Work an obligation: register, record, evidence

Once a system is classified, the engine generates the exact set of duties that apply to that system, given its risk tier, your role, its Annex III area, its behavioural flags and its GDPR answers. You never pick obligations from a menu — the engine derives them, so nothing relevant is missed and nothing irrelevant clutters the view.

Where obligations live

Every obligation shows up in two places, and they stay in sync:

1. On the system — the Obligations tab of the system record, lane by stage.
2. Across the portfolio — Obligations (under Position): what the law requires of your systems and of the organisation, in one register. The EU AI Act and GDPR rows of every system sit beside the organisation's own duties — the Art. 4 literacy duty, shown once, and the GDPR organisation duties — as Organisation rows. A standard's steps are not here: they are worked on its programme page, and join this register only in My work.

The Obligations register

1. Narrow the view with the register filters: Source (EU AI Act or GDPR), Scope (System or Organisation), Stage (the Act's six stages, then the GDPR groups), Status (Open by default, or Overdue · In review · Done · All statuses) and System, plus the domain chips (Governance & literacy · Risk · Data · Documentation · Transparency & information · Oversight · Monitoring & incidents · Conformity & registration · Supply chain) and a search. The filters are written into the address, so a filtered view can be shared.
2. My work · All in the header switches between the whole register and what is assigned to you — which also brings in the steps of any standard you run that are yours, each tagged with its source and its kind.
3. Choose a layout with List / Board / Timeline. List is the dense, sortable table — Obligation · Source · Scope · Stage · Owner · Status · Due. Board is the Kanban — To do · In progress · In review · Done. Timeline buckets the same rows by week, overdue first.
4. On the Board, drag a card into another column to change its status. The move saves immediately. A GDPR organisation duty or a step cannot be dragged to Done — it is done by approval, from its own page.
5. Select rows in the list to start them together from the bulk bar.
6. Click any row or card to open the obligation's record.

Two domain filters carry extra tools: Transparency & information shows the notice studio, which drafts Art. 50 wording for the systems that need it; Data shows, on every plan, the GDPR record of processing and data-subject request panels.

The five status words

The same five words on the register, the board, the system page and every record:

Lateness is not a status: an open obligation past its date keeps its status and shows the date — see Dates and deadlines: the Obligations timeline.

Review before Done. Every obligation goes through review, and none is completed without evidence attached. If you do not hold an approver role (Org admin or Compliance manager), marking an obligation done — or dragging it to Done — sends it to In review and asks an approver; the requests waiting appear on the Dashboard. An approver may complete an obligation directly. This keeps a segregation-of-duties trail on all of the work.

The record and the guided assessment

Clicking a row opens the obligation's record: its source and article, the system and any gate it sits on, what it requires, its checklist, Also counts toward where the work is credited in a standard you run, and three ways on — Open guided assessment, Edit owner & target, and Explain this obligation, which asks Aria.

The work itself happens in the guided assessment, a full page per obligation. On the left, Build the supporting record: the obligation's own questions and checklist, then the evidence attached and the reviewer, and a footer that sends it for review (Request review) — or, for an approver, completes it or decides a request, approving it or sending it back with a reason. On the right: the system, the owner, where it stands, why it matters, what good looks like, the activity trail, and Aria.

Some obligations have a dedicated editor — the Annex IV technical documentation, the FRIA, the Art. 43 conformity assessment, the EU Declaration of Conformity, the Annex VIII registration sheet, the Art. 6(3) wizard, the Art. 13 instructions-for-use package. For those, Open guided assessment goes straight to the editor; the printable ones (the IFU package, the Annex VIII sheet) are read-only references, and the obligation is still completed in its guided assessment.

Smart forms and auto-save

Where an obligation expects structured answers the guided assessment renders a smart form: exactly the fields the EU AI Act asks for, with Aria on hand to draft a first pass. Answers auto-save shortly after you stop typing, so there is no Save button to hunt for. Every save recomputes the system's completion figure.

Checklists and per-item evidence

Alongside the form you work through the obligation's checklist items — each a concrete step, often with its own sub-article reference. For each item you can tick it complete, add notes, and attach evidence — a policy PDF, a test report, a dated screenshot — directly to that item. Evidence is what turns a claim ("we have human oversight") into something an auditor can verify.

When the Regulation lets you reuse work

On six obligations the guided assessment shows a card headed The Regulation lets you reuse work here. These are the routes the EU AI Act's own text grants: a deployer's fundamental-rights assessment may draw on the GDPR data-protection impact assessment (Art. 27(4)); the deployer shall use the provider's Art. 13 instructions when carrying out that DPIA (Art. 26(9)); an Annex I product's testing and documentation may be integrated into the procedures that legislation already requires (Art. 8(2)); a provider already under a sectoral Union-law quality-management duty may fold Art. 17 into that system (Art. 17(3)); and a financial institution's internal governance rules under Union financial-services law stand in for the quality management system (Art. 17(4), except points (g), (h) and (i)) and for the deployer's monitoring duty (Art. 26(5)).

The card quotes the article, states the condition, and asks you to name what you are relying on. Recording that reliance prefills and explains — it never changes the obligation's status and never counts towards any completion figure. Whether your organisation truly complies with its own governance rules is not something the product can see; the status stays yours. A voluntary standard such as ISO/IEC 42001 is not sectoral Union law and does not open the Art. 17(3) route.