Assessments · AI obligations atlas
The AI Obligations Atlas sets out AI governance obligations by jurisdiction, tags each by the tier of its source (binding, expected or anticipated) and maps it to ten standardised AI use cases. Built for AI, technology and regulatory lawyers in external counsel firms, it serves the same records three ways: a web app, a REST API and an MCP server. Records state what sources say and how they are classified. They do not say what the law requires of any client.
Not legal advice. Triodian records positions and states what documents show. Whether anything meets a legal obligation, and what your duties require, are questions for your counsel.
The question it answers
Three tiers
The tier is a fact about the source, not a view about the client. A record whose tier rests on another instrument names that instrument and says the mapping is Triodian’s.
Binding
A statute, a regulation, or a prudential standard made under one. Breach carries a legal consequence.
Expected
A letter to industry, a guideline, a recognised standard. Not binding in itself; often read against a binding standard it draws on, which the record names.
Anticipated
Carries a date or a stage. The record moves tier when the source does.
Ten use cases
A lawyer filters by the use case the matter concerns. Records specific to it come first; records that apply to any AI use, such as board accountability or risk management, follow in a folded group. The same ten use cases run through the AI Use Assessment.
The matter brief
The web app downloads the public dataset once and filters it locally. The brief is built and kept there too, in a published schema. A question that asks for a verdict (“are we compliant?”) is logged for counsel, not written into the brief.
1
Entity type, jurisdiction, the use cases in play. A matter label that stays in the browser and is never sent.
2
The register, tier by tier: what each source says, its citation and link, its effective dates and status, and the provenance trail behind the record.
3
A fixed-format brief: the obligations in scope by tier, the questions counsel will need to determine, and the engagements that fit. No statement of what the law requires of the client.
4
From any brief, a registered firm can send a note and, if it ticks the box, the brief’s scope. Nothing else leaves the browser.
Three interfaces, one set of records
Every API and MCP response is checked against the dataset’s language rules before it leaves; a response that fails the check is withheld. Asking about a jurisdiction the Atlas does not cover yet returns a coverage note, so an empty result is never read as “no obligations”.
| Channel | What it serves | Who uses it |
|---|---|---|
| Web app | Register, filtered by tier, jurisdiction, entity type and use case; record pages with provenance; use cases; changes; the matter brief. | Lawyers scoping a matter |
| REST API | Obligations, instruments, changes since a date, provenance for any record, use cases, jurisdictions, organisations and the dataset policy. OpenAPI published. | Firm systems and research tools |
| MCP server | Four tools: find obligations, get an obligation, list changes, explain provenance. Streamable HTTP. | AI assistants inside the firm, under the firm’s key |
How the records are kept
Nothing that sets a status, a date or a tier is published without a named reviewer’s decision. Records still waiting for review are marked as such and kept off the public dataset.
Every record carries a provenance trail from the source it was read from to the decision that published it, and the API explains it on request.
Each instrument is a monitored source. A change in it raises a trigger, and the affected records are re-verified or re-tiered through the same review.
Records follow the open Triodian Metamodel: obligations, external organisations, use cases, data flows and triggers.
Where it stops
Records state what sources say and how they are classified. Whether an obligation applies to a client, and what it requires of them, is counsel’s determination.
The Atlas never says whether an entity is compliant. A question that asks for one is logged for counsel.
Australia, Singapore and international standards today. Other jurisdictions return a coverage note, not an empty list.
The matter label is never sent. The brief’s scope leaves the browser only if the lawyer chooses to share it with Triodian.
The app
Free to use at obligations-atlas.triodian.com. The register and matter brief need no account; firm registration, approved by a named reviewer, issues the API key that the REST API and MCP server accept. The Atlas is the entry point to the assessment apps: the brief names the engagements that fit, and the AI Board Direction, AI Risk Appetite, AI Use Assessment and AI Confidentiality Exposure Assessment apps read it.
Available now, and open source under Apache 2.0: free to self-host. Records as at their stated verification date; re-check the source before relying on any record.
Get in touch
How the register, the brief, the API and the MCP server fit your matters, and how firm registration works.
Book a 30-minute conversation →