Roles
Who carries which duty
Regulations are organised by instrument. Nobody arrives that way — they arrive as the person who has just been handed this. These pages answer that arrival.
§ 1 — How these are built
Every obligation in the corpus records the capacity it binds — provider, controller, internal audit function, public authority, and two dozen more. A role page is a query against that column, so nothing on it asserts that a duty falls on a role: the provision asserted that when it was written, and the page gathers what matches.
That rule decides which roles exist here. There is no page for a job title the instruments do not bind as such, however common the title is — a page whose central claim is “these duties are yours” has to have the duties behind it. Roles appear as the collections beneath them publish.
§ 2 — Roles
By role
- Internal auditor
19 provisions
Putting an AI system in the audit plan, and being asked to give an opinion on something probabilistic.
- Compliance officer
29 provisions
Holding the map: which of these instruments reaches your organisation, in which capacity, and on what date.
- AI product manager
13 provisions
Shipping the system, and holding the duties that fall on whoever puts it on the market.
- Accountant
8 provisions
Using the output of a tool in work that carries your professional name.
- Third-party risk manager
9 provisions
Assuring somebody else’s system, with the duty still sitting with you.
- Certification body assessor
4 provisions
Auditing somebody else’s management system, under requirements that decide whether your certificate means anything.