Skip to content
Submit incident

Policy themes

Every control we list is tagged with one or more of these 35 themes, in 8 families, so policies from different places can be read side by side. Choose a theme to see the policies that cover it, or compare two or three policies theme by theme.

Grouped the way the four reference instruments organise their requirements: the EU AI Act (Regulation (EU) 2024/1689) by obligation, the GDPR (Regulation (EU) 2016/679) by principle, right and duty, the NIST AI Risk Management Framework 1.0 by its Govern, Map, Measure and Manage functions, and ISO/IEC 42001:2023 by its management system clauses and Annex A controls. Each theme lists where it sits in those instruments.

Risk and scope

  • Risk classification

    34 policies, 97 controls

    Sorting AI systems or processing into tiers (prohibited, high, limited, minimal, systemic) that decide which other duties apply.

    Where it sits: EU AI Act Art. 6, 7 and Annex III; EU AI Act Art. 51; NIST AI RMF MAP function; ISO/IEC 42001 clause 6.1

  • Prohibited practices

    36 policies, 97 controls

    Uses of AI or data that are banned outright, whatever the safeguards.

    Where it sits: EU AI Act Art. 5; GDPR Art. 9(1) as a default prohibition

  • Risk management system

    82 policies, 308 controls

    A documented, continuous process to identify, analyse, evaluate and treat the risks an AI system poses across its life cycle.

    Where it sits: EU AI Act Art. 9; NIST AI RMF GOVERN and MANAGE functions; ISO/IEC 42001 clauses 6.1.2 and 6.1.3

  • Impact assessment

    44 policies, 116 controls

    A prior assessment of a system's or processing's effects on people's fundamental rights, data protection or society, recorded and acted on.

    Where it sits: GDPR Art. 35 and 36; EU AI Act Art. 27; NIST AI RMF MAP function; ISO/IEC 42001 clause 6.1.4 and Annex A.5

Data and privacy

  • Data governance and quality

    92 policies, 633 controls

    Rules on how data is collected, prepared and kept so that it is lawful, relevant, representative, accurate and minimal.

    Where it sits: EU AI Act Art. 10; GDPR Art. 5 and 25; NIST AI RMF MAP and MEASURE functions; ISO/IEC 42001 Annex A.7

  • Data subject rights and consent

    53 policies, 270 controls

    Individuals' rights over their personal data (access, correction, erasure, objection, portability) and the legal bases, such as consent, for using it.

    Where it sits: GDPR Art. 6, 7 and 12 to 21; NIST AI RMF MEASURE 2.10 (privacy risk)

  • Cross-border data transfer

    27 policies, 168 controls

    Conditions for sending personal data or AI services across borders, including adequacy, safeguards and localisation.

    Where it sits: GDPR Art. 44 to 49

  • Copyright and training data

    23 policies, 53 controls

    Duties about intellectual property in the content used to train models, including opt-outs and summaries of training content.

    Where it sits: EU AI Act Art. 53(1)(c) and (d)

Transparency and records

  • Transparency and disclosure to users

    107 policies, 720 controls

    Telling people that they are dealing with AI or that their data is processed, and giving deployers and the public the information needed to use or understand a system.

    Where it sits: EU AI Act Art. 13 and 50; GDPR Art. 12 to 14; NIST AI RMF MEASURE 2.8 and 2.9; ISO/IEC 42001 Annex A.8

  • Labelling of synthetic content

    13 policies, 45 controls

    Marking AI-generated or manipulated text, images, audio and video so that it can be recognised as such.

    Where it sits: EU AI Act Art. 50(2) and 50(4)

  • Technical documentation

    46 policies, 171 controls

    Keeping up-to-date documents that describe a system's design, data, testing and performance for authorities and downstream users.

    Where it sits: EU AI Act Art. 11, 18, 53 and Annex IV; ISO/IEC 42001 Annex A.6

  • Record keeping and logging

    78 policies, 402 controls

    Automatic logs of system operation and records of processing activities kept so that events can be traced and audited.

    Where it sits: EU AI Act Art. 12, 19 and 26(6); GDPR Art. 30; ISO/IEC 42001 Annex A.6

Technical safeguards

  • Human oversight

    56 policies, 196 controls

    Design and staffing so that competent people can monitor, understand, override or stop an AI system.

    Where it sits: EU AI Act Art. 14 and 26(2); GDPR Art. 22(3); NIST AI RMF GOVERN 3.2 and MAP 3.5; ISO/IEC 42001 Annex A.9

  • Accuracy, robustness and cybersecurity

    85 policies, 341 controls

    Technical measures that keep a system accurate, resilient to errors and attacks, and the data it uses secure.

    Where it sits: EU AI Act Art. 15; GDPR Art. 32; NIST AI RMF MEASURE 2.5 to 2.7

  • Bias and non-discrimination

    48 policies, 169 controls

    Detecting, preventing and correcting unfair or discriminatory outcomes from AI systems or data.

    Where it sits: EU AI Act Art. 10(2)(f) and (5); NIST AI RMF MEASURE 2.11

  • Testing and evaluation

    46 policies, 163 controls

    Testing, validation, red teaming and evaluation of a system against defined metrics before and after deployment.

    Where it sits: EU AI Act Art. 9(6) to (8), 55 and 60; NIST AI RMF MEASURE function; ISO/IEC 42001 clause 9 and Annex A.6

Assurance and lifecycle

  • Conformity assessment and certification

    35 policies, 182 controls

    Checking, by self-assessment, a third party or a certification scheme, that a system or organisation meets the rules before or while it operates.

    Where it sits: EU AI Act Art. 43, 47 and 48; GDPR Art. 42 and 43; ISO/IEC 42001 clauses 9.2 and 9.3

  • Registration and notification

    18 policies, 103 controls

    Registering systems, algorithms or models in a public or regulator database, or notifying an authority before use.

    Where it sits: EU AI Act Art. 49, 52 and 71

  • Incident and breach reporting

    27 policies, 126 controls

    Reporting serious incidents, malfunctions or personal data breaches to authorities and, where needed, to affected people.

    Where it sits: EU AI Act Art. 55(1)(c) and 73; GDPR Art. 33 and 34; NIST AI RMF MANAGE 4.3

  • Post-market monitoring and corrective action

    43 policies, 139 controls

    Watching how a system performs once in use and fixing, withdrawing or recalling it when problems appear.

    Where it sits: EU AI Act Art. 20, 26(5) and 72; NIST AI RMF MANAGE 4.1; ISO/IEC 42001 clauses 9 and 10

Rights and protected groups

  • Automated decision-making rights

    18 policies, 37 controls

    Rights of people affected by decisions made or shaped by automated systems: not to be subject to them alone, to an explanation, to contest and to human review.

    Where it sits: GDPR Art. 22; EU AI Act Art. 86

  • Children and vulnerable groups

    24 policies, 52 controls

    Extra protection for minors and people vulnerable through age, disability or social or economic situation.

    Where it sits: GDPR Art. 8; EU AI Act Art. 5(1)(b) and 9(9)

  • Biometric identification and surveillance

    3 policies, 6 controls

    Limits on facial recognition, remote biometric identification, emotion recognition, categorisation and other monitoring of people.

    Where it sits: EU AI Act Art. 5(1)(e) to (h) and 26(10); GDPR Art. 9

  • Whistleblowing, complaints and redress

    17 policies, 102 controls

    Channels to complain to a regulator or company, to seek a remedy or compensation, and protection for people who report breaches.

    Where it sits: GDPR Art. 77 to 82; EU AI Act Art. 85 and 87

Roles and organisation

  • Supply chain and provider-deployer duties

    58 policies, 230 controls

    How duties are split and passed along between developers, providers, deployers, importers, distributors, controllers, processors and other third parties.

    Where it sits: EU AI Act Art. 22 to 26; GDPR Art. 26 and 28; NIST AI RMF GOVERN 6; ISO/IEC 42001 Annex A.10

  • General purpose and foundation models

    27 policies, 119 controls

    Duties specific to providers of general purpose, foundation or frontier models, including those with systemic risk.

    Where it sits: EU AI Act Art. 51 to 55

  • Accountability and governance roles

    129 policies, 1204 controls

    Internal policies, management systems, named officers and leadership duties that make an organisation answerable for its AI or data use.

    Where it sits: EU AI Act Art. 17; GDPR Art. 5(2), 24 and 37 to 39; NIST AI RMF GOVERN function; ISO/IEC 42001 clause 5 and Annex A.2 and A.3

  • Training and AI literacy

    97 policies, 513 controls

    Making sure staff and users have the skills and understanding needed to build, use or oversee AI systems.

    Where it sits: EU AI Act Art. 4 and 26(2); NIST AI RMF GOVERN 2.2; ISO/IEC 42001 clauses 7.2 and 7.3

  • Public sector use and procurement

    52 policies, 325 controls

    Rules for how governments and public bodies buy, approve and use AI systems.

    Where it sits: EU AI Act Art. 27 and 49(3)

  • Innovation support and sandboxes

    47 policies, 249 controls

    Regulatory sandboxes, real-world testing schemes and support measures for smaller firms and research.

    Where it sits: EU AI Act Art. 57 to 63

Enforcement and sectors

  • Enforcement, penalties and regulators

    31 policies, 286 controls

    Which authorities supervise, what powers they hold, and the fines or sanctions for breaking the rules.

    Where it sits: EU AI Act Art. 70, 74 and 99 to 101; GDPR Art. 51 to 58 and 83

  • Sector rules: health

    9 policies, 27 controls

    Requirements specific to AI or data use in health care, medical devices and health data.

    Where it sits: EU AI Act Annex I (medical device legislation); GDPR Art. 9(2)(h)

  • Sector rules: finance and insurance

    5 policies, 7 controls

    Requirements specific to AI in credit, banking, insurance and financial markets.

    Where it sits: EU AI Act Annex III point 5(b) and (c)

  • Sector rules: employment

    10 policies, 20 controls

    Requirements specific to AI in hiring, worker management, monitoring and termination.

    Where it sits: EU AI Act Annex III point 4 and Art. 26(7)

  • Sector rules: education

    6 policies, 14 controls

    Requirements specific to AI in admissions, assessment, proctoring and learning.

    Where it sits: EU AI Act Annex III point 3