You Didn’t Build the AI. You Still Owe the Documentation.
Regulators worldwide are drawing the same line: the company that deploys AI into real decisions is responsible for proving it’s being used right.
The Deployer/Developer Distinction
Developer
Builds, trains, or substantially modifies the AI system. Provides instructions for use, technical documentation, and conformity assessments. Creates the trigger.
Deployer
Puts the AI system into use — purchasing, licensing, or integrating it into real decisions about real people. Owns the obligation.
The builder creates the trigger. The deployer owns the obligation. Every jurisdiction we track makes this distinction — and every one puts documentation duties on the deployer.
Deployer Obligations by Jurisdiction
| Obligation | EU AI Act | Colorado | UK | Singapore | Indonesia |
|---|---|---|---|---|---|
| Risk management policy | Art. 26 | C.R.S. 6-1-1703(2) | ICO guidance | IMDA Framework | PDP Law |
| Impact assessment | Art. 27 FRIA | C.R.S. 6-1-1703(3) | Art. 35 DPIA | AI Verify | — |
| Human oversight | Art. 26(2) | — | ICO audit | IMDA Framework | — |
| Consumer/individual notice | Art. 26(11) | C.R.S. 6-1-1703(4) | UK GDPR | PDPA | PDP Law |
| Incident reporting | Art. 26(5) | — | ICO breach | — | PDP Law |
| Log retention | 6 months min | 3 years | Per DPIA | — | — |
| Worker notification | Art. 26(7) | — | — | — | — |
| Max penalty | €15M / 3% | $20K/violation | 4% turnover | S$1M | 2% revenue |
| Enforcement date | Aug 2, 2026 | Jun 30, 2026 | Now | Now | Now |
Explore Each Jurisdiction
The Documentation Layer
Whether your exposure is in one jurisdiction or five, the core requirement is the same: structured, versioned, audit-ready evidence files that map to each obligation.
That’s what we build at AOP.