Organizations that build and sell AI-enabled products or services to businesses or consumers. They take on provider duties and, above all, customer demands for evidence of governance, security and transparency before buying.
We only list countries where an obligation in force or adopted mentions this use case.
| Jurisdiction | Level | Date | Note |
|---|---|---|---|
| European Union | Transparency | August 2, 2026 | Providers must design systems to disclose interaction and mark synthetic content (Art. 50); grace until Dec 2, 2026 for existing systems. |
| European Union | High risk | December 2, 2027 | If the product has an Annex III purpose, the provider takes on a risk management system, technical documentation and conformity assessment. |
| European Union | Sector rules | September 11, 2026 | Cyber Resilience Act: reporting of exploited vulnerabilities for products with digital elements (pure SaaS is usually out of scope). |
| Ecuador | Data protection | March 10, 2026 | The vendor must inform the controller about the system's functioning, limitations and risks. |
| Peru | Minimal risk or no specific regime | September 10, 2026 | Developers are within the regulation's scope; duties depend on the use and sector. Deadline depends on the company's sector: health, education, justice, security and finance Sep 10, 2026; transport, commerce and labor Sep 10, 2027; production, agriculture, energy and mining Sep 10, 2028; others Sep 10, 2029; small businesses Sep 10, 2027 and micro businesses Sep 10, 2028 unless their sector has an earlier date. |
| United States (federal) | Sector rules | — | FTC Act §5: prior substantiation of every AI claim, including in B2B sales. |
| Colorado | Consequential decision | January 1, 2027 | SB 26-189: developers must give technical documentation to deployers and keep records for 3 years. |
| California | Transparency | January 1, 2026 | AB 2013 (training data) and SB 942 (content disclosures) for generative systems. |
| Texas | Minimal risk or no specific regime | — | TRAIGA bans certain intentional uses and offers a safe harbor for NIST AI RMF alignment. |
| Brazil | Minimal risk or no specific regime | — | Bill PL 2338 would impose developer duties; the LGPD applies today. |
Datasheet · USD 19 · Available to buy
Guide · USD 39 · Available to buy
Checklist · USD 19 · Available to buy
Procedure · USD 39 · Available to buy
Includes 6 documents
Base documents on topics that procurement questionnaires from banks and US clients often cover: policy, inventory, impact assessment, incidents, vendors and security.
USD 169USD 274
Complete kit · available to buyIncludes 6 documents
Six base documents for integrating third-party models through APIs or RAG: due diligence, model provenance, architecture, integration map, adversarial security and service level agreement.
USD 119USD 194
Complete kit · available to buyIncludes 7 documents
Seven base documents for hosting in-house or open-weight models: provenance, security baseline, adversarial testing, architecture, model card, life cycle and rollback.
USD 149USD 233
Complete kit · available to buy