EU AI Act
The world's first comprehensive AI regulation, establishing risk-based rules for the placing on the market, putting into service and use of AI systems in the Union. Adopted 13 Jun 2024 (OJ L 1689/2024); entered into force 1 Aug 2024 with staged application: prohibited practices and AI literacy from 2 Feb 2025; GPAI obligations from 2 Aug 2025; most high-risk AI obligations from 2 Aug 2026; full application from 2 Aug 2027. 113 articles across 13 chapters: general provisions, prohibited AI practices, high-risk AI systems (classification, requirements, operator obligations, notified bodies, conformity assessment, standards), transparency for certain AI, general-purpose AI models (incl systemic-risk GPAI), measures for innovation (regulatory sandboxes), governance (AI Office, AI Board, scientific panel), the EU database for high-risk AI, post-market monitoring and market surveillance, codes of conduct and guidelines, delegation/committee, penalties, and final provisions including the right to explanation of individual decision-making.
EU AI Act is a compliance framework from European Union with 9 domains and 43 controls that map to 13 other frameworks. The largest domains are EU AI Act - High-Risk Operator Obligations (12 controls), EU AI Act - High-Risk Classification and Requirements (9 controls), EU AI Act - Notified Bodies, Standards and Conformity Assessment (6 controls). Every control below carries what it requires and what an assessor expects to see.
Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (9)
EU AI Act - General Provisions and Prohibited Practices
| Code | Title |
|---|---|
| EUAI-Art.4 | AI literacy |
| EUAI-Art.5 | Prohibited AI practices |
EU AI Act - General-Purpose AI Models
| Code | Title |
|---|---|
| EUAI-Art.51 | Classification of general-purpose AI models as general-purpose AI models with systemic risk |
| EUAI-Art.52 | Procedure |
| EUAI-Art.53 | Obligations for providers of general-purpose AI models |
| EUAI-Art.54 | Authorised representatives of providers of general-purpose AI models |
| EUAI-Art.55 | Obligations of providers of GPAI models with systemic risk |
EU AI Act - Governance and EU Database
| Code | Title |
|---|---|
| EUAI-Art.71 | EU database for high-risk AI systems |
EU AI Act - High-Risk Classification and Requirements
| Code | Title |
|---|---|
| EUAI-Art.10 | Data and data governance |
| EUAI-Art.11 | Technical documentation |
| EUAI-Art.12 | Record-keeping (logs) |
| EUAI-Art.13 | Transparency and provision of information to deployers |
| EUAI-Art.14 | Human oversight |
| EUAI-Art.15 | Accuracy, robustness and cybersecurity |
| EUAI-Art.6 | Classification rules for high-risk AI systems |
| EUAI-Art.8 | Compliance with the requirements |
| EUAI-Art.9 | Risk management system |
EU AI Act - High-Risk Operator Obligations
| Code | Title |
|---|---|
| EUAI-Art.16 | Obligations of providers of high-risk AI systems |
| EUAI-Art.17 | Quality management system |
| EUAI-Art.18 | Documentation keeping |
| EUAI-Art.19 | Automatically generated logs |
| EUAI-Art.20 | Corrective actions and duty of information |
| EUAI-Art.21 | Cooperation with competent authorities |
| EUAI-Art.22 | Authorised representatives of providers of high-risk AI systems |
| EUAI-Art.23 | Obligations of importers |
| EUAI-Art.24 | Obligations of distributors |
| EUAI-Art.25 | Responsibilities along the AI value chain |
| EUAI-Art.26 | Obligations of deployers of high-risk AI systems |
| EUAI-Art.27 | Fundamental rights impact assessment for high-risk AI systems |
EU AI Act - Innovation Measures
| Code | Title |
|---|---|
| EUAI-Art.59 | Further processing of personal data for developing certain AI systems in the public interest in the AI regulatory sandbox |
| EUAI-Art.60 | Testing of high-risk AI systems in real world conditions outside AI regulatory sandboxes |
| EUAI-Art.61 | Informed consent to participate in testing in real world conditions outside AI regulatory sandboxes |
EU AI Act - Notified Bodies, Standards and Conformity Assessment
| Code | Title |
|---|---|
| EUAI-Art.41 | Common specifications |
| EUAI-Art.43 | Conformity assessment |
| EUAI-Art.46 | Derogation from conformity assessment procedure |
| EUAI-Art.47 | EU declaration of conformity |
| EUAI-Art.48 | CE marking |
| EUAI-Art.49 | Registration |
EU AI Act - Post-Market Monitoring, Market Surveillance and Rights
| Code | Title |
|---|---|
| EUAI-Art.72 | Post-market monitoring by providers and post-market monitoring plan for high-risk AI systems |
| EUAI-Art.73 | Reporting of serious incidents |
| EUAI-Art.86 | Right to explanation of individual decision-making |
| EUAI-Art.87 | Reporting of infringements and protection of reporting persons |
EU AI Act - Transparency Obligations
| Code | Title |
|---|---|
| EUAI-Art.50 | Transparency obligations for providers and deployers of certain AI systems |
Your Compliance Coverage
If you comply with EU AI Act, you already cover:
ISO/IEC 42001:2023
98%
42 controls mapped
Compare →NIST SP 800-53 Rev 5
91%
39 controls mapped
Compare →SOC 2
77%
33 controls mapped
Compare →+ 10 more: ISO 27001:2022 (77%), Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 (67%)
See all 13 mapped frameworks ↓Maps to 13 other frameworks
Coverage is not the same as your position
This page shows what EU AI Act overlaps with in general. Where your organisation actually stands, against the standard you are going for and the certifications you already hold, is a different question. Same graph and the same recorded refutations, scoped to you rather than to a pair.
The Compliance Position Diagnostic, $5,000 fixed, ten business daysWhat is EU AI Act and who does it apply to?
EU AI Act is a compliance framework from European Union with 9 domains and 43 controls. The world's first comprehensive AI regulation, establishing risk-based rules for the placing on the market, putting into service and use of AI systems in the Union. Adopted 13 Jun 2024 (OJ L 1689/2024); entered into force 1 Aug 2024 with staged application: prohibited practices and AI literacy from 2 Feb 2025; GPAI obligations from 2 Aug 2025; most high-risk AI obligations from 2 Aug 2026; full application from 2 Aug 2027. 113 articles across 13 chapters: general provisions, prohibited AI practices, high-risk AI systems (classification, requirements, operator obligations, notified bodies, conformity assessment, standards), transparency for certain AI, general-purpose AI models (incl systemic-risk GPAI), measures for innovation (regulatory sandboxes), governance (AI Office, AI Board, scientific panel), the EU database for high-risk AI, post-market monitoring and market surveillance, codes of conduct and guidelines, delegation/committee, penalties, and final provisions including the right to explanation of individual decision-making. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does EU AI Act actually require?
EU AI Act has 43 controls organised across 9 domains. The largest domains are EU AI Act - High-Risk Operator Obligations (12 controls), EU AI Act - High-Risk Classification and Requirements (9 controls), EU AI Act - Notified Bodies, Standards and Conformity Assessment (6 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of EU AI Act do I already cover?
EU AI Act maps to 13 other compliance frameworks. The top mapping partners are ISO/IEC 42001:2023 (98% coverage), NIST SP 800-53 Rev 5 (91% coverage), SOC 2 (77% coverage). Use our comparison tool to explore control-level mappings between frameworks.
How do I implement EU AI Act?
Start your EU AI Act compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about EU AI Act requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 43 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,120 frameworks.
Get Started Free →Free forever, no credit card required