Obligations

The absence of AI law is not the absence of obligation

The most consequential misunderstanding in this domain is the belief that AI use is largely unregulated because AI-specific legislation is limited or pending.

Obligations attach to what an AI system does, not to the technology it uses. A system that processes personal information is subject to privacy law. A system that makes representations to customers is subject to consumer protection law. A system that affects access to employment, credit, housing, or services is subject to anti-discrimination law. A regulated entity's AI use sits inside its existing prudential and conduct obligations. A director who approves deployment without informing themselves is subject to duties that predate the technology by decades.

None of that requires AI-specific legislation, and none of it is waiting for any. An organization that has assessed only emerging AI regulation has assessed the smallest part of its actual obligation.

Obligations follow the customer

OBL-4 exists because the jurisdictional question most organizations ask is where they are established, and the question that determines exposure is frequently where their customers and data subjects are.

Several regimes apply extraterritorially. An organization that operates entirely within one jurisdiction may nonetheless be subject to another's requirements by reason of serving its residents, processing their information, or placing a system on its market. The organization's own location does not resolve the question, and an assessment scoped to domestic law will not surface it.

The practical consequence is that the jurisdictional assessment must begin with where customers, users, and data subjects actually are. That is a factual question that the organization can answer from its own records, and it is answered before any legal analysis rather than after it.

Self-imposed obligations

OBL-5 addresses a category that is frequently overlooked because the organization created it.

Statements about AI use made in contracts, terms of service, privacy notices, marketing material, tender responses, and public commitments can create obligations or exposure under applicable law. A divergence between a statement and actual practice may have consequences even where no AI-specific rule was breached. The jurisdiction, wording, and context determine what applies.

These commitments are made across several functions, at different times, without a central record. An organization that has committed publicly to human review of every automated decision, and which samples rather than reviews, has created an exposure that no external obligation imposed.

Identified is not met

OBL-6 separates two states that registers routinely conflate.

An obligations register records what the organization understands it is required to do. It does not establish that the requirement is being met, and the distinction is invisible in the artifact, because both states produce the same row in the same table.

Testing compliance is therefore a separate activity with a separate cycle, and the evidence it produces belongs under Assurance. The purpose of stating it here is that an organization which has built a thorough register and never tested against it has documented its obligations while remaining unable to say whether it meets them.