Skip to content

Governance

Governance & accountability: what AI regulations require

AI policy, roles, accountable leadership, regulatory watch.

26 requirements · 10 regulations · 9 checks

Requirements by regulation

UKUK principles1

UK-04

Accountability and governance Principle 4

EUDORA1

DORA-05

ICT risk framework under the management body's responsibility Art. 5, 6

EUNIS21

NIS2-20

Management body approval and training Art. 20

USNIST AI RMF13

GOVERN-1.1

Legal and regulatory requirements involving AI are understood, managed, and documented. GOVERN

GOVERN-1.2

The characteristics of trustworthy AI are integrated into organizational policies, processes, procedures, and practices. GOVERN

GOVERN-1.4

The risk management process and its outcomes are established through transparent policies, procedures, and other controls based on organizational risk priorities. GOVERN

GOVERN-1.5

Ongoing monitoring and periodic review of the risk management process and its outcomes are planned and organizational roles and responsibilities clearly defined, including determining the frequency of periodic review. GOVERN

GOVERN-2.1

Roles and responsibilities and lines of communication related to mapping, measuring, and managing AI risks are documented and are clear to individuals and teams throughout the organization. GOVERN

GOVERN-2.3

Executive leadership of the organization takes responsibility for decisions about risks associated with AI system development and deployment. GOVERN

GOVERN-3.1

Decision-making related to mapping, measuring, and managing AI risks throughout the lifecycle is informed by a diverse team (e.g., diversity of demographics, disciplines, experience, expertise, and backgrounds). GOVERN

GOVERN-3.2

Policies and procedures are in place to define and differentiate roles and responsibilities for human-AI configurations and oversight of AI systems. GOVERN

GOVERN-4.1

Organizational policies and practices are in place to foster a critical thinking and safety-first mindset in the design, development, deployment, and uses of AI systems to minimize potential negative impacts. GOVERN

GOVERN-5.1

Organizational policies and practices are in place to collect, consider, prioritize, and integrate feedback from those external to the team that developed or deployed the AI system regarding the potential individual and societal impacts related to AI risks. GOVERN

MAP-1.2

Interdisciplinary AI actors, competencies, skills, and capacities for establishing context reflect demographic diversity and broad domain and user experience expertise, and their participation is documented. Opportunities for interdisciplinary collaboration are prioritized. MAP

MANAGE-1.1

A determination is made as to whether the AI system achieves its intended purposes and stated objectives and whether its development or deployment should proceed. MANAGE

MANAGE-1.4

Negative residual risks (defined as the sum of all unmitigated risks) to both downstream acquirers of AI systems and end users are documented. MANAGE

COColorado AI Act1

CO-05

Risk management policy and programme §6-1-1703(2)

CASB 532

SB53-01

Publish a frontier AI framework (thresholds, mitigations, governance, weight security) §22757.12(a)

SB53-05

Whistleblowers: protection and anonymous internal channel Lab. Code §1107

USUS federal1

USF-01

Chief AI Officer and AI governance board M-25-21 §3

JPAI Promotion Act2

JP-01

Cooperate with national measures and follow the guidelines Art. 7

JP-02

Common principles: human-centric, safety, fairness, privacy, security, transparency, accountability Guidelines, part 2

INTLISO 420013

ISO-4.3

Scope of the AIMS Cl. 4.3, 4.4

ISO-5.2

AI policy Cl. 5.2, A.2

ISO-5.3

Roles, responsibilities, reporting of concerns Cl. 5.3, A.3

INTLOECD AI1

OECD-1.5

Accountability 1.5

Checks in this theme

Most shared first

Code	Check	Used by
CHK-ROLES-CLARIFIED	Roles, responsibilities and delegated authorities are documented and clear to relevant stakeholders	ISO 42001 NIST AI RMF OECD AI UK principles US federal
CHK-EXEC-ACCOUNT	Executive leadership is accountable for AI risk decisions (board committee, risk appetite)	DORA ISO 42001 NIS2 NIST AI RMF US federal
CHK-LEGAL-MAP	Applicable legal and regulatory requirements for AI are identified, mapped and monitored	ISO 42001 AI Promotion Act NIST AI RMF
CHK-POL-TRUST	Trustworthy-AI characteristics are embedded in organizational policies and a safety-first culture	ISO 42001 AI Promotion Act NIST AI RMF
CHK-REVIEW-PLAN	Ongoing monitoring and periodic review of the risk-management process are planned, with defined roles and review frequency	ISO 42001 NIST AI RMF
CHK-TEAM-DIVERSE	A diverse, interdisciplinary team is involved and its participation documented	NIST AI RMF
CHK-GO-NOGO	A go/no-go determination on system deployment is made and documented	NIST AI RMF
NEW-ISO42001-01	AIMS scope defined and approved	ISO 42001
NEW-US-CA-SB53-03	Anonymous internal reporting channel in place	SB 53

Related themes

Inventory & categorisation Literacy & competence Risk management Quality & conformity

Run these requirements across all your AI systems

TrustFlow inventories your systems, qualifies them under each regulation and collects evidence once for every referential.