The AI Regulatory Obligations Handbook
A practitioner’s manual for building an AI regulatory obligations program. Seven chapters, three handouts, and six worksheets, written for the compliance officer, privacy counsel, data protection officer, or internal auditor who has been handed this work and has no framework for it yet. It is free to read, free to share, and it sells nothing.
- What applies to us?
- What are we obligated to do?
- What documents does the law require us to produce?
- How do we keep them current?
The loop is the point. The program does not finish — it runs.
Why this exists
We have built and run compliance programs inside large regulated companies — HIPAA, SOX, SOC 2, ISO, FMLA. The work in this manual is the work we did, written down in the order it actually happens. It is the manual we would have wanted on the first day someone handed us an AI deployment and asked whether it was allowed.
Chapters
- 1How We Got HereWhere these rules came from, why Europe is further along, and what lands in 2027.
- 2Where to BeginYou are not starting from nothing. What you already have, and the first move.
- 3What You Are Actually CapturingWhat belongs in an intake, and the definition most organizations get wrong first.
- 4Getting the AnswersTwo conversations, one vendor, and the files your organization already maintains.
- 5What the Deployment Obligates You to DoThe hardest step: turning an accurate intake into the obligations that attach.
- 6The Documents the Law RequiresThe obligations satisfied only by producing a specific document, and when they are due.
- 7Keeping It CurrentThe maintenance requirement: what triggers a review, and what a review actually checks.
Handouts
Single-page references for the three assessments practitioners are most often asked about. Each one covers what triggers it, what it has to cover, and when it is due.
- Data Protection Impact AssessmentGDPR Article 35. When it is required, what it has to cover, and who signs it.
- Fundamental Rights Impact AssessmentEU AI Act Article 27. Who owes one, what it covers, and how it differs from a DPIA.
- State Data Protection and Privacy Risk AssessmentsUS state assessment duties, what triggers them, and where the requirements differ.
Worksheets
Meant to be printed and used. Each one prints black-on-white with room to write, one worksheet per deployment.
- 1Intake PreparationWork through before filling in an intake. One per deployment.
- 2Source MapRecord where each answer came from and how current it is.
- 3Conversation GuidesQuestion sets for the business owner and the technical owner.
- 4Controls EvidenceRecord the control, the evidence, the owner, and the review date.
- 5Review Triggers and LogWhat should force a re-review, and a log of the ones you ran.
- 6Deployment InventoryOne line per deployment, so the whole estate fits on a page.
Free to read, share, and adapt inside your organization. Attribution appreciated, not required. No warranty — verify time-sensitive claims against current sources.
LegisGate is the regulatory intelligence for AI deployments company. What we do.
Version 1.0 · August 2026