# Connect obligations to evidence

Taiga Learning · Worksheet
https://taiga.training/en/lessons/compliance-evidence/

Use fictional or approved information. Do not put secrets in this worksheet.

## Learning objectives
- Distinguish an obligation, a control, and evidence.
- Identify who must assess legal applicability.
- Recognize why generated documentation does not establish compliance.

## Exercise
Use the fictional customer export from this lesson. Complete one row with obligation or policy, interpretation owner, control, evidence, and review trigger. Add one unresolved question. Do not fill an unknown legal conclusion with an AI-generated answer.

## Your response
- Scenario and scope:
- Assumptions and open questions:
- Proposed answer or decision, with reasons:

## Verify your response
| Claim or criterion | Evidence or test | Result or gap | Owner |
| --- | --- | --- | --- |
| | | | |
| | | | |
| | | | |

## Next action
- Action, owner, and date:
- When will you review this response?

## Principle to retain
A document records a claim. Compliance work also needs an applicable obligation, an implemented control, evidence, and an accountable decision.

## Sources
- [European Commission: AI Act framework](https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai)
- [GDPR: official regulation](https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng)
- [NIST: Secure Software Development Framework](https://csrc.nist.gov/pubs/sp/800/218/final)

This worksheet supports learning. Completing it does not itself authorize a production change.