Frameworks / EU_AI_ACT
EU Artificial Intelligence Act (Reg. 2024/1689)
European Parliament & Council · EU · effective 2024-08-01 · EU_AI_ACT
High-risk obligations phase in through 2026-2027. Annex IV sets the technical documentation a provider must hold.
16 controls, mapped to the evidence that satisfies each
Every control links to the dimension whose evidence would satisfy it. That mapping is the working link between an obligation written in law or a standard and a document somebody has to produce. Each row has its own address: link to a single control.
| Control | Title | Requirement | Satisfied by |
|---|---|---|---|
| Art. 27(1)(a) | Description of the deployer's use processes | The assessment describes the deployer's processes in which the high-risk AI system will be used in line with its intended purpose. | D1 |
| Art. 27(1)(b) | Period and frequency of use | The assessment describes the period of time within which, and the frequency with which, the system is intended to be used. | D1 |
| Art. 27(3) | Notification to the market surveillance authority | Once performed, the deployer notifies the market surveillance authority of the assessment's results, submitting the AI Office's filled-out questionnaire template, unless the Article 46(1) exemption applies. | D1 |
| Art.11 / Annex IV | Technical documentation | Provider holds documentation describing the system, its intended purpose, and its design choices. | D1 |
| Art.13 | Transparency to deployers | Instructions for use sufficient for the deployer to interpret output. | D1 |
| Art. 27(1)(d) | Specific risks of harm to those groups | The assessment identifies the specific risks of harm likely to affect the categories identified under point (c), taking into account the information the provider supplied under Article 13. | D3 |
| Art.14 | Human oversight | Designed so a natural person can effectively oversee it during use. | D3 |
| Art.15 | Accuracy, robustness, cybersecurity | Appropriate accuracy declared; resilience to error and adversarial manipulation. | D3 |
| Art. 27(1)(c) | Categories of people likely affected | The assessment identifies the categories of natural persons and groups likely to be affected by the system's use in the specific context. | D4 |
| Art.10 | Data governance | Training, validation and test sets examined for bias; gaps addressed. | D4 |
| Art. 27(1) | Who must perform a fundamental rights impact assessment | Before first deploying a high-risk AI system under Article 6(2) — other than an Annex III point 2 critical-infrastructure system — a deployer that is a body governed by public law, a private entity providing public services, or a deployer of an Annex III point 5(b) or 5(c) system performs an assessment of the impact its use may have on fundamental rights. | D6 |
| Art. 27(1)(e) | Human oversight measures | The assessment describes how the human oversight measures required by the instructions for use are implemented. | D6 |
| Art. 27(1)(f) | Mitigation and governance if a risk materializes | The assessment sets out the measures to be taken if the identified risks materialize, including internal governance arrangements and complaint mechanisms. | D6 |
| Art. 27(2) | When the assessment is repeated | The duty applies at first use of the system; a deployer may rely on a previously conducted fundamental rights impact assessment for similar cases, but updates the assessment if any element listed in paragraph 1 has changed or is no longer up to date. | D6 |
| Art.12 | Record-keeping / logging | Automatic recording of events over the system lifetime, enabling traceability. | D6 |
| Art. 27(4) | Complementing a data protection impact assessment | Where an obligation under this Article is already met through a data protection impact assessment under GDPR Article 35 or Law Enforcement Directive Article 27, the fundamental rights impact assessment required here complements that assessment rather than duplicating it. | D7 |
What this mapping is, and what it is not
It is a reading of a published instrument, with each control cited to its source, mapped to the kind of evidence that would satisfy it. It is not legal advice, not a certification, and not a statement that any organisation complies with anything. Where an instrument is not yet in force, this page says so rather than selling urgency.
Talk to the person who built this
If you assess clients against this instrument, the mapping is the part you can check line by line. There is no sales team: this is founder-led, so it reaches the founder directly. Tenant access is $500 a month, and free early access to the method, the corpus and the router is on offer first if that is useful. If it is not a fit, saying so costs you one reply.