# AI Act and Regulatory Compliance Doc Template

## 1. EU AI Act Classification

| Feature | Tier | Citation | Reasoning |
|---------|------|----------|-----------|
| AI Summary | limited-risk | Art. 50(1) generative content | summarises user's own thread; no decision; transparency obligation only |
| AI Composer | limited-risk | Art. 50(1) | drafts content for user; transparency obligation |
| AI Analyst | limited-risk if used for analytics; high-risk if used to decide employment / credit / insurance / housing | Annex III(5)(b) | depends on use; we contractually prohibit high-risk use unless customer signs Annex III addendum |
| AI Agent | case-by-case; high-risk where action is on essential service decisions | Annex III + Art. 6 | per-step human approval keeps the human-in-the-loop |

## 2. US Sectoral Exposure

| Feature | FCRA | HIPAA | EEOC | NYC LL 144 | CO AI Act | CA ADMT | BIPA | FTC §5 |
|---------|------|--------|------|------------|------------|----------|------|----------|
| AI Summary | n/a | conditional | n/a | n/a | n/a | n/a | n/a | yes (claims) |
| AI Composer | n/a | conditional | n/a | n/a | n/a | n/a | n/a | yes |
| AI Analyst | yes if customer uses for credit | conditional (PHI) | yes if used for hiring | yes if AEDT | yes if consequential | yes 2026+ | n/a | yes |
| AI Agent | n/a in approved-actions catalogue | conditional | n/a | n/a | conditional | yes 2026+ | n/a | yes |

Sectoral controls: contract prohibits use in credit / hiring / housing / insurance underwriting unless the customer signs the regulated-use addendum that enables audit support.

## 3. Canada and UK

| Feature | AIDA tier | Directive on ADM applicability | UK ICO guidance |
|---------|------------|----------------------------------|------------------|
| AI Summary | low | n/a | aligned |
| AI Composer | low | n/a | aligned |
| AI Analyst | medium when used for consequential decisions | yes if federal customer | aligned |
| AI Agent | medium-high | yes if federal customer | aligned |

## 4. African Regulators

| Feature | Kenya ODPC AI 2024 | Nigeria NDPC 2024 | South Africa POPIA s.71 |
|---------|----------------------|---------------------|---------------------------|
| AI Summary | consent + DPIA if PII | consent + DPIA if PII | s.71 N/A (no automated decision) |
| AI Composer | consent + DPIA | consent + DPIA | s.71 N/A |
| AI Analyst | DPIA + lawful basis | DPIA + lawful basis | s.71 if used to make decisions about a data subject |
| AI Agent | DPIA + lawful basis + human oversight evidence | DPIA + lawful basis | s.71 yes; human oversight required |

## 5. Annex IV Technical Documentation Index (High-Risk Features Only)

For each high-risk-classified feature build:

| Annex IV item | Where covered | Artefact |
|----------------|----------------|----------|
| General description | Model Card §1 | MC-<feature> |
| Elements and development process | AI Architecture Spec, Prompt Spec | sections 1-7 |
| Data sets used | AI Data and Knowledge-Base Spec | full doc |
| Validation and testing | AI Eval Harness Spec, AI Red-Team Plan | full docs |
| Performance metrics | AI Hallucination SLO Doc | full doc |
| Risk management | AI Cost Runbook + AI Rollout Runbook + Risk Assessment | full docs |
| Human oversight | Responsible AI Declaration §3 + AI FR clauses | full |
| Cybersecurity measures | Trust Center + Isolation Evidence Pack | full |
| Changes through lifecycle | Model Card §12, ADR catalogue | full |
| Post-market monitoring | Monitoring Setup + Hallucination SLO Doc | full |

## 6. Disclosure Copy Library

| Surface | Region | Language | Copy |
|---------|--------|-----------|------|
| Output tooltip | global | EN | "This was drafted by AI. Review before relying on it." |
| First-use modal | EEA | EN/DE/FR | "This feature uses AI to draft responses. AI can make mistakes. Review every output. <link to RAI Declaration>" |
| First-use modal | global | EN | "AI-assisted feature. Outputs may contain mistakes. <link>" |
| High-risk oversight notice | EEA | EN | "A human must approve each step before it is executed." |
| Generative content disclosure (Art. 50) | EEA | EN | "Content marked AI was generated by an AI system." |
| Right-to-explanation copy | EEA/KE/NG/ZA | EN | "You can request the reasoning behind an automated output. Contact <support>." |
| Consent notice | KE/NG/ZA | EN | "By enabling AI features, you consent to your data being processed by <providers> under our DPA." |

## 7. Open Compliance Items

| Item | Owner | Due | Status |
|------|-------|-----|--------|
| Annex IV pack for AI Agent | AI Lead | YYYY-MM-DD | in progress |
| AEDT bias audit (if NYC customers) | Legal + AI Lead | YYYY-MM-DD | planned |
| Colorado AI Act readiness | Legal | YYYY-MM-DD | not started |

## 8. Review Cadence

- Quarterly review.
- Trigger review on: feature change, model bump, regulatory publication, customer onboarding in new region.
- Sign-off: DPO + Legal + AI Lead.