AIGO — EU AI Act AIGO Control Mapping

1. Document Purpose

This document establishes the detailed control-level crosswalk between applicable requirements of Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744, and the AIGO AI Governance Operating Framework. The purpose is to translate legal and regulatory requirements into identifiable AIGO governance controls while preserving the distinction between:

a legal requirement;
an AIGO governance requirement;
an AIGO control;
an implementation procedure;
evidence;
assessment;
monitoring;
assurance; and
legal compliance.

This mapping is an operational control crosswalk. It does not constitute legal advice, conformity assessment, certification, or a declaration of compliance. Regulation (EU) 2026/1744 is the current amendment baseline used by this document. The amendment was adopted on 8 July 2026 and published in the Official Journal on 24 July 2026.

2. Mapping Information

Field	Value
Mapping	AIGO EU AI Act AIGO Control Mapping
Version	0.1
Status	Draft
Document Identifier	`AIGO-MAP-EUAI-012`
Document Type	EU AI Act Mapping
Mapping Package	`AIGO-MAP-EUAI`
Primary Legal Instrument	Regulation (EU) 2024/1689
Current Amendment Baseline	Regulation (EU) 2026/1744
Primary Purpose	Requirement-to-control mapping
Mapping Architecture	`AIGO-MAP-EUAI-ARCH-001`
Registry	`00-AIGO-EU-AI-Act-Mapping-Registry-v0.1.json`
Timeline Source	`11-AIGO-EU-AI-Act-Applicability-and-Timeline-v0.1.md`

3. Control Mapping Principle

The control mapping follows this structure:

EU AI Act Requirement
        ↓
Applicability
        ↓
AIGO Governance Objective
        ↓
AIGO Control
        ↓
Procedure / Operating Method
        ↓
Assessment
        ↓
Evidence
        ↓
Monitoring
        ↓
Assurance

A control is not considered effective merely because it exists in this mapping. Implementation and operating effectiveness must be demonstrated separately.

4. Source Hierarchy

The mapping uses:

Tier 1 — Binding Law

Regulation (EU) 2024/1689;
applicable amendments, including Regulation (EU) 2026/1744.

Tier 2 — Official Implementation Material

European Commission guidance;
European AI Office material;
implementing acts;
delegated acts;
official codes and related materials.

Tier 3 — AIGO Control Interpretation

AIGO converts the identified requirement into an operational governance control. The control must not change the substance of the legal requirement. The current EU AI Act source and amendments remain authoritative.

5. Control Relationship Types

Each mapping should use one of the following relationship values:

DIRECT
PARTIAL
SUPPORTING
INDIRECT
CONDITIONAL
INFORMATIVE
NOT_APPLICABLE
NO_DIRECT_AIGO_EQUIVALENT

5.1 DIRECT

The AIGO control directly addresses the mapped requirement.

5.2 PARTIAL

The control addresses only part of the requirement.

5.3 SUPPORTING

The control facilitates implementation but does not satisfy the entire requirement.

5.4 CONDITIONAL

The control applies only when specified legal conditions are satisfied.

5.5 NO_DIRECT_AIGO_EQUIVALENT

The legal requirement must be addressed through another statutory or organizational mechanism.

6. Control Status

AIGO should distinguish:

MAPPED
CONTROL_DEFINED
IMPLEMENTED
EVIDENCED
ASSESSED
MONITORED
ASSURED
SUPERSEDED
RETIRED

A mapping status must not be interpreted as a legal-compliance status.

7. Control Identifier Convention

AIGO controls should use the existing AIGO Control Schema identifiers. For EU AI Act mapping purposes, the mapping should additionally provide a stable relationship identifier. Recommended format:

EUAI-CTRL-<AREA>-<SEQUENCE>

Examples:

EUAI-CTRL-APP-001
EUAI-CTRL-PROH-001
EUAI-CTRL-HR-001
EUAI-CTRL-DATA-001
EUAI-CTRL-TRANS-001
EUAI-CTRL-GPAI-001
EUAI-CTRL-RIGHTS-001
EUAI-CTRL-CONF-001

The EUAI identifier describes the regulatory mapping relationship. The underlying AIGO Control ID remains authoritative in the Control Schema.

8. Master Control Domains

The EU AI Act mapping should use the following initial control domains:

APP  Applicability
GOV  Governance
CLS  Classification
PROH Prohibited Practices
RISK Risk Management
DATA Data Governance
DOC  Documentation
REC  Record Keeping
TRANS Transparency
HUM  Human Oversight
PERF Performance / Accuracy
ROB  Robustness
SEC  Cybersecurity
QMS  Quality Management
CONF Conformity
REG  Registration
GPAI General-Purpose AI
LIT  AI Literacy
FR   Fundamental Rights
MON  Monitoring
INC  Incident Management
CHG  Change Management
AUTH Regulatory Authority Interaction
EVD  Evidence
ASSR Assurance
IMP  Improvement
RET  Retirement
TPG  Third-Party Governance

9. Control Architecture

The control architecture should operate across the AI lifecycle:

Planning
   ↓
Applicability
   ↓
Classification
   ↓
Risk
   ↓
Control
   ↓
Assessment
   ↓
Approval
   ↓
Deployment
   ↓
Monitoring
   ↓
Incident / Change
   ↓
Assurance
   ↓
Improvement
   ↓
Retirement

This aligns the EU AI Act mapping with the AIGO lifecycle model.

10. Control Mapping — Applicability

Control `EUAI-CTRL-APP-001`

Name: EU AI Act Applicability Determination Objective: Determine whether and how the AI Act applies to an AI system, actor, model, or activity. Mapped Requirements:

Article 2;
relevant definitions;
Article 6;
Articles 51–56 where GPAI is relevant;
Article 50;
applicable transitional provisions.

Relationship: DIRECT AIGO Components:

Governance;
AI System;
Assessment;
Risk;
Evidence.

Required Activities:

identify AI system;
identify actor;
identify territory;
identify intended purpose;
identify applicable regulatory category;
identify exceptions;
identify transitional provisions;
document determination.

Evidence:

applicability assessment;
AI System Profile;
legal-source reference;
review record.

11. Control `EUAI-CTRL-CLS-001`

Name: EU AI Act Classification Objective: Determine the applicable regulatory category of an AI system. Mapped Requirements:

Article 6;
Annex I;
Annex III;
GPAI provisions where applicable;
Article 5 screening relationship.

Relationship: DIRECT Controls:

classification assessment;
intended-purpose verification;
Annex mapping;
legal review where required.

Evidence:

classification record;
Annex reference;
rationale;
technical evidence.

12. Control `EUAI-CTRL-PROH-001`

Name: Prohibited AI Practice Screening Objective: Prevent AI systems from being used for prohibited practices within Article 5. Mapped Requirement:

Article 5.

Relationship: DIRECT / CRITICAL Activities:

screen use case;
evaluate system capability;
identify prohibited category;
assess legal conditions;
identify exceptions;
escalate uncertainty;
prevent unauthorized deployment.

Evidence:

screening assessment;
intended-purpose record;
legal review;
governance decision.

Detailed mapping: 02-AIGO-EU-AI-Act-Prohibited-AI-Practices-Mapping-v0.1.md

13. Control `EUAI-CTRL-PROH-002`

Name: Prohibited-Practice Change Re-Screening Objective: Ensure material changes trigger renewed Article 5 analysis. Triggers:

intended-purpose change;
new capability;
new modality;
new deployment context;
material model change;
new affected population;
regulatory amendment.

Relationship: DIRECT Evidence:

Change record;
updated screening;
decision.

14. Control `EUAI-CTRL-RISK-001`

Name: High-Risk AI Risk Management Objective: Establish and maintain the risk-management process required for applicable high-risk AI systems. Mapped Requirement:

Article 9.

Relationship: DIRECT / CRITICAL AIGO Components:

Risk;
Control;
Assessment;
Monitoring;
Evidence;
Assurance.

Activities:

risk identification;
analysis;
evaluation;
treatment;
residual-risk determination;
lifecycle reassessment.

Evidence:

risk record;
treatment;
residual risk;
monitoring results.

15. Control `EUAI-CTRL-DATA-001`

Name: High-Risk Data Governance Mapped Requirement:

Article 10.

Relationship: DIRECT / CRITICAL Objective: Ensure applicable training, validation, and testing data are governed according to the legal and technical requirements. Activities:

data inventory;
provenance;
quality;
relevance;
representativeness;
bias assessment;
data preparation;
testing;
documentation.

Evidence:

data records;
lineage;
quality assessment;
bias analysis;
validation results.

16. Control `EUAI-CTRL-DATA-002`

Name: Training-Data Rights and Copyright Governance Objective: Support applicable GPAI copyright and training-content obligations. Mapped Requirements:

GPAI copyright requirements;
training-content summary requirements.

Relationship: DIRECT / CONDITIONAL Evidence:

copyright policy;
training-content summary;
rights-management records;
review.

Detailed mapping: 05-AIGO-EU-AI-Act-GPAI-Mapping-v0.1.md

17. Control `EUAI-CTRL-DOC-001`

Name: High-Risk Technical Documentation Mapped Requirement:

Article 11;
Annex IV.

Relationship: DIRECT / CRITICAL Objective: Maintain required technical documentation in a complete, current, controlled, versioned, and traceable form. Evidence:

technical documentation;
version history;
review;
change history.

18. Control `EUAI-CTRL-DOC-002`

Name: Technical Documentation Change Synchronization Objective: Ensure system changes result in corresponding documentation review and update. Triggers:

model change;
architecture change;
data change;
intended-purpose change;
deployment change;
security change;
human-oversight change.

Relationship: DIRECT

19. Control `EUAI-CTRL-REC-001`

Name: High-Risk Record Keeping Mapped Requirement:

Article 12;
Article 19 and related requirements.

Relationship: DIRECT Activities:

logging;
record retention;
integrity;
access;
traceability;
evidence preservation.

20. Control `EUAI-CTRL-REC-002`

Name: Regulatory Evidence Preservation Objective: Preserve records subject to regulatory request, investigation, or enforcement. Activities:

retention hold;
integrity protection;
chain of custody;
access restriction;
evidence indexing.

Relationship: SUPPORTING / CRITICAL

21. Control `EUAI-CTRL-TRANS-001`

Name: AI Interaction Disclosure Mapped Requirement:

Article 50(1).

Relationship: DIRECT Objective: Inform people when they are interacting directly with AI where the Article 50 conditions apply. Evidence:

interface;
notice;
testing;
configuration;
review.

22. Control `EUAI-CTRL-TRANS-002`

Name: Machine-Readable AI Content Marking Mapped Requirement:

Article 50(2).

Relationship: DIRECT / CRITICAL Activities:

marking;
detection;
interoperability;
robustness testing;
configuration;
monitoring.

23. Control `EUAI-CTRL-TRANS-003`

Name: Deepfake Disclosure Mapped Requirement:

Article 50 provisions concerning deepfakes.

Relationship: DIRECT / CONDITIONAL Evidence:

content classification;
label;
publication record;
testing.

24. Control `EUAI-CTRL-TRANS-004`

Name: Public-Interest AI Text Disclosure Mapped Requirement:

applicable Article 50 provisions concerning AI-generated or manipulated text on matters of public interest.

Relationship: DIRECT / CONDITIONAL Activities:

identify public-interest content;
determine human review;
determine editorial control;
apply disclosure;
retain evidence.

25. Control `EUAI-CTRL-TRANS-005`

Name: Emotion Recognition Transparency Mapped Requirement:

applicable Article 50 emotion-recognition transparency requirements.

Relationship: DIRECT / CONDITIONAL Evidence:

system profile;
applicability assessment;
notification;
testing.

26. Control `EUAI-CTRL-TRANS-006`

Name: Biometric Categorisation Transparency Mapped Requirement:

applicable Article 50 biometric-categorisation transparency requirements.

Relationship: DIRECT / CONDITIONAL Control Interaction: The system must also undergo Article 5 prohibited-practice screening.

27. Control `EUAI-CTRL-HUM-001`

Name: High-Risk Human Oversight Mapped Requirement:

Article 14.

Relationship: DIRECT / CRITICAL Activities:

appoint oversight role;
define authority;
provide information;
intervention;
override;
escalation;
monitoring;
competence.

Evidence:

role assignment;
procedures;
tests;
training;
intervention records.

28. Control `EUAI-CTRL-HUM-002`

Name: Human Oversight Competence Mapped Requirements:

Article 14;
Article 4 where applicable.

Relationship: DIRECT / SUPPORTING Objective: Ensure persons responsible for oversight have role-appropriate knowledge and preparation.

29. Control `EUAI-CTRL-PERF-001`

Name: AI Accuracy Governance Mapped Requirement:

Article 15 and applicable high-risk requirements.

Relationship: DIRECT Activities:

define accuracy objectives;
test;
validate;
monitor;
document limitations.

30. Control `EUAI-CTRL-ROB-001`

Name: AI Robustness and Resilience Mapped Requirement:

Article 15.

Relationship: DIRECT Activities:

robustness testing;
resilience;
stress testing;
failure handling;
degradation monitoring.

31. Control `EUAI-CTRL-SEC-001`

Name: AI Cybersecurity Mapped Requirements:

Article 15;
applicable high-risk cybersecurity requirements;
GPAI safety/security obligations where applicable.

Relationship: DIRECT / CRITICAL Activities:

threat modeling;
vulnerability management;
secure development;
adversarial testing;
data/model protection;
incident response.

32. Control `EUAI-CTRL-QMS-001`

Name: AI Quality Management Governance Mapped Requirement:

Article 17.

Relationship: DIRECT / SUPPORTING Objective: Provide governance mechanisms supporting the applicable statutory quality-management system. Activities:

documented procedures;
roles;
design governance;
testing;
data governance;
risk;
documentation;
corrective action.

AIGO should not state that this control alone constitutes the statutory QMS.

33. Control `EUAI-CTRL-QMS-002`

Name: Quality-System Change Governance Objective: Ensure material AI-system changes trigger review of the quality-management system and supporting documentation. Relationship: SUPPORTING

34. Control `EUAI-CTRL-CONF-001`

Name: Conformity Applicability Determination Mapped Requirements:

Article 43;
Article 6;
relevant Annexes.

Relationship: DIRECT / CRITICAL Activities:

classify;
identify pathway;
determine internal vs third-party assessment;
identify notified-body requirement;
identify product-law interaction.

35. Control `EUAI-CTRL-CONF-002`

Name: Conformity Assessment Governance Objective: Coordinate the applicable conformity-assessment process. Activities:

assessment planning;
evidence;
technical documentation;
QMS;
assessment-body coordination;
findings;
corrective action;
closure.

Relationship: DIRECT

36. Control `EUAI-CTRL-CONF-003`

Name: Notified-Body Scope Verification Mapped Requirements:

Article 43;
Article 30;
Annex XIV where applicable.

Relationship: DIRECT / CRITICAL Activities:

verify authorization;
verify notification;
verify scope;
map system category;
map Annex XIV code;
verify current status.

37. Control `EUAI-CTRL-CONF-004`

Name: Conformity Certificate Control Mapped Requirement:

applicable Article 44 / conformity provisions.

Relationship: DIRECT / CONDITIONAL Evidence:

certificate;
issuer;
scope;
system version;
validity;
surveillance.

38. Control `EUAI-CTRL-CONF-005`

Name: EU Declaration of Conformity Governance Mapped Requirement:

Article 47;
Annex V.

Relationship: DIRECT / CONDITIONAL Objective: Ensure required declarations are prepared, signed, controlled, maintained, and linked to the applicable conformity evidence.

39. Control `EUAI-CTRL-CONF-006`

Name: CE Marking Governance Mapped Requirement:

Article 48 and applicable conformity framework.

Relationship: DIRECT / CONDITIONAL Evidence:

applicability;
marking;
declaration;
conformity evidence.

40. Control `EUAI-CTRL-REG-001`

Name: AI Act Registration Governance Mapped Requirement:

Article 49;
applicable registration Annexes.

Relationship: DIRECT / CONDITIONAL Activities:

applicability;
data preparation;
submission;
identifier;
update;
evidence.

41. Control `EUAI-CTRL-GPAI-001`

Name: GPAI Applicability Determination Mapped Requirements:

GPAI provisions.

Relationship: DIRECT Activities:

determine GPAI status;
determine provider role;
identify significant modification;
determine systemic risk;
identify applicable exemptions.

42. Control `EUAI-CTRL-GPAI-002`

Name: GPAI Technical Documentation Mapped Requirement: Applicable GPAI documentation requirements. Relationship: DIRECT Evidence:

model documentation;
evaluation;
training information;
version;
changes.

43. Control `EUAI-CTRL-GPAI-003`

Name: Downstream Provider Information Mapped Requirement: Applicable GPAI downstream-information obligations. Relationship: DIRECT / CONDITIONAL Activities:

information package;
versioning;
release;
update;
recipient traceability.

44. Control `EUAI-CTRL-GPAI-004`

Name: GPAI Copyright Governance Mapped Requirement: Applicable copyright-policy obligations. Relationship: DIRECT Evidence:

copyright policy;
implementation;
review.

45. Control `EUAI-CTRL-GPAI-005`

Name: GPAI Training-Content Summary Mapped Requirement: Applicable training-content-summary obligation. Relationship: DIRECT Evidence:

public summary;
version;
source;
review;
publication.

46. Control `EUAI-CTRL-GPAI-006`

Name: GPAI Systemic-Risk Governance Mapped Requirement: Applicable systemic-risk provisions. Relationship: DIRECT / CRITICAL Activities:

systemic-risk assessment;
notification;
safety;
security;
evaluations;
monitoring;
incident handling.

47. Control `EUAI-CTRL-GPAI-007`

Name: GPAI Safety and Security Framework Mapped Requirement: Applicable systemic-risk safety/security obligations. Relationship: DIRECT / CRITICAL Activities:

safety framework;
security framework;
red teaming;
evaluation;
mitigation;
monitoring.

48. Control `EUAI-CTRL-GPAI-008`

Name: GPAI Regulatory Submission Mapped Requirements: Applicable AI Office notification and submission provisions. Relationship: DIRECT / CONDITIONAL Activities:

prepare;
review;
approve;
submit;
retain;
follow up.

49. Control `EUAI-CTRL-LIT-001`

Name: AI Literacy Governance Mapped Requirement:

Article 4.

Relationship: DIRECT Activities:

identify relevant people;
assess context;
define measures;
deliver measures;
retain evidence;
review.

The amended Article 4 emphasizes measures supporting AI literacy and does not require providers/deployers to guarantee a specific level for each individual. The control should therefore remain contextual and proportionate.

50. Control `EUAI-CTRL-LIT-002`

Name: Role-Based AI Literacy Mapped Requirements:

Article 4;
related human-oversight obligations.

Relationship: DIRECT / SUPPORTING Activities:

role analysis;
system-context analysis;
learning needs;
targeted measures;
evidence.

51. Control `EUAI-CTRL-FR-001`

Name: Fundamental-Rights Impact Governance Mapped Requirement:

Article 27 where applicable;
related rights protections.

Relationship: DIRECT / CONDITIONAL / CRITICAL Activities:

identify affected persons;
rights analysis;
impact assessment;
mitigation;
residual impact;
monitoring.

52. Control `EUAI-CTRL-FR-002`

Name: Rights and Bias Monitoring Mapped Requirements:

applicable fundamental-rights and anti-bias provisions.

Relationship: DIRECT / SUPPORTING Activities:

bias detection;
disparity monitoring;
rights indicators;
complaints;
remediation.

53. Control `EUAI-CTRL-FR-003`

Name: AI Rights Complaint Management Mapped Requirements:

applicable complaints and rights provisions;
Article 85 where relevant;
Article 86 where relevant.

Relationship: DIRECT / CONDITIONAL Activities:

complaint intake;
jurisdiction;
investigation;
response;
remediation;
regulatory escalation.

54. Control `EUAI-CTRL-FR-004`

Name: AI-Assisted Decision Human Review Mapped Requirements:

applicable human-oversight and decision-information requirements.

Relationship: DIRECT / CONDITIONAL Activities:

human review;
evidence review;
challenge;
decision;
communication.

55. Control `EUAI-CTRL-MON-001`

Name: High-Risk AI Lifecycle Monitoring Mapped Requirements:

Articles 9, 12, 15;
applicable monitoring obligations.

Relationship: DIRECT Activities:

performance;
robustness;
security;
incidents;
risk;
changes;
human oversight.

56. Control `EUAI-CTRL-MON-002`

Name: Post-Market AI Monitoring Mapped Requirements:

applicable post-market monitoring provisions;
Annex-related requirements.

Relationship: DIRECT / CONDITIONAL Activities:

collect performance information;
identify incidents;
corrective action;
maintain records;
reassessment.

57. Control `EUAI-CTRL-INC-001`

Name: Serious AI Incident Management Mapped Requirements:

applicable AI Act incident provisions.

Relationship: DIRECT / CRITICAL Activities:

detection;
classification;
containment;
investigation;
reporting determination;
evidence;
corrective action;
follow-up.

58. Control `EUAI-CTRL-INC-002`

Name: Regulatory Incident Escalation Objective: Ensure potential statutory incidents are evaluated for external notification. Relationship: DIRECT / CONDITIONAL Activities:

legal review;
authority identification;
notification decision;
submission;
evidence.

59. Control `EUAI-CTRL-CHG-001`

Name: AI Act Regulatory Change Assessment Mapped Requirements: All applicable provisions where material changes can affect regulatory applicability. Relationship: DIRECT Activities:

change intake;
legal impact;
classification impact;
controls;
documentation;
conformity;
registration;
evidence;
approval.

60. Control `EUAI-CTRL-CHG-002`

Name: Significant-Change Assessment Mapped Requirement:

applicable Article 111 transition and significant-change provisions.

Relationship: DIRECT / CRITICAL Activities:

original system status;
change analysis;
significant-change determination;
legal consequences;
reassessment.

61. Control `EUAI-CTRL-AUTH-001`

Name: Regulatory Authority Register Mapped Requirements:

governance and supervisory provisions.

Relationship: SUPPORTING Activities:

identify authority;
jurisdiction;
competence;
contact;
source;
review.

62. Control `EUAI-CTRL-AUTH-002`

Name: Regulatory Information Request Management Mapped Requirements:

applicable supervisory powers.

Relationship: DIRECT / CONDITIONAL Activities:

request intake;
authenticity verification;
scope;
evidence;
review;
response;
follow-up.

63. Control `EUAI-CTRL-AUTH-003`

Name: Regulatory Inspection and Investigation Response Mapped Requirements:

applicable market-surveillance and AI Office investigative powers.

Relationship: DIRECT / CONDITIONAL Activities:

inspection readiness;
evidence preservation;
response team;
legal review;
authority coordination;
findings;
remediation.

The 2026 amendment introduced more detailed AI Office supervisory powers, including information requests and inspections for AI systems within its competence.

64. Control `EUAI-CTRL-AUTH-004`

Name: Regulatory Commitment Management Mapped Requirements:

applicable AI Office commitment mechanisms.

Relationship: DIRECT / CONDITIONAL Activities:

commitment record;
owner;
deadline;
evidence;
verification;
closure.

65. Control `EUAI-CTRL-AUTH-005`

Name: Regulatory Enforcement Event Management Mapped Requirements:

applicable enforcement and penalty provisions.

Relationship: DIRECT / CRITICAL Activities:

regulatory finding;
penalty;
corrective action;
management escalation;
response;
evidence;
assurance.

66. Control `EUAI-CTRL-EVD-001`

Name: EU AI Act Evidence Management Objective: Ensure evidence relating to AI Act obligations is attributable, current, traceable, protected, and retained. Relationship: SUPPORTING / CROSS-CUTTING Evidence Types:

assessments;
approvals;
technical documentation;
logs;
monitoring;
incidents;
conformity;
registrations;
regulatory communications;
assurance.

67. Control `EUAI-CTRL-EVD-002`

Name: EU AI Act Evidence Integrity Objective: Protect the integrity of evidence used to demonstrate governance and regulatory implementation. Activities:

metadata;
versioning;
timestamps;
checksum where appropriate;
access control;
retention.

68. Control `EUAI-CTRL-ASSR-001`

Name: EU AI Act Governance Assurance Objective: Provide objective assessment of applicable AIGO controls and evidence. Relationship: SUPPORTING Assurance Areas:

classification;
risk;
controls;
documentation;
evidence;
monitoring;
incidents;
regulatory interaction.

69. Control `EUAI-CTRL-ASSR-002`

Name: High-Risk AI Independent Assurance Mapped Requirements: Applicable high-risk governance requirements. Relationship: SUPPORTING / CONDITIONAL Objective: Provide enhanced assurance where risk, impact, or regulatory significance warrants it.

70. Control `EUAI-CTRL-IMP-001`

Name: Regulatory Corrective Action Mapped Requirements: Applicable AI Act corrective-action obligations. Relationship: DIRECT Activities:

finding;
root cause;
corrective action;
owner;
deadline;
verification;
closure.

71. Control `EUAI-CTRL-IMP-002`

Name: EU AI Act Continuous Improvement Objective: Translate incidents, regulatory changes, assurance findings, and evidence gaps into controlled improvements. Relationship: SUPPORTING

72. Control `EUAI-CTRL-RET-001`

Name: AI Regulatory Retirement Governance Mapped Requirements: Applicable continuing obligations after system retirement. Relationship: SUPPORTING / CONDITIONAL Activities:

record retention;
regulatory evidence;
certificate history;
registration;
incidents;
post-market obligations;
closure.

73. Control `EUAI-CTRL-TPG-001`

Name: AI Provider and Supplier Regulatory Due Diligence Mapped Requirements: Applicable provider, importer, distributor, and downstream governance requirements. Relationship: DIRECT / CONDITIONAL Activities:

role determination;
supplier assessment;
documentation;
incident obligations;
change notification;
contract requirements;
evidence.

74. Control `EUAI-CTRL-TPG-002`

Name: GPAI Supplier Governance Mapped Requirements: Applicable GPAI downstream-provider requirements. Relationship: DIRECT / CONDITIONAL Activities:

provider status;
model version;
technical documentation;
downstream information;
safety/security;
incident notification;
changes.

75. Control `EUAI-CTRL-APP-002`

Name: Regulatory Timeline Applicability Mapped Requirement:

Article 111;
Article 113;
related transitional rules.

Relationship: DIRECT Activities:

application date;
transition;
actor;
AI category;
significant change;
public-authority status.

The authoritative operational timeline is maintained in: 11-AIGO-EU-AI-Act-Applicability-and-Timeline-v0.1.md

76. Control `EUAI-CTRL-APP-003`

Name: Early-Readiness Governance Objective: Allow future AI Act requirements to be implemented before their statutory application date while clearly distinguishing legal status from internal implementation status. Relationship: SUPPORTING

77. Control `EUAI-CTRL-APP-004`

Name: Transitional-System Governance Objective: Manage AI systems subject to transitional provisions. Activities:

historical market date;
original version;
current version;
significant-change assessment;
transition deadline;
evidence.

78. Control `EUAI-CTRL-CONF-007`

Name: Annex XIV Conformity-Body Coding Mapped Requirement:

Annex XIV.

Relationship: DIRECT / CONDITIONAL Activities:

determine AI-system type;
assign relevant code where applicable;
verify conformity-body scope;
maintain evidence.

79. Control `EUAI-CTRL-REG-002`

Name: Registration Data Consistency Objective: Ensure information submitted to EU registration systems matches authoritative AIGO records. Relationship: SUPPORTING / CRITICAL Checks:

system ID;
provider;
intended purpose;
classification;
version;
registration status.

80. Control `EUAI-CTRL-DOC-003`

Name: EU AI Act Document Consistency Objective: Prevent contradictions among regulatory documentation. Relationships:

AI System Profile;
Risk;
Classification;
Technical Documentation;
Declaration;
Certificate;
Registration;
Monitoring.

Relationship: SUPPORTING / CROSS-CUTTING

81. Control `EUAI-CTRL-TRANS-007`

Name: Transparency Transition Governance Objective: Manage transitional Article 50 obligations for eligible pre-existing systems. Relationship: DIRECT / CONDITIONAL Activities:

market-placement date;
system type;
transition eligibility;
deadline;
implementation;
evidence.

82. Control `EUAI-CTRL-FR-005`

Name: Fundamental-Rights Change Impact Assessment Objective: Ensure material AI changes are reviewed for rights impact. Relationship: DIRECT / CONDITIONAL Triggers:

new affected population;
new purpose;
new decision authority;
new data;
new model;
new deployment context.

83. Control `EUAI-CTRL-GOV-001`

Name: AI Act Regulatory Governance Objective: Maintain accountability for EU AI Act implementation. Relationship: DIRECT / CROSS-CUTTING Activities:

assign owners;
define accountability;
approve policy;
review regulatory change;
monitor compliance;
report to management.

84. Control `EUAI-CTRL-GOV-002`

Name: AI Act Management Review Mapped Requirements: Supporting requirements concerning governance, monitoring, corrective action, and accountability. Relationship: SUPPORTING Inputs:

regulatory changes;
control coverage;
evidence coverage;
incidents;
assurance;
complaints;
upcoming dates;
supplier issues.

85. Control `EUAI-CTRL-GOV-003`

Name: AI Act Legal / Compliance Review Objective: Provide formal review of material legal interpretations and applicability decisions. Relationship: SUPPORTING / CRITICAL Triggers:

Article 5 uncertainty;
high-risk classification uncertainty;
conformity-path uncertainty;
systemic-risk GPAI determination;
rights impact;
major regulatory change.

86. Control `EUAI-CTRL-GOV-004`

Name: Regulatory Source Currency Objective: Ensure legal and official implementation sources are current. Activities:

source monitoring;
source review;
version;
amendment identification;
mapping updates.

Relationship: SUPPORTING / CROSS-CUTTING

87. Control `EUAI-CTRL-INC-003`

Name: Rights-Impact Incident Escalation Mapped Areas:

fundamental-rights governance;
complaints;
monitoring;
high-risk AI.

Relationship: DIRECT / CONDITIONAL

88. Control `EUAI-CTRL-INC-004`

Name: Transparency Incident Escalation Mapped Areas:

Article 50.

Relationship: DIRECT / CONDITIONAL Potential events:

missing disclosure;
broken marking;
unlabeled deepfake;
incorrect biometric notification.

89. Control `EUAI-CTRL-INC-005`

Name: GPAI Serious-Incident Escalation Mapped Areas:

GPAI serious incidents;
AI Office interaction.

Relationship: DIRECT / CONDITIONAL

90. Control `EUAI-CTRL-CHG-003`

Name: Regulatory Documentation Impact Objective: Ensure legal changes create updates to:

policies;
procedures;
templates;
schemas;
mappings;
controls.

Relationship: SUPPORTING / CROSS-CUTTING

91. Control `EUAI-CTRL-CHG-004`

Name: Conformity-Impact Change Assessment Mapped Areas:

high-risk AI;
conformity;
declarations;
certificates;
registration.

Relationship: DIRECT / CONDITIONAL

92. Control `EUAI-CTRL-CHG-005`

Name: GPAI Model Change Assessment Mapped Areas:

GPAI;
systemic risk;
significant modification.

Relationship: DIRECT / CONDITIONAL

93. Control `EUAI-CTRL-RET-002`

Name: Regulatory Record Retention Mapped Areas:

evidence;
conformity;
registration;
incidents;
regulatory interaction.

Relationship: DIRECT / SUPPORTING The retention period must come from the applicable legal and organizational requirements rather than a universal AIGO value.

94. Control `EUAI-CTRL-ASSR-003`

Name: Regulatory Evidence Readiness Assurance Objective: Assess whether the organization can demonstrate relevant implementation through authoritative evidence. Relationship: SUPPORTING

95. EU AI Act Master Control Matrix

AIGO Control Domain	Principal EU AI Act Areas
Applicability	Article 2, Article 6, GPAI, Article 50, transitions
Governance	Articles 64–68, accountability
Classification	Article 6, Annex I, Annex III
Prohibited Practices	Article 5
Risk	Article 9
Data	Article 10
Documentation	Article 11, Annex IV
Record Keeping	Article 12
Transparency	Article 50
Human Oversight	Article 14
Performance	Article 15
Robustness	Article 15
Cybersecurity	Article 15 / GPAI security
Quality	Article 17
Conformity	Articles 43–48
Registration	Article 49
GPAI	Articles 51–56 and related provisions
AI Literacy	Article 4
Fundamental Rights	Article 27 and related rights provisions
Monitoring	Post-market / lifecycle monitoring
Incident	Serious incidents and corrective action
Change	Significant changes / lifecycle changes
Authority	AI Office / national authorities
Evidence	Cross-cutting
Assurance	Cross-cutting
Improvement	Corrective action / continual improvement
Retirement	Continuing records / lifecycle closure

96. Control-to-AIGO Artifact Mapping

Control Area	Schema	Template / Artifact
Applicability	Assessment	AI Classification / Assessment
Classification	AI System / Assessment	AI Classification
Prohibited Practices	Assessment	Approval / Assessment
Risk	Risk	AI Risk Assessment
Data	Control / Assessment	Data Governance evidence
Documentation	Evidence	Technical Documentation
Record Keeping	Evidence	Evidence Record
Transparency	Control / Evidence	AI System Profile / Evidence
Human Oversight	Control	AI System Profile / Training evidence
Conformity	Assessment / Assurance	Conformity evidence
Registration	AI System / Evidence	Registration record
GPAI	AI System / Risk / Evidence	GPAI documentation
AI Literacy	Assessment / Evidence	Learning records
Rights	Risk / Assessment / Evidence	Rights assessment
Monitoring	Monitoring	Monitoring Template
Incident	Incident	Incident Template
Change	Change	Change Management Template
Assurance	Assurance	Assurance Template
Improvement	Improvement	Continuous Improvement Template
Retirement	Retirement	Retirement Template

97. Control Priority Levels

Each mapped control should have an AIGO priority:

CRITICAL
HIGH
MEDIUM
LOW
INFORMATIONAL

Criticality should depend on:

legal significance;
impact;
safety;
fundamental rights;
regulatory exposure;
likelihood of material harm.

98. Critical Control Examples

The following will normally warrant critical treatment where applicable:

EUAI-CTRL-PROH-001
EUAI-CTRL-RISK-001
EUAI-CTRL-DATA-001
EUAI-CTRL-DOC-001
EUAI-CTRL-HUM-001
EUAI-CTRL-SEC-001
EUAI-CTRL-GPAI-006
EUAI-CTRL-CONF-001
EUAI-CTRL-CONF-003
EUAI-CTRL-INC-001
EUAI-CTRL-FR-001

Criticality should be adjusted for system and legal applicability.

99. Control Applicability

A control should never be considered mandatory merely because it appears in this mapping. A control may be:

APPLICABLE
CONDITIONAL
NOT_APPLICABLE
FUTURE_APPLICABLE
TRANSITIONAL

The applicability determination should be documented.

100. Control Implementation Status

An operational implementation status should be separate:

NOT_IMPLEMENTED
PLANNED
IMPLEMENTED
IMPLEMENTED_EARLY
PARTIALLY_IMPLEMENTED
EVIDENCED
ASSESSED
ASSURED

101. Control Effectiveness

Control existence is distinct from effectiveness. Recommended model:

CONTROL_DEFINED
      ↓
CONTROL_IMPLEMENTED
      ↓
CONTROL_OPERATING
      ↓
CONTROL_TESTED
      ↓
CONTROL_EFFECTIVE

The final effectiveness judgment requires evidence and assessment.

102. Control Evidence

Each control should have defined evidence types. Example:

Control:
EUAI-CTRL-PROH-001

Evidence:
- applicability assessment
- Article 5 screening
- intended-purpose statement
- legal review
- approval decision

103. Control Monitoring

Each material control should have monitoring indicators. Example:

Control:
EUAI-CTRL-TRANS-002

Indicators:
- marking coverage
- detection success
- failure incidents
- content samples
- system changes

104. Control Assurance

Material controls should be linked to assurance activities. Example:

Control
 ↓
Evidence
 ↓
Testing
 ↓
Assurance
 ↓
Finding
 ↓
Improvement

105. Control Exceptions

A control exception must identify:

control;
legal requirement;
reason;
risk;
compensating measure;
authority;
expiry;
review.

AIGO risk acceptance cannot authorize conduct prohibited by law.

106. Control Coverage

A future EU AI Act Control Coverage report should calculate:

Applicable Controls
        ↓
Controls Defined
        ↓
Controls Implemented
        ↓
Controls Evidenced
        ↓
Controls Assessed
        ↓
Controls Assured

The report should separately display critical gaps.

107. Evidence Coverage

The EU AI Act Evidence Coverage Validator should use this mapping to determine:

evidence required;
evidence available;
evidence current;
evidence valid;
evidence reviewed.

108. Traceability Coverage

Each material legal requirement should be traceable to:

Requirement
 ↓
Control
 ↓
Assessment
 ↓
Evidence
 ↓
Monitoring
 ↓
Assurance

Broken chains should be findings.

109. Regulatory Source Traceability

Every control mapping should identify:

legal instrument;
article;
paragraph where applicable;
Annex;
amendment;
source version.

This prevents generic references such as “AI Act compliance” from becoming the only traceability record.

110. Current Amendment Rule

Where Regulation (EU) 2026/1744 changes a requirement, the control mapping shall:

identify the amended requirement;
identify the affected control;
identify the effective date;
identify transition;
update evidence requirements;
update procedures if needed;
revalidate the mapping.

Regulation (EU) 2026/1744 is the current amendment baseline for this version.

111. Timeline Integration

The control applicability engine shall reference: 11-AIGO-EU-AI-Act-Applicability-and-Timeline-v0.1.md Controls must support:

CURRENTLY_APPLICABLE
FUTURE_APPLICABLE
TRANSITIONAL
IMPLEMENTED_EARLY

112. High-Risk Timeline Integration

The control engine should distinguish:

Article 6(2) / Annex III
→ 2 December 2027

Article 6(1) / Annex I
→ 2 August 2028

These dates must not be collapsed into a single high-risk deadline.

113. Control and Public-Authority Transition

The engine should support the public-authority high-risk transition through:

PUBLIC_AUTHORITY_USE
+
HIGH_RISK
+
Article 111 transition
=
Applicable transition logic

The exact legal result must be determined from the current provision.

114. Control and Significant Change

Controls must support regulatory reactivation after material change. Example:

Pre-existing High-Risk System
        ↓
Significant Change
        ↓
Chapter III applicability assessment
        ↓
Controls activated

115. Control and Article 50 Transition

For eligible pre-existing synthetic-content systems, transparency marking controls should record:

market date;
transition eligibility;
deadline;
implementation;
evidence.

116. GPAI Control Timeline

GPAI controls should be treated as current from: 2 August 2025 subject to transitional treatment for pre-existing models and the specific obligations involved.

117. AI Literacy Control Timeline

AI literacy controls should be treated as currently applicable from: 2 February 2025 with the amended Article 4 context reflected in the control design.

118. Governance Control Timeline

Governance controls are currently applicable according to the AI Act’s staged application framework. AIGO should not defer governance implementation until high-risk application dates.

119. Control Governance

Each control should have:

control owner;
control objective;
applicability;
operating procedure;
frequency;
evidence;
monitoring;
escalation;
assurance;
change trigger;
exception process.

120. Control Owner Model

Recommended ownership fields:

ACCOUNTABLE_OWNER
CONTROL_OWNER
OPERATIONAL_OWNER
LEGAL_REVIEWER
EVIDENCE_OWNER
ASSURANCE_OWNER

Not every control requires different people in every field.

121. Control Frequency

Possible values:

CONTINUOUS
PER_TRANSACTION
PER_SYSTEM
PER_CHANGE
QUARTERLY
SEMI_ANNUAL
ANNUAL
EVENT_DRIVEN

The frequency should be based on risk and legal requirements.

122. Control Operating Model

A control specification should include:

Objective
Scope
Applicability
Owner
Frequency
Procedure
Inputs
Outputs
Evidence
Monitoring
Escalation
Exception
Assurance
Review

123. Control Failure

A control failure should create a finding. Potential lifecycle:

Control Failure
   ↓
Incident / Finding
   ↓
Risk
   ↓
Corrective Action
   ↓
Change
   ↓
Retest
   ↓
Evidence
   ↓
Assurance

124. Control Effectiveness Evidence

Control effectiveness should be supported by:

testing;
operating records;
monitoring;
evidence;
assurance.

Policy existence alone is insufficient.

125. Cross-Control Dependencies

Many controls depend on others. Examples:

Applicability
   ↓
Classification
   ↓
High-Risk Controls

Classification
   ↓
Conformity
   ↓
Registration

Incident
   ↓
Change
   ↓
Documentation

GPAI Classification
   ↓
Systemic Risk
   ↓
Safety / Security
   ↓
Regulatory Submission

126. Control Dependency Validation

The Reference Validator should verify that:

mapped control IDs exist;
dependent controls resolve;
referenced schemas exist;
referenced templates exist.

127. Control Consistency Validation

The Framework Consistency Checker should verify that:

the same control is not described differently in multiple mappings;
control names are consistent;
AIGO control IDs remain stable;
legal sources are consistent;
applicability logic is consistent.

128. Control Documentation Integrity

The Document Integrity Checker should ensure the control-mapping document remains:

complete;
readable;
correctly versioned;
structurally consistent;
linked to the registry.

129. Control Repository Health

The Repository Health Checker should report:

missing controls;
duplicate control IDs;
orphaned controls;
controls without evidence;
critical control gaps;
stale regulatory mappings.

130. Control Mapping Findings

Potential findings include:

CONTROL_MAPPING_MISSING
CONTROL_REFERENCE_INVALID
CONTROL_OWNER_MISSING
CONTROL_APPLICABILITY_UNRESOLVED
CONTROL_EVIDENCE_MISSING
CONTROL_MONITORING_MISSING
CONTROL_ASSURANCE_MISSING
CONTROL_DEPENDENCY_BROKEN
CONTROL_VERSION_CONFLICT
CRITICAL_CONTROL_GAP
REGULATORY_CONTROL_OUTDATED

131. Control Mapping Quality Criteria

A high-quality EU AI Act control mapping should be:

source-traceable;
applicability-aware;
operational;
testable;
evidence-linked;
monitorable;
assurability-aware;
version-controlled;
aligned with AIGO schemas;
aligned with the central timeline.

132. Control Coverage Metrics

Potential metrics:

Metric	Purpose
Applicable Controls	Scope
Controls Defined	Design coverage
Controls Implemented	Implementation
Controls Evidenced	Evidence coverage
Controls Assessed	Assessment
Controls Assured	Assurance
Critical Control Gaps	Risk
Overdue Control Reviews	Governance
Stale Mappings	Regulatory currency

133. Control Mapping Release Gate

Before approval of this control mapping, verify:

Legal Sources Current
Control IDs Valid
Control Owners Defined
Applicability Logic Defined
Timeline References Current
Evidence Links Defined
Monitoring Links Defined
Assurance Links Defined
Critical Controls Identified
Cross-References Valid
Registry Updated

134. Relationship to Main Mapping

This document provides detailed control relationships. The master mapping: 01-AIGO-EU-AI-Act-Mapping-v0.1.md provides the high-level legal-to-AIGO crosswalk. The two documents should remain consistent.

135. Relationship to Prohibited-Practice Mapping

The prohibited-practice mapping is authoritative for detailed Article 5 categories. This document maps those requirements to controls.

136. Relationship to High-Risk Mapping

The high-risk mapping is authoritative for detailed Article 6 and Chapter III analysis. This document translates the resulting requirements into controls.

137. Relationship to Transparency Mapping

The transparency mapping is authoritative for detailed Article 50 analysis. This document provides Article 50 control implementations.

138. Relationship to GPAI Mapping

The GPAI mapping is authoritative for detailed GPAI requirements. This document provides GPAI controls.

139. Relationship to Rights Mapping

The Rights and Remedies mapping is authoritative for detailed rights and remedy analysis. This document provides corresponding controls.

140. Relationship to Conformity Mapping

The Conformity and Documentation mapping is authoritative for conformity procedures and documentation analysis. This document provides the corresponding operational controls.

141. Relationship to Annex Mapping

The Annex mapping is authoritative for Annex-specific relationships. This document maps the relevant Annex requirements to controls.

142. Relationship to Timeline Mapping

The Applicability and Timeline mapping is the authoritative timeline source. This document must not establish independent competing deadlines.

143. Relationship to Evidence and Assurance

The Evidence and Assurance mapping should define how the control evidence is retained and how controls are assured. The detailed mapping file: 13-AIGO-EU-AI-Act-Evidence-and-Assurance-Mapping-v0.1.md will provide that layer.

144. Machine-Readable Future Model

A future control mapping schema may represent:

{
  "mappingId": "EUAI-CTRL-RISK-001",
  "legalSource": {
    "instrument": "Regulation (EU) 2024/1689",
    "article": "9"
  },
  "relationship": "DIRECT",
  "aigoControlId": "AIGO-CTRL-...",
  "applicability": "CONDITIONAL",
  "priority": "CRITICAL",
  "evidence": [],
  "monitoring": [],
  "assurance": [],
  "status": "MAPPED"
}

The future machine-readable schema should use the existing AIGO Control Schema rather than creating an uncontrolled parallel control definition.

145. Control Mapping Registry Requirements

The mapping registry should ultimately record:

mappingId
legalSource
article
paragraph
annex
relationship
aigoControlId
applicability
priority
implementationStatus
evidenceRequirements
monitoringRequirements
assuranceRequirements
effectiveDate
transition
reviewStatus

146. Legal Compliance Boundary

This mapping establishes:

which AIGO control is intended to address the mapped requirement.

It does not establish:

that the organization complies with the requirement.

That determination requires:

applicable-law analysis;
factual evidence;
control implementation;
operating effectiveness;
assurance;
and, where relevant, statutory conformity or regulatory determination.

147. Control Exceptions and Risk Acceptance

AIGO risk acceptance cannot authorize conduct that is prohibited by applicable law. For lawful but risky activities, an organization may use its approved risk-acceptance process where permitted. The control mapping should therefore distinguish:

LEGAL_PROHIBITION

from:

RESIDUAL_ORGANIZATIONAL_RISK

148. Control Review Frequency

Controls should be reviewed:

at least annually;
after legal changes;
after material incidents;
after major AI-system changes;
after material assurance findings;
when control effectiveness is questioned.

149. Regulatory Change Review

A control mapping should be reviewed after:

AI Act amendments;
delegated acts;
implementing acts;
Commission guidance;
AI Office guidance;
AI Board recommendations;
standards affecting implementation.

Regulation (EU) 2026/1744 is the current amendment baseline and must be monitored for implementation effects.

150. Control Mapping Governance

The control mapping should have:

Mapping Owner;
Legal/Compliance Reviewer;
AI Governance Owner;
Control Owner;
Evidence Owner;
Assurance Reviewer;
Framework Architect.

151. Control Mapping Assurance

An independent reviewer should verify, where appropriate:

legal-source accuracy;
completeness;
control suitability;
traceability;
evidence;
timeline;
criticality.

152. Control Mapping Improvement

Improvements should be generated from:

legal changes;
incidents;
assurance findings;
control failures;
evidence gaps;
implementation experience.

153. Control Mapping Retirement

A control mapping entry may be retired when:

legal requirement is repealed;
control is superseded;
AIGO architecture changes;
regulatory relationship is no longer applicable.

Historical mappings should remain recoverable.

154. Historical Control Mapping

A historical control mapping should preserve:

legal version;
control version;
applicability date;
status;
supersession reason.

This supports historical auditability.

155. Current Regulatory Baseline

This document’s legal baseline is:

Regulation (EU) 2024/1689
        +
Regulation (EU) 2026/1744

The 2026 amendment is the current amendment included in version 0.1 of this mapping.

156. Validation Requirements

The control mapping should pass:

Legal Validation

Every material control relationship has a legal source.

Reference Validation

AIGO control IDs resolve.

Applicability Validation

Conditional controls identify their conditions.

Timeline Validation

Dates reference the authoritative timeline.

Traceability Validation

Requirement → Control → Evidence chain exists.

Coverage Validation

Critical requirements are mapped.

Consistency Validation

Control names and IDs are consistent across the AIGO repository.

Document Integrity Validation

The mapping document and registry are structurally sound.

157. Limitations

This mapping cannot independently establish:

legal compliance;
control effectiveness;
statutory conformity;
validity of a regulatory interpretation;
adequacy of evidence;
adequacy of a notified body;
legality of a specific AI deployment.

Those determinations require appropriate factual, technical, legal, and assurance review.

158. Relationship to Repository Health

The Repository Health Checker should treat this mapping as a core cross-reference layer. Potential repository-health checks include:

Control Mapping Present
Control IDs Valid
Critical Requirements Covered
Evidence Relationships Present
Timeline Relationships Present
No Orphaned Controls
No Duplicate Mapping IDs
No Stale Legal Source

159. Final Control-Mapping Lifecycle

The intended AIGO control lifecycle is:

Legal Requirement
      ↓
Applicability
      ↓
Control Mapping
      ↓
Control Definition
      ↓
Implementation
      ↓
Evidence
      ↓
Monitoring
      ↓
Assessment
      ↓
Assurance
      ↓
Finding
      ↓
Improvement
      ↓
Revalidation

160. Document Control

Field	Value
Document	AIGO EU AI Act AIGO Control Mapping
Version	0.1
Status	Draft
Document Identifier	`AIGO-MAP-EUAI-012`
Document Type	EU AI Act Mapping
Primary Purpose	Requirement-to-control crosswalk
Primary Legal Instrument	Regulation (EU) 2024/1689
Amendment Baseline	Regulation (EU) 2026/1744
Owner
Legal/Compliance Reviewer
Governance Reviewer
Control Reviewer
Framework Architect
Approved By
Effective Date
Next Review Date

161. Document Status

Document: AIGO — EU AI Act AIGO Control Mapping Version: 0.1 Status: Draft Working Name: AIGO Full Name: AI Governance Operating Framework Document Identifier: AIGO-MAP-EUAI-012 Document Type: EU AI Act Mapping This document establishes the detailed control-level crosswalk between the EU AI Act and the AIGO AI Governance Operating Framework, including applicability, classification, prohibited practices, risk, data, documentation, record keeping, transparency, human oversight, performance, robustness, cybersecurity, quality, conformity, registration, GPAI, AI literacy, fundamental rights, monitoring, incidents, change management, regulatory interaction, evidence, assurance, improvement, and retirement. End of Document

​AIGO — EU AI Act AIGO Control Mapping

​1. Document Purpose

​2. Mapping Information

​3. Control Mapping Principle

​4. Source Hierarchy

​Tier 1 — Binding Law

​Tier 2 — Official Implementation Material

​Tier 3 — AIGO Control Interpretation

​5. Control Relationship Types

​5.1 DIRECT

​5.2 PARTIAL

​5.3 SUPPORTING

​5.4 CONDITIONAL

​5.5 NO_DIRECT_AIGO_EQUIVALENT

​6. Control Status

​7. Control Identifier Convention

​8. Master Control Domains

​9. Control Architecture

​10. Control Mapping — Applicability

​Control EUAI-CTRL-APP-001

​11. Control EUAI-CTRL-CLS-001

​12. Control EUAI-CTRL-PROH-001

​13. Control EUAI-CTRL-PROH-002

​14. Control EUAI-CTRL-RISK-001

​15. Control EUAI-CTRL-DATA-001

​16. Control EUAI-CTRL-DATA-002

​17. Control EUAI-CTRL-DOC-001

​18. Control EUAI-CTRL-DOC-002

​19. Control EUAI-CTRL-REC-001

​20. Control EUAI-CTRL-REC-002

​21. Control EUAI-CTRL-TRANS-001

​22. Control EUAI-CTRL-TRANS-002

​23. Control EUAI-CTRL-TRANS-003

​24. Control EUAI-CTRL-TRANS-004

​25. Control EUAI-CTRL-TRANS-005

​26. Control EUAI-CTRL-TRANS-006

​27. Control EUAI-CTRL-HUM-001

​28. Control EUAI-CTRL-HUM-002

​29. Control EUAI-CTRL-PERF-001

​30. Control EUAI-CTRL-ROB-001

​31. Control EUAI-CTRL-SEC-001

​32. Control EUAI-CTRL-QMS-001

​33. Control EUAI-CTRL-QMS-002

​34. Control EUAI-CTRL-CONF-001

​35. Control EUAI-CTRL-CONF-002

​36. Control EUAI-CTRL-CONF-003

​37. Control EUAI-CTRL-CONF-004

​38. Control EUAI-CTRL-CONF-005

​39. Control EUAI-CTRL-CONF-006

​40. Control EUAI-CTRL-REG-001

​41. Control EUAI-CTRL-GPAI-001

​42. Control EUAI-CTRL-GPAI-002

​43. Control EUAI-CTRL-GPAI-003

​44. Control EUAI-CTRL-GPAI-004

​45. Control EUAI-CTRL-GPAI-005

​46. Control EUAI-CTRL-GPAI-006

​47. Control EUAI-CTRL-GPAI-007

​48. Control EUAI-CTRL-GPAI-008

​49. Control EUAI-CTRL-LIT-001

​50. Control EUAI-CTRL-LIT-002

​51. Control EUAI-CTRL-FR-001

​52. Control EUAI-CTRL-FR-002

​53. Control EUAI-CTRL-FR-003

​54. Control EUAI-CTRL-FR-004

​55. Control EUAI-CTRL-MON-001

​56. Control EUAI-CTRL-MON-002

​57. Control EUAI-CTRL-INC-001

​58. Control EUAI-CTRL-INC-002

​59. Control EUAI-CTRL-CHG-001

​60. Control EUAI-CTRL-CHG-002

​61. Control EUAI-CTRL-AUTH-001

​62. Control EUAI-CTRL-AUTH-002

​63. Control EUAI-CTRL-AUTH-003

​64. Control EUAI-CTRL-AUTH-004

​65. Control EUAI-CTRL-AUTH-005

​66. Control EUAI-CTRL-EVD-001

​67. Control EUAI-CTRL-EVD-002

​68. Control EUAI-CTRL-ASSR-001

​69. Control EUAI-CTRL-ASSR-002

​70. Control EUAI-CTRL-IMP-001

AIGO — EU AI Act AIGO Control Mapping

1. Document Purpose

2. Mapping Information

3. Control Mapping Principle

4. Source Hierarchy

Tier 1 — Binding Law

Tier 2 — Official Implementation Material

Tier 3 — AIGO Control Interpretation

5. Control Relationship Types

5.1 DIRECT

5.2 PARTIAL

5.3 SUPPORTING

5.4 CONDITIONAL

5.5 NO_DIRECT_AIGO_EQUIVALENT

6. Control Status

7. Control Identifier Convention

8. Master Control Domains

9. Control Architecture

10. Control Mapping — Applicability

Control `EUAI-CTRL-APP-001`

11. Control `EUAI-CTRL-CLS-001`

12. Control `EUAI-CTRL-PROH-001`

13. Control `EUAI-CTRL-PROH-002`

14. Control `EUAI-CTRL-RISK-001`

15. Control `EUAI-CTRL-DATA-001`

16. Control `EUAI-CTRL-DATA-002`

17. Control `EUAI-CTRL-DOC-001`

18. Control `EUAI-CTRL-DOC-002`

19. Control `EUAI-CTRL-REC-001`

20. Control `EUAI-CTRL-REC-002`

21. Control `EUAI-CTRL-TRANS-001`

22. Control `EUAI-CTRL-TRANS-002`

23. Control `EUAI-CTRL-TRANS-003`

24. Control `EUAI-CTRL-TRANS-004`

25. Control `EUAI-CTRL-TRANS-005`

26. Control `EUAI-CTRL-TRANS-006`

27. Control `EUAI-CTRL-HUM-001`

28. Control `EUAI-CTRL-HUM-002`

29. Control `EUAI-CTRL-PERF-001`

30. Control `EUAI-CTRL-ROB-001`

31. Control `EUAI-CTRL-SEC-001`

32. Control `EUAI-CTRL-QMS-001`

33. Control `EUAI-CTRL-QMS-002`

34. Control `EUAI-CTRL-CONF-001`

35. Control `EUAI-CTRL-CONF-002`

36. Control `EUAI-CTRL-CONF-003`

37. Control `EUAI-CTRL-CONF-004`

38. Control `EUAI-CTRL-CONF-005`

39. Control `EUAI-CTRL-CONF-006`

40. Control `EUAI-CTRL-REG-001`

41. Control `EUAI-CTRL-GPAI-001`

42. Control `EUAI-CTRL-GPAI-002`

43. Control `EUAI-CTRL-GPAI-003`

44. Control `EUAI-CTRL-GPAI-004`

45. Control `EUAI-CTRL-GPAI-005`

46. Control `EUAI-CTRL-GPAI-006`

47. Control `EUAI-CTRL-GPAI-007`

48. Control `EUAI-CTRL-GPAI-008`

49. Control `EUAI-CTRL-LIT-001`

50. Control `EUAI-CTRL-LIT-002`

51. Control `EUAI-CTRL-FR-001`

52. Control `EUAI-CTRL-FR-002`

53. Control `EUAI-CTRL-FR-003`

54. Control `EUAI-CTRL-FR-004`

55. Control `EUAI-CTRL-MON-001`

56. Control `EUAI-CTRL-MON-002`

57. Control `EUAI-CTRL-INC-001`

58. Control `EUAI-CTRL-INC-002`

59. Control `EUAI-CTRL-CHG-001`

60. Control `EUAI-CTRL-CHG-002`

61. Control `EUAI-CTRL-AUTH-001`

62. Control `EUAI-CTRL-AUTH-002`

63. Control `EUAI-CTRL-AUTH-003`

64. Control `EUAI-CTRL-AUTH-004`

65. Control `EUAI-CTRL-AUTH-005`

66. Control `EUAI-CTRL-EVD-001`

67. Control `EUAI-CTRL-EVD-002`

68. Control `EUAI-CTRL-ASSR-001`

69. Control `EUAI-CTRL-ASSR-002`

70. Control `EUAI-CTRL-IMP-001`