Risk, Ethics & Compliance ยท RSK-04
Legal and regulatory obligations
The organisation keeps a current view of the laws, regulations and standards that apply to its use of AI, with an owner for each obligation and a way of checking it is met.
Why it matters
Obligations on AI come from many places at once: data protection, equality, sector regulation, consumer and employment law, and new AI-specific rules. Without one maintained view, obligations are missed or each team interprets them differently.
Levels
| 0 Absent | Confirmed absent: the evidence shows nothing is in place. Not known is recorded as insufficient evidence, not 0. |
|---|---|
| 1 Initial | No view of which obligations apply to AI use; legal advice is sought only when a problem arises. |
| 2 Developing | Some obligations are known and tracked, typically data protection, but the view is incomplete, unowned or out of date. |
| 3 Defined | An owned, reviewed register of AI obligations guides design and approval, and each use records its regulatory role, duties, regulator contact and how obligations are shared. |
| 4 Managed | Compliance with each obligation is checked and reported, and new or changed obligations are assessed for effect within a set time. |
| 5 Optimising | The organisation anticipates regulatory change, shapes its practice ahead of it, and contributes to consultations where it has relevant experience. |
Level 3 criteria
Level 3 is met when every applicable criterion is met. Criteria marked with an overlay apply only to organisations with that characteristic (overlays).
- RSK-04.1 A maintained register lists the obligations that apply to the organisation's use of AI, with a named owner for each.
- RSK-04.2 The register of obligations is reviewed on a set cycle.
- RSK-04.3 The register is used when uses of AI are designed and approved.
- RSK-04.4 Legal advice is taken when each use of AI is designed and when it changes materially.
- RSK-04.5 For each use of AI, the organisation's regulatory role, for example provider or deployer, is recorded and checked again when the purpose, branding or system changes.
- RSK-04.6 For each use of AI, the reporting duties that follow from that role are recorded, with a named owner for contact with regulators.
- RSK-04.7 For each use of AI, a record shows how legal obligations are split between suppliers, the organisation and users.
- RSK-04.8 Each party is told its share of the legal obligations for a use of AI.
Assessment questions
- Which laws, regulations and standards apply to your use of AI, and where is that recorded?
- Who owns each obligation, and how do you know it is being met?
- How would you find out about a new obligation, and how quickly would you act on it?
- The obligations register, with owners and review dates
- Compliance check records or legal sign-off for recent uses of AI
- Regulatory role recorded for each use, with re-check records and the named regulator contact
How to reach Level 3
- Build a register of laws, regulations and standards that apply to AI use, name an owner for each obligation and set a review cycle.
- For each use, record the organisation's regulatory role (for example provider or deployer), the reporting duties that follow and a named owner for contact with regulators, and re-check the role when purpose, branding or the system changes.
- Record for each use how legal obligations are split between suppliers, the organisation and users, and tell each party its share.
- Make the register part of design and approval, with legal advice taken at design and on material change.
Common pitfalls
- Treating the register as a legal team document that delivery teams never use.
- Missing a change of regulatory role when a bought system is rebranded or repurposed.
Starter artefacts
- AI obligations register with owners
- Per-use regulatory role and responsibility split record
Ownership and sequence
- Accountable
- risk lead
- Contributors
- ai governance lead, data owner, security lead
- Depends on
- GOV-02
- Roadmap step
- 2
- Lifecycle
- strategy, design, acquire_build, operate
Cross-references
| Algorithmic Transparency Recording Standard | Scope mandatory organisations direct; Scope tools in scope partial; Scope exemptions partial |
|---|---|
| EU AI Act | Art 5 partial; Art 6 partial; Art 25 direct; Art 26(5) partial; Art 26(12) direct; Art 27 partial; Art 49(3) partial; Art 73 partial; Art 17 partial |
| GDS AI Playbook | P2 direct |
| ISO/IEC 42001 | 4.2 partial; A.8.5 direct |
| JSP 936 Part 1 | para 25 partial; para 47 direct; para 48 partial; para 108 direct; para 204 partial |
| MITRE AI Maturity Model | P1.1 direct; P2.3 partial; P5.2 partial |
| NIST AI 600-1 | R10 partial |
| NIST AI RMF 1.0 | GOVERN 1.1 direct; MAP 1.1 partial |
| UK Data and AI Ethics Framework | Accountability 4 direct; Trade-offs 2 direct; SAT 3.6 partial |
| UNESCO AI Maturity Framework | 5.4 direct |
direct: this control at Level 3 meets the item. partial: it covers part of it.