AIGO — EU AI Act Rights and Remedies Mapping

1. Document Purpose

This document provides the AIGO mapping for rights, fundamental-rights safeguards, complaints, explanations, access to information, human review, regulatory remedies, and related protections under Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744. The mapping translates relevant EU AI Act requirements into the AIGO governance framework covering:

fundamental-rights protection;
affected-person identification;
fundamental-rights impact assessment;
data protection interaction;
transparency;
human oversight;
explanations and information;
complaint mechanisms;
regulatory complaints;
affected-person communications;
bias and discrimination;
monitoring;
incident management;
corrective action;
evidence;
assurance;
management review; and
continual improvement.

This document is an operational governance mapping. It is not legal advice, a legal opinion, or a determination that a particular organization has satisfied its legal obligations. The current amended AI Act expressly connects certain rights protections with high-risk AI governance, including the fundamental-rights impact assessment under Article 27. Regulation (EU) 2026/1744 also clarifies that a deployer may use cross-references to an applicable GDPR data protection impact assessment when conducting the Article 27 assessment, where the requirements overlap.

2. Mapping Information

Field	Value
Mapping	AIGO EU AI Act Rights and Remedies Mapping
Version	0.1
Status	Draft
Document Identifier	`AIGO-MAP-EUAI-009`
Document Type	EU AI Act Mapping
Mapping Package	`AIGO-MAP-EUAI`
Primary Legal Instrument	Regulation (EU) 2024/1689
Current Amendment Baseline	Regulation (EU) 2026/1744
Primary Rights Provisions	Articles 26, 27, 85, 86 and related provisions
Related Provisions	Articles 5, 9, 13–14, 50 and relevant high-risk provisions
Mapping Architecture	`AIGO-MAP-EUAI-ARCH-001`
Registry	`00-AIGO-EU-AI-Act-Mapping-Registry-v0.1.json`

3. Rights Governance Principle

AIGO should treat fundamental-rights protection as a lifecycle governance responsibility. The preferred model is:

AI System
    ↓
Affected Persons / Groups
    ↓
Legal and Contextual Applicability
    ↓
Rights Impact Identification
    ↓
Risk Assessment
    ↓
Controls
    ↓
Human Oversight
    ↓
Transparency / Information
    ↓
Decision / Action
    ↓
Complaint / Challenge
    ↓
Monitoring
    ↓
Remediation
    ↓
Evidence
    ↓
Assurance

Rights protection should not be reduced to a single assessment document.

4. Source Hierarchy

4.1 Binding Legal Sources

The primary legal source is: Regulation (EU) 2024/1689 as amended by: Regulation (EU) 2026/1744 The current EUR-Lex legal text is authoritative. Rights and remedies may also be governed by other EU and national law, including:

data protection law;
equality and anti-discrimination law;
consumer protection law;
employment law;
administrative law;
sector-specific law;
judicial remedies.

The AI Act does not replace those legal regimes.

5. Fundamental-Rights Scope

Potential rights and interests affected by AI systems may include:

human dignity;
privacy;
personal data protection;
non-discrimination;
equality;
freedom of expression;
freedom of association;
freedom of assembly;
freedom of thought and conscience;
right to an effective remedy;
presumption of innocence;
rights of the child;
workers’ rights;
access to essential services;
democratic participation;
human autonomy.

The precise legal basis depends on the actual use case.

6. AIGO Fundamental-Rights Governance Control

Control Name: Fundamental-Rights AI Governance Control Objective: Identify, assess, mitigate, monitor, and remediate material fundamental-rights risks arising from applicable AI systems. Control Owner: AI Governance Owner / Fundamental-Rights or Compliance Owner. Frequency:

before deployment where applicable;
before material change;
after material incidents;
after relevant regulatory change;
periodically according to risk.

Evidence:

rights assessment;
affected-person analysis;
safeguards;
decisions;
monitoring;
complaints;
remediation;
assurance.

7. Affected-Person Model

AIGO should identify individuals and groups potentially affected by an AI system. Potential categories include:

DIRECT_USER
EMPLOYEE
CUSTOMER
CITIZEN
PATIENT
STUDENT
JOB_APPLICANT
WORKER
CONSUMER
BORROWER
BENEFICIARY
MIGRANT
ASYLUM_APPLICANT
PERSON_SUBJECT_TO_LAW_ENFORCEMENT
PERSON_IN_PUBLIC_SPACE
CHILD
VULNERABLE_PERSON
OTHER_AFFECTED_PERSON

These are governance categories, not replacements for legal definitions.

8. Affected-Group Analysis

The organization should consider whether a system may disproportionately affect:

protected groups;
vulnerable people;
children;
persons with disabilities;
economically vulnerable people;
socially vulnerable people;
employees;
applicants;
persons with limited access to alternative services.

The analysis should be evidence-based.

9. Fundamental-Rights Impact Assessment

Article 27 requires certain deployers of high-risk AI systems to conduct a fundamental-rights impact assessment in the circumstances specified by the Regulation. The Commission explains that this requirement applies to certain public-law bodies and private operators providing public services, and to operators of high-risk AI systems used for certain creditworthiness or life/health-insurance pricing or risk assessments. The Commission also explains that where a data protection impact assessment is required, the fundamental-rights impact assessment should be conducted in conjunction with it.

10. Article 27 AIGO Mapping

Relationship: DIRECT / CONDITIONAL / CRITICAL AIGO Components:

Assessment;
Risk;
Governance;
Evidence;
Human Oversight;
Monitoring;
Assurance.

Recommended chain:

High-Risk AI System
        ↓
Article 27 Applicability
        ↓
Affected Persons
        ↓
Fundamental Rights
        ↓
Impact Assessment
        ↓
Mitigation
        ↓
Residual Risk
        ↓
Notification / Governance Action
        ↓
Monitoring

11. Article 27 Applicability Record

The AIGO assessment should determine:

Question	Result
Is the AI system high-risk?	Yes / No
Is the organization the relevant deployer?	Yes / No
Is the deployer a public-law body?	Yes / No
Is the deployer a private operator providing public services?	Yes / No
Is the system used for covered creditworthiness assessment?	Yes / No
Is the system used for covered life/health insurance pricing or risk assessment?	Yes / No
Is Article 27 otherwise applicable?	Yes / No / Conditional
Is a DPIA also required?	Yes / No
Can the DPIA satisfy overlapping components?	Yes / No / Conditional
Is notification to the relevant national authority required?	Yes / No
Reviewer
Date

12. Article 27 and Data Protection Impact Assessment

The amended Article 27 permits cross-reference to relevant sections of a GDPR Article 35 DPIA or Article 27 DPIA under Directive (EU) 2016/680 where those obligations already address the relevant matters. AIGO should therefore support:

Fundamental Rights Impact Assessment
          ↕
Data Protection Impact Assessment

where legally appropriate. Cross-reference should not be assumed to eliminate every Article 27 requirement.

13. Combined Assessment Governance

Where a DPIA and Article 27 assessment overlap, AIGO should identify:

common issue;
DPIA section;
Article 27 section;
remaining rights considerations;
remaining privacy considerations;
responsible owner;
approval;
evidence.

This prevents duplicated assessments while preserving distinct legal requirements.

14. Fundamental-Rights Assessment Content

AIGO should assess, where relevant:

purpose;
affected individuals;
affected groups;
decision context;
power asymmetry;
potential rights impacts;
discrimination;
privacy;
autonomy;
dignity;
access to services;
human oversight;
transparency;
remedies;
safeguards;
residual risk.

The precise assessment should be proportional to the system and legal context.

15. Bias and Discrimination

The amended AI Act explicitly recognizes bias detection and correction as an important protection of persons from adverse effects, including discrimination, and extends attention beyond providers of high-risk systems to potential bias arising from deployer activity and other AI systems. AIGO should therefore treat bias governance as potentially relevant beyond the strict high-risk-provider context.

16. Bias Governance Control

Control Name: AI Bias Detection and Correction Control The control should cover:

bias identification;
relevant protected characteristics;
data and output analysis;
testing;
mitigation;
residual impact;
monitoring;
correction.

The control should be applied where appropriate to the system and risk.

17. Bias Evidence

Potential evidence:

bias assessment;
demographic performance analysis where lawful;
test results;
mitigation records;
model changes;
complaints;
monitoring;
assurance.

The organization should comply with applicable privacy and data-protection law when processing sensitive information for bias detection.

18. Non-Discrimination

AIGO should evaluate whether AI use could:

create discriminatory outcomes;
amplify existing disparities;
unfairly restrict access;
create differential treatment;
produce indirect discrimination;
obscure decision responsibility.

Applicable equality and anti-discrimination law must be considered alongside the AI Act.

19. Human Oversight

Human oversight can provide an important rights safeguard. AIGO should define:

responsible person;
authority;
competence;
intervention;
override;
escalation;
review.

The human oversight requirement remains dependent on the applicable AI system and legal framework.

20. Human Decision Review

Where AI contributes to a consequential decision, AIGO should consider:

what the AI actually determined;
what the human reviewed;
whether the human had sufficient information;
whether the human could challenge or override the output;
whether reasons were documented;
whether the person affected had a meaningful route to challenge.

A human signature alone should not automatically be treated as meaningful human review.

21. Explanation and Information

The AI Act contains specific information and transparency requirements in particular contexts. AIGO should distinguish:

General AI Transparency

from:

Specific Legal Right to Information / Explanation

An organization’s general explanation policy does not automatically satisfy a statutory right.

22. Explanations for High-Risk Decisions

Where applicable law requires an explanation or information regarding an AI-assisted decision, AIGO should record:

decision;
AI role;
decision-maker;
explanation provided;
date;
recipient;
method;
complaint route.

The exact scope of the right depends on the applicable legal provision.

23. Complaints

AIGO should support internal complaints relating to:

AI decisions;
transparency;
bias;
discrimination;
inappropriate use;
system errors;
rights impact;
inability to obtain information.

The complaint system should distinguish:

INTERNAL_COMPLAINT

from:

STATUTORY_COMPLAINT_TO_AUTHORITY

An internal complaint procedure does not replace a legal right to complain to a competent authority.

24. Regulatory Complaint Mechanisms

The amended AI Act includes complaint mechanisms relevant to AI Office supervision for AI systems under its competence. The amended Article 75 framework allows the AI Office to act following complaints concerning covered operators and AI systems. AIGO should maintain the ability to:

receive complaints;
assess jurisdiction;
preserve evidence;
notify legal/compliance;
cooperate with authorities where required;
track regulatory responses.

25. Complaint Intake Control

Control Name: AI Rights Complaint Management The control should define:

intake;
identity;
affected AI system;
issue;
claimed right;
urgency;
safeguarding;
investigation;
response;
escalation;
remedy;
evidence.

26. Complaint Triage

Complaints may be categorized as:

TRANSPARENCY
DISCRIMINATION
PRIVACY
SAFETY
SECURITY
HUMAN_OVERSIGHT
AI_DECISION
ACCESS
ACCURACY
BIAS
OTHER_RIGHTS

The organization should not use categories to reject a complaint merely because it does not fit an existing taxonomy.

27. Vulnerable Persons

Complaints involving:

children;
persons with disabilities;
vulnerable persons;
serious rights impacts;
urgent safety risks

may require enhanced handling. The escalation model should be proportionate to actual risk.

28. Access to Information

AIGO should maintain procedures for determining what information affected persons are entitled to receive. Potential information may include:

AI use;
purpose;
decision context;
relevant explanation;
responsible organization;
complaint route;
correction process.

The exact entitlement must be determined under applicable law.

29. Transparency Relationship

Rights governance should link to the Article 50 transparency mapping. Recommended chain:

AI System
   ↓
Transparency Requirement
   ↓
Information Provided
   ↓
Affected Person
   ↓
Complaint / Challenge

The Transparency Mapping remains authoritative for Article 50-specific requirements.

30. Remedies

AIGO should support remediation mechanisms such as:

correction;
reconsideration;
human review;
system restriction;
decision reversal where appropriate;
compensation where legally required;
escalation to an authority;
process improvement.

AIGO should not invent a remedy where the applicable legal regime does not provide one.

31. Human Reconsideration

Where an AI-assisted outcome can materially affect an individual, AIGO should consider whether an appropriate human reconsideration mechanism is needed. Potential process:

AI-Assisted Decision
      ↓
Affected Person Challenge
      ↓
Human Review
      ↓
Evidence Review
      ↓
Decision
      ↓
Communication
      ↓
Further Remedy / Escalation

32. Decision Auditability

For material AI-assisted decisions, AIGO should retain enough information to reconstruct:

system version;
relevant input/context;
output;
human review;
decision;
reason;
applicable policy;
date;
affected-person communication.

The extent of retention should comply with applicable privacy and retention requirements.

33. Right to Challenge

Where applicable, AIGO should provide a meaningful mechanism for a person to challenge an AI-assisted outcome. The mechanism should identify:

how to submit;
responsible function;
response timeframe;
escalation;
records;
remediation.

The exact legal standard depends on the applicable sector and law.

34. Human Review and Automation Bias

AIGO should address the risk that humans may defer excessively to AI output. Controls may include:

review protocols;
independent evidence checks;
uncertainty display;
challenge procedures;
escalation;
reviewer training;
sampling.

This is particularly important for high-impact systems.

35. Fundamental-Rights Risk

AIGO should support a dedicated risk category: FUNDAMENTAL_RIGHTS_RISK Potential risk sources:

discriminatory outputs;
exclusion;
surveillance;
inaccurate classification;
automated denial;
profiling;
opacity;
lack of human review;
inappropriate inference.

36. Rights Risk Treatment

Treatment may include:

human review;
restrictions;
additional testing;
transparency;
data improvement;
controls;
monitoring;
alternative decision paths.

37. Children

AI systems involving children should receive enhanced consideration of:

rights;
vulnerability;
safety;
privacy;
manipulation;
transparency;
age-appropriate communication.

The organization should distinguish legal requirements from recommended safeguards.

38. Persons with Disabilities

AIGO should consider:

accessibility;
assistive technology;
discrimination;
communication;
human review;
alternative channels.

Rights impact should be addressed in the system context.

39. Employment Context

Where AI systems affect workers or employment decisions, AIGO should consider:

worker information;
transparency;
human review;
discrimination;
complaint routes;
workplace governance;
applicable employment law.

Article 4 literacy requirements should also be considered for personnel using the system.

40. Essential Services

Where AI decisions affect access to essential services or benefits, AIGO should emphasize:

fairness;
accuracy;
human review;
explanations;
complaints;
remediation;
monitoring.

This may overlap with Annex III high-risk requirements.

41. Creditworthiness

Where an applicable high-risk AI system performs creditworthiness assessment, AIGO should consider:

discrimination;
explainability;
human review;
evidence;
complaint mechanism;
affected-person communication;
fundamental-rights assessment.

Specific financial-sector law should also be considered.

42. Insurance

Where applicable high-risk AI is used for life or health insurance pricing or risk assessment, AIGO should consider:

discrimination;
sensitive characteristics;
transparency;
human oversight;
fundamental-rights impact;
complaints;
remediation.

The Article 27 mapping includes this context.

43. Law Enforcement Context

AI systems used in law-enforcement contexts require heightened rights governance. Potential considerations:

proportionality;
necessity;
human oversight;
accountability;
evidence;
affected-person rights;
legal authorization.

Article 5 prohibitions must be assessed separately.

44. Migration and Border Control

AI systems used in migration, asylum, or border-control contexts may have significant rights impacts. AIGO should consider:

vulnerability;
dignity;
access;
human review;
appeal or complaint;
transparency;
evidence.

45. Justice and Democratic Processes

AI used in judicial or democratic contexts may affect:

fairness;
procedural rights;
access to justice;
democratic participation;
public trust.

AIGO should apply enhanced governance where relevant.

46. Rights and Privacy

The amended AI Act explicitly states that Union law on personal-data protection, privacy, and communications confidentiality continues to apply to personal data processed under the AI Act. AIGO should therefore maintain:

AI Act Rights Governance
        +
GDPR / EDPB / Applicable Privacy Law

as related but distinct compliance layers.

47. Rights and Data Protection

The organization should avoid treating a DPIA as automatically covering every AI Act rights obligation. Instead:

DPIA
   ↓
Privacy / Data Protection Risks

FRIA
   ↓
Broader Fundamental-Rights Risks

AIGO Governance
   ↓
Integrated Controls / Evidence / Monitoring

Where assessments overlap, cross-reference should be used.

48. Rights and Security

Security incidents may become rights incidents. Example:

Security Breach
      ↓
Personal Data Exposure
      ↓
Affected Persons
      ↓
Rights Impact
      ↓
Incident
      ↓
Notification / Remediation

The applicable security, privacy, and AI Act obligations should be assessed separately.

49. Rights and AI Incidents

A serious incident affecting rights should trigger:

containment;
investigation;
affected-person analysis;
legal review;
remediation;
communication;
evidence preservation;
assurance.

50. Rights Monitoring

Monitoring may include:

complaints;
demographic disparities;
decision reversals;
false positives;
false negatives;
accessibility complaints;
explanation requests;
human-review outcomes;
recurring rights issues.

Monitoring should be lawful and proportionate.

51. Rights Assurance

Assurance may review:

rights assessments;
affected-person identification;
controls;
human review;
complaints;
remediation;
evidence;
monitoring.

Independent assurance is recommended for material high-impact rights risks.

52. Rights Evidence

Potential evidence includes:

Fundamental Rights Impact Assessment
Data Protection Impact Assessment
Bias Assessment
Affected-Person Analysis
Human Review Records
Information / Explanation Records
Complaint Records
Remediation
Monitoring
Incident Records
Assurance Reports

Evidence should be access-controlled because rights cases can contain sensitive personal information.

53. Rights Evidence Quality

Evidence should be:

attributable;
current;
complete;
relevant;
traceable;
protected.

Where personal data is contained in evidence, retention and access should be minimized to what is necessary.

54. Complaint Evidence

A complaint record should include enough information to demonstrate:

receipt;
issue;
investigation;
decision;
response;
remediation;
escalation where necessary.

The record should avoid unnecessary duplication of sensitive personal data.

55. Rights and Monitoring Evidence

Monitoring should retain enough evidence to reproduce material findings. For example:

Indicator
   ↓
Threshold
   ↓
Observed Result
   ↓
Investigation
   ↓
Action
   ↓
Verification

56. Rights and Change Management

A material change should trigger rights-impact review where it affects:

target population;
decision context;
data;
model;
capability;
autonomy;
intended purpose;
deployment geography;
human oversight;
explanation mechanism.

57. Rights and Retirement

Retirement should preserve relevant rights-related records where required, including:

historical decisions;
complaints;
incidents;
evidence;
regulatory communications;
retention obligations.

Retirement should not destroy evidence merely because the AI system is no longer operational.

58. Rights and Governance

The Governance Schema should define:

accountability;
rights oversight;
escalation;
decision authority;
legal/compliance responsibilities.

AIGO should identify who is accountable for rights-risk decisions.

59. Rights and Management Review

Management review should consider:

rights-impact findings;
complaints;
discrimination indicators;
serious incidents;
regulatory developments;
remediation;
assurance;
affected-person trends.

Material rights concerns should be escalated promptly.

60. Rights and Continual Improvement

Improvement activities may include:

redesign;
additional human review;
improved transparency;
data improvement;
new controls;
complaint-process improvements;
user support;
training;
monitoring enhancements.

61. Regulatory Rights and AI Office Complaints

For AI systems under AI Office supervision, the amended legal framework enables complaints to trigger AI Office supervisory action within its competence. AIGO should therefore maintain:

regulatory complaint intake;
jurisdiction assessment;
evidence preservation;
legal review;
response process;
regulatory interaction record.

Internal complaint closure must not prevent a complainant from exercising a statutory external right.

62. Rights of Defence in AI Office Proceedings

The amended Article 75 framework expressly provides rights of defence and access to the file for operators within the AI Office’s supervisory scope, subject to confidentiality and business-secret protections. AIGO should support:

legal representation;
file-access coordination;
confidentiality review;
business-secret protection;
evidence preservation;
response tracking.

These are procedural safeguards, not internal AIGO rights.

63. Access to Regulatory File

Where legally applicable, the organization should maintain a controlled process for:

access request;
legal review;
confidentiality review;
negotiated disclosure;
internal distribution;
record keeping.

AIGO should not independently assert access rights beyond the applicable legal provisions.

64. Judicial Review

Where the AI Act provides judicial remedies or review mechanisms, AIGO should preserve:

decision;
legal basis;
deadline;
representation;
evidence;
submissions.

Judicial procedure should remain under appropriate legal counsel.

65. Rights and Transparency

The rights-and-remedies mapping should connect to: 04-AIGO-EU-AI-Act-Transparency-Mapping-v0.1.md The relationship is:

Transparency
   ↓
Awareness
   ↓
Understanding
   ↓
Challenge / Complaint
   ↓
Remedy

Transparency is an enabling mechanism and not necessarily itself a remedy.

66. Rights and Prohibited AI Practices

Article 5 is relevant because the prohibited-practice framework protects fundamental rights. The relationship should be:

Potential Prohibited Practice
       ↓
Article 5 Screening
       ↓
Rights Risk
       ↓
Stop / Escalate

The detailed Article 5 requirements remain in the prohibited-practices mapping.

67. Rights and High-Risk AI

The High-Risk mapping remains authoritative for:

Article 9 risk management;
Article 13 transparency;
Article 14 human oversight;
Article 27 fundamental-rights impact assessment;
related high-risk requirements.

This document provides the cross-cutting rights and remedy architecture.

68. Rights Control Matrix

Rights Area	AIGO Control	Primary Record
Rights Applicability	Rights Applicability Control	Assessment
Fundamental Rights	Fundamental-Rights Governance Control	Assessment / Risk
Bias	Bias Detection and Correction	Assessment / Monitoring
Discrimination	Fairness / Rights Control	Assessment
Human Review	Human Oversight Control	Control / Evidence
Information	Rights Information Control	Evidence
Explanation	Explanation / Decision Record	Evidence
Complaints	AI Rights Complaint Management	Incident / Evidence
Remediation	Rights Remediation Control	Improvement
Regulatory Complaint	Regulatory Complaint Control	Governance / Evidence
Monitoring	Rights Impact Monitoring	Monitoring
Assurance	Rights Assurance	Assurance
Change	Rights Impact Change Assessment	Change
Retirement	Rights Record Retention	Retirement / Evidence

69. Rights Traceability Chain

The minimum AIGO chain should be:

AI Act Requirement
      ↓
AI System
      ↓
Affected Person / Group
      ↓
Right / Interest
      ↓
Risk
      ↓
Control
      ↓
Human Oversight / Transparency
      ↓
Decision
      ↓
Complaint / Challenge
      ↓
Remedy
      ↓
Evidence
      ↓
Assurance

70. Rights Findings

Potential findings include:

RIGHTS_APPLICABILITY_UNRESOLVED
AFFECTED_PERSON_ANALYSIS_MISSING
FUNDAMENTAL_RIGHTS_ASSESSMENT_MISSING
BIAS_ASSESSMENT_GAP
DISCRIMINATION_RISK_UNADDRESSED
HUMAN_REVIEW_GAP
EXPLANATION_PROCESS_MISSING
COMPLAINT_MECHANISM_MISSING
REMEDY_PROCESS_MISSING
RIGHTS_MONITORING_MISSING
RIGHTS_EVIDENCE_GAP
RIGHTS_ASSURANCE_GAP
REGULATORY_COMPLAINT_UNCONTROLLED
RIGHTS_CHANGE_IMPACT_UNASSESSED

71. Critical Rights Findings

Potential critical findings include:

applicable Article 27 assessment absent;
material discriminatory impact not addressed;
high-impact AI decision lacks required human oversight;
statutory complaint mechanism not supported where applicable;
material rights incident lacks remediation;
affected persons cannot exercise an applicable legal right;
evidence needed for a rights matter is improperly destroyed.

Severity should reflect actual legal and rights impact.

72. Rights Coverage

A future AIGO Rights Coverage Validator may measure:

Applicable Rights Requirements
          ↓
Mapped
          ↓
Controlled
          ↓
Implemented
          ↓
Evidenced
          ↓
Monitored
          ↓
Assured

This would complement the existing Control and Evidence Coverage Validators.

73. Rights Metrics

Potential management metrics include:

Metric	Purpose
High-Risk Systems With Rights Assessment	Coverage
Article 27 Assessments	Legal requirement
Affected Groups Identified	Scope
Open Rights Findings	Risk
Complaints	Impact
Complaint Resolution Time	Responsiveness
Human Review Outcomes	Oversight
Bias Findings	Fairness
Remediation Actions	Improvement
Assurance Coverage	Verification

Metrics should not be treated as legal-compliance percentages.

74. Rights Evidence Coverage

Evidence requirements may include:

rights assessment;
affected-person analysis;
bias assessment;
human-review evidence;
complaints;
explanations;
remediation;
monitoring;
assurance.

The Evidence Coverage Validator should eventually support these mappings.

75. Rights Assurance Coverage

Assurance should assess:

whether rights impacts were identified;
whether controls exist;
whether human oversight works;
whether complaints are handled;
whether remediation is effective;
whether evidence is sufficient.

76. Rights and AI Literacy

Relevant personnel should receive contextual AI literacy on:

rights impacts;
discrimination;
human oversight;
transparency;
complaints;
escalation.

The detailed literacy requirements are maintained in: 06-AIGO-EU-AI-Act-AI-Literacy-Mapping-v0.1.md

77. Rights and Governance Enforcement

Rights-related concerns may lead to regulatory involvement. The Governance and Enforcement mapping remains authoritative for:

authorities;
inspections;
complaints to authorities;
investigations;
corrective measures;
enforcement.

This document provides the rights-facing perspective.

78. Rights and Conformity

For applicable high-risk systems, rights-related evidence may contribute to conformity assessment. However:

Rights Governance Evidence
        ≠
Automatic Conformity

The Conformity mapping remains authoritative for conformity processes.

79. Rights and Evidence Protection

Rights-related evidence may be highly sensitive. AIGO should apply:

access controls;
minimization;
retention rules;
integrity;
confidentiality;
role-based access.

80. Rights and Legal Privilege

Legal advice concerning rights matters may be privileged depending on applicable law. AIGO should preserve operational traceability while limiting unnecessary distribution of privileged material.

81. Rights and Regulatory Change

Changes in:

AI Act provisions;
data protection law;
equality law;
consumer law;
employment law;
sectoral law;
national implementation

should trigger rights-impact review.

82. Rights Regulatory Watch

The organization should monitor:

AI Act amendments;
Commission guidance;
AI Office material;
AI Board outputs;
national authority guidance;
court decisions;
data protection authority guidance;
equality and human-rights developments.

The source and legal status should be recorded.

83. Rights Review Frequency

Minimum:

annual;
event-driven after material legal change;
after material rights incident;
after serious complaint;
after relevant assurance finding;
before major AIGO release.

84. Current Amendment Baseline

Regulation (EU) 2026/1744 is part of the current legal baseline and modifies several rights-related AI Act mechanisms. Notably, it:

retains the AI Act’s fundamental-rights protection objective;
clarifies interaction with EU data-protection law;
amends Article 27 to allow cross-references to applicable DPIAs;
strengthens attention to bias detection and correction;
modifies the supervisory and enforcement architecture relevant to complaints and rights of defence.

85. Current Enforcement and Complaints Baseline

The amended AI Office framework allows complaints to inform supervisory action for AI systems within AI Office competence, while preserving procedural rights including access to the file subject to confidentiality safeguards. AIGO should therefore maintain two distinct routes:

Internal Rights Complaint

and:

External Regulatory Complaint

Both should be supported without conflating them.

86. Limitations

This mapping cannot independently determine:

whether a particular right has legally been infringed;
whether discrimination exists under applicable law;
whether a person has a specific statutory remedy;
whether an explanation is legally sufficient;
whether a complaint is admissible before an authority;
whether a fundamental-rights impact assessment is legally required in a particular fact pattern;
whether a particular remedy must be provided.

These matters require current law, factual analysis, and appropriate legal review.

87. Validation Requirements

The mapping should satisfy:

Legal Source Validation

Rights provisions trace to current law.

Applicability Validation

Affected actor and affected persons are identified.

Assessment Validation

Article 27 applicability is explicitly evaluated where relevant.

Rights Validation

Potentially affected rights are identified.

Control Validation

Rights safeguards are mapped to AIGO controls.

Remedy Validation

Applicable complaint and remediation routes are identified.

Evidence Validation

Rights decisions and safeguards have evidence requirements.

Authority Validation

External complaint routes identify the appropriate authority where known.

Privacy Validation

Rights evidence remains aligned with data-protection requirements.

Consistency Validation

Rights terminology aligns with the master mapping and high-risk mapping.

88. Relationship to Other EU AI Act Mappings

File	Relationship
`01-AIGO-EU-AI-Act-Mapping-v0.1.md`	Master mapping
`02-AIGO-EU-AI-Act-Prohibited-AI-Practices-Mapping-v0.1.md`	Prohibited practices
`03-AIGO-EU-AI-Act-High-Risk-AI-Mapping-v0.1.md`	High-risk and Article 27
`04-AIGO-EU-AI-Act-Transparency-Mapping-v0.1.md`	Transparency
`05-AIGO-EU-AI-Act-GPAI-Mapping-v0.1.md`	GPAI
`06-AIGO-EU-AI-Act-AI-Literacy-Mapping-v0.1.md`	AI literacy
`07-AIGO-EU-AI-Act-Governance-and-Enforcement-Mapping-v0.1.md`	Authorities and enforcement
`08-AIGO-EU-AI-Act-Conformity-and-Documentation-Mapping-v0.1.md`	Conformity
`10-AIGO-EU-AI-Act-Annexes-Mapping-v0.1.md`	Annexes
`11-AIGO-EU-AI-Act-Applicability-and-Timeline-v0.1.md`	Applicability and dates
`12-AIGO-EU-AI-Act-AIGO-Control-Mapping-v0.1.md`	Detailed controls
`13-AIGO-EU-AI-Act-Evidence-and-Assurance-Mapping-v0.1.md`	Evidence and assurance

89. Relationship to AIGO Schemas

Rights Activity	AIGO Schema
Governance / accountability	Governance
AI system	AI System
Rights applicability	Assessment
Rights risk	Risk
Rights control	Control
Decision / approval	Approval
Rights monitoring	Monitoring
Rights complaint / incident	Incident
Rights remediation	Improvement / Change
Rights assurance	Assurance
Rights evidence	Evidence
Management review	Management Review
Retirement records	Retirement

No separate Rights Schema is required at this stage.

90. Relationship to AIGO Templates

Relevant templates include:

AI System Registration;
AI System Profile;
AI Classification;
AI Risk Assessment;
AI Control Assessment;
AI Approval;
AI Monitoring;
AI Incident;
AI Change Management;
AI Assurance;
AI Management Review;
AI Continuous Improvement;
AI Evidence Record.

A dedicated Fundamental-Rights Impact Assessment Template may be introduced later if the existing Assessment Template does not adequately support Article 27 implementation.

91. Relationship to AIGO Tools

The rights mapping should be supported by:

Schema Validator;
Reference Validator;
Traceability Validator;
Control Coverage Validator;
Evidence Coverage Validator;
Framework Consistency Checker;
Document Integrity Checker;
Repository Health Checker.

92. Document Control

Field	Value
Document	AIGO EU AI Act Rights and Remedies Mapping
Version	0.1
Status	Draft
Document Identifier	`AIGO-MAP-EUAI-009`
Document Type	EU AI Act Mapping
Primary Provisions	Articles 26, 27, 85, 86 and related provisions
Amendment Baseline	Regulation (EU) 2026/1744
Owner
Legal/Compliance Reviewer
Governance Reviewer
Rights / Fundamental-Rights Reviewer
Framework Architect
Approved By
Effective Date
Next Review Date

93. Document Status

Document: AIGO — EU AI Act Rights and Remedies Mapping Version: 0.1 Status: Draft Working Name: AIGO Full Name: AI Governance Operating Framework Document Identifier: AIGO-MAP-EUAI-009 Document Type: EU AI Act Mapping This document maps fundamental-rights protections, affected-person governance, Article 27 impact assessment, complaints, explanations, human review, remediation, regulatory complaints, evidence, assurance, monitoring, and continual improvement into the AIGO AI Governance Operating Framework. End of Document

​AIGO — EU AI Act Rights and Remedies Mapping

​1. Document Purpose

​2. Mapping Information

​3. Rights Governance Principle

​4. Source Hierarchy

​4.1 Binding Legal Sources

​5. Fundamental-Rights Scope

​6. AIGO Fundamental-Rights Governance Control

​7. Affected-Person Model

​8. Affected-Group Analysis

​9. Fundamental-Rights Impact Assessment

​10. Article 27 AIGO Mapping

​11. Article 27 Applicability Record

​12. Article 27 and Data Protection Impact Assessment

​13. Combined Assessment Governance

​14. Fundamental-Rights Assessment Content

​15. Bias and Discrimination

​16. Bias Governance Control

​17. Bias Evidence

​18. Non-Discrimination

​19. Human Oversight

​20. Human Decision Review

​21. Explanation and Information

​22. Explanations for High-Risk Decisions

​23. Complaints

​24. Regulatory Complaint Mechanisms

​25. Complaint Intake Control

​26. Complaint Triage

​27. Vulnerable Persons

​28. Access to Information

​29. Transparency Relationship

​30. Remedies

​31. Human Reconsideration

​32. Decision Auditability

​33. Right to Challenge

​34. Human Review and Automation Bias

​35. Fundamental-Rights Risk

​36. Rights Risk Treatment

​37. Children

​38. Persons with Disabilities

​39. Employment Context

​40. Essential Services

​41. Creditworthiness

​42. Insurance

​43. Law Enforcement Context

​44. Migration and Border Control

​45. Justice and Democratic Processes

​46. Rights and Privacy

​47. Rights and Data Protection

​48. Rights and Security

​49. Rights and AI Incidents

​50. Rights Monitoring

​51. Rights Assurance

​52. Rights Evidence

​53. Rights Evidence Quality

​54. Complaint Evidence

​55. Rights and Monitoring Evidence

​56. Rights and Change Management

​57. Rights and Retirement

​58. Rights and Governance

​59. Rights and Management Review

​60. Rights and Continual Improvement

​61. Regulatory Rights and AI Office Complaints

​62. Rights of Defence in AI Office Proceedings

​63. Access to Regulatory File

​64. Judicial Review

​65. Rights and Transparency

​66. Rights and Prohibited AI Practices

​67. Rights and High-Risk AI

​68. Rights Control Matrix

​69. Rights Traceability Chain

​70. Rights Findings

​71. Critical Rights Findings

​72. Rights Coverage

​73. Rights Metrics

​74. Rights Evidence Coverage

​75. Rights Assurance Coverage

​76. Rights and AI Literacy

​77. Rights and Governance Enforcement

​78. Rights and Conformity