合规义务映射Compliance Obligation Mapping

一行映射至少四列：义务来源（哪份文件第几条）→ 触发条件（你是什么角色、用在什么场景）→ 落地动作（文档、日志、标识、评估、备案）→ 证据位置与复核日期。

角色决定义务：境内《生成式人工智能服务管理暂行办法》的条款落在「提供者」上，例如第七条要求训练数据「使用具有合法来源的数据和基础模型」、第十二条要求按深度合成规定对图片视频等生成内容标识、第十七条要求具有舆论属性或社会动员能力的服务开展安全评估并履行算法备案。

同一套系统可能同时落进几个体系：欧盟《人工智能法案》按风险分层组织义务，欧委会页面写明它对 AI 系统定义了四级风险，并要求生成内容可被识别；NIST AI 风险管理框架则属自愿采用。

别把「用了 API」当成「义务在厂商那边」：多数体系里部署者与提供者承担的动作不同，但两边都可能有要做的事。

映射表要能追版本：条款会改、条号会挪、链接会失效。表里保留引用版本号和核验日期，比保留一句「已合规」有用。

A usable row has at least four columns: source (which document, which article), trigger (your role and the use case), action (documents, logs, labelling, assessment, filing), and where the evidence lives plus the date it was last checked.

Roles decide duties. China's Interim Measures for Generative AI Services place obligations on providers: Article 7 requires lawfully sourced data and foundation models for training data, Article 12 requires labelling generated images and video under the deep-synthesis rules, and Article 17 requires a security assessment and algorithm filing for services with public-opinion attributes or social mobilisation capability.

One system can land in several regimes at once. The EU AI Act organises duties by risk tier - the Commission's policy page states it defines four levels of risk for AI systems and requires generative output to be identifiable - while the NIST AI Risk Management Framework is voluntary.

Do not read "we just call an API" as "the obligations are the vendor's". In most regimes providers and deployers owe different actions, and both sides usually owe something.

Keep the mapping versioned. Articles get renumbered, text changes, links rot. A row carrying the cited version and a verification date beats a footer saying "compliant".