Determine regulatory applicability for an AI system
Draft
Determine regulatory applicability for an AI system
Layer 4. Control REGCompliance and regulatory
Allocation
| L4-REG-01 | |
|---|---|
| Decides | General Counsel |
| Consulted | DPO, Business Owner and Compliance |
| Executes | Compliance |
| Evidence | Applicability assessment, obligation register entry |
In plain terms
Decide which obligations attach to this system. Applicability is determined, not assumed, and it changes when the system changes.
What is being judged
Which instruments reach this system, in which jurisdictions, and in what role. The role question is the one most often skipped: the same system carries different obligations depending on whether the organization is provider or deployer, and that is L4-REG-02.
Applicability is not classification. A system can be material under AI9GM and outside Annex III. A system can be inside Annex III and low consequence internally. The two determinations run independently and are frequently conflated because both produce a category.
What this decision does not cover
It does not determine value-chain status, which is L4-REG-02. It does not sign off any impact assessment.
When it fires
On event. At classification. On change of jurisdiction, population served, purpose or data scope. On regulatory change. On a value-chain status change under L4-REG-02.
On cycle. On regulatory change rather than a fixed period, which is why the obligation register carries the review rather than the calendar.
What you need before deciding
What the system does, who it affects and where they are. The value-chain position. The data it processes and its classification. The current obligation register.
How this goes wrong
Applicability assumed from technology: a system treated as high-risk because it uses a large language model, or as out of scope because it does not. Determined once: the assessment reflects the system at launch and the jurisdictions it then served. The register that is a list of laws: an obligation register naming instruments rather than obligations mapped to systems, which cannot answer what this system must do.
Related decisions
Upstream L4-CLS-04.
Paired L4-REG-02.
Downstream L4-REG-04 and L4-REG-05 impact assessments, L4-POL-03 catalog, L3 control implementation.
Instrument references
The instruments are the subject here. EU AI Act Articles 6, 25 and 26. ISO/IEC 42001 clause 4.1 and 4.2 context and interested parties.
Correction
The maintainer answers corrections. There is no service level. Responses are best-effort and opportunistic within a reasonable time: a correction raised on a Monday is answered that week or sooner.