AIGO — EU AI Act Main Mapping

1. Document Purpose

This document provides the principal AIGO mapping between the European Union Artificial Intelligence Act and the AIGO AI Governance Operating Framework. It establishes the primary relationship between:

EU AI Act requirements;
applicability conditions;
regulated actors;
AI-system categories;
AIGO governance domains;
AIGO risks;
AIGO controls;
AIGO assessments;
AIGO approvals;
AIGO monitoring;
AIGO incidents;
AIGO change management;
AIGO assurance;
AIGO evidence;
AIGO management review;
AIGO improvement; and
AIGO retirement.

This document is the master mapping. Detailed subject-specific mappings are maintained in the other EU AI Act mapping documents within: mappings/eu-ai-act/ This mapping is an operational governance crosswalk. It is not legal advice, a conformity assessment, or a declaration of compliance.

2. Mapping Information

Field	Value
Mapping	AIGO EU AI Act Main Mapping
Version	0.1
Status	Draft
Document Identifier	`AIGO-MAP-EUAI-001`
Document Type	EU AI Act Mapping
Framework	AIGO — AI Governance Operating Framework
Mapping Package	`AIGO-MAP-EUAI`
Primary Legal Instrument	Regulation (EU) 2024/1689
Current Amendment Baseline	Regulation (EU) 2026/1744
Mapping Architecture	`AIGO-MAP-EUAI-ARCH-001`
Registry	`00-AIGO-EU-AI-Act-Mapping-Registry-v0.1.json`

Regulation (EU) 2026/1744, adopted on 8 July 2026 and published on 24 July 2026, amended Regulation (EU) 2024/1689 as part of the Digital Omnibus on AI. The mapping therefore uses the amended legal baseline rather than reproducing the unamended 2024 timetable.

3. Authoritative Source Hierarchy

The mapping shall apply the following source hierarchy.

3.1 Binding Legal Source

The primary source is: Regulation (EU) 2024/1689 of the European Parliament and of the Council as amended by applicable subsequent Union legislation, including: Regulation (EU) 2026/1744 — Digital Omnibus on AI. The binding legal text is authoritative for legal requirements.

3.2 Official Implementation Material

Supporting sources may include:

European Commission guidance;
European AI Office guidance;
official FAQs;
codes of practice;
delegated acts;
implementing acts;
common specifications;
harmonised standards when formally applicable;
other official implementation material.

3.3 AIGO Mapping

AIGO translates the legal requirement into an operational governance relationship. An AIGO mapping does not change the legal requirement.

4. Mapping Methodology

Each mapped provision should answer the following questions:

What legal requirement applies?
Who is the affected actor?
To which AI systems or activities does it apply?
When does it apply?
Are there exceptions or transitional provisions?
What AIGO governance domain addresses it?
What AIGO risk or governance objective is relevant?
What AIGO control implements or supports it?
What assessment is required?
What approval or decision is required?
What monitoring is required?
What evidence should exist?
What assurance may be appropriate?
What happens when the requirement is not satisfied?
What lifecycle stages are affected?

5. Mapping Relationship Types

The following relationship types are used:

Relationship	Meaning
DIRECT	AIGO contains a control or governance mechanism directly addressing the requirement
PARTIAL	AIGO addresses only part of the requirement
SUPPORTING	AIGO provides supporting governance capability
INDIRECT	Relationship exists but is not a direct implementation mechanism
CONDITIONAL	Mapping applies only under stated conditions
INFORMATIVE	Mapping provides contextual information
NOT_APPLICABLE	Requirement is outside defined organizational applicability
NO_DIRECT_AIGO_EQUIVALENT	Requirement requires a separate legal, regulatory, or organizational mechanism

A direct AIGO mapping does not itself establish legal compliance.

6. Actor Mapping

The EU AI Act applies differently depending on actor role. AIGO should therefore capture the applicable actor before applying detailed requirements. Primary actor categories include:

PROVIDER
DEPLOYER
IMPORTER
DISTRIBUTOR
PRODUCT_MANUFACTURER
AUTHORISED_REPRESENTATIVE
OPERATOR
AFFECTED_PERSON
PUBLIC_AUTHORITY
NATIONAL_COMPETENT_AUTHORITY
MARKET_SURVEILLANCE_AUTHORITY
EUROPEAN_AI_OFFICE
OTHER_RELEVANT_ACTOR

An organization may occupy more than one role for different AI systems or activities. AIGO governance should preserve the actor role applicable to each governed AI system.

7. Applicability Model

The primary AIGO applicability chain is:

AI Activity
    ↓
Actor
    ↓
Territorial Scope
    ↓
AI System / Model Type
    ↓
Intended Purpose
    ↓
Risk / Classification
    ↓
Exception / Exemption
    ↓
Transition
    ↓
EU AI Act Applicability

An organization should not assume that the presence of an AI system automatically means that every EU AI Act provision applies.

8. AIGO Applicability Record

For material EU AI Act assessments, AIGO should maintain:

Field	Purpose
EU AI Act provision	Identifies source requirement
Actor	Identifies duty bearer
AI System ID	Identifies affected system
Intended Purpose	Establishes context
Jurisdiction	Establishes territorial context
AI Act Category	Identifies legal classification
Applicability	Yes / No / Conditional
Exception	Identifies applicable exception
Effective Date	Establishes timing
Transition	Identifies transitional rule
Rationale	Documents decision
Evidence	Supports applicability decision
Reviewer	Accountability
Review Date	Currency

9. AIGO Classification Versus EU AI Act Category

AIGO classification and EU AI Act classification must remain separate concepts. An AI system may have:

an AIGO risk classification;
an EU AI Act category;
a sector classification;
a technical risk classification;
a privacy classification;
a security classification.

These classifications may influence one another but are not interchangeable. The AIGO Classification Template and Risk Assessment should therefore record the EU AI Act classification separately where applicable.

10. Core AIGO Mapping Architecture

The principal crosswalk is:

EU AI Act
    ↓
Applicability
    ↓
AIGO Governance
    ↓
AIGO Risk
    ↓
AIGO Control
    ↓
AIGO Assessment
    ↓
AIGO Approval
    ↓
AIGO Monitoring
    ↓
AIGO Evidence
    ↓
AIGO Assurance
    ↓
Management Review
    ↓
Improvement
    ↓
Retirement

This represents the preferred operationalization path.

11. Article 1 — Subject Matter and Purpose

Legal Theme

The AI Act establishes harmonised rules on artificial intelligence and a framework intended to address risks associated with AI while supporting innovation and protecting health, safety, fundamental rights, democracy, rule of law, and environmental interests as applicable.

AIGO Mapping

AIGO Components:

Governance;
AI System;
Risk;
Control;
Assessment;
Assurance;
Evidence;
Management Review.

Relationship

DIRECT / SUPPORTING

AIGO Implementation

The AIGO Governance arrangement should establish:

AI governance authority;
AI system lifecycle governance;
risk management;
controls;
human oversight;
monitoring;
assurance;
incident management;
continual improvement.

Evidence

Potential evidence includes:

governance charter;
AI inventory;
risk methodology;
control framework;
governance records;
assurance reports;
management review.

12. Article 2 — Scope

Legal Theme

The AI Act defines the entities, AI systems, models, and circumstances to which the Regulation applies, including territorial and role-based conditions and specified exclusions.

AIGO Mapping

AIGO Components:

Governance;
AI System;
Classification;
Risk;
Assessment.

Relationship

DIRECT

AIGO Implementation

Each in-scope AI system should have:

identified legal actor;
applicable jurisdiction;
intended purpose;
EU AI Act applicability determination;
relevant category;
evidence supporting the determination.

Control Requirement

AIGO Applicability Determination Control The control should require documented applicability analysis for material AI systems.

13. Article 3 — Definitions

Legal Theme

The Regulation defines key terms used throughout the AI Act.

AIGO Mapping

AIGO Components:

Common Definitions;
Governance;
Classification;
AI System Schema;
Guidance.

Relationship

SUPPORTING

AIGO Requirement

AIGO should maintain an explicit distinction between:

EU AI Act legal definitions;
AIGO framework definitions;
organization-specific implementation terminology.

EU AI Act terms should not be redefined in a way that changes their legal meaning.

Control Requirement

Controlled Regulatory Terminology Controlled terminology should reference the authoritative legal source.

14. Article 4 — AI Literacy

Legal Theme

The AI Act establishes requirements concerning AI literacy for relevant providers and deployers. The Commission’s current implementation material states that the original AI-literacy provisions applied from 2 February 2025. The 2026 Digital Omnibus subsequently modified parts of the AI-literacy framework, so the detailed mapping must distinguish the current binding text from earlier implementation guidance.

AIGO Mapping

AIGO Components:

Governance;
Training and Competence;
Evidence;
Management Review;
Improvement.

Relationship

DIRECT

AIGO Controls

AIGO should maintain:

AI literacy requirements;
role-based competence requirements;
training plans;
competence evidence;
periodic review.

Evidence

training records;
competence assessments;
role profiles;
learning records;
management review.

15. Article 5 — Prohibited AI Practices

Legal Theme

Certain AI practices are prohibited subject to the conditions defined by the Regulation and subsequent amendments. The 2026 Digital Omnibus additionally amended the prohibition framework, including the addition of prohibitions relating to certain non-consensual sexually explicit/intimate content and child sexual abuse material generated by AI.

AIGO Mapping

AIGO Components:

Classification;
Risk;
Approval;
Control;
Monitoring;
Incident;
Assurance.

Relationship

DIRECT / CRITICAL

AIGO Requirement

AIGO should implement a prohibited-practice screening gate. Recommended process:

Proposed AI Activity
        ↓
Prohibited-Practice Screening
        ↓
Prohibited?
   ┌────┴────┐
  YES        NO
   ↓          ↓
STOP /        Continue
ESCALATE      Classification

Control

EU AI Act Prohibited-Practice Screening Control

Approval

A potential prohibited practice should not proceed through ordinary deployment approval. It should be escalated to appropriate legal/compliance and governance authority.

Evidence

screening decision;
use-case description;
intended-purpose evidence;
legal review where required;
governance decision.

16. Articles 6–7 — High-Risk Classification

Legal Theme

The AI Act establishes the criteria for determining high-risk AI systems and provides mechanisms concerning changes to high-risk classification. The Commission’s current implementation material states that, following the Digital Omnibus, the application dates for high-risk rules have been extended for specified categories.

AIGO Mapping

AIGO Components:

AI Classification;
AI System;
Risk;
Assessment;
Approval.

Relationship

DIRECT

AIGO Requirement

AIGO should maintain a specific EU AI Act high-risk determination. This should be separate from the AIGO general risk rating.

Evidence

intended-purpose documentation;
Annex I analysis where relevant;
Annex III analysis where relevant;
classification rationale;
legal/compliance review;
system profile.

17. Article 8 — Compliance with Requirements

Legal Theme

High-risk AI systems must comply with the applicable requirements established by the Regulation.

AIGO Mapping

AIGO Components:

Governance;
Control;
Assessment;
Evidence;
Assurance.

Relationship

DIRECT

AIGO Implementation

AIGO should establish a high-risk compliance control framework. The framework should support:

requirements identification;
control assignment;
implementation;
assessment;
evidence;
monitoring;
assurance.

18. Article 9 — Risk Management System

Legal Theme

Providers of high-risk AI systems must establish and maintain a risk-management system covering the defined lifecycle and applicable risks.

AIGO Mapping

AIGO Components:

Risk;
Control;
Assessment;
Monitoring;
Assurance;
Evidence;
Improvement.

Relationship

DIRECT

AIGO Operational Chain

Risk Identification
      ↓
Risk Analysis
      ↓
Risk Evaluation
      ↓
Risk Treatment
      ↓
Residual Risk
      ↓
Monitoring
      ↓
Reassessment

AIGO Controls

AIGO risk controls should include:

risk identification;
risk assessment;
treatment;
residual-risk evaluation;
monitoring;
reassessment;
escalation.

Evidence

risk assessments;
control assessments;
monitoring reports;
residual-risk records;
improvement records.

19. Article 10 — Data and Data Governance

Legal Theme

High-risk AI systems are subject to requirements concerning training, validation, testing data and data governance.

AIGO Mapping

AIGO Components:

Data Governance;
Risk;
Control;
Assessment;
Evidence;
Assurance.

Relationship

DIRECT

AIGO Controls

Controls should cover:

data governance;
data quality;
data relevance;
data provenance;
bias identification;
representative data where applicable;
preprocessing;
validation;
testing;
data-management responsibilities.

Evidence

dataset records;
data lineage;
data-quality assessments;
bias assessments;
data governance approvals;
test results.

20. Article 11 — Technical Documentation

Legal Theme

Technical documentation must be prepared and maintained for applicable high-risk AI systems.

AIGO Mapping

AIGO Components:

AI System Profile;
Evidence;
Documentation;
Assurance;
Change Management.

Relationship

DIRECT

AIGO Controls

AIGO should provide controlled documentation requirements covering:

system purpose;
architecture;
data;
model;
performance;
controls;
limitations;
risks;
lifecycle;
changes.

Evidence

Technical documentation should be maintained in a controlled repository with version history and integrity controls.

21. Article 12 — Record-Keeping

Legal Theme

Applicable high-risk AI systems must maintain appropriate records and logs.

AIGO Mapping

AIGO Components:

Evidence;
Monitoring;
AI System;
Incident;
Assurance.

Relationship

DIRECT

AIGO Control

AI Governance Record-Keeping Control The control should require:

log retention;
controlled repository;
timestamp integrity;
access control;
retention;
evidence traceability.

22. Article 13 — Transparency and Provision of Information to Deployers

Legal Theme

Relevant providers must ensure that high-risk AI systems are designed and developed with sufficient transparency and information for deployers.

AIGO Mapping

AIGO Components:

Transparency;
AI System Profile;
Evidence;
Human Oversight;
Risk.

Relationship

DIRECT

AIGO Controls

AIGO should support:

intended-purpose documentation;
system limitations;
known risks;
usage constraints;
human oversight information;
operational instructions.

23. Article 14 — Human Oversight

Legal Theme

High-risk AI systems require appropriate human oversight.

AIGO Mapping

AIGO Components:

Human Oversight;
Control;
Monitoring;
Incident;
Assurance;
Training.

Relationship

DIRECT / CRITICAL

AIGO Control

Human Oversight Control The control should establish:

accountable human role;
required competence;
intervention authority;
override capability;
escalation;
monitoring;
workload considerations;
documentation.

Evidence

assigned oversight role;
competence record;
oversight procedures;
intervention logs;
review records.

24. Article 15 — Accuracy, Robustness and Cybersecurity

Legal Theme

Applicable high-risk AI systems are subject to requirements concerning accuracy, robustness, resilience, and cybersecurity.

AIGO Mapping

AIGO Components:

Control;
Risk;
Assessment;
Monitoring;
Assurance;
Incident.

Relationship

DIRECT

AIGO Control Domains

Controls should address:

performance;
robustness;
resilience;
adversarial risks;
cybersecurity;
failure handling;
monitoring;
incident response.

25. Articles 16–22 — Provider Obligations

Legal Theme

The Regulation establishes provider obligations concerning:

compliance;
quality management;
documentation;
automatic logs where applicable;
corrective action;
authorities;
registration;
representation;
cooperation.

AIGO Mapping

AIGO Components:

Governance;
AI System;
Control;
Evidence;
Change;
Incident;
Monitoring;
Assurance.

Relationship

DIRECT / SUPPORTING

AIGO Implementation

AIGO should ensure that provider responsibilities are represented in:

governance;
lifecycle management;
controls;
records;
assurance;
incident management;
change management.

Legal Theme

The AI Act assigns obligations across different actors in the AI value chain.

AIGO Mapping

AIGO Components:

Governance;
Third-Party Governance;
AI System;
Risk;
Control;
Evidence.

Relationship

DIRECT / CONDITIONAL

AIGO Requirement

Third-party governance should identify:

actor role;
supplier/provider;
system status;
required documentation;
contractual requirements;
incident notification;
change notification;
compliance evidence.

27. Article 26 — Deployer Obligations

Legal Theme

Deployers of high-risk AI systems have specific obligations concerning use, monitoring, human oversight, records, instructions, and other requirements.

AIGO Mapping

AIGO Components:

Governance;
Human Oversight;
Monitoring;
Incident;
Evidence;
Risk;
Control.

Relationship

DIRECT

AIGO Controls

Deployers should have controls covering:

approved use;
instructions;
human oversight;
monitoring;
incident handling;
record keeping;
data governance where applicable;
change escalation.

28. Article 27 — Fundamental Rights Impact Assessment

Legal Theme

Applicable deployers must carry out a fundamental-rights impact assessment in the circumstances defined by the Regulation.

AIGO Mapping

AIGO Components:

Assessment;
Risk;
Governance;
Evidence;
Assurance;
Management Review.

Relationship

DIRECT / CONDITIONAL

AIGO Implementation

AIGO should support:

applicability screening;
impacted-rights identification;
affected-person analysis;
risk assessment;
mitigation;
residual-risk review;
evidence;
management decision.

The AIGO assessment process may be used as the governance mechanism, but the mapping should clearly identify where the EU AI Act imposes a distinct legal assessment obligation.

29. Article 28 — Authorities and Bodies

Legal Theme

The Regulation provides for competent authorities and the governance structures responsible for supervision.

AIGO Mapping

AIGO Components:

Governance;
Escalation;
Compliance;
Incident;
Assurance.

Relationship

SUPPORTING AIGO organizations should identify the relevant external authorities applicable to them but should not represent internal governance bodies as exercising statutory authority.

30. Articles 29–31 — Market Surveillance and Enforcement Interfaces

Legal Theme

The Regulation establishes supervision, market surveillance, and related organizational relationships.

AIGO Mapping

AIGO Components:

Governance;
Incident;
Evidence;
Assurance;
Regulatory Change.

Relationship

SUPPORTING AIGO should provide:

regulatory correspondence records;
authority interaction records;
incident escalation;
evidence preservation;
remediation;
management review.

31. Article 49 — Registration

Legal Theme

Certain AI systems and actors are subject to registration requirements.

AIGO Mapping

AIGO Components:

AI System Registration;
Governance;
Evidence;
Approval.

Relationship

DIRECT / CONDITIONAL

AIGO Control

AI System Regulatory Registration Control The control should determine:

whether EU registration applies;
responsible party;
registration status;
registration evidence;
changes requiring update.

The AIGO internal AI inventory is not automatically equivalent to EU registration.

32. Article 50 — Transparency Obligations

Legal Theme

Certain providers and deployers must comply with transparency obligations for specified AI systems and content. The Commission’s current implementation material states that Article 50 transparency obligations apply from 2 August 2026.

AIGO Mapping

AIGO Components:

Governance;
Control;
Transparency;
Monitoring;
Evidence;
Assurance;
Incident.

Relationship

DIRECT

AIGO Controls

Potential controls include:

AI interaction disclosure;
synthetic-content identification;
deepfake disclosure;
public-interest content disclosure;
emotion-recognition notification;
biometric categorization notification.

Evidence

transparency configuration;
notices;
content-marking implementation;
testing;
monitoring;
incident records.

Detailed requirements are maintained in: 04-AIGO-EU-AI-Act-Transparency-Mapping-v0.1.md

33. Articles 51–56 — General-Purpose AI Models

Legal Theme

The AI Act establishes obligations for GPAI model providers, including additional requirements for models presenting systemic risk. The Commission states that GPAI obligations became applicable from 2 August 2025, while Commission enforcement powers apply from 2 August 2026. Models placed on the market before 2 August 2025 have until 2 August 2027 to comply.

AIGO Mapping

AIGO Components:

AI System / Model;
Classification;
Risk;
Control;
Evidence;
Assurance;
Incident;
Monitoring.

Relationship

DIRECT / CONDITIONAL

AIGO GPAI Controls

Potential controls include:

GPAI applicability determination;
model documentation;
downstream information;
copyright policy;
training-data summary;
systemic-risk assessment;
adversarial evaluation;
incident reporting;
systemic-risk monitoring;
AI Office interaction.

Detailed treatment is maintained in: 05-AIGO-EU-AI-Act-GPAI-Mapping-v0.1.md

34. General-Purpose AI Model Systemic Risk

Where a GPAI model is subject to systemic-risk obligations, AIGO should establish an enhanced governance profile. Potential governance requirements include:

Systemic Risk Determination
        ↓
Enhanced Risk Assessment
        ↓
Enhanced Controls
        ↓
Testing / Evaluation
        ↓
Incident Management
        ↓
Monitoring
        ↓
Assurance
        ↓
Regulatory Interaction

35. Governance and AI Office

The EU AI Office has central responsibilities under the AI Act, particularly regarding GPAI. AIGO should therefore maintain regulatory interaction controls for organizations that must engage with EU authorities. The AI Office’s legal authority must not be confused with the organization’s internal AI governance authority.

36. Articles 57–59 — Innovation and Regulatory Sandboxes

Legal Theme

The AI Act establishes frameworks for regulatory sandboxes and innovation support. The Digital Omnibus further expands access to regulatory sandboxes and simplifies implementation mechanisms.

AIGO Mapping

AIGO Components:

Governance;
Risk;
Assessment;
Change;
Evidence;
Assurance.

Relationship

SUPPORTING / CONDITIONAL AIGO should govern:

sandbox entry;
scope;
risk;
safeguards;
monitoring;
exit;
evidence;
regulatory engagement.

37. Articles 60–62 — Testing in Real-World Conditions and Serious Incidents

AIGO Mapping

AIGO Components:

Assessment;
Monitoring;
Incident;
Evidence;
Assurance;
Change.

Relationship

DIRECT / CONDITIONAL AIGO should provide:

real-world testing governance;
subject protection;
monitoring;
incident escalation;
evidence preservation;
change controls.

38. Articles 64–67 — Governance

Legal Theme

The AI Act establishes institutional governance structures including the AI Office and AI Board and provides for advisory functions.

AIGO Mapping

AIGO Components:

Governance;
Roles;
Reporting;
Regulatory Engagement;
Assurance.

Relationship

SUPPORTING AIGO should identify:

internal regulatory owner;
regulatory liaison;
escalation route;
management reporting;
regulatory change monitoring.

39. Articles 68–69 — AI Board and National Coordination

AIGO Mapping

The AIGO governance framework should distinguish:

EU / National Regulatory Governance
                ↓
Organizational AI Governance

The internal governance system should not be represented as a replacement for national or EU governance institutions.

40. Articles 70–73 — National Competent Authorities and Cooperation

AIGO Mapping

AIGO should support:

authority identification;
regulatory requests;
evidence preservation;
response management;
incident escalation;
regulatory correspondence.

These activities should connect to:

Governance;
Evidence;
Incident;
Assurance;
Management Review.

41. Articles 74–79 — Market Surveillance and AI-System Supervision

AIGO Mapping

Potential controls include:

regulatory readiness;
evidence availability;
technical-documentation management;
incident handling;
corrective actions;
supplier coordination;
authority response.

These requirements should connect to the AIGO Evidence and Assurance models.

42. Articles 80–83 — Corrective Actions and Regulatory Measures

AIGO Mapping

Regulatory nonconformance should create controlled governance actions. Recommended chain:

Regulatory Finding
       ↓
Incident / Finding
       ↓
Risk
       ↓
Corrective Action
       ↓
Change
       ↓
Evidence
       ↓
Verification
       ↓
Assurance

43. Articles 85–86 — Complaints and Explanations

AIGO Mapping

Where applicable, organizations should maintain:

complaint mechanisms;
information handling;
explanation processes;
human escalation;
evidence;
remediation;
monitoring.

The AIGO Incident and Evidence structures may support these activities, but a specific statutory complaint pathway must remain distinguishable.

44. Articles 88–90 — Confidentiality and Information Handling

AIGO Mapping

These provisions connect to:

Information Security;
Privacy;
Evidence;
Access Control;
Records Management.

AIGO should ensure that regulatory information is handled according to applicable confidentiality and security obligations.

45. Articles 99–101 — Penalties and Enforcement

AIGO Mapping

Potential governance controls include:

compliance monitoring;
regulatory risk;
escalation;
incident management;
evidence preservation;
management review;
corrective actions.

Organizations should maintain regulatory-risk awareness without attempting to calculate statutory penalties solely through AIGO.

46. Articles 102–112 — Final and Transitional Provisions

AIGO Mapping

These provisions should be addressed through:

applicability;
transition;
regulatory monitoring;
legal-source tracking;
controlled mapping updates.

The dedicated timeline mapping is authoritative for operational application dates.

47. Annex I — Union Harmonisation Legislation

AIGO Mapping

Annex I is relevant to determining whether an AI system falls within the regulated-product high-risk pathway. AIGO should capture:

product category;
applicable product legislation;
AI-system relationship;
classification;
conformity pathway;
transition date.

The current Digital Omnibus extends the relevant high-risk application date for AI embedded in regulated products to 2 August 2028.

48. Annex III — High-Risk Use Cases

AIGO Mapping

Annex III should be mapped to:

AI classification;
intended purpose;
affected-person impact;
risk;
fundamental-rights impact;
controls;
assessments;
approvals;
monitoring;
assurance.

The Commission currently describes the revised high-risk application timeline as 2 December 2027 for specified stand-alone high-risk use cases following the Digital Omnibus.

49. Annex IV — Technical Documentation

Annex IV requirements should connect to:

Technical Documentation
        ↓
AI System Profile
        ↓
Evidence
        ↓
Assurance
        ↓
Change Management

The AIGO System Profile and Evidence structures should support the governance record needed to demonstrate documentation completeness. AIGO should not claim that the generic System Profile alone automatically satisfies every Annex IV requirement.

50. Annex V — EU Declaration of Conformity

The AIGO framework should distinguish:

Internal Governance Approval

from:

EU Declaration of Conformity

AIGO may provide supporting evidence and governance controls, but the statutory declaration remains a distinct legal artifact.

51. Annex VI and VII — Conformity Assessment

The mapping should identify the applicable conformity-assessment route. AIGO may support:

readiness assessment;
evidence management;
control assessment;
technical assessment;
assurance;
approval.

However, AIGO approval does not replace the legally required conformity-assessment procedure.

52. Annex VIII — Registration Information

Where EU registration requirements apply, AIGO should maintain:

regulatory registration applicability;
registration owner;
registration identifier;
registration date;
evidence;
update requirements.

This should be linked to the AI System Profile and Evidence records.

53. Annex IX — Post-Market Monitoring

Post-market obligations should map to:

Monitoring;
Incident;
Risk;
Evidence;
Assurance;
Improvement.

Recommended chain:

Post-Market Monitoring
        ↓
Observation
        ↓
Risk / Incident
        ↓
Corrective Action
        ↓
Evidence
        ↓
Assurance

54. AIGO Governance Domain Mapping

The master EU AI Act mapping should maintain a crosswalk to the AIGO governance domains.

EU AI Act Area	AIGO Governance Domain
Applicability	Governance / Classification
Prohibited Practices	Governance / Risk / Approval
High-Risk Classification	Classification / Risk
Risk Management	Risk
Data Governance	Controls / Data
Technical Documentation	Evidence / AI System
Record Keeping	Evidence
Transparency	Controls / Monitoring
Human Oversight	Controls / Governance
Accuracy / Robustness / Cybersecurity	Controls / Risk
Provider Obligations	Governance
Deployer Obligations	Governance / Operations
GPAI	AI System / Risk / Assurance
Governance / Enforcement	Governance
Fundamental Rights	Risk / Assessment
Complaints / Remedies	Incident / Governance
Post-Market Monitoring	Monitoring
Incident Reporting	Incident
Conformity	Assessment / Assurance
Registration	AI System / Governance
Retirement / Transition	Change / Retirement

55. AIGO Lifecycle Mapping

EU AI Act obligations should be integrated into the AIGO lifecycle.

AIGO Lifecycle Stage	EU AI Act Mapping Focus
Planning	Applicability, actor, prohibited practices
Design	Risk, documentation, transparency
Development	Data, testing, cybersecurity
Data Preparation	Data governance and quality
Testing and Validation	Accuracy, robustness, safety, bias
Approval	Regulatory classification and readiness
Deployment	Instructions, human oversight, transparency
Operation	Monitoring, records, incident handling
Monitoring	Performance, risk, incidents, post-market
Change	Reclassification, reassessment, documentation
Assurance	Conformity readiness, controls, evidence
Retirement	Records, evidence, regulatory obligations

56. AIGO Risk Mapping

EU AI Act requirements may generate several risk categories. Potential AIGO risk categories include:

REGULATORY_RISK
COMPLIANCE_RISK
FUNDAMENTAL_RIGHTS_RISK
SAFETY_RISK
SECURITY_RISK
PRIVACY_RISK
DATA_GOVERNANCE_RISK
TRANSPARENCY_RISK
HUMAN_OVERSIGHT_RISK
OPERATIONAL_RISK
SUPPLIER_RISK
REPUTATIONAL_RISK

The risk taxonomy should remain AIGO-controlled. EU AI Act categories should not be copied directly into the general AIGO risk taxonomy without governance review.

57. AIGO Control Mapping

Controls should be grouped into operational categories such as:

Applicability Control
Classification Control
Prohibited-Practice Screening Control
Risk Management Control
Data Governance Control
Technical Documentation Control
Record-Keeping Control
Human Oversight Control
Transparency Control
Cybersecurity Control
Monitoring Control
Incident Control
Regulatory Reporting Control
Third-Party Control
Conformity Support Control
Post-Market Monitoring Control
Change Management Control
Retirement Control

Detailed control mappings are maintained in: 12-AIGO-EU-AI-Act-AIGO-Control-Mapping-v0.1.md

58. AIGO Assessment Mapping

Relevant assessment types include:

EU AI Act Applicability Assessment
AI Classification Assessment
Risk Assessment
Data Governance Assessment
Fundamental Rights Impact Assessment
Control Assessment
Technical Assessment
Conformity Readiness Assessment
Change Assessment
Incident Assessment
Retirement Assessment

The organization should determine which assessments are legally required, operationally required, or governance-recommended.

59. AIGO Approval Mapping

Approval requirements may include:

prohibited-practice screening outcome;
high-risk deployment approval;
regulatory applicability decision;
residual compliance risk;
significant change;
exception;
retirement.

Approvals should identify their authority and legal/governance basis.

60. Monitoring Mapping

Monitoring may include:

AI system performance;
human oversight;
transparency;
incident trends;
control performance;
post-market information;
risk indicators;
regulatory changes;
supplier changes.

Monitoring requirements must remain proportionate and traceable to the applicable EU AI Act provision.

61. Incident Mapping

Relevant incidents may include:

serious AI incidents;
non-compliance;
security incidents;
privacy events;
fundamental-rights impacts;
prohibited-use events;
failed controls;
transparency failures.

Incident records should be linked to:

AI system;
risk;
control;
evidence;
change;
improvement;
assurance.

62. Change Management Mapping

A material change should trigger EU AI Act reassessment where it may affect:

intended purpose;
high-risk classification;
provider/deployer role;
transparency;
model capability;
data;
risk;
technical documentation;
conformity;
registration;
post-market monitoring.

The Change Management procedure should incorporate regulatory-impact screening.

63. Assurance Mapping

AIGO assurance may review:

applicability determination;
classification;
control coverage;
evidence;
documentation;
monitoring;
incident handling;
regulatory change management.

Independent assurance should be considered for material or high-risk obligations.

64. Evidence Mapping

Evidence may include:

applicability assessments;
classification decisions;
technical documentation;
risk assessments;
control assessments;
approval records;
logs;
monitoring records;
incident records;
corrective actions;
declarations;
registration records;
assurance reports.

Each evidence item should be traceable to the relevant legal requirement or AIGO control.

65. Management Review Mapping

EU AI Act regulatory status should be included in management review where material. Management review may consider:

applicability changes;
new guidance;
upcoming deadlines;
control gaps;
evidence gaps;
assurance findings;
incidents;
resource requirements;
supplier issues;
regulatory engagement.

66. Improvement Mapping

Regulatory gaps should feed continual improvement. Recommended chain:

Regulatory Change
      ↓
Gap Analysis
      ↓
Improvement
      ↓
Control / Procedure Change
      ↓
Evidence
      ↓
Verification
      ↓
Assurance

67. Retirement Mapping

Retirement should consider whether EU AI Act obligations continue after operational use ends. Potential continuing obligations include:

record retention;
evidence preservation;
incident investigation;
regulatory reporting;
data retention;
contractual obligations;
post-market activity.

AI system retirement must therefore not automatically terminate all regulatory governance records.

68. Third-Party Mapping

Third-party AI systems should be mapped according to the organization’s role. The governance record should identify:

supplier;
provider/deployer relationship;
contract;
regulatory responsibility;
required documentation;
evidence;
monitoring;
notification;
change;
termination.

Contractual allocation of responsibilities does not automatically eliminate statutory obligations.

69. Fundamental Rights Mapping

The AIGO framework should map applicable AI Act requirements to:

risk;
impact assessment;
fairness;
privacy;
human oversight;
transparency;
complaint mechanisms;
monitoring;
assurance.

Where applicable, the organization should preserve evidence of its fundamental-rights analysis.

70. Regulatory Change Monitoring

The organization should monitor:

amendments;
guidance;
standards;
codes;
implementing acts;
delegated acts.

When a change is identified:

Regulatory Change
      ↓
AIGO Change Record
      ↓
Mapping Review
      ↓
Control Impact
      ↓
Evidence Impact
      ↓
Management Review

71. Mapping Status Model

Each provision should be classifiable as:

NOT_REVIEWED
REVIEWED
APPLICABLE
NOT_APPLICABLE
CONDITIONAL
MAPPED
PARTIALLY_MAPPED
IMPLEMENTATION_DEFINED
IMPLEMENTED
EVIDENCED
ASSESSED
ASSURED
SUPERSEDED

These statuses represent mapping/governance progress. They do not constitute legal-compliance certification.

72. Mapping Findings

The master mapping should identify potential findings such as:

UNMAPPED_REQUIREMENT
APPLICABILITY_UNRESOLVED
ACTOR_UNRESOLVED
AIGO_CONTROL_GAP
EVIDENCE_GAP
ASSESSMENT_GAP
ASSURANCE_GAP
TIMELINE_GAP
SOURCE_CURRENCY_GAP
REGULATORY_CHANGE_PENDING

73. Mapping Coverage

A future mapping validation process should measure:

total mapped provisions;
applicable provisions;
unmapped provisions;
partially mapped provisions;
control coverage;
evidence coverage;
assurance coverage;
timeline coverage.

Coverage metrics should be accompanied by critical gaps.

74. Critical EU AI Act Gaps

The following should normally be treated as high or critical mapping gaps:

prohibited-practice screening absent;
applicable high-risk classification absent;
risk-management mapping absent;
applicable transparency mapping absent;
applicable GPAI mapping absent;
fundamental-rights assessment mapping absent where required;
regulatory registration mapping absent where required;
serious-incident mapping absent;
applicable conformity mapping absent;
current implementation dates absent or incorrect.

75. Current Application Timeline

The mapping package shall use the current legal and Commission baseline. The European Commission currently states:

the AI Act entered into force on 1 August 2024;
the general application date is 2 August 2026;
prohibitions and AI-literacy provisions applied from 2 February 2025 under the staged framework;
governance and GPAI obligations applied from 2 August 2025;
specified high-risk use cases under Annex III apply from 2 December 2027;
AI systems embedded in regulated products under the relevant Annex I pathway apply from 2 August 2028.

Timeline details must be maintained centrally in: 11-AIGO-EU-AI-Act-Applicability-and-Timeline-v0.1.md

76. Current GPAI Timeline

The current Commission guidance states:

GPAI obligations became applicable from 2 August 2025;
Commission enforcement powers apply from 2 August 2026;
GPAI models placed on the market before 2 August 2025 have until 2 August 2027 to comply.

AIGO GPAI mappings should use the dedicated GPAI mapping document rather than duplicating detailed timelines.

77. Current High-Risk Timeline

The Commission’s current high-risk guidance states:

rules for specified high-risk stand-alone systems apply from 2 December 2027;
high-risk AI embedded in products such as machinery, toys, and lifts applies from 2 August 2028.

The final legal interpretation should always be checked against the current EUR-Lex text.

78. Current Transparency Baseline

The general AI Act framework reaches its general application milestone on 2 August 2026, and the Commission’s current implementation material identifies Article 50 transparency obligations as part of the rules applying at that stage. AIGO should therefore treat transparency as a current operational mapping area rather than a future-only requirement.

79. Digital Omnibus Integration

The mapping shall explicitly account for Regulation (EU) 2026/1744. The Digital Omnibus changed or clarified areas including:

high-risk implementation timelines;
AI literacy;
GPAI governance;
database registration;
post-market monitoring;
AI Office powers;
certain prohibited practices;
SME/SMC simplifications;
regulatory sandboxes;
interaction with product-safety legislation.

The mapping should not rely on the original 2024 AI Act text alone.

80. Source Currency Rule

Before every material mapping release:

verify the current EUR-Lex legal source;
verify applicable amendments;
verify Commission implementation material;
identify changed dates;
identify changed obligations;
update affected mappings;
run consistency validation;
obtain legal/compliance review where appropriate.

The mapping package should record the source verification date.

81. Mapping Review Frequency

The master mapping should be reviewed:

at least annually;
after any amendment;
after material official guidance;
after significant implementation measures;
after material enforcement developments;
after relevant case law;
before major AIGO releases.

Event-driven review takes precedence over routine review.

82. Mapping Ownership

The mapping package should have: Mapping Owner: Responsible for maintaining the mapping package. Legal/Compliance Reviewer: Responsible for reviewing legal interpretation and applicability. Governance Reviewer: Responsible for evaluating AIGO implementation alignment. Framework Architect: Responsible for architectural consistency. Control Owner: Responsible for mapped control implementation. Evidence Owner: Responsible for evidence requirements. Assurance Reviewer: Responsible for validation of material implementation claims.

83. Validation Requirements

The master mapping should satisfy:

Source Validation

Every material requirement has an authoritative source reference.

Applicability Validation

Applicable actor and scope are identified.

Mapping Validation

AIGO relationship is explicitly classified.

Control Validation

Mapped controls exist where claimed.

Reference Validation

AIGO identifiers resolve.

Traceability Validation

The requirement-to-AIGO chain is intact.

Evidence Validation

Required evidence relationships are identified.

Timeline Validation

Application dates are current.

Version Validation

Legal and mapping versions are identified.

Review Validation

Material mappings have appropriate review status.

84. Limitations

The mapping cannot independently determine:

legal compliance;
legal interpretation in a specific factual scenario;
conformity assessment outcome;
adequacy of technical documentation;
effectiveness of controls;
sufficiency of evidence;
appropriateness of risk decisions;
correctness of a regulator’s interpretation.

Those matters require qualified legal, technical, governance, and assurance judgment.

85. Relationship to Other EU AI Act Mapping Files

File	Purpose
`02-AIGO-EU-AI-Act-Prohibited-AI-Practices-Mapping-v0.1.md`	Article 5 and prohibited practices
`03-AIGO-EU-AI-Act-High-Risk-AI-Mapping-v0.1.md`	High-risk classification and obligations
`04-AIGO-EU-AI-Act-Transparency-Mapping-v0.1.md`	Transparency obligations
`05-AIGO-EU-AI-Act-GPAI-Mapping-v0.1.md`	GPAI requirements
`06-AIGO-EU-AI-Act-AI-Literacy-Mapping-v0.1.md`	AI literacy
`07-AIGO-EU-AI-Act-Governance-and-Enforcement-Mapping-v0.1.md`	Governance and enforcement
`08-AIGO-EU-AI-Act-Conformity-and-Documentation-Mapping-v0.1.md`	Conformity and documentation
`09-AIGO-EU-AI-Act-Rights-and-Remedies-Mapping-v0.1.md`	Rights and remedies
`10-AIGO-EU-AI-Act-Annexes-Mapping-v0.1.md`	Annex mappings
`11-AIGO-EU-AI-Act-Applicability-and-Timeline-v0.1.md`	Applicability and dates
`12-AIGO-EU-AI-Act-AIGO-Control-Mapping-v0.1.md`	Direct AIGO controls
`13-AIGO-EU-AI-Act-Evidence-and-Assurance-Mapping-v0.1.md`	Evidence and assurance

The master mapping should provide the high-level crosswalk and delegate detailed subject matter to these files.

86. Example Master Mapping Record

A conceptual mapping entry is:

Field	Example
Mapping ID	`EUAI-HR-ART9-001`
Source	Regulation (EU) 2024/1689, Article 9
Actor	Provider of applicable high-risk AI system
Applicability	Conditional
Requirement	Establish and maintain a risk-management system
AIGO Relationship	Direct
AIGO Component	Risk
AIGO Control	AI Risk Management Control
AIGO Assessment	AI Risk Assessment
AIGO Evidence	Risk Assessment Record
AIGO Monitoring	Risk Monitoring
AIGO Assurance	Risk / Control Assurance
Status	MAPPED
Confidence	HIGH

87. Example Governance Chain

A high-risk AI implementation may produce:

EU AI Act
    ↓
Article 9
    ↓
AIGO Risk Requirement
    ↓
Risk Assessment
    ↓
Risk Record
    ↓
Control
    ↓
Control Assessment
    ↓
Evidence
    ↓
Monitoring
    ↓
Assurance
    ↓
Management Review
    ↓
Improvement

This is the intended operational traceability pattern.

88. Regulatory Change Chain

When EU AI Act requirements change:

Legal Amendment
      ↓
Source Review
      ↓
Mapping Update
      ↓
Applicability Review
      ↓
Control Impact
      ↓
Procedure / Template Impact
      ↓
Evidence Impact
      ↓
Monitoring / Assurance Impact
      ↓
Management Review
      ↓
Implementation
      ↓
Verification

This chain should be integrated with AIGO Change Management.

89. Mapping Release Evidence

A release of this mapping package should retain evidence including:

source verification;
registry;
mapping review;
legal/compliance review;
changed mappings;
validation results;
unresolved issues;
approval.

Such records may be stored through the AIGO Evidence model.

90. Mapping Quality Standard

The AIGO EU AI Act mapping should be considered fit for operational use only when it is:

legally sourced;
current;
actor-aware;
applicability-aware;
traceable;
internally consistent;
mapped to AIGO controls;
supported by evidence requirements;
reviewed;
versioned.

91. Document Control

Field	Value
Document	AIGO EU AI Act Main Mapping
Version	0.1
Status	Draft
Document Identifier	`AIGO-MAP-EUAI-001`
Document Type	EU AI Act Mapping
Mapping Package	`AIGO-MAP-EUAI`
Owner
Legal/Compliance Reviewer
Governance Reviewer
Framework Architect
Approved By
Effective Date
Next Review Date

92. Document Status

Document: AIGO — EU AI Act Main Mapping Version: 0.1 Status: Draft Working Name: AIGO Full Name: AI Governance Operating Framework Document Identifier: AIGO-MAP-EUAI-001 Document Type: EU AI Act Mapping This document provides the principal mapping between the EU AI Act and the AIGO AI Governance Operating Framework. Detailed mappings are maintained in the associated EU AI Act mapping package. End of Document

​AIGO — EU AI Act Main Mapping

​1. Document Purpose

​2. Mapping Information

​3. Authoritative Source Hierarchy

​3.1 Binding Legal Source

​3.2 Official Implementation Material

​3.3 AIGO Mapping

​4. Mapping Methodology

​5. Mapping Relationship Types

​6. Actor Mapping

​7. Applicability Model

​8. AIGO Applicability Record

​9. AIGO Classification Versus EU AI Act Category

​10. Core AIGO Mapping Architecture

​11. Article 1 — Subject Matter and Purpose

​Legal Theme

​AIGO Mapping

​Relationship

​AIGO Implementation

​Evidence

​12. Article 2 — Scope

​Legal Theme

​AIGO Mapping

​Relationship

​AIGO Implementation

​Control Requirement

​13. Article 3 — Definitions

​Legal Theme

​AIGO Mapping

​Relationship

​AIGO Requirement

​Control Requirement

​14. Article 4 — AI Literacy

​Legal Theme

​AIGO Mapping

​Relationship

​AIGO Controls

​Evidence

​15. Article 5 — Prohibited AI Practices

​Legal Theme

​AIGO Mapping

​Relationship

​AIGO Requirement

​Control

​Approval

​Evidence

​16. Articles 6–7 — High-Risk Classification

​Legal Theme

​AIGO Mapping

​Relationship

​AIGO Requirement

​Evidence

​17. Article 8 — Compliance with Requirements

​Legal Theme

​AIGO Mapping

​Relationship

​AIGO Implementation

​18. Article 9 — Risk Management System

​Legal Theme

​AIGO Mapping

​Relationship

​AIGO Operational Chain

​AIGO Controls

​Evidence

​19. Article 10 — Data and Data Governance

​Legal Theme

​AIGO Mapping

​Relationship

​AIGO Controls

​Evidence

​20. Article 11 — Technical Documentation

​Legal Theme

​AIGO Mapping

​Relationship

​AIGO Controls

​Evidence

​21. Article 12 — Record-Keeping

​Legal Theme

​AIGO Mapping

​Relationship

AIGO — EU AI Act Main Mapping

1. Document Purpose

2. Mapping Information

3. Authoritative Source Hierarchy

3.1 Binding Legal Source

3.2 Official Implementation Material

3.3 AIGO Mapping

4. Mapping Methodology

5. Mapping Relationship Types

6. Actor Mapping

7. Applicability Model

8. AIGO Applicability Record

9. AIGO Classification Versus EU AI Act Category

10. Core AIGO Mapping Architecture

11. Article 1 — Subject Matter and Purpose

Legal Theme

AIGO Mapping

Relationship

AIGO Implementation

Evidence

12. Article 2 — Scope

Legal Theme

AIGO Mapping

Relationship

AIGO Implementation

Control Requirement

13. Article 3 — Definitions

Legal Theme

AIGO Mapping

Relationship

AIGO Requirement

Control Requirement

14. Article 4 — AI Literacy

Legal Theme

AIGO Mapping

Relationship

AIGO Controls

Evidence

15. Article 5 — Prohibited AI Practices

Legal Theme

AIGO Mapping

Relationship

AIGO Requirement

Control

Approval

Evidence

16. Articles 6–7 — High-Risk Classification

Legal Theme

AIGO Mapping

Relationship

AIGO Requirement

Evidence

17. Article 8 — Compliance with Requirements

Legal Theme

AIGO Mapping

Relationship

AIGO Implementation

18. Article 9 — Risk Management System

Legal Theme

AIGO Mapping

Relationship

AIGO Operational Chain

AIGO Controls

Evidence

19. Article 10 — Data and Data Governance

Legal Theme

AIGO Mapping

Relationship

AIGO Controls

Evidence

20. Article 11 — Technical Documentation

Legal Theme

AIGO Mapping

Relationship

AIGO Controls

Evidence

21. Article 12 — Record-Keeping

Legal Theme

AIGO Mapping

Relationship