> ## Documentation Index
> Fetch the complete documentation index at: https://docs.aigoframework.com/llms.txt
> Use this file to discover all available pages before exploring further.

# 01 AIGO EU AI Act Mapping v0.1

# AIGO — EU AI Act Main Mapping

## 1. Document Purpose

This document provides the principal AIGO mapping between the European Union Artificial Intelligence Act and the AIGO AI Governance Operating Framework.

It establishes the primary relationship between:

* EU AI Act requirements;
* applicability conditions;
* regulated actors;
* AI-system categories;
* AIGO governance domains;
* AIGO risks;
* AIGO controls;
* AIGO assessments;
* AIGO approvals;
* AIGO monitoring;
* AIGO incidents;
* AIGO change management;
* AIGO assurance;
* AIGO evidence;
* AIGO management review;
* AIGO improvement; and
* AIGO retirement.

This document is the master mapping.

Detailed subject-specific mappings are maintained in the other EU AI Act mapping documents within:

`mappings/eu-ai-act/`

This mapping is an operational governance crosswalk. It is not legal advice, a conformity assessment, or a declaration of compliance.

***

## 2. Mapping Information

| Field                      | Value                                          |
| -------------------------- | ---------------------------------------------- |
| Mapping                    | AIGO EU AI Act Main Mapping                    |
| Version                    | 0.1                                            |
| Status                     | Draft                                          |
| Document Identifier        | `AIGO-MAP-EUAI-001`                            |
| Document Type              | EU AI Act Mapping                              |
| Framework                  | AIGO — AI Governance Operating Framework       |
| Mapping Package            | `AIGO-MAP-EUAI`                                |
| Primary Legal Instrument   | Regulation (EU) 2024/1689                      |
| Current Amendment Baseline | Regulation (EU) 2026/1744                      |
| Mapping Architecture       | `AIGO-MAP-EUAI-ARCH-001`                       |
| Registry                   | `00-AIGO-EU-AI-Act-Mapping-Registry-v0.1.json` |

Regulation (EU) 2026/1744, adopted on 8 July 2026 and published on 24 July 2026, amended Regulation (EU) 2024/1689 as part of the Digital Omnibus on AI. The mapping therefore uses the amended legal baseline rather than reproducing the unamended 2024 timetable.

***

## 3. Authoritative Source Hierarchy

The mapping shall apply the following source hierarchy.

### 3.1 Binding Legal Source

The primary source is:

**Regulation (EU) 2024/1689 of the European Parliament and of the Council**

as amended by applicable subsequent Union legislation, including:

**Regulation (EU) 2026/1744 — Digital Omnibus on AI.**

The binding legal text is authoritative for legal requirements.

### 3.2 Official Implementation Material

Supporting sources may include:

* European Commission guidance;
* European AI Office guidance;
* official FAQs;
* codes of practice;
* delegated acts;
* implementing acts;
* common specifications;
* harmonised standards when formally applicable;
* other official implementation material.

### 3.3 AIGO Mapping

AIGO translates the legal requirement into an operational governance relationship.

An AIGO mapping does not change the legal requirement.

***

## 4. Mapping Methodology

Each mapped provision should answer the following questions:

1. What legal requirement applies?
2. Who is the affected actor?
3. To which AI systems or activities does it apply?
4. When does it apply?
5. Are there exceptions or transitional provisions?
6. What AIGO governance domain addresses it?
7. What AIGO risk or governance objective is relevant?
8. What AIGO control implements or supports it?
9. What assessment is required?
10. What approval or decision is required?
11. What monitoring is required?
12. What evidence should exist?
13. What assurance may be appropriate?
14. What happens when the requirement is not satisfied?
15. What lifecycle stages are affected?

***

## 5. Mapping Relationship Types

The following relationship types are used:

| Relationship                 | Meaning                                                                             |
| ---------------------------- | ----------------------------------------------------------------------------------- |
| DIRECT                       | AIGO contains a control or governance mechanism directly addressing the requirement |
| PARTIAL                      | AIGO addresses only part of the requirement                                         |
| SUPPORTING                   | AIGO provides supporting governance capability                                      |
| INDIRECT                     | Relationship exists but is not a direct implementation mechanism                    |
| CONDITIONAL                  | Mapping applies only under stated conditions                                        |
| INFORMATIVE                  | Mapping provides contextual information                                             |
| NOT\_APPLICABLE              | Requirement is outside defined organizational applicability                         |
| NO\_DIRECT\_AIGO\_EQUIVALENT | Requirement requires a separate legal, regulatory, or organizational mechanism      |

A direct AIGO mapping does not itself establish legal compliance.

***

## 6. Actor Mapping

The EU AI Act applies differently depending on actor role.

AIGO should therefore capture the applicable actor before applying detailed requirements.

Primary actor categories include:

```text id="i3jfbp" theme={null}
PROVIDER
DEPLOYER
IMPORTER
DISTRIBUTOR
PRODUCT_MANUFACTURER
AUTHORISED_REPRESENTATIVE
OPERATOR
AFFECTED_PERSON
PUBLIC_AUTHORITY
NATIONAL_COMPETENT_AUTHORITY
MARKET_SURVEILLANCE_AUTHORITY
EUROPEAN_AI_OFFICE
OTHER_RELEVANT_ACTOR
```

An organization may occupy more than one role for different AI systems or activities.

AIGO governance should preserve the actor role applicable to each governed AI system.

***

## 7. Applicability Model

The primary AIGO applicability chain is:

```text theme={null}
AI Activity
    ↓
Actor
    ↓
Territorial Scope
    ↓
AI System / Model Type
    ↓
Intended Purpose
    ↓
Risk / Classification
    ↓
Exception / Exemption
    ↓
Transition
    ↓
EU AI Act Applicability
```

An organization should not assume that the presence of an AI system automatically means that every EU AI Act provision applies.

***

## 8. AIGO Applicability Record

For material EU AI Act assessments, AIGO should maintain:

| Field               | Purpose                         |
| ------------------- | ------------------------------- |
| EU AI Act provision | Identifies source requirement   |
| Actor               | Identifies duty bearer          |
| AI System ID        | Identifies affected system      |
| Intended Purpose    | Establishes context             |
| Jurisdiction        | Establishes territorial context |
| AI Act Category     | Identifies legal classification |
| Applicability       | Yes / No / Conditional          |
| Exception           | Identifies applicable exception |
| Effective Date      | Establishes timing              |
| Transition          | Identifies transitional rule    |
| Rationale           | Documents decision              |
| Evidence            | Supports applicability decision |
| Reviewer            | Accountability                  |
| Review Date         | Currency                        |

***

## 9. AIGO Classification Versus EU AI Act Category

AIGO classification and EU AI Act classification must remain separate concepts.

An AI system may have:

* an AIGO risk classification;
* an EU AI Act category;
* a sector classification;
* a technical risk classification;
* a privacy classification;
* a security classification.

These classifications may influence one another but are not interchangeable.

The AIGO Classification Template and Risk Assessment should therefore record the EU AI Act classification separately where applicable.

***

## 10. Core AIGO Mapping Architecture

The principal crosswalk is:

```text theme={null}
EU AI Act
    ↓
Applicability
    ↓
AIGO Governance
    ↓
AIGO Risk
    ↓
AIGO Control
    ↓
AIGO Assessment
    ↓
AIGO Approval
    ↓
AIGO Monitoring
    ↓
AIGO Evidence
    ↓
AIGO Assurance
    ↓
Management Review
    ↓
Improvement
    ↓
Retirement
```

This represents the preferred operationalization path.

***

# 11. Article 1 — Subject Matter and Purpose

## Legal Theme

The AI Act establishes harmonised rules on artificial intelligence and a framework intended to address risks associated with AI while supporting innovation and protecting health, safety, fundamental rights, democracy, rule of law, and environmental interests as applicable.

## AIGO Mapping

**AIGO Components:**

* Governance;
* AI System;
* Risk;
* Control;
* Assessment;
* Assurance;
* Evidence;
* Management Review.

## Relationship

**DIRECT / SUPPORTING**

## AIGO Implementation

The AIGO Governance arrangement should establish:

* AI governance authority;
* AI system lifecycle governance;
* risk management;
* controls;
* human oversight;
* monitoring;
* assurance;
* incident management;
* continual improvement.

## Evidence

Potential evidence includes:

* governance charter;
* AI inventory;
* risk methodology;
* control framework;
* governance records;
* assurance reports;
* management review.

***

# 12. Article 2 — Scope

## Legal Theme

The AI Act defines the entities, AI systems, models, and circumstances to which the Regulation applies, including territorial and role-based conditions and specified exclusions.

## AIGO Mapping

**AIGO Components:**

* Governance;
* AI System;
* Classification;
* Risk;
* Assessment.

## Relationship

**DIRECT**

## AIGO Implementation

Each in-scope AI system should have:

* identified legal actor;
* applicable jurisdiction;
* intended purpose;
* EU AI Act applicability determination;
* relevant category;
* evidence supporting the determination.

## Control Requirement

**AIGO Applicability Determination Control**

The control should require documented applicability analysis for material AI systems.

***

# 13. Article 3 — Definitions

## Legal Theme

The Regulation defines key terms used throughout the AI Act.

## AIGO Mapping

**AIGO Components:**

* Common Definitions;
* Governance;
* Classification;
* AI System Schema;
* Guidance.

## Relationship

**SUPPORTING**

## AIGO Requirement

AIGO should maintain an explicit distinction between:

* EU AI Act legal definitions;
* AIGO framework definitions;
* organization-specific implementation terminology.

EU AI Act terms should not be redefined in a way that changes their legal meaning.

## Control Requirement

**Controlled Regulatory Terminology**

Controlled terminology should reference the authoritative legal source.

***

# 14. Article 4 — AI Literacy

## Legal Theme

The AI Act establishes requirements concerning AI literacy for relevant providers and deployers.

The Commission's current implementation material states that the original AI-literacy provisions applied from 2 February 2025. The 2026 Digital Omnibus subsequently modified parts of the AI-literacy framework, so the detailed mapping must distinguish the current binding text from earlier implementation guidance.

## AIGO Mapping

**AIGO Components:**

* Governance;
* Training and Competence;
* Evidence;
* Management Review;
* Improvement.

## Relationship

**DIRECT**

## AIGO Controls

AIGO should maintain:

* AI literacy requirements;
* role-based competence requirements;
* training plans;
* competence evidence;
* periodic review.

## Evidence

* training records;
* competence assessments;
* role profiles;
* learning records;
* management review.

***

# 15. Article 5 — Prohibited AI Practices

## Legal Theme

Certain AI practices are prohibited subject to the conditions defined by the Regulation and subsequent amendments.

The 2026 Digital Omnibus additionally amended the prohibition framework, including the addition of prohibitions relating to certain non-consensual sexually explicit/intimate content and child sexual abuse material generated by AI.

## AIGO Mapping

**AIGO Components:**

* Classification;
* Risk;
* Approval;
* Control;
* Monitoring;
* Incident;
* Assurance.

## Relationship

**DIRECT / CRITICAL**

## AIGO Requirement

AIGO should implement a prohibited-practice screening gate.

Recommended process:

```text theme={null}
Proposed AI Activity
        ↓
Prohibited-Practice Screening
        ↓
Prohibited?
   ┌────┴────┐
  YES        NO
   ↓          ↓
STOP /        Continue
ESCALATE      Classification
```

## Control

**EU AI Act Prohibited-Practice Screening Control**

## Approval

A potential prohibited practice should not proceed through ordinary deployment approval.

It should be escalated to appropriate legal/compliance and governance authority.

## Evidence

* screening decision;
* use-case description;
* intended-purpose evidence;
* legal review where required;
* governance decision.

***

# 16. Articles 6–7 — High-Risk Classification

## Legal Theme

The AI Act establishes the criteria for determining high-risk AI systems and provides mechanisms concerning changes to high-risk classification.

The Commission's current implementation material states that, following the Digital Omnibus, the application dates for high-risk rules have been extended for specified categories.

## AIGO Mapping

**AIGO Components:**

* AI Classification;
* AI System;
* Risk;
* Assessment;
* Approval.

## Relationship

**DIRECT**

## AIGO Requirement

AIGO should maintain a specific EU AI Act high-risk determination.

This should be separate from the AIGO general risk rating.

## Evidence

* intended-purpose documentation;
* Annex I analysis where relevant;
* Annex III analysis where relevant;
* classification rationale;
* legal/compliance review;
* system profile.

***

# 17. Article 8 — Compliance with Requirements

## Legal Theme

High-risk AI systems must comply with the applicable requirements established by the Regulation.

## AIGO Mapping

**AIGO Components:**

* Governance;
* Control;
* Assessment;
* Evidence;
* Assurance.

## Relationship

**DIRECT**

## AIGO Implementation

AIGO should establish a high-risk compliance control framework.

The framework should support:

* requirements identification;
* control assignment;
* implementation;
* assessment;
* evidence;
* monitoring;
* assurance.

***

# 18. Article 9 — Risk Management System

## Legal Theme

Providers of high-risk AI systems must establish and maintain a risk-management system covering the defined lifecycle and applicable risks.

## AIGO Mapping

**AIGO Components:**

* Risk;
* Control;
* Assessment;
* Monitoring;
* Assurance;
* Evidence;
* Improvement.

## Relationship

**DIRECT**

## AIGO Operational Chain

```text theme={null}
Risk Identification
      ↓
Risk Analysis
      ↓
Risk Evaluation
      ↓
Risk Treatment
      ↓
Residual Risk
      ↓
Monitoring
      ↓
Reassessment
```

## AIGO Controls

AIGO risk controls should include:

* risk identification;
* risk assessment;
* treatment;
* residual-risk evaluation;
* monitoring;
* reassessment;
* escalation.

## Evidence

* risk assessments;
* control assessments;
* monitoring reports;
* residual-risk records;
* improvement records.

***

# 19. Article 10 — Data and Data Governance

## Legal Theme

High-risk AI systems are subject to requirements concerning training, validation, testing data and data governance.

## AIGO Mapping

**AIGO Components:**

* Data Governance;
* Risk;
* Control;
* Assessment;
* Evidence;
* Assurance.

## Relationship

**DIRECT**

## AIGO Controls

Controls should cover:

* data governance;
* data quality;
* data relevance;
* data provenance;
* bias identification;
* representative data where applicable;
* preprocessing;
* validation;
* testing;
* data-management responsibilities.

## Evidence

* dataset records;
* data lineage;
* data-quality assessments;
* bias assessments;
* data governance approvals;
* test results.

***

# 20. Article 11 — Technical Documentation

## Legal Theme

Technical documentation must be prepared and maintained for applicable high-risk AI systems.

## AIGO Mapping

**AIGO Components:**

* AI System Profile;
* Evidence;
* Documentation;
* Assurance;
* Change Management.

## Relationship

**DIRECT**

## AIGO Controls

AIGO should provide controlled documentation requirements covering:

* system purpose;
* architecture;
* data;
* model;
* performance;
* controls;
* limitations;
* risks;
* lifecycle;
* changes.

## Evidence

Technical documentation should be maintained in a controlled repository with version history and integrity controls.

***

# 21. Article 12 — Record-Keeping

## Legal Theme

Applicable high-risk AI systems must maintain appropriate records and logs.

## AIGO Mapping

**AIGO Components:**

* Evidence;
* Monitoring;
* AI System;
* Incident;
* Assurance.

## Relationship

**DIRECT**

## AIGO Control

**AI Governance Record-Keeping Control**

The control should require:

* log retention;
* controlled repository;
* timestamp integrity;
* access control;
* retention;
* evidence traceability.

***

# 22. Article 13 — Transparency and Provision of Information to Deployers

## Legal Theme

Relevant providers must ensure that high-risk AI systems are designed and developed with sufficient transparency and information for deployers.

## AIGO Mapping

**AIGO Components:**

* Transparency;
* AI System Profile;
* Evidence;
* Human Oversight;
* Risk.

## Relationship

**DIRECT**

## AIGO Controls

AIGO should support:

* intended-purpose documentation;
* system limitations;
* known risks;
* usage constraints;
* human oversight information;
* operational instructions.

***

# 23. Article 14 — Human Oversight

## Legal Theme

High-risk AI systems require appropriate human oversight.

## AIGO Mapping

**AIGO Components:**

* Human Oversight;
* Control;
* Monitoring;
* Incident;
* Assurance;
* Training.

## Relationship

**DIRECT / CRITICAL**

## AIGO Control

**Human Oversight Control**

The control should establish:

* accountable human role;
* required competence;
* intervention authority;
* override capability;
* escalation;
* monitoring;
* workload considerations;
* documentation.

## Evidence

* assigned oversight role;
* competence record;
* oversight procedures;
* intervention logs;
* review records.

***

# 24. Article 15 — Accuracy, Robustness and Cybersecurity

## Legal Theme

Applicable high-risk AI systems are subject to requirements concerning accuracy, robustness, resilience, and cybersecurity.

## AIGO Mapping

**AIGO Components:**

* Control;
* Risk;
* Assessment;
* Monitoring;
* Assurance;
* Incident.

## Relationship

**DIRECT**

## AIGO Control Domains

Controls should address:

* performance;
* robustness;
* resilience;
* adversarial risks;
* cybersecurity;
* failure handling;
* monitoring;
* incident response.

***

# 25. Articles 16–22 — Provider Obligations

## Legal Theme

The Regulation establishes provider obligations concerning:

* compliance;
* quality management;
* documentation;
* automatic logs where applicable;
* corrective action;
* authorities;
* registration;
* representation;
* cooperation.

## AIGO Mapping

**AIGO Components:**

* Governance;
* AI System;
* Control;
* Evidence;
* Change;
* Incident;
* Monitoring;
* Assurance.

## Relationship

**DIRECT / SUPPORTING**

## AIGO Implementation

AIGO should ensure that provider responsibilities are represented in:

* governance;
* lifecycle management;
* controls;
* records;
* assurance;
* incident management;
* change management.

***

# 26. Articles 23–27 — Importers, Distributors and Deployer-Related Responsibilities

## Legal Theme

The AI Act assigns obligations across different actors in the AI value chain.

## AIGO Mapping

**AIGO Components:**

* Governance;
* Third-Party Governance;
* AI System;
* Risk;
* Control;
* Evidence.

## Relationship

**DIRECT / CONDITIONAL**

## AIGO Requirement

Third-party governance should identify:

* actor role;
* supplier/provider;
* system status;
* required documentation;
* contractual requirements;
* incident notification;
* change notification;
* compliance evidence.

***

# 27. Article 26 — Deployer Obligations

## Legal Theme

Deployers of high-risk AI systems have specific obligations concerning use, monitoring, human oversight, records, instructions, and other requirements.

## AIGO Mapping

**AIGO Components:**

* Governance;
* Human Oversight;
* Monitoring;
* Incident;
* Evidence;
* Risk;
* Control.

## Relationship

**DIRECT**

## AIGO Controls

Deployers should have controls covering:

* approved use;
* instructions;
* human oversight;
* monitoring;
* incident handling;
* record keeping;
* data governance where applicable;
* change escalation.

***

# 28. Article 27 — Fundamental Rights Impact Assessment

## Legal Theme

Applicable deployers must carry out a fundamental-rights impact assessment in the circumstances defined by the Regulation.

## AIGO Mapping

**AIGO Components:**

* Assessment;
* Risk;
* Governance;
* Evidence;
* Assurance;
* Management Review.

## Relationship

**DIRECT / CONDITIONAL**

## AIGO Implementation

AIGO should support:

* applicability screening;
* impacted-rights identification;
* affected-person analysis;
* risk assessment;
* mitigation;
* residual-risk review;
* evidence;
* management decision.

The AIGO assessment process may be used as the governance mechanism, but the mapping should clearly identify where the EU AI Act imposes a distinct legal assessment obligation.

***

# 29. Article 28 — Authorities and Bodies

## Legal Theme

The Regulation provides for competent authorities and the governance structures responsible for supervision.

## AIGO Mapping

**AIGO Components:**

* Governance;
* Escalation;
* Compliance;
* Incident;
* Assurance.

## Relationship

**SUPPORTING**

AIGO organizations should identify the relevant external authorities applicable to them but should not represent internal governance bodies as exercising statutory authority.

***

# 30. Articles 29–31 — Market Surveillance and Enforcement Interfaces

## Legal Theme

The Regulation establishes supervision, market surveillance, and related organizational relationships.

## AIGO Mapping

**AIGO Components:**

* Governance;
* Incident;
* Evidence;
* Assurance;
* Regulatory Change.

## Relationship

**SUPPORTING**

AIGO should provide:

* regulatory correspondence records;
* authority interaction records;
* incident escalation;
* evidence preservation;
* remediation;
* management review.

***

# 31. Article 49 — Registration

## Legal Theme

Certain AI systems and actors are subject to registration requirements.

## AIGO Mapping

**AIGO Components:**

* AI System Registration;
* Governance;
* Evidence;
* Approval.

## Relationship

**DIRECT / CONDITIONAL**

## AIGO Control

**AI System Regulatory Registration Control**

The control should determine:

* whether EU registration applies;
* responsible party;
* registration status;
* registration evidence;
* changes requiring update.

The AIGO internal AI inventory is not automatically equivalent to EU registration.

***

# 32. Article 50 — Transparency Obligations

## Legal Theme

Certain providers and deployers must comply with transparency obligations for specified AI systems and content.

The Commission's current implementation material states that Article 50 transparency obligations apply from **2 August 2026**.

## AIGO Mapping

**AIGO Components:**

* Governance;
* Control;
* Transparency;
* Monitoring;
* Evidence;
* Assurance;
* Incident.

## Relationship

**DIRECT**

## AIGO Controls

Potential controls include:

* AI interaction disclosure;
* synthetic-content identification;
* deepfake disclosure;
* public-interest content disclosure;
* emotion-recognition notification;
* biometric categorization notification.

## Evidence

* transparency configuration;
* notices;
* content-marking implementation;
* testing;
* monitoring;
* incident records.

Detailed requirements are maintained in:

`04-AIGO-EU-AI-Act-Transparency-Mapping-v0.1.md`

***

# 33. Articles 51–56 — General-Purpose AI Models

## Legal Theme

The AI Act establishes obligations for GPAI model providers, including additional requirements for models presenting systemic risk.

The Commission states that GPAI obligations became applicable from **2 August 2025**, while Commission enforcement powers apply from **2 August 2026**. Models placed on the market before 2 August 2025 have until **2 August 2027** to comply.

## AIGO Mapping

**AIGO Components:**

* AI System / Model;
* Classification;
* Risk;
* Control;
* Evidence;
* Assurance;
* Incident;
* Monitoring.

## Relationship

**DIRECT / CONDITIONAL**

## AIGO GPAI Controls

Potential controls include:

* GPAI applicability determination;
* model documentation;
* downstream information;
* copyright policy;
* training-data summary;
* systemic-risk assessment;
* adversarial evaluation;
* incident reporting;
* systemic-risk monitoring;
* AI Office interaction.

Detailed treatment is maintained in:

`05-AIGO-EU-AI-Act-GPAI-Mapping-v0.1.md`

***

# 34. General-Purpose AI Model Systemic Risk

Where a GPAI model is subject to systemic-risk obligations, AIGO should establish an enhanced governance profile.

Potential governance requirements include:

```text id="i6xzzc" theme={null}
Systemic Risk Determination
        ↓
Enhanced Risk Assessment
        ↓
Enhanced Controls
        ↓
Testing / Evaluation
        ↓
Incident Management
        ↓
Monitoring
        ↓
Assurance
        ↓
Regulatory Interaction
```

***

# 35. Governance and AI Office

The EU AI Office has central responsibilities under the AI Act, particularly regarding GPAI.

AIGO should therefore maintain regulatory interaction controls for organizations that must engage with EU authorities.

The AI Office's legal authority must not be confused with the organization's internal AI governance authority.

***

# 36. Articles 57–59 — Innovation and Regulatory Sandboxes

## Legal Theme

The AI Act establishes frameworks for regulatory sandboxes and innovation support.

The Digital Omnibus further expands access to regulatory sandboxes and simplifies implementation mechanisms.

## AIGO Mapping

**AIGO Components:**

* Governance;
* Risk;
* Assessment;
* Change;
* Evidence;
* Assurance.

## Relationship

**SUPPORTING / CONDITIONAL**

AIGO should govern:

* sandbox entry;
* scope;
* risk;
* safeguards;
* monitoring;
* exit;
* evidence;
* regulatory engagement.

***

# 37. Articles 60–62 — Testing in Real-World Conditions and Serious Incidents

## AIGO Mapping

**AIGO Components:**

* Assessment;
* Monitoring;
* Incident;
* Evidence;
* Assurance;
* Change.

## Relationship

**DIRECT / CONDITIONAL**

AIGO should provide:

* real-world testing governance;
* subject protection;
* monitoring;
* incident escalation;
* evidence preservation;
* change controls.

***

# 38. Articles 64–67 — Governance

## Legal Theme

The AI Act establishes institutional governance structures including the AI Office and AI Board and provides for advisory functions.

## AIGO Mapping

**AIGO Components:**

* Governance;
* Roles;
* Reporting;
* Regulatory Engagement;
* Assurance.

## Relationship

**SUPPORTING**

AIGO should identify:

* internal regulatory owner;
* regulatory liaison;
* escalation route;
* management reporting;
* regulatory change monitoring.

***

# 39. Articles 68–69 — AI Board and National Coordination

## AIGO Mapping

The AIGO governance framework should distinguish:

```text theme={null}
EU / National Regulatory Governance
                ↓
Organizational AI Governance
```

The internal governance system should not be represented as a replacement for national or EU governance institutions.

***

# 40. Articles 70–73 — National Competent Authorities and Cooperation

## AIGO Mapping

AIGO should support:

* authority identification;
* regulatory requests;
* evidence preservation;
* response management;
* incident escalation;
* regulatory correspondence.

These activities should connect to:

* Governance;
* Evidence;
* Incident;
* Assurance;
* Management Review.

***

# 41. Articles 74–79 — Market Surveillance and AI-System Supervision

## AIGO Mapping

Potential controls include:

* regulatory readiness;
* evidence availability;
* technical-documentation management;
* incident handling;
* corrective actions;
* supplier coordination;
* authority response.

These requirements should connect to the AIGO Evidence and Assurance models.

***

# 42. Articles 80–83 — Corrective Actions and Regulatory Measures

## AIGO Mapping

Regulatory nonconformance should create controlled governance actions.

Recommended chain:

```text theme={null}
Regulatory Finding
       ↓
Incident / Finding
       ↓
Risk
       ↓
Corrective Action
       ↓
Change
       ↓
Evidence
       ↓
Verification
       ↓
Assurance
```

***

# 43. Articles 85–86 — Complaints and Explanations

## AIGO Mapping

Where applicable, organizations should maintain:

* complaint mechanisms;
* information handling;
* explanation processes;
* human escalation;
* evidence;
* remediation;
* monitoring.

The AIGO Incident and Evidence structures may support these activities, but a specific statutory complaint pathway must remain distinguishable.

***

# 44. Articles 88–90 — Confidentiality and Information Handling

## AIGO Mapping

These provisions connect to:

* Information Security;
* Privacy;
* Evidence;
* Access Control;
* Records Management.

AIGO should ensure that regulatory information is handled according to applicable confidentiality and security obligations.

***

# 45. Articles 99–101 — Penalties and Enforcement

## AIGO Mapping

Potential governance controls include:

* compliance monitoring;
* regulatory risk;
* escalation;
* incident management;
* evidence preservation;
* management review;
* corrective actions.

Organizations should maintain regulatory-risk awareness without attempting to calculate statutory penalties solely through AIGO.

***

# 46. Articles 102–112 — Final and Transitional Provisions

## AIGO Mapping

These provisions should be addressed through:

* applicability;
* transition;
* regulatory monitoring;
* legal-source tracking;
* controlled mapping updates.

The dedicated timeline mapping is authoritative for operational application dates.

***

# 47. Annex I — Union Harmonisation Legislation

## AIGO Mapping

Annex I is relevant to determining whether an AI system falls within the regulated-product high-risk pathway.

AIGO should capture:

* product category;
* applicable product legislation;
* AI-system relationship;
* classification;
* conformity pathway;
* transition date.

The current Digital Omnibus extends the relevant high-risk application date for AI embedded in regulated products to **2 August 2028**.

***

# 48. Annex III — High-Risk Use Cases

## AIGO Mapping

Annex III should be mapped to:

* AI classification;
* intended purpose;
* affected-person impact;
* risk;
* fundamental-rights impact;
* controls;
* assessments;
* approvals;
* monitoring;
* assurance.

The Commission currently describes the revised high-risk application timeline as **2 December 2027** for specified stand-alone high-risk use cases following the Digital Omnibus.

***

# 49. Annex IV — Technical Documentation

Annex IV requirements should connect to:

```text theme={null}
Technical Documentation
        ↓
AI System Profile
        ↓
Evidence
        ↓
Assurance
        ↓
Change Management
```

The AIGO System Profile and Evidence structures should support the governance record needed to demonstrate documentation completeness.

AIGO should not claim that the generic System Profile alone automatically satisfies every Annex IV requirement.

***

# 50. Annex V — EU Declaration of Conformity

The AIGO framework should distinguish:

```text theme={null}
Internal Governance Approval
```

from:

```text theme={null}
EU Declaration of Conformity
```

AIGO may provide supporting evidence and governance controls, but the statutory declaration remains a distinct legal artifact.

***

# 51. Annex VI and VII — Conformity Assessment

The mapping should identify the applicable conformity-assessment route.

AIGO may support:

* readiness assessment;
* evidence management;
* control assessment;
* technical assessment;
* assurance;
* approval.

However, AIGO approval does not replace the legally required conformity-assessment procedure.

***

# 52. Annex VIII — Registration Information

Where EU registration requirements apply, AIGO should maintain:

* regulatory registration applicability;
* registration owner;
* registration identifier;
* registration date;
* evidence;
* update requirements.

This should be linked to the AI System Profile and Evidence records.

***

# 53. Annex IX — Post-Market Monitoring

Post-market obligations should map to:

* Monitoring;
* Incident;
* Risk;
* Evidence;
* Assurance;
* Improvement.

Recommended chain:

```text theme={null}
Post-Market Monitoring
        ↓
Observation
        ↓
Risk / Incident
        ↓
Corrective Action
        ↓
Evidence
        ↓
Assurance
```

***

# 54. AIGO Governance Domain Mapping

The master EU AI Act mapping should maintain a crosswalk to the AIGO governance domains.

| EU AI Act Area                        | AIGO Governance Domain       |
| ------------------------------------- | ---------------------------- |
| Applicability                         | Governance / Classification  |
| Prohibited Practices                  | Governance / Risk / Approval |
| High-Risk Classification              | Classification / Risk        |
| Risk Management                       | Risk                         |
| Data Governance                       | Controls / Data              |
| Technical Documentation               | Evidence / AI System         |
| Record Keeping                        | Evidence                     |
| Transparency                          | Controls / Monitoring        |
| Human Oversight                       | Controls / Governance        |
| Accuracy / Robustness / Cybersecurity | Controls / Risk              |
| Provider Obligations                  | Governance                   |
| Deployer Obligations                  | Governance / Operations      |
| GPAI                                  | AI System / Risk / Assurance |
| Governance / Enforcement              | Governance                   |
| Fundamental Rights                    | Risk / Assessment            |
| Complaints / Remedies                 | Incident / Governance        |
| Post-Market Monitoring                | Monitoring                   |
| Incident Reporting                    | Incident                     |
| Conformity                            | Assessment / Assurance       |
| Registration                          | AI System / Governance       |
| Retirement / Transition               | Change / Retirement          |

***

# 55. AIGO Lifecycle Mapping

EU AI Act obligations should be integrated into the AIGO lifecycle.

| AIGO Lifecycle Stage   | EU AI Act Mapping Focus                       |
| ---------------------- | --------------------------------------------- |
| Planning               | Applicability, actor, prohibited practices    |
| Design                 | Risk, documentation, transparency             |
| Development            | Data, testing, cybersecurity                  |
| Data Preparation       | Data governance and quality                   |
| Testing and Validation | Accuracy, robustness, safety, bias            |
| Approval               | Regulatory classification and readiness       |
| Deployment             | Instructions, human oversight, transparency   |
| Operation              | Monitoring, records, incident handling        |
| Monitoring             | Performance, risk, incidents, post-market     |
| Change                 | Reclassification, reassessment, documentation |
| Assurance              | Conformity readiness, controls, evidence      |
| Retirement             | Records, evidence, regulatory obligations     |

***

# 56. AIGO Risk Mapping

EU AI Act requirements may generate several risk categories.

Potential AIGO risk categories include:

```text theme={null}
REGULATORY_RISK
COMPLIANCE_RISK
FUNDAMENTAL_RIGHTS_RISK
SAFETY_RISK
SECURITY_RISK
PRIVACY_RISK
DATA_GOVERNANCE_RISK
TRANSPARENCY_RISK
HUMAN_OVERSIGHT_RISK
OPERATIONAL_RISK
SUPPLIER_RISK
REPUTATIONAL_RISK
```

The risk taxonomy should remain AIGO-controlled.

EU AI Act categories should not be copied directly into the general AIGO risk taxonomy without governance review.

***

# 57. AIGO Control Mapping

Controls should be grouped into operational categories such as:

```text theme={null}
Applicability Control
Classification Control
Prohibited-Practice Screening Control
Risk Management Control
Data Governance Control
Technical Documentation Control
Record-Keeping Control
Human Oversight Control
Transparency Control
Cybersecurity Control
Monitoring Control
Incident Control
Regulatory Reporting Control
Third-Party Control
Conformity Support Control
Post-Market Monitoring Control
Change Management Control
Retirement Control
```

Detailed control mappings are maintained in:

`12-AIGO-EU-AI-Act-AIGO-Control-Mapping-v0.1.md`

***

# 58. AIGO Assessment Mapping

Relevant assessment types include:

```text theme={null}
EU AI Act Applicability Assessment
AI Classification Assessment
Risk Assessment
Data Governance Assessment
Fundamental Rights Impact Assessment
Control Assessment
Technical Assessment
Conformity Readiness Assessment
Change Assessment
Incident Assessment
Retirement Assessment
```

The organization should determine which assessments are legally required, operationally required, or governance-recommended.

***

# 59. AIGO Approval Mapping

Approval requirements may include:

* prohibited-practice screening outcome;
* high-risk deployment approval;
* regulatory applicability decision;
* residual compliance risk;
* significant change;
* exception;
* retirement.

Approvals should identify their authority and legal/governance basis.

***

# 60. Monitoring Mapping

Monitoring may include:

* AI system performance;
* human oversight;
* transparency;
* incident trends;
* control performance;
* post-market information;
* risk indicators;
* regulatory changes;
* supplier changes.

Monitoring requirements must remain proportionate and traceable to the applicable EU AI Act provision.

***

# 61. Incident Mapping

Relevant incidents may include:

* serious AI incidents;
* non-compliance;
* security incidents;
* privacy events;
* fundamental-rights impacts;
* prohibited-use events;
* failed controls;
* transparency failures.

Incident records should be linked to:

* AI system;
* risk;
* control;
* evidence;
* change;
* improvement;
* assurance.

***

# 62. Change Management Mapping

A material change should trigger EU AI Act reassessment where it may affect:

* intended purpose;
* high-risk classification;
* provider/deployer role;
* transparency;
* model capability;
* data;
* risk;
* technical documentation;
* conformity;
* registration;
* post-market monitoring.

The Change Management procedure should incorporate regulatory-impact screening.

***

# 63. Assurance Mapping

AIGO assurance may review:

* applicability determination;
* classification;
* control coverage;
* evidence;
* documentation;
* monitoring;
* incident handling;
* regulatory change management.

Independent assurance should be considered for material or high-risk obligations.

***

# 64. Evidence Mapping

Evidence may include:

* applicability assessments;
* classification decisions;
* technical documentation;
* risk assessments;
* control assessments;
* approval records;
* logs;
* monitoring records;
* incident records;
* corrective actions;
* declarations;
* registration records;
* assurance reports.

Each evidence item should be traceable to the relevant legal requirement or AIGO control.

***

# 65. Management Review Mapping

EU AI Act regulatory status should be included in management review where material.

Management review may consider:

* applicability changes;
* new guidance;
* upcoming deadlines;
* control gaps;
* evidence gaps;
* assurance findings;
* incidents;
* resource requirements;
* supplier issues;
* regulatory engagement.

***

# 66. Improvement Mapping

Regulatory gaps should feed continual improvement.

Recommended chain:

```text theme={null}
Regulatory Change
      ↓
Gap Analysis
      ↓
Improvement
      ↓
Control / Procedure Change
      ↓
Evidence
      ↓
Verification
      ↓
Assurance
```

***

# 67. Retirement Mapping

Retirement should consider whether EU AI Act obligations continue after operational use ends.

Potential continuing obligations include:

* record retention;
* evidence preservation;
* incident investigation;
* regulatory reporting;
* data retention;
* contractual obligations;
* post-market activity.

AI system retirement must therefore not automatically terminate all regulatory governance records.

***

# 68. Third-Party Mapping

Third-party AI systems should be mapped according to the organization's role.

The governance record should identify:

* supplier;
* provider/deployer relationship;
* contract;
* regulatory responsibility;
* required documentation;
* evidence;
* monitoring;
* notification;
* change;
* termination.

Contractual allocation of responsibilities does not automatically eliminate statutory obligations.

***

# 69. Fundamental Rights Mapping

The AIGO framework should map applicable AI Act requirements to:

* risk;
* impact assessment;
* fairness;
* privacy;
* human oversight;
* transparency;
* complaint mechanisms;
* monitoring;
* assurance.

Where applicable, the organization should preserve evidence of its fundamental-rights analysis.

***

# 70. Regulatory Change Monitoring

The organization should monitor:

* amendments;
* guidance;
* standards;
* codes;
* implementing acts;
* delegated acts.

When a change is identified:

```text theme={null}
Regulatory Change
      ↓
AIGO Change Record
      ↓
Mapping Review
      ↓
Control Impact
      ↓
Evidence Impact
      ↓
Management Review
```

***

# 71. Mapping Status Model

Each provision should be classifiable as:

```text theme={null}
NOT_REVIEWED
REVIEWED
APPLICABLE
NOT_APPLICABLE
CONDITIONAL
MAPPED
PARTIALLY_MAPPED
IMPLEMENTATION_DEFINED
IMPLEMENTED
EVIDENCED
ASSESSED
ASSURED
SUPERSEDED
```

These statuses represent mapping/governance progress.

They do not constitute legal-compliance certification.

***

# 72. Mapping Findings

The master mapping should identify potential findings such as:

```text theme={null}
UNMAPPED_REQUIREMENT
APPLICABILITY_UNRESOLVED
ACTOR_UNRESOLVED
AIGO_CONTROL_GAP
EVIDENCE_GAP
ASSESSMENT_GAP
ASSURANCE_GAP
TIMELINE_GAP
SOURCE_CURRENCY_GAP
REGULATORY_CHANGE_PENDING
```

***

# 73. Mapping Coverage

A future mapping validation process should measure:

* total mapped provisions;
* applicable provisions;
* unmapped provisions;
* partially mapped provisions;
* control coverage;
* evidence coverage;
* assurance coverage;
* timeline coverage.

Coverage metrics should be accompanied by critical gaps.

***

# 74. Critical EU AI Act Gaps

The following should normally be treated as high or critical mapping gaps:

* prohibited-practice screening absent;
* applicable high-risk classification absent;
* risk-management mapping absent;
* applicable transparency mapping absent;
* applicable GPAI mapping absent;
* fundamental-rights assessment mapping absent where required;
* regulatory registration mapping absent where required;
* serious-incident mapping absent;
* applicable conformity mapping absent;
* current implementation dates absent or incorrect.

***

# 75. Current Application Timeline

The mapping package shall use the current legal and Commission baseline.

The European Commission currently states:

* the AI Act entered into force on **1 August 2024**;
* the general application date is **2 August 2026**;
* prohibitions and AI-literacy provisions applied from **2 February 2025** under the staged framework;
* governance and GPAI obligations applied from **2 August 2025**;
* specified high-risk use cases under Annex III apply from **2 December 2027**;
* AI systems embedded in regulated products under the relevant Annex I pathway apply from **2 August 2028**.

Timeline details must be maintained centrally in:

`11-AIGO-EU-AI-Act-Applicability-and-Timeline-v0.1.md`

***

# 76. Current GPAI Timeline

The current Commission guidance states:

* GPAI obligations became applicable from **2 August 2025**;
* Commission enforcement powers apply from **2 August 2026**;
* GPAI models placed on the market before **2 August 2025** have until **2 August 2027** to comply.

AIGO GPAI mappings should use the dedicated GPAI mapping document rather than duplicating detailed timelines.

***

# 77. Current High-Risk Timeline

The Commission's current high-risk guidance states:

* rules for specified high-risk stand-alone systems apply from **2 December 2027**;
* high-risk AI embedded in products such as machinery, toys, and lifts applies from **2 August 2028**.

The final legal interpretation should always be checked against the current EUR-Lex text.

***

# 78. Current Transparency Baseline

The general AI Act framework reaches its general application milestone on **2 August 2026**, and the Commission's current implementation material identifies Article 50 transparency obligations as part of the rules applying at that stage.

AIGO should therefore treat transparency as a current operational mapping area rather than a future-only requirement.

***

# 79. Digital Omnibus Integration

The mapping shall explicitly account for Regulation (EU) 2026/1744.

The Digital Omnibus changed or clarified areas including:

* high-risk implementation timelines;
* AI literacy;
* GPAI governance;
* database registration;
* post-market monitoring;
* AI Office powers;
* certain prohibited practices;
* SME/SMC simplifications;
* regulatory sandboxes;
* interaction with product-safety legislation.

The mapping should not rely on the original 2024 AI Act text alone.

***

# 80. Source Currency Rule

Before every material mapping release:

1. verify the current EUR-Lex legal source;
2. verify applicable amendments;
3. verify Commission implementation material;
4. identify changed dates;
5. identify changed obligations;
6. update affected mappings;
7. run consistency validation;
8. obtain legal/compliance review where appropriate.

The mapping package should record the source verification date.

***

# 81. Mapping Review Frequency

The master mapping should be reviewed:

* at least annually;
* after any amendment;
* after material official guidance;
* after significant implementation measures;
* after material enforcement developments;
* after relevant case law;
* before major AIGO releases.

Event-driven review takes precedence over routine review.

***

# 82. Mapping Ownership

The mapping package should have:

**Mapping Owner:**
Responsible for maintaining the mapping package.

**Legal/Compliance Reviewer:**
Responsible for reviewing legal interpretation and applicability.

**Governance Reviewer:**
Responsible for evaluating AIGO implementation alignment.

**Framework Architect:**
Responsible for architectural consistency.

**Control Owner:**
Responsible for mapped control implementation.

**Evidence Owner:**
Responsible for evidence requirements.

**Assurance Reviewer:**
Responsible for validation of material implementation claims.

***

# 83. Validation Requirements

The master mapping should satisfy:

### Source Validation

Every material requirement has an authoritative source reference.

### Applicability Validation

Applicable actor and scope are identified.

### Mapping Validation

AIGO relationship is explicitly classified.

### Control Validation

Mapped controls exist where claimed.

### Reference Validation

AIGO identifiers resolve.

### Traceability Validation

The requirement-to-AIGO chain is intact.

### Evidence Validation

Required evidence relationships are identified.

### Timeline Validation

Application dates are current.

### Version Validation

Legal and mapping versions are identified.

### Review Validation

Material mappings have appropriate review status.

***

# 84. Limitations

The mapping cannot independently determine:

* legal compliance;
* legal interpretation in a specific factual scenario;
* conformity assessment outcome;
* adequacy of technical documentation;
* effectiveness of controls;
* sufficiency of evidence;
* appropriateness of risk decisions;
* correctness of a regulator's interpretation.

Those matters require qualified legal, technical, governance, and assurance judgment.

***

# 85. Relationship to Other EU AI Act Mapping Files

| File                                                             | Purpose                                  |
| ---------------------------------------------------------------- | ---------------------------------------- |
| `02-AIGO-EU-AI-Act-Prohibited-AI-Practices-Mapping-v0.1.md`      | Article 5 and prohibited practices       |
| `03-AIGO-EU-AI-Act-High-Risk-AI-Mapping-v0.1.md`                 | High-risk classification and obligations |
| `04-AIGO-EU-AI-Act-Transparency-Mapping-v0.1.md`                 | Transparency obligations                 |
| `05-AIGO-EU-AI-Act-GPAI-Mapping-v0.1.md`                         | GPAI requirements                        |
| `06-AIGO-EU-AI-Act-AI-Literacy-Mapping-v0.1.md`                  | AI literacy                              |
| `07-AIGO-EU-AI-Act-Governance-and-Enforcement-Mapping-v0.1.md`   | Governance and enforcement               |
| `08-AIGO-EU-AI-Act-Conformity-and-Documentation-Mapping-v0.1.md` | Conformity and documentation             |
| `09-AIGO-EU-AI-Act-Rights-and-Remedies-Mapping-v0.1.md`          | Rights and remedies                      |
| `10-AIGO-EU-AI-Act-Annexes-Mapping-v0.1.md`                      | Annex mappings                           |
| `11-AIGO-EU-AI-Act-Applicability-and-Timeline-v0.1.md`           | Applicability and dates                  |
| `12-AIGO-EU-AI-Act-AIGO-Control-Mapping-v0.1.md`                 | Direct AIGO controls                     |
| `13-AIGO-EU-AI-Act-Evidence-and-Assurance-Mapping-v0.1.md`       | Evidence and assurance                   |

The master mapping should provide the high-level crosswalk and delegate detailed subject matter to these files.

***

# 86. Example Master Mapping Record

A conceptual mapping entry is:

| Field             | Example                                         |
| ----------------- | ----------------------------------------------- |
| Mapping ID        | `EUAI-HR-ART9-001`                              |
| Source            | Regulation (EU) 2024/1689, Article 9            |
| Actor             | Provider of applicable high-risk AI system      |
| Applicability     | Conditional                                     |
| Requirement       | Establish and maintain a risk-management system |
| AIGO Relationship | Direct                                          |
| AIGO Component    | Risk                                            |
| AIGO Control      | AI Risk Management Control                      |
| AIGO Assessment   | AI Risk Assessment                              |
| AIGO Evidence     | Risk Assessment Record                          |
| AIGO Monitoring   | Risk Monitoring                                 |
| AIGO Assurance    | Risk / Control Assurance                        |
| Status            | MAPPED                                          |
| Confidence        | HIGH                                            |

***

# 87. Example Governance Chain

A high-risk AI implementation may produce:

```text theme={null}
EU AI Act
    ↓
Article 9
    ↓
AIGO Risk Requirement
    ↓
Risk Assessment
    ↓
Risk Record
    ↓
Control
    ↓
Control Assessment
    ↓
Evidence
    ↓
Monitoring
    ↓
Assurance
    ↓
Management Review
    ↓
Improvement
```

This is the intended operational traceability pattern.

***

# 88. Regulatory Change Chain

When EU AI Act requirements change:

```text theme={null}
Legal Amendment
      ↓
Source Review
      ↓
Mapping Update
      ↓
Applicability Review
      ↓
Control Impact
      ↓
Procedure / Template Impact
      ↓
Evidence Impact
      ↓
Monitoring / Assurance Impact
      ↓
Management Review
      ↓
Implementation
      ↓
Verification
```

This chain should be integrated with AIGO Change Management.

***

# 89. Mapping Release Evidence

A release of this mapping package should retain evidence including:

* source verification;
* registry;
* mapping review;
* legal/compliance review;
* changed mappings;
* validation results;
* unresolved issues;
* approval.

Such records may be stored through the AIGO Evidence model.

***

# 90. Mapping Quality Standard

The AIGO EU AI Act mapping should be considered fit for operational use only when it is:

* legally sourced;
* current;
* actor-aware;
* applicability-aware;
* traceable;
* internally consistent;
* mapped to AIGO controls;
* supported by evidence requirements;
* reviewed;
* versioned.

***

# 91. Document Control

| Field                     | Value                       |
| ------------------------- | --------------------------- |
| Document                  | AIGO EU AI Act Main Mapping |
| Version                   | 0.1                         |
| Status                    | Draft                       |
| Document Identifier       | `AIGO-MAP-EUAI-001`         |
| Document Type             | EU AI Act Mapping           |
| Mapping Package           | `AIGO-MAP-EUAI`             |
| Owner                     |                             |
| Legal/Compliance Reviewer |                             |
| Governance Reviewer       |                             |
| Framework Architect       |                             |
| Approved By               |                             |
| Effective Date            |                             |
| Next Review Date          |                             |

***

# 92. Document Status

**Document:** AIGO — EU AI Act Main Mapping

**Version:** 0.1

**Status:** Draft

**Working Name:** AIGO

**Full Name:** AI Governance Operating Framework

**Document Identifier:** `AIGO-MAP-EUAI-001`

**Document Type:** EU AI Act Mapping

This document provides the principal mapping between the EU AI Act and the AIGO AI Governance Operating Framework. Detailed mappings are maintained in the associated EU AI Act mapping package.

End of Document