24 control themes shared by every regulation
Impact assessment, human oversight, logging: the same subjects come back from one text to the next. Each theme gathers the requirements of every framework and the checks that answer them.
Governance
Governance & accountability
AI policy, roles, accountable leadership, regulatory watch.
10 regulations · 26 requirementsInventory & categorisation
Register of AI systems, categorisation, record of processing.
6 regulations · 7 requirementsLiteracy & competence
Training, awareness and competence of operators and overseers.
4 regulations · 6 requirementsRisk management
Risk tolerance, register, treatment and residual risk.
12 regulations · 28 requirementsQuality & conformity
Management system, conformity assessment, declaration, marking, internal audit.
3 regulations · 8 requirementsAssessment
Prohibited practices
Screening of prohibited or excessive-risk uses.
3 regulations · 3 requirementsImpact assessments
DPIA, FRIA, algorithmic impact assessment, HUDERIA.
11 regulations · 17 requirementsFairness & non-discrimination
Bias, algorithmic discrimination, fairness audits.
11 regulations · 11 requirementsPersonal data
Lawful basis, minimisation, privacy by design.
7 regulations · 10 requirementsBuild
Data governance
Quality, representativeness and provenance of training and input data.
5 regulations · 6 requirementsTechnical documentation
Documentation, instructions for use, model card, retention.
10 regulations · 26 requirementsLogging & traceability
Automatic logs, retention, access.
4 regulations · 7 requirementsAccuracy & robustness
Testing, TEVV, red teaming, safe failure.
11 regulations · 23 requirementsCybersecurity
Security of hosting, model and software supply chain.
11 regulations · 14 requirementsEnvironmental impact
Energy and resources used by training and inference.
3 regulations · 3 requirementsPeople & use
Transparency & notice
Inform users, affected persons and representatives.
17 regulations · 27 requirementsSynthetic content
Marking and labelling of generated content, deepfakes.
5 regulations · 5 requirementsHuman oversight
Human control, stop, intervention on automated decisions.
11 regulations · 14 requirementsExplanation & redress
Right to explanation, contestation, human review, feedback.
13 regulations · 21 requirementsLifecycle & third parties
Post-deployment monitoring
Production monitoring, drift, continual improvement, decommissioning.
8 regulations · 18 requirementsIncidents & corrective action
Detection, notification to authorities, corrective action.
12 regulations · 21 requirementsAuthorities & registration
Registration, filing, representative, cooperation with authorities.
7 regulations · 10 requirementsThird parties & value chain
Supplier contracts, shared responsibilities, processors.
10 regulations · 16 requirementsIntellectual property
Copyright, training-data summary, opt-out, remuneration.
3 regulations · 4 requirements