AI Regulatory Obligations Matrix by Country

How to use this document

• What it is for. This is a tracking matrix that comes with the AI and data protection obligations identified, by jurisdiction and rule, as of the cut-off date, with their citation, status, the date they apply when there is one, the source and the verification date. Next to each rule there is an internal tracking table for the organization to record whether it applies, the owner, the evidence or supporting document, the implementation status and the next review.
• What it does not contain. The matrix brings the obligations identified as of the cut-off date as a starting point; it is not exhaustive and does not include every law, every sector or any change after that date. Nor does it decide whether an obligation applies to your organization: the organization makes that determination with its advisor. Add in Section 5.3 whatever your counsel identifies that is not in the prefilled list.
• Who should own it. Legal or compliance, with support from privacy, security and AI system owners. Enter the function in [RESPONSIBLE FUNCTION] and the person in [OWNER].
• Decisions to take first. Decide in which countries the organization operates for these purposes (through an establishment, clients, affected people or staff), which regulated sectors affect it, how often the matrix is verified and who validates whether an obligation applies.
• How to complete it. Review the prefilled rules in Section 5, keep the ones your organization decides to track and complete the "Internal tracking" table for each. Each row summarizes what the cited source says on the cut-off date. Rows marked "secondary source" should be confirmed in the official source before you use them. Classify the instrument's nature using Section 3: a bill, a guidance document or a voluntary standard is not recorded as a binding obligation.
• Country variants. Strictly speaking, this document has no country variants. If you pick a country when you customize it, Section 5 is reduced to that country's rules (and European Union rules in the case of Spain), plus the international standards. If you do not pick a country, it keeps every jurisdiction: delete the ones you do not use.
• Review. Whether a law applies, and from when, is a legal question. Have internal or outside counsel validate the "Does it apply to my organization?" column and the application dates.
• Approval and use. Have the AI committee or management approve the first version, record each review in "Version history" and, if you share it with clients, state the cut-off date and that it reflects the organization's own analysis.

AI Regulatory Obligations Matrix by Country

Field	Value
Organization	[LEGAL ENTITY NAME]
Owning function	[RESPONSIBLE FUNCTION]
Matrix owner	[OWNER]
Approved by	[APPROVED BY]
Cut-off date of this version	[DATE]
Verification frequency	[REVIEW FREQUENCY]
Countries included	[COMPLETE]

1. Purpose and scope

1.1 This matrix allows [ORGANIZATION NAME] to organize by country and track the regulatory obligations relating to the development, sale and use of AI systems and the associated processing of personal data, starting from the obligations prefilled in Section 5, and to link each one to the internal document and evidence that support it.

1.2 It includes laws, regulations, authority resolutions and, for tracking purposes, bills, guidance and voluntary standards, distinguished by their status and nature.

1.3 The prefilled part reflects what the cited sources say as of the cut-off date of this document. It is not exhaustive, does not replace consulting the current official text and does not determine which rules apply to the organization.

2. Completion rules

2.1 One row per obligation. The "Regulatory reference" table already has one row per obligation, with a reference ("Ref.") that links it to its "Internal tracking" row.

2.2 Precise citation and official source. Each rule states its source and each row its specific citation and verification date. If the source is secondary, the row is marked as such until it is verified in the official source.

2.3 Additional obligations. Those your counsel identifies that are not in the prefilled list are recorded in Section 5.3, with your own summary of what the source says: what must be done, by whom and when.

2.4 Reasoned applicability. The "Does it apply to my organization?" column states yes, no or under analysis, with the reason (territory, role, sector, threshold, type of system).

2.5 Dates. The "Applies from" column records the date set by the instrument itself. Postponed, phased or pending-regulation dates are recorded with that condition.

2.6 Link to implementation. Each obligation that applies has a supporting document or evidence, an owner, an internal status and a next review.

2.7 Verification. Each review of the matrix records the date it was verified against the official source and who carried it out.