, by written mandate, an authorised representative established in the Union. The representative verifies that the EU declaration of conformity and technical documentation exist and that conformity assessment was done, keeps the provider's contact details and the documentation available for ten years, supplies information to authorities, cooperates with them, and must end the mandate if the provider acts contrary to the Regulation.","practical_action":"Sign a written mandate with an EU-established representative and give them a controlled copy of the technical file and declaration.","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-22-authorised-representative","context_url":"https://aipolicytracker.org/obligations/eu-ai-act-art-22-authorised-representative.md","official_source_url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","source_publisher":null,"source_reference":"Article 22","review_status":"verified","confidence_level":"high","last_verified_at":"2026-09-26","reviewed_by":null}
{"slug":"eu-ai-act-art-25-value-chain-becoming-provider","title":"Deployers, distributors and importers must assume provider duties when they rebrand or substantially modify high-risk AI","policy":"eu-ai-act","jurisdiction":"eu","category":"governance_accountability","is_binding":true,"applies_from":"2027-12-02","summary":"A distributor, importer, deployer or other third party is treated as the provider of a high-risk AI system, with all Article 16 duties, if it puts its own name or trademark on a system already on the market, makes a substantial modification to a high-risk system that stays high-risk, or changes the intended purpose of a system so that it becomes high-risk. The original provider then ceases to be provider for that system but must cooperate and supply the information and access needed for the new provider to comply.","practical_action":"Add a reclassification check to change control so that white-labelling, fine-tuning or repurposing a high-risk system triggers the provider workstream.","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-25-value-chain-becoming-provider","context_url":"https://aipolicytracker.org/obligations/eu-ai-act-art-25-value-chain-becoming-provider.md","official_source_url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","source_publisher":null,"source_reference":"Article 25(1) and 25(2)","review_status":"verified","confidence_level":"high","last_verified_at":"2026-09-26","reviewed_by":null}
{"slug":"eu-ai-act-art-25-4-written-agreements-with-component-suppliers","title":"Providers of high-risk AI must have written agreements with suppliers of components, tools and services","policy":"eu-ai-act","jurisdiction":"eu","category":"vendor_governance","is_binding":true,"applies_from":"2027-12-02","summary":"A provider of a high-risk AI system and any third party that supplies AI systems, tools, services, components or processes used in or integrated into it must set out, in a written agreement, the information, capabilities, technical access and other assistance needed for the provider to meet its obligations, based on the generally acknowledged state of the art. Suppliers of free and open-source tools and components other than general-purpose AI models are outside this duty. The AI Office may publish voluntary model terms.","practical_action":"Insert AI Act information, access and assistance clauses into contracts with model, data and component suppliers.","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-25-4-written-agreements-with-component-suppliers","context_url":"https://aipolicytracker.org/obligations/eu-ai-act-art-25-4-written-agreements-with-component-suppliers.md","official_source_url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","source_publisher":null,"source_reference":"Article 25(4)","review_status":"verified","confidence_level":"high","last_verified_at":"2026-09-26","reviewed_by":null}
{"slug":"eu-ai-act-art-6-4-non-high-risk-assessment-documentation","title":"Providers must document and register a conclusion that an Annex III system is not high-risk","policy":"eu-ai-act","jurisdiction":"eu","category":"technical_documentation","is_binding":true,"applies_from":"2027-12-02","summary":"A provider that considers a system listed in Annex III to be outside the high-risk tier because it meets one of the Article 6(3) conditions, such as performing a narrow procedural task or only preparing a human assessment, must write down that assessment before placing the system on the market or putting it into service, register the system in the EU database under Article 49(2), and hand over the assessment on request from a national competent authority.","practical_action":"Record a reasoned Article 6(3) assessment in the design file and register the system before launch rather than relying on an informal judgement.","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-6-4-non-high-risk-assessment-documentation","context_url":"https://aipolicytracker.org/obligations/eu-ai-act-art-6-4-non-high-risk-assessment-documentation.md","official_source_url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","source_publisher":null,"source_reference":"Article 6(4); Article 49(2)","review_status":"verified","confidence_level":"high","last_verified_at":"2026-09-26","reviewed_by":null}
{"slug":"eu-ai-act-art-26-4-deployer-input-data","title":"Deployers must ensure input data they control is relevant and representative","policy":"eu-ai-act","jurisdiction":"eu","category":"data_governance","is_binding":true,"applies_from":"2027-12-02","summary":"To the extent a deployer controls the data fed into a high-risk AI system, it must make sure that input data is relevant to, and sufficiently representative for, the system's intended purpose. The duty sits with the deployer even though the provider designed the system, because the deployer chooses what the system is run on.","practical_action":"Define input-data quality checks for each high-risk system, including population coverage and field validation, and review them with the provider's instructions.","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-26-4-deployer-input-data","context_url":"https://aipolicytracker.org/obligations/eu-ai-act-art-26-4-deployer-input-data.md","official_source_url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","source_publisher":null,"source_reference":"Article 26(4)","review_status":"verified","confidence_level":"high","last_verified_at":"2026-09-26","reviewed_by":null}
{"slug":"eu-ai-act-art-26-5-deployer-monitoring-and-suspension","title":"Deployers must monitor high-risk AI, suspend use on risk and report serious incidents","policy":"eu-ai-act","jurisdiction":"eu","category":"post_market_monitoring","is_binding":true,"applies_from":"2027-12-02","summary":"Deployers must monitor a high-risk AI system's operation against the provider's instructions and feed observations to the provider under Article 72. If they have reason to think the system as used may present a risk to health, safety or fundamental rights, they must inform the provider or distributor and the market surveillance authority without undue delay and suspend use. On a serious incident, they must immediately inform the provider, then the importer or distributor and the authorities. Financial institutions meet this through their internal governance rules.","practical_action":"Give each high-risk system an operational owner with a kill-switch authority and a written escalation route to the provider and the authority.","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-26-5-deployer-monitoring-and-suspension","context_url":"https://aipolicytracker.org/obligations/eu-ai-act-art-26-5-deployer-monitoring-and-suspension.md","official_source_url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","source_publisher":null,"source_reference":"Article 26(5)","review_status":"verified","confidence_level":"high","last_verified_at":"2026-09-26","reviewed_by":null}
{"slug":"eu-ai-act-art-26-7-worker-information","title":"Employers must inform workers and their representatives before using high-risk AI at work","policy":"eu-ai-act","jurisdiction":"eu","category":"transparency","is_binding":true,"applies_from":"2027-12-02","summary":"Before putting a high-risk AI system into service or using it at the workplace, a deployer that is an employer must tell the workers' representatives and the affected workers that they will be subject to the system. The information is given following the procedures and rules on informing workers and their representatives under Union and national law and practice, which may include works-council consultation.","practical_action":"Add an AI Act notice step to the HR technology change process and consult the works council where national law requires it.","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-26-7-worker-information","context_url":"https://aipolicytracker.org/obligations/eu-ai-act-art-26-7-worker-information.md","official_source_url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","source_publisher":null,"source_reference":"Article 26(7)","review_status":"verified","confidence_level":"high","last_verified_at":"2026-09-26","reviewed_by":null}
{"slug":"eu-ai-act-art-26-8-public-authority-registration-before-use","title":"Public authorities must register their use of high-risk AI and must not use unregistered systems","policy":"eu-ai-act","jurisdiction":"eu","category":"public_sector_use","is_binding":true,"applies_from":"2027-12-02","summary":"Deployers that are public authorities or Union institutions, bodies, offices or agencies must register their use of an Annex III high-risk AI system in the EU database before putting it into service. If they find that the system they intend to use has not been registered in the database by its provider, they must not use it and must inform the provider or distributor.","practical_action":"Check the EU database entry for the provider's system as a procurement acceptance criterion, then register the deployment before go-live.","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-26-8-public-authority-registration-before-use","context_url":"https://aipolicytracker.org/obligations/eu-ai-act-art-26-8-public-authority-registration-before-use.md","official_source_url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","source_publisher":null,"source_reference":"Article 26(8); Article 49(3) and 49(4)","review_status":"verified","confidence_level":"high","last_verified_at":"2026-09-26","reviewed_by":null}
{"slug":"eu-ai-act-art-26-9-dpia-using-provider-information","title":"Deployers must use the provider's transparency information in their data protection impact assessment","policy":"eu-ai-act","jurisdiction":"eu","category":"privacy_data_protection","is_binding":true,"applies_from":"2027-12-02","summary":"Where a deployer of a high-risk AI system is required to carry out a data protection impact assessment under Article 35 of the GDPR or Article 27 of the Law Enforcement Directive, it must draw on the information the provider supplied under Article 13, such as the intended purpose, performance, limitations and human-oversight measures, when producing that assessment.","practical_action":"Attach the provider's instructions for use to the DPIA template and cross-reference the Article 27 fundamental rights impact assessment where one is required.","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-26-9-dpia-using-provider-information","context_url":"https://aipolicytracker.org/obligations/eu-ai-act-art-26-9-dpia-using-provider-information.md","official_source_url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","source_publisher":null,"source_reference":"Article 26(9)","review_status":"verified","confidence_level":"high","last_verified_at":"2026-09-26","reviewed_by":null}
{"slug":"eu-ai-act-art-26-10-post-remote-biometric-identification-authorisation","title":"Law-enforcement deployers must obtain authorisation for post-remote biometric identification and report annually","policy":"eu-ai-act","jurisdiction":"eu","category":"governance_accountability","is_binding":true,"applies_from":"2027-12-02","summary":"A deployer using a high-risk post-remote biometric identification system in a criminal investigation must request authorisation from a judicial or independent administrative authority in advance or within 48 hours, unless the use is only the initial identification of a potential suspect on objective and verifiable facts. Use is limited to a targeted search; if authorisation is refused, use stops and the data is deleted. No adverse legal decision may rest solely on the output, each use is documented, and the deployer reports annually to the market surveillance and data protection authorities.","practical_action":"Build the authorisation request, 48-hour clock and deletion step into the investigation workflow and schedule the annual report.","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-26-10-post-remote-biometric-identification-authorisation","context_url":"https://aipolicytracker.org/obligations/eu-ai-act-art-26-10-post-remote-biometric-identification-authorisation.md","official_source_url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","source_publisher":null,"source_reference":"Article 26(10)","review_status":"verified","confidence_level":"medium","last_verified_at":"2026-09-26","reviewed_by":null}
{"slug":"eu-ai-act-art-26-11-notice-to-affected-persons","title":"Deployers must tell natural persons that a high-risk AI system is used in decisions about them","policy":"eu-ai-act","jurisdiction":"eu","category":"transparency","is_binding":true,"applies_from":"2027-12-02","summary":"Deployers of Annex III high-risk AI systems that take decisions about natural persons, or help take them, must inform those persons that they are subject to the system. The notice is separate from any explanation owed under Article 86 and from the worker notice in Article 26(7). In law-enforcement contexts the duty follows the information rules of the Law Enforcement Directive.","practical_action":"Add a plain-language AI-use notice to application forms, decision letters or account terms for each affected decision process.","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-26-11-notice-to-affected-persons","context_url":"https://aipolicytracker.org/obligations/eu-ai-act-art-26-11-notice-to-affected-persons.md","official_source_url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","source_publisher":null,"source_reference":"Article 26(11)","review_status":"verified","confidence_level":"high","last_verified_at":"2026-09-26","reviewed_by":null}
{"slug":"eu-ai-act-art-50-2-synthetic-content-marking","title":"Providers of generative AI must mark synthetic output as artificially generated in a machine-readable way","policy":"eu-ai-act","jurisdiction":"eu","category":"transparency","is_binding":true,"applies_from":"2026-08-02","summary":"Providers of AI systems, including general-purpose AI systems, that generate synthetic audio, image, video or text must ensure the output is marked in a machine-readable format and detectable as artificially generated or manipulated. The technical solution must be effective, interoperable, robust and reliable as far as the state of the art allows, taking account of content type and cost. Systems that only perform assistive editing or do not substantially alter the input, and law-authorised criminal-detection uses, are outside the duty.","practical_action":"Implement watermarking or content credentials on generated output and keep test evidence that the mark survives common transformations.","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-50-2-synthetic-content-marking","context_url":"https://aipolicytracker.org/obligations/eu-ai-act-art-50-2-synthetic-content-marking.md","official_source_url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","source_publisher":null,"source_reference":"Article 50(2)","review_status":"verified","confidence_level":"high","last_verified_at":"2026-09-26","reviewed_by":null}
{"slug":"eu-ai-act-art-50-3-emotion-recognition-notice","title":"Deployers of emotion recognition or biometric categorisation must inform exposed persons","policy":"eu-ai-act","jurisdiction":"eu","category":"transparency","is_binding":true,"applies_from":"2026-08-02","summary":"A deployer of an emotion recognition system or a biometric categorisation system must inform the natural persons exposed to it that the system is operating and must process their personal data in line with the GDPR, the Law Enforcement Directive and the EU institutions data protection regulation. Systems permitted by law to detect, prevent or investigate criminal offences are excepted, subject to safeguards. Use in workplaces and schools is separately banned by Article 5 except for medical or safety reasons.","practical_action":"Place a visible notice at the point of capture and confirm a lawful basis for the biometric processing before switch-on.","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-50-3-emotion-recognition-notice","context_url":"https://aipolicytracker.org/obligations/eu-ai-act-art-50-3-emotion-recognition-notice.md","official_source_url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","source_publisher":null,"source_reference":"Article 50(3)","review_status":"verified","confidence_level":"high","last_verified_at":"2026-09-26","reviewed_by":null}
{"slug":"eu-ai-act-art-50-4-deepfake-and-public-interest-text-disclosure","title":"Deployers must disclose deepfakes and AI-generated text published on matters of public interest","policy":"eu-ai-act","jurisdiction":"eu","category":"transparency","is_binding":true,"applies_from":"2026-08-02","summary":"A deployer that generates or manipulates image, audio or video content that is a deep fake must disclose that the content has been artificially generated or manipulated, with lighter treatment for evidently artistic, creative, satirical or fictional works so that the disclosure does not spoil the work. A deployer that publishes AI-generated text to inform the public on matters of public interest must disclose this unless the text passed human review or editorial control and someone holds editorial responsibility. The disclosure must reach people clearly at the latest at first exposure.","practical_action":"Adopt a labelling standard for published synthetic media and a newsroom rule that AI-drafted public-interest text is either labelled or editorially signed off.","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-50-4-deepfake-and-public-interest-text-disclosure","context_url":"https://aipolicytracker.org/obligations/eu-ai-act-art-50-4-deepfake-and-public-interest-text-disclosure.md","official_source_url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","source_publisher":null,"source_reference":"Article 50(4)","review_status":"verified","confidence_level":"high","last_verified_at":"2026-09-26","reviewed_by":null}
{"slug":"eu-ai-act-art-52-systemic-risk-notification","title":"Providers of GPAI models must notify the Commission within two weeks of meeting the systemic-risk threshold","policy":"eu-ai-act","jurisdiction":"eu","category":"governance_accountability","is_binding":true,"applies_from":"2025-08-02","summary":"A provider whose general-purpose AI model meets the Article 51(1)(a) high-impact capability condition, which is presumed once cumulative training compute exceeds 10^25 floating-point operations, must notify the Commission without delay and in any event within two weeks of the condition being met or of learning that it will be met. The notification may include arguments that the model nonetheless does not present systemic risk; the Commission decides and keeps a public list of designated models.","practical_action":"Track cumulative training compute per model against the threshold and pre-draft the notification and any rebuttal arguments.","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-52-systemic-risk-notification","context_url":"https://aipolicytracker.org/obligations/eu-ai-act-art-52-systemic-risk-notification.md","official_source_url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","source_publisher":null,"source_reference":"Article 52(1)","review_status":"verified","confidence_level":"high","last_verified_at":"2026-09-26","reviewed_by":null}
{"slug":"eu-ai-act-art-53-gpai-technical-and-downstream-documentation","title":"Providers of GPAI models must maintain technical documentation and inform downstream providers","policy":"eu-ai-act","jurisdiction":"eu","category":"technical_documentation","is_binding":true,"applies_from":"2025-08-02","summary":"Providers of general-purpose AI models must draw up and keep up to date technical documentation covering the training and testing process and evaluation results, as set in Annex XI, and supply it to the AI Office or national authorities on request. They must also keep current the Annex XII information for providers that integrate the model into their own AI systems, so those providers understand its capabilities and limitations and can meet their own duties. Free and open-source models without systemic risk are exempt from both duties.","practical_action":"Maintain a model card and technical file aligned to Annexes XI and XII with version control tied to each model release.","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-53-gpai-technical-and-downstream-documentation","context_url":"https://aipolicytracker.org/obligations/eu-ai-act-art-53-gpai-technical-and-downstream-documentation.md","official_source_url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","source_publisher":null,"source_reference":"Article 53(1)(a) and 53(1)(b); Annexes XI and XII","review_status":"verified","confidence_level":"high","last_verified_at":"2026-09-26","reviewed_by":null}
{"slug":"eu-ai-act-art-54-gpai-authorised-representative","title":"Non-EU providers of GPAI models must appoint an EU authorised representative","policy":"eu-ai-act","jurisdiction":"eu","category":"governance_accountability","is_binding":true,"applies_from":"2025-08-02","summary":"Before placing a general-purpose AI model on the Union market, a provider established in a third country must appoint, by written mandate, an authorised representative established in the Union. The representative checks that the Annex XI documentation exists and the Article 53 duties are met, keeps a copy of the documentation and the provider's contact details for ten years after market placement, provides information to the AI Office on request, cooperates with authorities, and must end the mandate if the provider breaches the Regulation. Open-source models without systemic risk are exempt.","practical_action":"Appoint an EU representative under a written mandate covering document retention and AI Office liaison before the model reaches EU users.","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-54-gpai-authorised-representative","context_url":"https://aipolicytracker.org/obligations/eu-ai-act-art-54-gpai-authorised-representative.md","official_source_url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","source_publisher":null,"source_reference":"Article 54","review_status":"verified","confidence_level":"high","last_verified_at":"2026-09-26","reviewed_by":null}
{"slug":"eu-ai-act-art-55-systemic-risk-incident-reporting","title":"Providers of systemic-risk GPAI models must track and report serious incidents to the AI Office","policy":"eu-ai-act","jurisdiction":"eu","category":"incident_handling","is_binding":true,"applies_from":"2025-08-02","summary":"Providers of general-purpose AI models with systemic risk must keep track of, document and report without undue delay to the AI Office and, where relevant, to national competent authorities the relevant information about serious incidents and the possible corrective measures to address them. The General-Purpose AI Code of Practice sets out timelines and content that providers may follow to demonstrate compliance.","practical_action":"Define serious-incident criteria for the model, a tracking log and an AI Office notification template with owner and clock.","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-55-systemic-risk-incident-reporting","context_url":"https://aipolicytracker.org/obligations/eu-ai-act-art-55-systemic-risk-incident-reporting.md","official_source_url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","source_publisher":null,"source_reference":"Article 55(1)(c)","review_status":"verified","confidence_level":"high","last_verified_at":"2026-09-26","reviewed_by":null}
{"slug":"eu-ai-act-art-55-systemic-risk-cybersecurity","title":"Providers of systemic-risk GPAI models must secure the model and its infrastructure","policy":"eu-ai-act","jurisdiction":"eu","category":"accuracy_robustness_security","is_binding":true,"applies_from":"2025-08-02","summary":"Providers of general-purpose AI models with systemic risk must ensure an adequate level of cybersecurity protection for the model and for the physical infrastructure it runs on, which in practice covers protection of model weights, training and inference environments, and access controls against theft, tampering and unauthorised release. Codes of practice and harmonised standards may be used to show compliance.","practical_action":"Apply a documented security standard to weight storage, training clusters and inference endpoints, with penetration tests and insider-risk controls.","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-55-systemic-risk-cybersecurity","context_url":"https://aipolicytracker.org/obligations/eu-ai-act-art-55-systemic-risk-cybersecurity.md","official_source_url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","source_publisher":null,"source_reference":"Article 55(1)(d)","review_status":"verified","confidence_level":"high","last_verified_at":"2026-09-26","reviewed_by":null}
{"slug":"eu-ai-act-art-86-right-to-explanation","title":"Deployers must explain individual decisions taken with high-risk AI on request","policy":"eu-ai-act","jurisdiction":"eu","category":"transparency","is_binding":true,"applies_from":"2027-12-02","summary":"A person affected by a decision that a deployer took on the basis of the output of an Annex III high-risk AI system, other than critical-infrastructure systems, which produces legal effects or similarly significantly affects them in a way they consider adverse to their health, safety or fundamental rights, has the right to obtain from the deployer clear and meaningful explanations of the role the system played in the decision and the main elements of the decision. The right does not apply where Union or national law provides an exception.","practical_action":"Set up a request channel and an explanation template that names the system's role, the key inputs and the human decision points for each affected process.","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-86-right-to-explanation","context_url":"https://aipolicytracker.org/obligations/eu-ai-act-art-86-right-to-explanation.md","official_source_url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","source_publisher":null,"source_reference":"Article 86","review_status":"verified","confidence_level":"high","last_verified_at":"2026-09-26","reviewed_by":null}
{"slug":"south-korea-ai-basic-act-art-31-advance-notice-of-high-impact-and-generative-ai","title":"AI business operators must notify users in advance that a product or service runs on high-impact or generative AI","policy":"south-korea-framework-act-on-the-development-of-artificial-intelligence-and-establishment-of-a-foundation-for","jurisdiction":"south-korea","category":"transparency","is_binding":true,"applies_from":"2026-01-22","summary":"An AI business operator that provides a product or service operated by high-impact AI or by generative AI must notify users in advance that the product or service is based on such AI. The notice is owed before use and is the entry point of the Act's transparency chapter; failure to give it can attract an administrative fine after a corrective order.","practical_action":"Add a plain-language AI notice at onboarding or first use for any product that relies on high-impact or generative AI.","url":"https://aipolicytracker.org/obligations/south-korea-ai-basic-act-art-31-advance-notice-of-high-impact-and-generative-ai","context_url":"https://aipolicytracker.org/obligations/south-korea-ai-basic-act-art-31-advance-notice-of-high-impact-and-generative-ai.md","official_source_url":"https://www.law.go.kr/lsInfoP.do?lsiSeq=268543","source_publisher":null,"source_reference":"Article 31(1)","review_status":"verified","confidence_level":"medium","last_verified_at":"2026-09-26","reviewed_by":null}
{"slug":"south-korea-ai-basic-act-art-31-generative-output-labelling-and-deepfake-notice","title":"AI business operators must label generative AI output and clearly flag realistic synthetic media","policy":"south-korea-framework-act-on-the-development-of-artificial-intelligence-and-establishment-of-a-foundation-for","jurisdiction":"south-korea","category":"transparency","is_binding":true,"applies_from":"2026-01-22","summary":"An AI business operator that provides generative AI or a product or service using it must indicate that the output was generated by generative AI. Where the operator provides content such as virtual sound, images or video that is hard to distinguish from reality, it must clearly notify users that the content is AI-generated, in a manner that does not impair a work's artistic or creative expression where that applies. Detailed methods are left to Presidential Decree and ministry guidance.","practical_action":"Apply visible labels and, where feasible, embedded provenance marks to generated audio, image and video, and track the decree's technical specifications.","url":"https://aipolicytracker.org/obligations/south-korea-ai-basic-act-art-31-generative-output-labelling-and-deepfake-notice","context_url":"https://aipolicytracker.org/obligations/south-korea-ai-basic-act-art-31-generative-output-labelling-and-deepfake-notice.md","official_source_url":"https://www.law.go.kr/lsInfoP.do?lsiSeq=268543","source_publisher":null,"source_reference":"Article 31(2) and 31(3)","review_status":"verified","confidence_level":"medium","last_verified_at":"2026-09-26","reviewed_by":null}
{"slug":"south-korea-ai-basic-act-art-32-safety-measures-for-high-performance-ai","title":"Operators of AI above the compute threshold must run lifecycle risk management and report safety results","policy":"south-korea-framework-act-on-the-development-of-artificial-intelligence-and-establishment-of-a-foundation-for","jurisdiction":"south-korea","category":"safety_testing","is_binding":true,"applies_from":"2026-01-22","summary":"An AI business operator whose AI system's cumulative training computation exceeds the threshold set by Presidential Decree must identify, assess and mitigate risks across the system's life cycle, build a risk management system to monitor and respond to safety incidents caused by the AI, and submit the results of these measures to the Minister of Science and ICT. The threshold and reporting form are set in the Decree.","practical_action":"Track training compute against the decree threshold and prepare a safety report covering risk identification, mitigation and incident monitoring for submission to the ministry.","url":"https://aipolicytracker.org/obligations/south-korea-ai-basic-act-art-32-safety-measures-for-high-performance-ai","context_url":"https://aipolicytracker.org/obligations/south-korea-ai-basic-act-art-32-safety-measures-for-high-performance-ai.md","official_source_url":"https://www.law.go.kr/lsInfoP.do?lsiSeq=268543","source_publisher":null,"source_reference":"Article 32","review_status":"verified","confidence_level":"medium","last_verified_at":"2026-09-26","reviewed_by":null}
{"slug":"south-korea-ai-basic-act-art-34-high-impact-ai-risk-management-plan","title":"Operators of high-impact AI must establish and operate a risk management plan","policy":"south-korea-framework-act-on-the-development-of-artificial-intelligence-and-establishment-of-a-foundation-for","jurisdiction":"south-korea","category":"risk_management","is_binding":true,"applies_from":"2026-01-22","summary":"An AI business operator that provides high-impact AI, or a product or service using it, must establish and operate a plan for managing the risks of that AI. High-impact AI is AI used in areas such as energy, drinking water, health care and medical devices, nuclear safety, biometric analysis for criminal investigation, decisions on recruitment or loans, transport, public services and education, where it may materially affect life, safety or fundamental rights.","practical_action":"Classify systems against the high-impact areas and write a risk management plan for each one before launch.","url":"https://aipolicytracker.org/obligations/south-korea-ai-basic-act-art-34-high-impact-ai-risk-management-plan","context_url":"https://aipolicytracker.org/obligations/south-korea-ai-basic-act-art-34-high-impact-ai-risk-management-plan.md","official_source_url":"https://www.law.go.kr/lsInfoP.do?lsiSeq=268543","source_publisher":null,"source_reference":"Article 34(1)","review_status":"verified","confidence_level":"medium","last_verified_at":"2026-09-26","reviewed_by":null}
{"slug":"south-korea-ai-basic-act-art-34-high-impact-ai-explanation-measures","title":"Operators of high-impact AI must be able to explain outputs and the main criteria behind them","policy":"south-korea-framework-act-on-the-development-of-artificial-intelligence-and-establishment-of-a-foundation-for","jurisdiction":"south-korea","category":"transparency","is_binding":true,"applies_from":"2026-01-22","summary":"Operators of high-impact AI must put in place measures to explain the AI's final results, the main criteria used to reach them, and an overview of the training data, to the extent that this is technically feasible. The duty targets explainability of the system's decisions to users and affected people rather than full disclosure of the model.","practical_action":"Document the decision criteria and training-data overview for each high-impact system and prepare a user-facing explanation format.","url":"https://aipolicytracker.org/obligations/south-korea-ai-basic-act-art-34-high-impact-ai-explanation-measures","context_url":"https://aipolicytracker.org/obligations/south-korea-ai-basic-act-art-34-high-impact-ai-explanation-measures.md","official_source_url":"https://www.law.go.kr/lsInfoP.do?lsiSeq=268543","source_publisher":null,"source_reference":"Article 34(1)","review_status":"verified","confidence_level":"medium","last_verified_at":"2026-09-26","reviewed_by":null}
{"slug":"south-korea-ai-basic-act-art-34-high-impact-ai-human-oversight","title":"Operators of high-impact AI must ensure human management and supervision","policy":"south-korea-framework-act-on-the-development-of-artificial-intelligence-and-establishment-of-a-foundation-for","jurisdiction":"south-korea","category":"human_oversight","is_binding":true,"applies_from":"2026-01-22","summary":"Operators of high-impact AI must ensure that the AI is subject to human management and supervision, so that people remain able to monitor its operation and intervene in or override its outputs where those outputs may affect life, physical safety or fundamental rights.","practical_action":"Assign accountable supervisors for each high-impact system and design the interface so they can pause, correct or overrule outputs.","url":"https://aipolicytracker.org/obligations/south-korea-ai-basic-act-art-34-high-impact-ai-human-oversight","context_url":"https://aipolicytracker.org/obligations/south-korea-ai-basic-act-art-34-high-impact-ai-human-oversight.md","official_source_url":"https://www.law.go.kr/lsInfoP.do?lsiSeq=268543","source_publisher":null,"source_reference":"Article 34(1)","review_status":"verified","confidence_level":"medium","last_verified_at":"2026-09-26","reviewed_by":null}
{"slug":"south-korea-ai-basic-act-art-34-high-impact-ai-user-protection-and-documentation","title":"Operators of high-impact AI must prepare user-protection measures and keep records of their safety and trust measures","policy":"south-korea-framework-act-on-the-development-of-artificial-intelligence-and-establishment-of-a-foundation-for","jurisdiction":"south-korea","category":"governance_accountability","is_binding":true,"applies_from":"2026-01-22","summary":"Operators of high-impact AI must prepare and implement a plan to protect users, and must prepare and keep documents describing the measures they take to secure the AI's safety and reliability, so that they can be shown to the Ministry of Science and ICT on request. Further items may be added by Presidential Decree, and the ministry may publish guidelines on how to meet these duties.","practical_action":"Write a user-protection plan for each high-impact system and keep a dated file of the safety and trust measures applied to it.","url":"https://aipolicytracker.org/obligations/south-korea-ai-basic-act-art-34-high-impact-ai-user-protection-and-documentation","context_url":"https://aipolicytracker.org/obligations/south-korea-ai-basic-act-art-34-high-impact-ai-user-protection-and-documentation.md","official_source_url":"https://www.law.go.kr/lsInfoP.do?lsiSeq=268543","source_publisher":null,"source_reference":"Article 34(1)","review_status":"verified","confidence_level":"medium","last_verified_at":"2026-09-26","reviewed_by":null}
{"slug":"south-korea-ai-basic-act-art-35-high-impact-ai-impact-assessment","title":"Operators of high-impact AI should assess its impact on fundamental rights before use","policy":"south-korea-framework-act-on-the-development-of-artificial-intelligence-and-establishment-of-a-foundation-for","jurisdiction":"south-korea","category":"impact_assessment","is_binding":false,"applies_from":"2026-01-22","summary":"An AI business operator that provides high-impact AI, or a product or service using it, is to make efforts to assess in advance the impact the AI may have on people's fundamental rights. The provision is drafted as an endeavour duty rather than a hard requirement, but public bodies procuring high-impact AI are directed to give preference to products that have undergone such an assessment, and the ministry may set assessment methods.","practical_action":"Run a fundamental-rights impact assessment for each high-impact system, particularly where public-sector procurement is in view.","url":"https://aipolicytracker.org/obligations/south-korea-ai-basic-act-art-35-high-impact-ai-impact-assessment","context_url":"https://aipolicytracker.org/obligations/south-korea-ai-basic-act-art-35-high-impact-ai-impact-assessment.md","official_source_url":"https://www.law.go.kr/lsInfoP.do?lsiSeq=268543","source_publisher":null,"source_reference":"Article 35","review_status":"verified","confidence_level":"medium","last_verified_at":"2026-09-26","reviewed_by":null}
{"slug":"south-korea-ai-basic-act-art-36-domestic-representative","title":"Foreign AI business operators above the threshold must designate a domestic representative in Korea","policy":"south-korea-framework-act-on-the-development-of-artificial-intelligence-and-establishment-of-a-foundation-for","jurisdiction":"south-korea","category":"governance_accountability","is_binding":true,"applies_from":"2026-01-22","summary":"An AI business operator without an address or place of business in Korea, whose user numbers or revenue meet the thresholds set by Presidential Decree, must designate in writing a domestic representative with an address in Korea. The representative handles the operator's duties under the Act, including submitting the Article 32 safety results, supporting high-impact AI confirmation and cooperating with fact-finding investigations, and the operator is treated as responsible for the representative's acts.","practical_action":"Check user and revenue figures against the decree thresholds and appoint a Korean representative by written designation before the duty bites.","url":"https://aipolicytracker.org/obligations/south-korea-ai-basic-act-art-36-domestic-representative","context_url":"https://aipolicytracker.org/obligations/south-korea-ai-basic-act-art-36-domestic-representative.md","official_source_url":"https://www.law.go.kr/lsInfoP.do?lsiSeq=268543","source_publisher":null,"source_reference":"Article 36","review_status":"verified","confidence_level":"medium","last_verified_at":"2026-09-26","reviewed_by":null}
{"slug":"us-california-sb-53-transparency-report","title":"Frontier developers must publish a transparency report before deploying a new frontier model","policy":"us-california-sb-53","jurisdiction":"us-california","category":"transparency","is_binding":true,"applies_from":"2026-01-01","summary":"Before or at the time a frontier developer deploys a new frontier model, or a substantially modified version, it must publish a transparency report on its website describing the model, its intended uses and restrictions, the release date and modalities, and how to contact the developer. A large frontier developer must add a summary of its catastrophic-risk assessment for the model, the results, any third-party evaluators involved and the steps taken under its frontier AI framework, with trade-secret and security redactions explained.","practical_action":"Attach a model-release transparency report to the launch checklist, with a redaction log for withheld details.","url":"https://aipolicytracker.org/obligations/us-california-sb-53-transparency-report","context_url":"https://aipolicytracker.org/obligations/us-california-sb-53-transparency-report.md","official_source_url":"https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202520260SB53","source_publisher":null,"source_reference":"Business and Professions Code Section 22757.12 (as added by SB 53)","review_status":"verified","confidence_level":"medium","last_verified_at":"2026-09-26","reviewed_by":null}
{"slug":"us-california-sb-53-catastrophic-risk-assessment-summaries","title":"Large frontier developers must send periodic summaries of catastrophic-risk assessments to the state","policy":"us-california-sb-53","jurisdiction":"us-california","category":"safety_testing","is_binding":true,"applies_from":"2026-01-01","summary":"A large frontier developer must transmit to the California Office of Emergency Services, on the periodic schedule the statute sets, a summary of any assessment of catastrophic risk that results from the internal use of its frontier models. This covers risks arising before public deployment, such as during internal evaluation or use of the model to accelerate research, and complements the public transparency report.","practical_action":"Schedule a recurring internal-use risk assessment and a state submission with a fixed owner in the safety team.","url":"https://aipolicytracker.org/obligations/us-california-sb-53-catastrophic-risk-assessment-summaries","context_url":"https://aipolicytracker.org/obligations/us-california-sb-53-catastrophic-risk-assessment-summaries.md","official_source_url":"https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202520260SB53","source_publisher":null,"source_reference":"Business and Professions Code Section 22757.12 (as added by SB 53)","review_status":"verified","confidence_level":"medium","last_verified_at":"2026-09-26","reviewed_by":null}
{"slug":"us-california-sb-53-whistleblower-protections","title":"Frontier developers must protect employees who report catastrophic-risk concerns","policy":"us-california-sb-53","jurisdiction":"us-california","category":"governance_accountability","is_binding":true,"applies_from":"2026-01-01","summary":"A frontier developer must not adopt rules or take action that prevent or retaliate against a covered employee for disclosing to the Attorney General, a federal authority, a manager or another employee with authority that the developer's activities pose a specific and substantial danger to public health or safety from catastrophic risk, or that it has violated the Act. Covered employees must be given clear notice of these rights, and large frontier developers must run an anonymous internal reporting process with regular updates to the reporter and to officers and directors.","practical_action":"Publish a whistleblower policy covering catastrophic-risk concerns, stand up an anonymous channel and brief managers on the anti-retaliation rule.","url":"https://aipolicytracker.org/obligations/us-california-sb-53-whistleblower-protections","context_url":"https://aipolicytracker.org/obligations/us-california-sb-53-whistleblower-protections.md","official_source_url":"https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202520260SB53","source_publisher":null,"source_reference":"Labor Code Section 1107 (as added by SB 53)","review_status":"verified","confidence_level":"medium","last_verified_at":"2026-09-26","reviewed_by":null}
{"slug":"us-colorado-ai-act-developer-reasonable-care","title":"Developers must use reasonable care to avoid algorithmic discrimination","policy":"us-colorado-ai-act","jurisdiction":"us-colorado","category":"risk_management","is_binding":true,"applies_from":null,"summary":"A developer of a high-risk AI system must use reasonable care to protect consumers from any known or reasonably foreseeable risk of algorithmic discrimination arising from the intended and contracted uses of the system. A developer that meets the documentation, public-statement and Attorney General disclosure duties in the rest of section 6-1-1702 benefits from a rebuttable presumption that it used reasonable care.","practical_action":"Run and record a discrimination-risk assessment for each high-risk system before release and keep it current so the statutory presumption can be claimed.","url":"https://aipolicytracker.org/obligations/us-colorado-ai-act-developer-reasonable-care","context_url":"https://aipolicytracker.org/obligations/us-colorado-ai-act-developer-reasonable-care.md","official_source_url":"https://leg.colorado.gov/bills/sb24-205","source_publisher":null,"source_reference":"C.R.S. 6-1-1702(1)","review_status":"pending_review","confidence_level":"high","last_verified_at":null,"reviewed_by":null}
{"slug":"us-colorado-ai-act-developer-disclosure-to-attorney-general","title":"Developers must notify the Attorney General and deployers of discovered algorithmic discrimination","policy":"us-colorado-ai-act","jurisdiction":"us-colorado","category":"incident_handling","is_binding":true,"applies_from":null,"summary":"Within 90 days after a developer discovers, through ongoing testing or a credible report from a deployer, that a high-risk AI system it developed has caused or is reasonably likely to have caused algorithmic discrimination, it must disclose this to the Colorado Attorney General and to all known deployers or other developers of the system, without unreasonable delay.","practical_action":"Route bias findings and deployer complaints into an incident process with a 90-day regulatory and customer notification clock.","url":"https://aipolicytracker.org/obligations/us-colorado-ai-act-developer-disclosure-to-attorney-general","context_url":"https://aipolicytracker.org/obligations/us-colorado-ai-act-developer-disclosure-to-attorney-general.md","official_source_url":"https://leg.colorado.gov/bills/sb24-205","source_publisher":null,"source_reference":"C.R.S. 6-1-1702(5)","review_status":"pending_review","confidence_level":"high","last_verified_at":null,"reviewed_by":null}
{"slug":"us-colorado-ai-act-deployer-reasonable-care","title":"Deployers must use reasonable care to avoid algorithmic discrimination","policy":"us-colorado-ai-act","jurisdiction":"us-colorado","category":"risk_management","is_binding":true,"applies_from":null,"summary":"A deployer of a high-risk AI system must use reasonable care to protect consumers from known or reasonably foreseeable risks of algorithmic discrimination. A deployer that runs the required risk-management programme, completes impact assessments, gives consumer notices and makes the required disclosures benefits from a rebuttable presumption of reasonable care; some deployers with fewer than 50 employees are relieved of parts of the programme and assessment duties when they rely on the developer's impact assessment.","practical_action":"Treat each consequential-decision use of AI as a governed system with an owner, a risk record and the statutory paperwork so the presumption is available.","url":"https://aipolicytracker.org/obligations/us-colorado-ai-act-deployer-reasonable-care","context_url":"https://aipolicytracker.org/obligations/us-colorado-ai-act-deployer-reasonable-care.md","official_source_url":"https://leg.colorado.gov/bills/sb24-205","source_publisher":null,"source_reference":"C.R.S. 6-1-1703(1)","review_status":"pending_review","confidence_level":"high","last_verified_at":null,"reviewed_by":null}
{"slug":"us-colorado-ai-act-deployer-public-statement","title":"Deployers must publish a statement about the high-risk AI systems they use","policy":"us-colorado-ai-act","jurisdiction":"us-colorado","category":"transparency","is_binding":true,"applies_from":null,"summary":"A deployer must make available on its website, or in another public way, a clear and readily available statement summarising the types of high-risk AI systems it currently deploys, how it manages known or reasonably foreseeable risks of algorithmic discrimination from those systems, and the nature, source and extent of the information it collects and uses. The statement must be updated periodically.","practical_action":"Publish an AI-use page listing high-risk systems in plain language and review it whenever a system is added or changed.","url":"https://aipolicytracker.org/obligations/us-colorado-ai-act-deployer-public-statement","context_url":"https://aipolicytracker.org/obligations/us-colorado-ai-act-deployer-public-statement.md","official_source_url":"https://leg.colorado.gov/bills/sb24-205","source_publisher":null,"source_reference":"C.R.S. 6-1-1703(5)","review_status":"pending_review","confidence_level":"high","last_verified_at":null,"reviewed_by":null}
{"slug":"us-colorado-ai-act-deployer-disclosure-to-attorney-general","title":"Deployers must notify the Attorney General of discovered algorithmic discrimination","policy":"us-colorado-ai-act","jurisdiction":"us-colorado","category":"incident_handling","is_binding":true,"applies_from":null,"summary":"If a deployer discovers that a high-risk AI system it uses has caused algorithmic discrimination, it must send a notice to the Colorado Attorney General within 90 days of the discovery, in the form the Attorney General prescribes, without unreasonable delay.","practical_action":"Add a 90-day Attorney General notification step to the incident playbook for consequential-decision systems.","url":"https://aipolicytracker.org/obligations/us-colorado-ai-act-deployer-disclosure-to-attorney-general","context_url":"https://aipolicytracker.org/obligations/us-colorado-ai-act-deployer-disclosure-to-attorney-general.md","official_source_url":"https://leg.colorado.gov/bills/sb24-205","source_publisher":null,"source_reference":"C.R.S. 6-1-1703(7)","review_status":"pending_review","confidence_level":"high","last_verified_at":null,"reviewed_by":null}
{"slug":"us-colorado-ai-act-consumer-ai-interaction-disclosure","title":"Deployers and developers must disclose to consumers that they are interacting with an AI system","policy":"us-colorado-ai-act","jurisdiction":"us-colorado","category":"transparency","is_binding":true,"applies_from":null,"summary":"Any developer or deployer that makes an AI system available to consumers that is intended to interact with them must disclose to each consumer that they are interacting with an AI system, unless that would be obvious to a reasonable person. This duty is not limited to high-risk systems and covers chatbots and voice agents offered to Colorado consumers.","practical_action":"Add an AI disclosure at the start of chatbot, voice and messaging interactions and record where it appears.","url":"https://aipolicytracker.org/obligations/us-colorado-ai-act-consumer-ai-interaction-disclosure","context_url":"https://aipolicytracker.org/obligations/us-colorado-ai-act-consumer-ai-interaction-disclosure.md","official_source_url":"https://leg.colorado.gov/bills/sb24-205","source_publisher":null,"source_reference":"C.R.S. 6-1-1704","review_status":"pending_review","confidence_level":"high","last_verified_at":null,"reviewed_by":null}
{"slug":"us-new-york-city-local-law-144-bias-audit","title":"Employers and employment agencies must obtain an independent bias audit before using an automated employment decision tool","policy":"us-new-york-city-local-law-144-automated-employment-decision-tools","jurisdiction":"us-new-york","category":"accuracy_robustness_security","is_binding":true,"applies_from":"2023-07-05","summary":"An automated employment decision tool may not be used to screen candidates or employees for hiring or promotion in New York City unless it has been the subject of a bias audit by an independent auditor within the year before use. The audit calculates selection rates and impact ratios by sex, race/ethnicity and their intersections, and scoring-rate comparisons for tools that score rather than select, using the employer's historical data or, where insufficient, test data as the DCWP rules allow.","practical_action":"Commission an annual independent bias audit for each tool, supplying historical outcome data by protected category, and calendar the twelve-month expiry.","url":"https://aipolicytracker.org/obligations/us-new-york-city-local-law-144-bias-audit","context_url":"https://aipolicytracker.org/obligations/us-new-york-city-local-law-144-bias-audit.md","official_source_url":"https://www.nyc.gov/site/dca/about/automated-employment-decision-tools.page","source_publisher":null,"source_reference":"NYC Administrative Code Section 20-871(a)(1); 6 RCNY Section 5-301","review_status":"verified","confidence_level":"high","last_verified_at":"2026-09-26","reviewed_by":null}
{"slug":"us-new-york-city-local-law-144-publish-audit-summary","title":"Employers and employment agencies must publish a summary of the bias audit results","policy":"us-new-york-city-local-law-144-automated-employment-decision-tools","jurisdiction":"us-new-york","category":"transparency","is_binding":true,"applies_from":"2023-07-05","summary":"Before using an automated employment decision tool, the employer or employment agency must make a summary of the most recent bias audit results and the distribution date of the tool publicly available on the employment section of its website. Under the DCWP rules the summary states the audit date, the data source and type, the number of applicants or candidates in each category, and the selection or scoring rates and impact ratios, and must remain posted for at least six months after the tool was last used.","practical_action":"Post the audit summary and distribution date on the careers page before go-live and refresh it with each annual audit.","url":"https://aipolicytracker.org/obligations/us-new-york-city-local-law-144-publish-audit-summary","context_url":"https://aipolicytracker.org/obligations/us-new-york-city-local-law-144-publish-audit-summary.md","official_source_url":"https://www.nyc.gov/site/dca/about/automated-employment-decision-tools.page","source_publisher":null,"source_reference":"NYC Administrative Code Section 20-871(a)(2); 6 RCNY Section 5-302","review_status":"verified","confidence_level":"high","last_verified_at":"2026-09-26","reviewed_by":null}
{"slug":"us-new-york-city-local-law-144-candidate-notice","title":"Employers and employment agencies must notify candidates and employees before an automated tool is used","policy":"us-new-york-city-local-law-144-automated-employment-decision-tools","jurisdiction":"us-new-york","category":"transparency","is_binding":true,"applies_from":"2023-07-05","summary":"Candidates and employees who reside in New York City must be told, at least ten business days before an automated employment decision tool is used to assess them, that such a tool will be used in the hiring or promotion decision, and which job qualifications and characteristics the tool will assess. The DCWP rules allow the notice to be given on the careers page, in the job posting, or by mail or email, and require that it reach the person before the tool is applied.","practical_action":"Insert the tool notice and the assessed qualifications into job postings and application confirmations at least ten business days before screening.","url":"https://aipolicytracker.org/obligations/us-new-york-city-local-law-144-candidate-notice","context_url":"https://aipolicytracker.org/obligations/us-new-york-city-local-law-144-candidate-notice.md","official_source_url":"https://www.nyc.gov/site/dca/about/automated-employment-decision-tools.page","source_publisher":null,"source_reference":"NYC Administrative Code Section 20-871(b)(1) and (b)(2); 6 RCNY Section 5-303","review_status":"verified","confidence_level":"high","last_verified_at":"2026-09-26","reviewed_by":null}
{"slug":"us-new-york-city-local-law-144-alternative-process-request","title":"Employers and employment agencies must let candidates request an alternative selection process or accommodation","policy":"us-new-york-city-local-law-144-automated-employment-decision-tools","jurisdiction":"us-new-york","category":"human_oversight","is_binding":true,"applies_from":"2023-07-05","summary":"The advance notice to candidates and employees must allow them to request an alternative selection process or a reasonable accommodation. The DCWP rules make clear that the law itself does not require the employer to provide an alternative process, but the request route must exist and accommodation requests remain governed by disability and human-rights law. Instructions for making the request must be included in the notice.","practical_action":"Provide a request mechanism in the candidate notice and record how each request was handled under the accommodation policy.","url":"https://aipolicytracker.org/obligations/us-new-york-city-local-law-144-alternative-process-request","context_url":"https://aipolicytracker.org/obligations/us-new-york-city-local-law-144-alternative-process-request.md","official_source_url":"https://www.nyc.gov/site/dca/about/automated-employment-decision-tools.page","source_publisher":null,"source_reference":"NYC Administrative Code Section 20-871(b)(1); 6 RCNY Section 5-303","review_status":"verified","confidence_level":"high","last_verified_at":"2026-09-26","reviewed_by":null}
{"slug":"us-new-york-city-local-law-144-data-policy-disclosure","title":"Employers and employment agencies must disclose the data collected and their retention policy for the tool","policy":"us-new-york-city-local-law-144-automated-employment-decision-tools","jurisdiction":"us-new-york","category":"privacy_data_protection","is_binding":true,"applies_from":"2023-07-05","summary":"Unless already disclosed on the website, an employer or employment agency must provide, within 30 days of a written request from a candidate or employee, information about the type of data the automated employment decision tool collects, the source of that data, and the employer's or agency's data retention policy. The DCWP rules allow this information to be posted publicly instead of answered case by case.","practical_action":"Publish a short data notice for the tool covering data types, sources and retention, or set up a 30-day response process for written requests.","url":"https://aipolicytracker.org/obligations/us-new-york-city-local-law-144-data-policy-disclosure","context_url":"https://aipolicytracker.org/obligations/us-new-york-city-local-law-144-data-policy-disclosure.md","official_source_url":"https://www.nyc.gov/site/dca/about/automated-employment-decision-tools.page","source_publisher":null,"source_reference":"NYC Administrative Code Section 20-871(b)(3); 6 RCNY Section 5-303","review_status":"verified","confidence_level":"high","last_verified_at":"2026-09-26","reviewed_by":null}
{"slug":"us-texas-responsible-ai-governance-act-traiga-government-agency-ai-interaction-disclosure","title":"Government agencies must disclose to consumers that they are interacting with an AI system","policy":"us-texas-responsible-ai-governance-act-traiga","jurisdiction":"us-texas","category":"transparency","is_binding":true,"applies_from":"2026-01-01","summary":"A governmental agency that makes an AI system available to interact with consumers must disclose to each consumer, before or at the time of the interaction, that they are interacting with an AI system. The disclosure is owed even where the AI nature of the interaction would be obvious, must be clear and conspicuous, written in plain language and may not use a dark pattern; a hyperlink to the disclosure is acceptable for online services.","practical_action":"Put a plain-language AI notice at the entry point of every public-facing chatbot, voice line or automated service and keep a screenshot record.","url":"https://aipolicytracker.org/obligations/us-texas-responsible-ai-governance-act-traiga-government-agency-ai-interaction-disclosure","context_url":"https://aipolicytracker.org/obligations/us-texas-responsible-ai-governance-act-traiga-government-agency-ai-interaction-disclosure.md","official_source_url":"https://capitol.texas.gov/BillLookup/History.aspx?LegSess=89R&Bill=HB149","source_publisher":null,"source_reference":"Business and Commerce Code Section 551.051","review_status":"verified","confidence_level":"high","last_verified_at":"2026-09-26","reviewed_by":null}
{"slug":"us-texas-responsible-ai-governance-act-traiga-health-care-ai-disclosure","title":"Health-care providers must disclose the use of AI in patient services","policy":"us-texas-responsible-ai-governance-act-traiga","jurisdiction":"us-texas","category":"transparency","is_binding":true,"applies_from":"2026-01-01","summary":"A person who provides health-care services or treatment and uses an AI system in relation to those services must disclose that use to the patient, or to the patient's personal representative or guardian, no later than the date the service or treatment is first provided, with an exception for emergencies where the disclosure is made as soon as reasonably possible. The disclosure must be clear, conspicuous and in plain language.","practical_action":"Add an AI-use statement to intake and consent materials for services that use AI, with an emergency-follow-up rule.","url":"https://aipolicytracker.org/obligations/us-texas-responsible-ai-governance-act-traiga-health-care-ai-disclosure","context_url":"https://aipolicytracker.org/obligations/us-texas-responsible-ai-governance-act-traiga-health-care-ai-disclosure.md","official_source_url":"https://capitol.texas.gov/BillLookup/History.aspx?LegSess=89R&Bill=HB149","source_publisher":null,"source_reference":"Business and Commerce Code Section 551.051","review_status":"verified","confidence_level":"medium","last_verified_at":"2026-09-26","reviewed_by":null}
{"slug":"us-texas-responsible-ai-governance-act-traiga-manipulation-prohibition","title":"Developers and deployers must not use AI to incite self-harm, harm to others or crime","policy":"us-texas-responsible-ai-governance-act-traiga","jurisdiction":"us-texas","category":"prohibited_practice","is_binding":true,"applies_from":"2026-01-01","summary":"A person may not develop or deploy an AI system in a manner that intentionally aims to incite or encourage a person to commit physical self-harm, including suicide, to harm another person, or to engage in criminal activity. The prohibition turns on the developer's or deployer's intent rather than on the system's effects, which is the pattern followed throughout the Act's prohibited-use provisions.","practical_action":"Record the intended purpose of each system at design review and add safety testing for self-harm and violence content in conversational products.","url":"https://aipolicytracker.org/obligations/us-texas-responsible-ai-governance-act-traiga-manipulation-prohibition","context_url":"https://aipolicytracker.org/obligations/us-texas-responsible-ai-governance-act-traiga-manipulation-prohibition.md","official_source_url":"https://capitol.texas.gov/BillLookup/History.aspx?LegSess=89R&Bill=HB149","source_publisher":null,"source_reference":"Business and Commerce Code Section 551.052","review_status":"verified","confidence_level":"high","last_verified_at":"2026-09-26","reviewed_by":null}
{"slug":"us-texas-responsible-ai-governance-act-traiga-government-social-scoring-prohibition","title":"Governmental entities must not use AI for social scoring","policy":"us-texas-responsible-ai-governance-act-traiga","jurisdiction":"us-texas","category":"prohibited_practice","is_binding":true,"applies_from":"2026-01-01","summary":"A governmental entity may not develop or deploy an AI system that evaluates or classifies natural persons or groups on the basis of their social behaviour or personal characteristics, with the intent to calculate or assign a social score or similar valuation that leads to detrimental or unfavourable treatment unrelated to the context in which the data was collected, or that is unjustified or disproportionate to the behaviour.","practical_action":"Screen agency scoring, eligibility and risk-ranking tools for social-scoring characteristics before procurement or build.","url":"https://aipolicytracker.org/obligations/us-texas-responsible-ai-governance-act-traiga-government-social-scoring-prohibition","context_url":"https://aipolicytracker.org/obligations/us-texas-responsible-ai-governance-act-traiga-government-social-scoring-prohibition.md","official_source_url":"https://capitol.texas.gov/BillLookup/History.aspx?LegSess=89R&Bill=HB149","source_publisher":null,"source_reference":"Business and Commerce Code Section 551.053","review_status":"verified","confidence_level":"high","last_verified_at":"2026-09-26","reviewed_by":null}
{"slug":"us-texas-responsible-ai-governance-act-traiga-government-biometric-identification-prohibition","title":"Governmental entities must not use AI for biometric identification from public data without consent where it infringes rights","policy":"us-texas-responsible-ai-governance-act-traiga","jurisdiction":"us-texas","category":"prohibited_practice","is_binding":true,"applies_from":"2026-01-01","summary":"A governmental entity may not develop or deploy an AI system for the purpose of uniquely identifying a specific individual using biometric data, or of gathering images or other media from the internet or another public source without the individual's consent, where doing so would infringe a right guaranteed under the United States or Texas constitutions or violate state or federal law. The Act preserves lawful uses that comply with existing biometric-privacy law.","practical_action":"Require legal sign-off on lawful basis and constitutional review before any agency biometric-matching or public-image scraping project.","url":"https://aipolicytracker.org/obligations/us-texas-responsible-ai-governance-act-traiga-government-biometric-identification-prohibition","context_url":"https://aipolicytracker.org/obligations/us-texas-responsible-ai-governance-act-traiga-government-biometric-identification-prohibition.md","official_source_url":"https://capitol.texas.gov/BillLookup/History.aspx?LegSess=89R&Bill=HB149","source_publisher":null,"source_reference":"Business and Commerce Code Section 551.054","review_status":"verified","confidence_level":"high","last_verified_at":"2026-09-26","reviewed_by":null}
{"slug":"us-texas-responsible-ai-governance-act-traiga-unlawful-discrimination-prohibition","title":"Developers and deployers must not use AI with the intent to unlawfully discriminate against a protected class","policy":"us-texas-responsible-ai-governance-act-traiga","jurisdiction":"us-texas","category":"prohibited_practice","is_binding":true,"applies_from":"2026-01-01","summary":"A person may not develop or deploy an AI system with the intent to unlawfully discriminate against a protected class in violation of state or federal law. A disparate impact on a protected class is not, by itself, sufficient to show an intent to discriminate, and insurers and financial institutions acting under their own regulatory regimes are treated separately.","practical_action":"Document the non-discriminatory purpose of each decision system and keep fairness testing evidence that shows there was no intent to discriminate.","url":"https://aipolicytracker.org/obligations/us-texas-responsible-ai-governance-act-traiga-unlawful-discrimination-prohibition","context_url":"https://aipolicytracker.org/obligations/us-texas-responsible-ai-governance-act-traiga-unlawful-discrimination-prohibition.md","official_source_url":"https://capitol.texas.gov/BillLookup/History.aspx?LegSess=89R&Bill=HB149","source_publisher":null,"source_reference":"Business and Commerce Code Section 551.056","review_status":"verified","confidence_level":"high","last_verified_at":"2026-09-26","reviewed_by":null}
{"slug":"us-texas-responsible-ai-governance-act-traiga-sexual-content-and-csam-prohibition","title":"Developers and distributors must not build AI intended to produce child sexual abuse material or unlawful sexual deepfakes","policy":"us-texas-responsible-ai-governance-act-traiga","jurisdiction":"us-texas","category":"prohibited_practice","is_binding":true,"applies_from":"2026-01-01","summary":"A person may not develop or distribute an AI system with the sole intent of producing, assisting or aiding in producing, or distributing child pornography or unlawful deep-fake videos or images, including sexually explicit deepfakes of a person without consent, or of engaging in sexually explicit text-based conversations while impersonating or imitating a child, in violation of the Texas Penal Code.","practical_action":"Enforce content-safety filters and abuse-detection on generative products and record the intended purpose of any image or chat model at release.","url":"https://aipolicytracker.org/obligations/us-texas-responsible-ai-governance-act-traiga-sexual-content-and-csam-prohibition","context_url":"https://aipolicytracker.org/obligations/us-texas-responsible-ai-governance-act-traiga-sexual-content-and-csam-prohibition.md","official_source_url":"https://capitol.texas.gov/BillLookup/History.aspx?LegSess=89R&Bill=HB149","source_publisher":null,"source_reference":"Business and Commerce Code Section 551.057","review_status":"verified","confidence_level":"high","last_verified_at":"2026-09-26","reviewed_by":null}
{"slug":"us-colorado-admt-advance-notice","title":"Notify consumers before automated decision-making technology influences a consequential decision","policy":"us-colorado-automated-decision-making-technology-act","jurisdiction":"us-colorado","category":"transparency","is_binding":true,"applies_from":"2027-01-01","summary":"Deployers must tell a consumer, before the decision is made, that automated decision-making technology will be used to make or materially influence a consequential decision about them. The exact content and timing of the notice follow the enrolled bill, which a reviewer must read.","practical_action":"Add a plain-language notice to every consumer-facing flow in which an automated tool influences a consequential decision.","url":"https://aipolicytracker.org/obligations/us-colorado-admt-advance-notice","context_url":"https://aipolicytracker.org/obligations/us-colorado-admt-advance-notice.md","official_source_url":"https://leg.colorado.gov/bills/sb26-189","source_publisher":null,"source_reference":null,"review_status":"pending_review","confidence_level":"medium","last_verified_at":null,"reviewed_by":null}
{"slug":"us-colorado-admt-adverse-decision-disclosure","title":"Disclose the use of the technology and the principal reasons after an adverse consequential decision","policy":"us-colorado-automated-decision-making-technology-act","jurisdiction":"us-colorado","category":"transparency","is_binding":true,"applies_from":"2027-01-01","summary":"After an adverse consequential decision, the deployer must tell the consumer that automated decision-making technology was used, give the principal reasons for the decision, and explain how to obtain human review.","practical_action":"Template an adverse-decision letter that names the tool, the main reasons and the human-review route.","url":"https://aipolicytracker.org/obligations/us-colorado-admt-adverse-decision-disclosure","context_url":"https://aipolicytracker.org/obligations/us-colorado-admt-adverse-decision-disclosure.md","official_source_url":"https://leg.colorado.gov/bills/sb26-189","source_publisher":null,"source_reference":null,"review_status":"pending_review","confidence_level":"medium","last_verified_at":null,"reviewed_by":null}
{"slug":"us-colorado-admt-human-review","title":"Offer meaningful human review of an adverse consequential decision","policy":"us-colorado-automated-decision-making-technology-act","jurisdiction":"us-colorado","category":"human_oversight","is_binding":true,"applies_from":"2027-01-01","summary":"A consumer who receives an adverse consequential decision may obtain meaningful review by a person with the authority and information to change the outcome. Scope and timing follow the enrolled bill.","practical_action":"Staff and document a human-review channel with authority to reverse decisions.","url":"https://aipolicytracker.org/obligations/us-colorado-admt-human-review","context_url":"https://aipolicytracker.org/obligations/us-colorado-admt-human-review.md","official_source_url":"https://leg.colorado.gov/bills/sb26-189","source_publisher":null,"source_reference":null,"review_status":"pending_review","confidence_level":"medium","last_verified_at":null,"reviewed_by":null}
{"slug":"us-colorado-admt-record-keeping","title":"Keep records of consequential decisions influenced by the technology for three years","policy":"us-colorado-automated-decision-making-technology-act","jurisdiction":"us-colorado","category":"record_keeping","is_binding":true,"applies_from":"2027-01-01","summary":"Deployers must retain records showing how automated decision-making technology was used in consequential decisions, for three years, according to secondary reporting on the enrolled bill.","practical_action":"Log each decision, the tool used, inputs relied on and the notices sent, with a three-year retention rule.","url":"https://aipolicytracker.org/obligations/us-colorado-admt-record-keeping","context_url":"https://aipolicytracker.org/obligations/us-colorado-admt-record-keeping.md","official_source_url":"https://leg.colorado.gov/bills/sb26-189","source_publisher":null,"source_reference":null,"review_status":"pending_review","confidence_level":"medium","last_verified_at":null,"reviewed_by":null}
{"slug":"us-colorado-admt-developer-documentation","title":"Developers must supply deployers with documentation of the technology","policy":"us-colorado-automated-decision-making-technology-act","jurisdiction":"us-colorado","category":"technical_documentation","is_binding":true,"applies_from":"2027-01-01","summary":"Developers of automated decision-making technology must provide deployers with the documentation the statute lists, so that deployers can meet their notice, disclosure and review duties.","practical_action":"Publish a deployer-facing documentation pack for each tool sold into consequential-decision uses.","url":"https://aipolicytracker.org/obligations/us-colorado-admt-developer-documentation","context_url":"https://aipolicytracker.org/obligations/us-colorado-admt-developer-documentation.md","official_source_url":"https://leg.colorado.gov/bills/sb26-189","source_publisher":null,"source_reference":null,"review_status":"pending_review","confidence_level":"medium","last_verified_at":null,"reviewed_by":null}