Role
Compliance officer
Holding the map: which of these instruments reaches your organisation, in which capacity, and on what date.
§ 1 — What you carry
Where the duty attaches
A compliance function rarely occupies one capacity. The same organisation is commonly a deployer of systems it bought, a provider of one it built or rebranded, and the audited organisation when someone comes to look — and the obligations differ in each, including the ones that look like duplicates.
What this page is for is the capacity question, which is the one that decides everything else. Substantially modifying a system you bought can make you its provider; putting your name on it certainly does. The duties that follow are not the ones you were tracking the week before.
Also written as head of compliance, regulatory compliance manager. Everything below is drawn from the obligation dataset by the capacity that binds this role, not by job title — 29 provisions across 4 collections.
§ 2 — The obligations
What binds you
EU AI Act
14 provisions
- Article 10 — Data and data governance
- Article 11 — Technical documentation
- Article 12 — Record-keeping
- Article 13 — Transparency and provision of information to deployers
- Article 14 — Human oversight
- Article 15 — Accuracy, robustness and cybersecurity
- Article 26 — Obligations of deployers of high-risk AI systems
- Article 27 — Fundamental rights impact assessment for high-risk AI systems
- Article 5 — Prohibited AI practices
- Article 50 — Transparency obligations for providers and deployers of certain AI systems
- Article 6 — Classification rules for high-risk AI systems
- Article 72 — Post-market monitoring by providers and post-market monitoring plan for high-risk AI systems
- Article 73 — Reporting of serious incidents
- Article 9 — Risk management system
ISO/IEC 42001
9 provisions
- Annex A and Annex B — Reference control objectives and controls · Implementation guidance for AI controls
- Clause 4.1 — Understanding the organization and its context
- Clause 4.3 — Determining the scope of the AI management system
- Clause 5.2 — AI policy
- Clause 5.3 — Roles, responsibilities and authorities
- Clause 6.1.2 — AI risk assessment
- Clause 7.2 — Competence
- Clause 8.4 — AI system impact assessment
- Clause 9.2, with 9.2.1 and 9.2.2 — Internal audit · General · Internal audit programme
Agentic AI oversight
4 provisions
- IMDA Agentic AI Framework v1.5 §2.1 — Assess and bound the risks upfront
- IMDA Agentic AI Framework v1.5 §2.1.1 and §2.2.2 — Reversibility of agent’s actions
- IMDA Agentic AI Framework v1.5 §2.3.3 — Continuous testing and monitoring
- Model AI Governance Framework for Agentic AI v1.5, §§2.1.2 and 2.3.1 — Bound risks through design by defining agents limits and permissions
Auditing AI systems
2 provisions
§ 3 — Evidence
The artefacts this role owns
Drawn from the evidence column of the provisions above, most widely demanded first. These are what an assessor asks this role to produce.
- 1xA bias examination that reached the risk register
- 1xA communication record showing reach rather than circulation
- 1xA competence determination made before people are assigned
- 1xA context register keeping external and internal issues apart
- 1xA correlation identifier surviving hand-offs
- 1xA dataset defect register, with treatment
- 1xA dated classification determination per system
- 1xA dated residual-risk acceptance decision
- 1xA dated residual-risk acceptance with a named accepter
- 1xA derivation trace from the policy to each AI objective
- 1xA filed initial report that was later completed
- 1xA finding that came out of the monitoring, and what it changed
§ 4 — Ahead
What lands next
2 December 2026
2 December 2026
Article 50 — Transparency obligations for providers and deployers of certain AI systems
2 December 2027
2 December 2027
2 December 2027
2 December 2027
2 December 2027
Article 13 — Transparency and provision of information to deployers
2 December 2027
Certification
Assessed on the same standard of evidence
Every Council credential is examined on applied judgement against a published anchor, set out the way the obligations on this page are. The Certified Applied AI Associate, the Council’s flagship, is open to any adult today, its fee waived by a coupon code from the AI-Readiness Check, and the register lists what is open for enrolment.