NIST AI RMF, GovernGOVERN 1.1

If your AI system is the controlling factor in a decision that materially affects a person's legal status, rights, or access to essential goods, services or opportunities, and it operates in a registrable sector (primary health diagnosis or treatment, creditworthiness or insurance and loan decisions, real-time biometric identification in public spaces, the exercise of government authority or public benefits, unsupervised hiring or compensation decisions, or academic admission or grading), register with ANIA.

If you are a provider or deployer of a high-risk AI system intended to be used by public authorities, and the system was placed on the market or put into service before Chapter III applies to it, take the necessary steps to comply with the Regulation's requirements and obligations by 2 August 2030, regardless of whether the system is later significantly redesigned.

If you are a law enforcement deployer using a high-risk AI system for post-remote biometric identification in a targeted search for a suspected or convicted person, request authorisation from a judicial authority or a binding, judicially reviewable administrative authority, in advance or without undue delay and no later than 48 hours, unless you are using the system only for the initial identification of a potential suspect on objective and verifiable facts directly linked to the offence.

Submit annual reports to the relevant market surveillance and data protection authorities on your use of post-remote biometric identification systems.

Once you have performed the assessment, notify the market surveillance authority of its results using the AI Office's template, unless you are exempt as a real-world testing participant under Article 46(1).

You are subject to the Article 49(2) EU database registration obligation.

Provide the documentation of your assessment to national competent authorities on request.

Obtain prior authorisation from a Magistrate before deploying a real-time or post-remote biometric identification system in a publicly accessible space in Malta for law enforcement purposes, and notify the Commissioner with the Regulation (EU) 2024/1689 Article 5(6) information excluding sensitive operational data, under Legal Notice 227 of 2025.

Make the tool available for audit or compliance review by the Insurance Commissioner, and review its performance, use, and outcomes at least quarterly.

Make your automated utilization management system available for audit by the department, which may perform the audit itself or through a third-party entity.

Comply with Regulation (EU) 2024/1689's requirements for high-risk AI systems, including conformity assessment and human oversight, once the Regulation is incorporated into the EEA Agreement and the Norwegian Act is adopted.

For a medium-risk or high-risk AI system, prepare a classification dossier and notify the classification result to the Ministry of Science and Technology through the one-stop AI portal before putting the system into service.

For a high-risk AI system, complete a conformity assessment before putting it into service or after a significant change, and maintain that conformity throughout operation.

Give a competent authority access to the automatically generated logs of your high-risk AI system, to the extent they are under your control, when it makes a reasoned request, if you are the system's provider.

If you are a public authority, or a Union institution, body, office or agency, deploying a high-risk AI system, comply with the Article 49 registration obligations.

Provide any information or documentation a market surveillance or notifying authority requests under Article 21 or Article 45, carry out or update the fundamental rights impact assessment Article 27 requires, and give an affected person the explanation Article 86 requires when you operate a high-risk AI system for one of the purposes Annex III lists: failing to do so can carry a German administrative fine of up to 50,000 euros, separate from the Regulation's own fines.

Where you test an AI system under real-world conditions in Hungary, expect to do so through the AI regulatory sandbox the AI market surveillance authority operates under Section 10.

Comply with information requests, contravention notices and prohibition notices issued by an authorised officer of a relevant market surveillance authority in respect of an AI system you provide or deploy (Part 5).

A utilization business operator must cooperate with the AI-promotion measures the national government carries out under Article 4 and a local government carries out under Article 5.

Before carrying on business as a provider of artificial intelligence or AI-related data services in Vanuatu, apply to the Director of the Department of Communications and Digital Transformation for an ICT service permit in that class, and pay the prescribed annual permit fee.

Comply with any condition the Director imposes on the permit, and cooperate with an enforcement officer's inspection, information request, or search warrant, since a serious breach can suspend the permit and stop all operations, and providing the service without a valid permit is a criminal offence.

If enacted, register as an AI provider with the National Artificial Intelligence Agency the bill would create.

Certify annually to the Alabama Department of Insurance that the artificial intelligence does not rely on a group dataset, is applied fairly and equitably consistent with applicable federal guidance, and does not discriminate against any subscriber group or enrollee.

If you do not use an external consumer data and information source or an ECDIS-based algorithm or predictive model, file a signed officer attestation to that effect with the Division instead.

File a compliance report with the Division on SERFF: annually by December 1 if you are a life insurer, and annually by July 1 if you are a private passenger automobile insurer or a health benefit plan insurer.

Cooperate with the Commissioner and the Division of Insurance in any examination or investigation of your use of an external consumer data and information source, algorithm, or predictive model.

A QCB-regulated financial entity must obtain QCB approval before launching a new AI system as a provider or making a material modification to one, and before signing a High-Risk AI purchase, licensing, or outsourcing agreement.

Beginning 1 July 2027, report annually to the Office of Suicide Prevention on the crisis-referral notifications you issued and the protocols you have in place, without including user identifiers or personal information

Starting July 1, 2027, report annually to the Attorney General on the number of crisis-service-provider referrals issued and the protocols used to detect, prevent, and respond to suicidal ideation or self-harm, without including any user-identifying information

Preserve the origin metadata of AI-generated content under judicial or administrative investigation, and hand it to the Haute Autorité de la Communication within eight days of a request.

Provide accurate, complete information to Digitaliseringsstyrelsen, Datatilsynet or Domstolsstyrelsen on request, and allow them to inspect your premises and technical systems, or risk a court-set fine with no statutory ceiling stated in Danish law.

Do not create or distribute an AI-generated output that Kazakhstani law bans.

A scraper collecting the personal data of an individual in Oman from a public page must confirm the data was made public in a manner not contrary to the Personal Data Protection Law before treating it as outside the Law's scope under Art. 3(j); a biometric identifier such as a faceprint or voiceprint derived from publicly posted photographs, video, or audio requires a Ministry permit under Art. 5 regardless of the recording's public availability.

Register with the Personal Data Protection Commission and have a lawful basis before collecting or processing personal data through a crawler or data pipeline, whether or not the data was publicly accessible online.

Keep technical documentation available for the AI Office