NIST AI RMF, GovernGOVERN 1.1

If you are the provider of a high-risk AI system, keep at the disposal of the national competent authorities, for a period ending 10 years after the system has been placed on the market or put into service: its technical documentation under Article 11; the documentation concerning your quality management system under Article 17; where applicable, the documentation concerning changes approved by notified bodies and the decisions and other documents notified bodies issued; and the EU declaration of conformity under Article 47.

Give a competent authority access to the automatically generated logs of your high-risk AI system, to the extent they are under your control, when it makes a reasoned request, if you are the system's provider.

Keep at the disposal of the competent authorities and the national authorities or bodies referred to in Article 74(10), for 10 years after the high-risk AI system has been placed on the market or put into service, the contact details of the provider that appointed you, a copy of the EU declaration of conformity, the technical documentation and, if applicable, the certificate issued by the notified body (Article 22(3), point (b)).

When a competent authority makes a reasoned request, provide it with all the information and documentation, including the items listed in the point above, necessary to demonstrate the conformity of the high-risk AI system with the requirements of Section 2, including access to the logs automatically generated by the system, as referred to in Article 12(1), to the extent those logs are under the control of the provider (Article 22(3), point (c)).

If you are a public authority, or a Union institution, body, office or agency, deploying a high-risk AI system, comply with the Article 49 registration obligations.

A modifier that becomes a provider limits its documentation to the modification and its copyright policy and training summary to the data used in the modification, and must also comply with Article 54; if the original model has systemic risk, the modified model is presumed to have high-impact capabilities and its provider must comply with the systemic risk obligations and notify the Commission (Sections 3.2.1 and 3.2.2, paragraphs 65 to 68).

A model is classified as a general-purpose AI model with systemic risk from the moment it meets a condition of Article 51(1), and the provider must notify the Commission without delay and in any event within two weeks after the presumption threshold is met or it becomes known that it will be met, which may be before training is complete, reporting the estimated compute in FLOP with two significant figures and the approach used to estimate it (Sections 2.3.1 and 2.3.2, paragraphs 26 to 31).

If you are a provider or a representative established in Finland, keep the documents referred to in Article 18(1) of the AI Act available to the market surveillance authorities and the notifying authorities for ten years after a high-risk AI system is placed on the market or put into service, even through liquidation, bankruptcy, or the business ceasing or being transferred (Section 26).

If you provide, import, distribute or deploy a high-risk AI system used as a safety component in the management and operation of critical infrastructure (digital infrastructure, road traffic, or the supply of water, gas, heating or electricity), comply with the AI Act obligations that the market surveillance authority designated for that domain by a Conseil d'État decree supervises (proposed Articles L. 1340-1 and L. 1340-2 of the Code de la défense).

Provide the information or documentation, and give the access, that Article 21 requires of a provider of a high-risk AI system when a competent authority asks; carry out and update the fundamental rights impact assessment Article 27 requires and send the notification it requires; if you are a notified body, inform the notifying authority as Article 45 requires; and, if you operate a high-risk AI system under point 1, 3, 4 or 5 of Annex III, give an affected person the explanation Article 86 requires (Section 15).

If you provide a high-risk AI system listed in point 2 of Annex III to the Regulation, you or your authorised representative must register you and the system in the Bundesnetzagentur's non-public register before you place the system on the market or put it into service, supplying the information that Annex VIII, Section A lists. This duty does not apply to a public body of a Land.

Submit to supervision by the competent Landesmedienanstalt as market surveillance authority if you are a media service provider that places an AI system on the market, puts it into service or uses it to provide media services for journalistic or advertising purposes.

Where you test an AI system under real-world conditions in Hungary, supply data to the AI market surveillance authority when it requires it and allow its remote or on-site inspections without prior notice, under Section 7(2).

Disclose to the Division of Insurance, the Department of Human Services or the Department of Health Care Policy and Financing, as applicable, the utilization review functions for which the AI system will be used and the points in the process where it will be used, the process for human oversight of adverse coverage determinations, and the process for maintaining audit information

If your AI system is the controlling factor in a decision that materially affects a person's legal status, rights, or access to essential goods, services or opportunities, and it operates in a registrable sector (primary health diagnosis or treatment, creditworthiness or insurance and loan decisions, real-time biometric identification in public spaces, the exercise of government authority or public benefits, unsupervised hiring or compensation decisions, or academic admission or grading), register with ANIA.

If you are a provider or deployer of a high-risk AI system intended to be used by public authorities, and the system was placed on the market or put into service before Chapter III applies to it, take the necessary steps to comply with the Regulation's requirements and obligations by 2 August 2030, regardless of whether the system is later significantly redesigned.

Upon a reasoned request of a national competent authority, demonstrate that your high-risk AI system conforms with the Chapter III, Section 2 requirements.

Ensure the system undergoes the relevant conformity assessment procedure under Article 43 before you place it on the market or put it into service, draw up an EU declaration of conformity under Article 47, affix the CE marking under Article 48, and comply with the registration obligations of Article 49(1).

If you are a law enforcement deployer using a high-risk AI system for post-remote biometric identification in a targeted search for a suspected or convicted person, request authorisation from a judicial authority or a binding, judicially reviewable administrative authority, in advance or without undue delay and no later than 48 hours, unless you are using the system only for the initial identification of a potential suspect on objective and verifiable facts directly linked to the offence.

Submit annual reports to the relevant market surveillance and data protection authorities on your use of post-remote biometric identification systems.

Once you have performed the assessment, notify the market surveillance authority of its results using the AI Office's template, unless you are exempt, which Article 27(3) allows in the case referred to in Article 46(1), where a market surveillance authority has authorised the system for exceptional reasons such as public security or the protection of life and health.

Ensure the system complies with the requirements of Chapter III, Section 2: risk management (Article 9), data and data governance (Article 10), technical documentation (Article 11), record-keeping (Article 12), transparency and instructions for use (Article 13), human oversight (Article 14) and accuracy, robustness and cybersecurity (Article 15).

Draw up an EU declaration of conformity (Article 47), affix the CE marking (Article 48) and register yourself and the system in the EU database (Article 49(1)).

You are subject to the Article 49(2) EU database registration obligation.

Provide the documentation of your assessment to national competent authorities on request.

Conduct the testing without prejudice to the prohibitions under Article 5 and to any ethical review that Union or national law requires.

Draw up a real-world testing plan and submit it to the market surveillance authority in the Member State where you will test, and test only after that authority has approved the testing and the plan (Article 60(4), points (a) and (b)).

As controller, the Ministry of the Interior must carry out the data-protection impact assessment beforehand and consult the Garante (art. 10, comma 6).

Certify annually to the Alabama Department of Insurance that the artificial intelligence does not rely on a group dataset, is applied fairly and equitably consistent with applicable federal guidance, and does not discriminate against any subscriber group or enrollee.

File a compliance report with the Division on SERFF: annually by December 1 if you are a life insurer, and annually by July 1 if you are a private passenger automobile insurer or a health benefit plan insurer.

Cooperate with the Commissioner and the Division of Insurance in any examination or investigation of your use of an external consumer data and information source, algorithm, or predictive model.

Notify the Financial Supervision Authority and the competent supervisory authority of the trading venue that you engage in algorithmic trading, and on request give the Financial Supervision Authority information on your algorithmic trading and systems (section 82^15(8) and (9)).

Notify the competent authorities of your home Member State and of the trading venue at which you engage in algorithmic trading as a member or participant that you engage in algorithmic trading in a Member State, and on request provide a description of the nature of your algorithmic trading strategies, details of the trading parameters or limits to which the system is subject, the key compliance and risk controls you have in place and details of the testing of your systems (Directive 2014/65/EU, Article 17(2)).

The CBJ says that along with the framework you should adhere to the regulations, guidelines, frameworks and circulars it issues and to national cybersecurity and data privacy laws, including Personal Data Protection Law 24 of 2023 (section 3.1).

It reaches you if you provide digital and personalized advisory services through a computer program or artificial intelligence enabled algorithms with limited human intervention, which the Rules call Robotic and Artificial Intelligence Enabled Advisory Services: do not carry out those services without a Robotic and Artificial Intelligence Enabled Advisory Services licence issued by the Financial Services Commission of Mauritius, and apply for it in accordance with Part IV of the Financial Services Act (clauses 2, 3 and 4). A person already carrying out the services when the Rules began had to apply within 3 months of commencement (clause 14).

Comply with all applicable federal and state laws and regulations in decisions and actions made with AI Systems that may impact consumers; the bulletin states that the use of AI does not relieve a provider of its obligation to refrain from discrimination under the Elliott-Larsen Civil Rights Act.

A QCB-regulated financial entity must obtain QCB approval before launching a new AI system as a provider or making a material modification to one, and before signing a High-Risk AI purchase, licensing, or outsourcing agreement.

It is addressed to a firm the Financial Conduct Authority regulates, and the FCA states that a firm that uses AI as part of its business operations remains responsible for ensuring compliance with the FCA's rules, including in relation to consumer protection (paragraph 3.45).

Beginning 1 July 2027, report annually to the Office of Suicide Prevention on the crisis-referral notifications you issued and the protocols you have in place, without including user identifiers or personal information

Starting July 1, 2027, report annually to the Attorney General on the number of crisis-service-provider referrals issued and the protocols used to detect, prevent, and respond to suicidal ideation or self-harm, without including any user-identifying information

If you do not sign a code of practice that is assessed as adequate under Article 50(7), be ready to demonstrate through other adequate means how you comply with Article 50(2), (4) and (5), and to explain how your measures ensure compliance; the guidelines say you should, for instance, carry out a gap analysis against the measures of an adequate code, and that you may be subject to a larger number of requests for information and for access to assess the effectiveness, interoperability, robustness and reliability of your technical solutions (paragraph 148).

Preserve the origin metadata of AI-generated content under judicial or administrative investigation, and hand it to the Haute Autorité de la Communication within eight days of a request.

Hand the documents the state media authority asks for to that authority.

Stop distributing and placing AI-generated campaign material that the Corruption Prevention and Combating Bureau has decided to ban (Article 31.1(1)).

Provide accurate, complete information to Digitaliseringsstyrelsen, Datatilsynet or Domstolsstyrelsen on request, and allow them to inspect your premises and technical systems, or risk a fine; the Danish text states no ceiling, and the bill's notes say the EU AI Act's Article 99 ceilings apply.

Where national law permits real-time remote biometric identification for law enforcement under an Article 5(1)(h) exception, do not use the system until a fundamental rights impact assessment has been completed and the competent judicial or independent administrative authority has authorized the use, except in a duly justified urgent case; register the system in the EU database, without undue delay in a justified emergency; and notify each use to the market surveillance authority and the national data protection authority (Section 10, paragraphs 377, 380, 382, 383 and 409).

Comply with the other Union law that continues to apply alongside Article 5, since respecting the prohibitions is not a sufficient condition for compliance with it: the General Data Protection Regulation, the Law Enforcement Directive and Regulation (EU) 2018/1725 (paragraph 45), with the AI Act applying as lex specialis to Article 10 of the Law Enforcement Directive for biometric categorization and real-time remote biometric identification used for law enforcement (paragraph 46), and Union consumer protection and safety legislation (paragraph 47) (Section 2.8, paragraphs 43 to 47).

Obtain the prosecutor's authorisation, granted for a specific event or the strictly necessary time and never for more than fifteen days at a time (art. 8, commi 4 and 5).

After use, notify the Garante, with the prior clearance of the competent judicial authority (art. 9, comma 4).

Do not create or distribute an AI-generated output that Kazakhstani law bans.

Keep technical documentation available for the AI Office, unless your model is released under a free and open-source licence that allows access, usage, modification and distribution, has its parameters, including the weights, and the information on its architecture and usage made publicly available, and does not carry systemic risk

Register with the Personal Data Protection Commission and have a lawful basis before collecting or processing personal data through a crawler or data pipeline, whether or not the data was publicly accessible online.