GV-1.1 Legal and regulatory requirements involving AI are understood, managed, and documented
Legal and regulatory requirements involving AI are understood, managed, and documented. The organisation identifies which AI-specific and AI-adjacent legal duties bind each system, records how each is discharged, and kee
5
artefacts
1
held by a system
2
at each review
hard
to go live
Policy repository / GRC workspace
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Change records showing the register was updated when applicable law changed · Policy repository / GRC workspace
periodic reviewEvidence produced at each review
- Evidence of legal review at design and before deployment, with reviewer and date · Source control / CI pipeline
- A record of jurisdictions the system is deployed into and the requirements that follow from each · Document repository
governing documentDocuments that govern the control
- A register of legal and regulatory requirements applicable to each AI system, naming the instrument and the obligation · Policy repository / GRC workspace
- Mapping from each identified obligation to the control, process or artefact that discharges it · Document repository
First move
Mostly documents and reviews. Pull the 1 system-held artefact from your Policy repository / GRC workspace on a schedule; put the documents under version control with an owner and review date, and log each review as a dated record with a named reviewer.
Common gaps auditors find
- A generic corporate compliance register with no AI-specific entries
- Requirements listed but never mapped to a control, so nothing shows they are met
- Register maintained for the launch jurisdiction only while the system is reachable elsewhere
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet