> ## Documentation Index
> Fetch the complete documentation index at: https://docs.aigoframework.com/llms.txt
> Use this file to discover all available pages before exploring further.
# 12 AIGO EU AI Act AIGO Control Mapping v0.1
# AIGO — EU AI Act AIGO Control Mapping
## 1. Document Purpose
This document establishes the detailed control-level crosswalk between applicable requirements of Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744, and the AIGO AI Governance Operating Framework.
The purpose is to translate legal and regulatory requirements into identifiable AIGO governance controls while preserving the distinction between:
* a legal requirement;
* an AIGO governance requirement;
* an AIGO control;
* an implementation procedure;
* evidence;
* assessment;
* monitoring;
* assurance; and
* legal compliance.
This mapping is an operational control crosswalk. It does not constitute legal advice, conformity assessment, certification, or a declaration of compliance.
Regulation (EU) 2026/1744 is the current amendment baseline used by this document. The amendment was adopted on 8 July 2026 and published in the Official Journal on 24 July 2026.
***
## 2. Mapping Information
| Field | Value |
| -------------------------- | ------------------------------------------------------ |
| Mapping | AIGO EU AI Act AIGO Control Mapping |
| Version | 0.1 |
| Status | Draft |
| Document Identifier | `AIGO-MAP-EUAI-012` |
| Document Type | EU AI Act Mapping |
| Mapping Package | `AIGO-MAP-EUAI` |
| Primary Legal Instrument | Regulation (EU) 2024/1689 |
| Current Amendment Baseline | Regulation (EU) 2026/1744 |
| Primary Purpose | Requirement-to-control mapping |
| Mapping Architecture | `AIGO-MAP-EUAI-ARCH-001` |
| Registry | `00-AIGO-EU-AI-Act-Mapping-Registry-v0.1.json` |
| Timeline Source | `11-AIGO-EU-AI-Act-Applicability-and-Timeline-v0.1.md` |
***
# 3. Control Mapping Principle
The control mapping follows this structure:
```text theme={null}
EU AI Act Requirement
↓
Applicability
↓
AIGO Governance Objective
↓
AIGO Control
↓
Procedure / Operating Method
↓
Assessment
↓
Evidence
↓
Monitoring
↓
Assurance
```
A control is not considered effective merely because it exists in this mapping.
Implementation and operating effectiveness must be demonstrated separately.
***
# 4. Source Hierarchy
The mapping uses:
### Tier 1 — Binding Law
* Regulation (EU) 2024/1689;
* applicable amendments, including Regulation (EU) 2026/1744.
### Tier 2 — Official Implementation Material
* European Commission guidance;
* European AI Office material;
* implementing acts;
* delegated acts;
* official codes and related materials.
### Tier 3 — AIGO Control Interpretation
AIGO converts the identified requirement into an operational governance control.
The control must not change the substance of the legal requirement.
The current EU AI Act source and amendments remain authoritative.
***
# 5. Control Relationship Types
Each mapping should use one of the following relationship values:
```text theme={null}
DIRECT
PARTIAL
SUPPORTING
INDIRECT
CONDITIONAL
INFORMATIVE
NOT_APPLICABLE
NO_DIRECT_AIGO_EQUIVALENT
```
## 5.1 DIRECT
The AIGO control directly addresses the mapped requirement.
## 5.2 PARTIAL
The control addresses only part of the requirement.
## 5.3 SUPPORTING
The control facilitates implementation but does not satisfy the entire requirement.
## 5.4 CONDITIONAL
The control applies only when specified legal conditions are satisfied.
## 5.5 NO\_DIRECT\_AIGO\_EQUIVALENT
The legal requirement must be addressed through another statutory or organizational mechanism.
***
# 6. Control Status
AIGO should distinguish:
```text theme={null}
MAPPED
CONTROL_DEFINED
IMPLEMENTED
EVIDENCED
ASSESSED
MONITORED
ASSURED
SUPERSEDED
RETIRED
```
A mapping status must not be interpreted as a legal-compliance status.
***
# 7. Control Identifier Convention
AIGO controls should use the existing AIGO Control Schema identifiers.
For EU AI Act mapping purposes, the mapping should additionally provide a stable relationship identifier.
Recommended format:
```text theme={null}
EUAI-CTRL--
```
Examples:
```text theme={null}
EUAI-CTRL-APP-001
EUAI-CTRL-PROH-001
EUAI-CTRL-HR-001
EUAI-CTRL-DATA-001
EUAI-CTRL-TRANS-001
EUAI-CTRL-GPAI-001
EUAI-CTRL-RIGHTS-001
EUAI-CTRL-CONF-001
```
The EUAI identifier describes the regulatory mapping relationship.
The underlying AIGO Control ID remains authoritative in the Control Schema.
***
# 8. Master Control Domains
The EU AI Act mapping should use the following initial control domains:
```text theme={null}
APP Applicability
GOV Governance
CLS Classification
PROH Prohibited Practices
RISK Risk Management
DATA Data Governance
DOC Documentation
REC Record Keeping
TRANS Transparency
HUM Human Oversight
PERF Performance / Accuracy
ROB Robustness
SEC Cybersecurity
QMS Quality Management
CONF Conformity
REG Registration
GPAI General-Purpose AI
LIT AI Literacy
FR Fundamental Rights
MON Monitoring
INC Incident Management
CHG Change Management
AUTH Regulatory Authority Interaction
EVD Evidence
ASSR Assurance
IMP Improvement
RET Retirement
TPG Third-Party Governance
```
***
# 9. Control Architecture
The control architecture should operate across the AI lifecycle:
```text theme={null}
Planning
↓
Applicability
↓
Classification
↓
Risk
↓
Control
↓
Assessment
↓
Approval
↓
Deployment
↓
Monitoring
↓
Incident / Change
↓
Assurance
↓
Improvement
↓
Retirement
```
This aligns the EU AI Act mapping with the AIGO lifecycle model.
***
# 10. Control Mapping — Applicability
## Control `EUAI-CTRL-APP-001`
**Name:** EU AI Act Applicability Determination
**Objective:** Determine whether and how the AI Act applies to an AI system, actor, model, or activity.
**Mapped Requirements:**
* Article 2;
* relevant definitions;
* Article 6;
* Articles 51–56 where GPAI is relevant;
* Article 50;
* applicable transitional provisions.
**Relationship:** `DIRECT`
**AIGO Components:**
* Governance;
* AI System;
* Assessment;
* Risk;
* Evidence.
**Required Activities:**
1. identify AI system;
2. identify actor;
3. identify territory;
4. identify intended purpose;
5. identify applicable regulatory category;
6. identify exceptions;
7. identify transitional provisions;
8. document determination.
**Evidence:**
* applicability assessment;
* AI System Profile;
* legal-source reference;
* review record.
***
# 11. Control `EUAI-CTRL-CLS-001`
**Name:** EU AI Act Classification
**Objective:** Determine the applicable regulatory category of an AI system.
**Mapped Requirements:**
* Article 6;
* Annex I;
* Annex III;
* GPAI provisions where applicable;
* Article 5 screening relationship.
**Relationship:** `DIRECT`
**Controls:**
* classification assessment;
* intended-purpose verification;
* Annex mapping;
* legal review where required.
**Evidence:**
* classification record;
* Annex reference;
* rationale;
* technical evidence.
***
# 12. Control `EUAI-CTRL-PROH-001`
**Name:** Prohibited AI Practice Screening
**Objective:** Prevent AI systems from being used for prohibited practices within Article 5.
**Mapped Requirement:**
* Article 5.
**Relationship:** `DIRECT / CRITICAL`
**Activities:**
* screen use case;
* evaluate system capability;
* identify prohibited category;
* assess legal conditions;
* identify exceptions;
* escalate uncertainty;
* prevent unauthorized deployment.
**Evidence:**
* screening assessment;
* intended-purpose record;
* legal review;
* governance decision.
Detailed mapping:
`02-AIGO-EU-AI-Act-Prohibited-AI-Practices-Mapping-v0.1.md`
***
# 13. Control `EUAI-CTRL-PROH-002`
**Name:** Prohibited-Practice Change Re-Screening
**Objective:** Ensure material changes trigger renewed Article 5 analysis.
**Triggers:**
* intended-purpose change;
* new capability;
* new modality;
* new deployment context;
* material model change;
* new affected population;
* regulatory amendment.
**Relationship:** `DIRECT`
**Evidence:**
* Change record;
* updated screening;
* decision.
***
# 14. Control `EUAI-CTRL-RISK-001`
**Name:** High-Risk AI Risk Management
**Objective:** Establish and maintain the risk-management process required for applicable high-risk AI systems.
**Mapped Requirement:**
* Article 9.
**Relationship:** `DIRECT / CRITICAL`
**AIGO Components:**
* Risk;
* Control;
* Assessment;
* Monitoring;
* Evidence;
* Assurance.
**Activities:**
* risk identification;
* analysis;
* evaluation;
* treatment;
* residual-risk determination;
* lifecycle reassessment.
**Evidence:**
* risk record;
* treatment;
* residual risk;
* monitoring results.
***
# 15. Control `EUAI-CTRL-DATA-001`
**Name:** High-Risk Data Governance
**Mapped Requirement:**
* Article 10.
**Relationship:** `DIRECT / CRITICAL`
**Objective:**
Ensure applicable training, validation, and testing data are governed according to the legal and technical requirements.
**Activities:**
* data inventory;
* provenance;
* quality;
* relevance;
* representativeness;
* bias assessment;
* data preparation;
* testing;
* documentation.
**Evidence:**
* data records;
* lineage;
* quality assessment;
* bias analysis;
* validation results.
***
# 16. Control `EUAI-CTRL-DATA-002`
**Name:** Training-Data Rights and Copyright Governance
**Objective:** Support applicable GPAI copyright and training-content obligations.
**Mapped Requirements:**
* GPAI copyright requirements;
* training-content summary requirements.
**Relationship:** `DIRECT / CONDITIONAL`
**Evidence:**
* copyright policy;
* training-content summary;
* rights-management records;
* review.
Detailed mapping:
`05-AIGO-EU-AI-Act-GPAI-Mapping-v0.1.md`
***
# 17. Control `EUAI-CTRL-DOC-001`
**Name:** High-Risk Technical Documentation
**Mapped Requirement:**
* Article 11;
* Annex IV.
**Relationship:** `DIRECT / CRITICAL`
**Objective:**
Maintain required technical documentation in a complete, current, controlled, versioned, and traceable form.
**Evidence:**
* technical documentation;
* version history;
* review;
* change history.
***
# 18. Control `EUAI-CTRL-DOC-002`
**Name:** Technical Documentation Change Synchronization
**Objective:** Ensure system changes result in corresponding documentation review and update.
**Triggers:**
* model change;
* architecture change;
* data change;
* intended-purpose change;
* deployment change;
* security change;
* human-oversight change.
**Relationship:** `DIRECT`
***
# 19. Control `EUAI-CTRL-REC-001`
**Name:** High-Risk Record Keeping
**Mapped Requirement:**
* Article 12;
* Article 19 and related requirements.
**Relationship:** `DIRECT`
**Activities:**
* logging;
* record retention;
* integrity;
* access;
* traceability;
* evidence preservation.
***
# 20. Control `EUAI-CTRL-REC-002`
**Name:** Regulatory Evidence Preservation
**Objective:** Preserve records subject to regulatory request, investigation, or enforcement.
**Activities:**
* retention hold;
* integrity protection;
* chain of custody;
* access restriction;
* evidence indexing.
**Relationship:** `SUPPORTING / CRITICAL`
***
# 21. Control `EUAI-CTRL-TRANS-001`
**Name:** AI Interaction Disclosure
**Mapped Requirement:**
* Article 50(1).
**Relationship:** `DIRECT`
**Objective:**
Inform people when they are interacting directly with AI where the Article 50 conditions apply.
**Evidence:**
* interface;
* notice;
* testing;
* configuration;
* review.
***
# 22. Control `EUAI-CTRL-TRANS-002`
**Name:** Machine-Readable AI Content Marking
**Mapped Requirement:**
* Article 50(2).
**Relationship:** `DIRECT / CRITICAL`
**Activities:**
* marking;
* detection;
* interoperability;
* robustness testing;
* configuration;
* monitoring.
***
# 23. Control `EUAI-CTRL-TRANS-003`
**Name:** Deepfake Disclosure
**Mapped Requirement:**
* Article 50 provisions concerning deepfakes.
**Relationship:** `DIRECT / CONDITIONAL`
**Evidence:**
* content classification;
* label;
* publication record;
* testing.
***
# 24. Control `EUAI-CTRL-TRANS-004`
**Name:** Public-Interest AI Text Disclosure
**Mapped Requirement:**
* applicable Article 50 provisions concerning AI-generated or manipulated text on matters of public interest.
**Relationship:** `DIRECT / CONDITIONAL`
**Activities:**
* identify public-interest content;
* determine human review;
* determine editorial control;
* apply disclosure;
* retain evidence.
***
# 25. Control `EUAI-CTRL-TRANS-005`
**Name:** Emotion Recognition Transparency
**Mapped Requirement:**
* applicable Article 50 emotion-recognition transparency requirements.
**Relationship:** `DIRECT / CONDITIONAL`
**Evidence:**
* system profile;
* applicability assessment;
* notification;
* testing.
***
# 26. Control `EUAI-CTRL-TRANS-006`
**Name:** Biometric Categorisation Transparency
**Mapped Requirement:**
* applicable Article 50 biometric-categorisation transparency requirements.
**Relationship:** `DIRECT / CONDITIONAL`
**Control Interaction:**
The system must also undergo Article 5 prohibited-practice screening.
***
# 27. Control `EUAI-CTRL-HUM-001`
**Name:** High-Risk Human Oversight
**Mapped Requirement:**
* Article 14.
**Relationship:** `DIRECT / CRITICAL`
**Activities:**
* appoint oversight role;
* define authority;
* provide information;
* intervention;
* override;
* escalation;
* monitoring;
* competence.
**Evidence:**
* role assignment;
* procedures;
* tests;
* training;
* intervention records.
***
# 28. Control `EUAI-CTRL-HUM-002`
**Name:** Human Oversight Competence
**Mapped Requirements:**
* Article 14;
* Article 4 where applicable.
**Relationship:** `DIRECT / SUPPORTING`
**Objective:**
Ensure persons responsible for oversight have role-appropriate knowledge and preparation.
***
# 29. Control `EUAI-CTRL-PERF-001`
**Name:** AI Accuracy Governance
**Mapped Requirement:**
* Article 15 and applicable high-risk requirements.
**Relationship:** `DIRECT`
**Activities:**
* define accuracy objectives;
* test;
* validate;
* monitor;
* document limitations.
***
# 30. Control `EUAI-CTRL-ROB-001`
**Name:** AI Robustness and Resilience
**Mapped Requirement:**
* Article 15.
**Relationship:** `DIRECT`
**Activities:**
* robustness testing;
* resilience;
* stress testing;
* failure handling;
* degradation monitoring.
***
# 31. Control `EUAI-CTRL-SEC-001`
**Name:** AI Cybersecurity
**Mapped Requirements:**
* Article 15;
* applicable high-risk cybersecurity requirements;
* GPAI safety/security obligations where applicable.
**Relationship:** `DIRECT / CRITICAL`
**Activities:**
* threat modeling;
* vulnerability management;
* secure development;
* adversarial testing;
* data/model protection;
* incident response.
***
# 32. Control `EUAI-CTRL-QMS-001`
**Name:** AI Quality Management Governance
**Mapped Requirement:**
* Article 17.
**Relationship:** `DIRECT / SUPPORTING`
**Objective:**
Provide governance mechanisms supporting the applicable statutory quality-management system.
**Activities:**
* documented procedures;
* roles;
* design governance;
* testing;
* data governance;
* risk;
* documentation;
* corrective action.
AIGO should not state that this control alone constitutes the statutory QMS.
***
# 33. Control `EUAI-CTRL-QMS-002`
**Name:** Quality-System Change Governance
**Objective:** Ensure material AI-system changes trigger review of the quality-management system and supporting documentation.
**Relationship:** `SUPPORTING`
***
# 34. Control `EUAI-CTRL-CONF-001`
**Name:** Conformity Applicability Determination
**Mapped Requirements:**
* Article 43;
* Article 6;
* relevant Annexes.
**Relationship:** `DIRECT / CRITICAL`
**Activities:**
* classify;
* identify pathway;
* determine internal vs third-party assessment;
* identify notified-body requirement;
* identify product-law interaction.
***
# 35. Control `EUAI-CTRL-CONF-002`
**Name:** Conformity Assessment Governance
**Objective:**
Coordinate the applicable conformity-assessment process.
**Activities:**
* assessment planning;
* evidence;
* technical documentation;
* QMS;
* assessment-body coordination;
* findings;
* corrective action;
* closure.
**Relationship:** `DIRECT`
***
# 36. Control `EUAI-CTRL-CONF-003`
**Name:** Notified-Body Scope Verification
**Mapped Requirements:**
* Article 43;
* Article 30;
* Annex XIV where applicable.
**Relationship:** `DIRECT / CRITICAL`
**Activities:**
* verify authorization;
* verify notification;
* verify scope;
* map system category;
* map Annex XIV code;
* verify current status.
***
# 37. Control `EUAI-CTRL-CONF-004`
**Name:** Conformity Certificate Control
**Mapped Requirement:**
* applicable Article 44 / conformity provisions.
**Relationship:** `DIRECT / CONDITIONAL`
**Evidence:**
* certificate;
* issuer;
* scope;
* system version;
* validity;
* surveillance.
***
# 38. Control `EUAI-CTRL-CONF-005`
**Name:** EU Declaration of Conformity Governance
**Mapped Requirement:**
* Article 47;
* Annex V.
**Relationship:** `DIRECT / CONDITIONAL`
**Objective:**
Ensure required declarations are prepared, signed, controlled, maintained, and linked to the applicable conformity evidence.
***
# 39. Control `EUAI-CTRL-CONF-006`
**Name:** CE Marking Governance
**Mapped Requirement:**
* Article 48 and applicable conformity framework.
**Relationship:** `DIRECT / CONDITIONAL`
**Evidence:**
* applicability;
* marking;
* declaration;
* conformity evidence.
***
# 40. Control `EUAI-CTRL-REG-001`
**Name:** AI Act Registration Governance
**Mapped Requirement:**
* Article 49;
* applicable registration Annexes.
**Relationship:** `DIRECT / CONDITIONAL`
**Activities:**
* applicability;
* data preparation;
* submission;
* identifier;
* update;
* evidence.
***
# 41. Control `EUAI-CTRL-GPAI-001`
**Name:** GPAI Applicability Determination
**Mapped Requirements:**
* GPAI provisions.
**Relationship:** `DIRECT`
**Activities:**
* determine GPAI status;
* determine provider role;
* identify significant modification;
* determine systemic risk;
* identify applicable exemptions.
***
# 42. Control `EUAI-CTRL-GPAI-002`
**Name:** GPAI Technical Documentation
**Mapped Requirement:**
Applicable GPAI documentation requirements.
**Relationship:** `DIRECT`
**Evidence:**
* model documentation;
* evaluation;
* training information;
* version;
* changes.
***
# 43. Control `EUAI-CTRL-GPAI-003`
**Name:** Downstream Provider Information
**Mapped Requirement:**
Applicable GPAI downstream-information obligations.
**Relationship:** `DIRECT / CONDITIONAL`
**Activities:**
* information package;
* versioning;
* release;
* update;
* recipient traceability.
***
# 44. Control `EUAI-CTRL-GPAI-004`
**Name:** GPAI Copyright Governance
**Mapped Requirement:**
Applicable copyright-policy obligations.
**Relationship:** `DIRECT`
**Evidence:**
* copyright policy;
* implementation;
* review.
***
# 45. Control `EUAI-CTRL-GPAI-005`
**Name:** GPAI Training-Content Summary
**Mapped Requirement:**
Applicable training-content-summary obligation.
**Relationship:** `DIRECT`
**Evidence:**
* public summary;
* version;
* source;
* review;
* publication.
***
# 46. Control `EUAI-CTRL-GPAI-006`
**Name:** GPAI Systemic-Risk Governance
**Mapped Requirement:**
Applicable systemic-risk provisions.
**Relationship:** `DIRECT / CRITICAL`
**Activities:**
* systemic-risk assessment;
* notification;
* safety;
* security;
* evaluations;
* monitoring;
* incident handling.
***
# 47. Control `EUAI-CTRL-GPAI-007`
**Name:** GPAI Safety and Security Framework
**Mapped Requirement:**
Applicable systemic-risk safety/security obligations.
**Relationship:** `DIRECT / CRITICAL`
**Activities:**
* safety framework;
* security framework;
* red teaming;
* evaluation;
* mitigation;
* monitoring.
***
# 48. Control `EUAI-CTRL-GPAI-008`
**Name:** GPAI Regulatory Submission
**Mapped Requirements:**
Applicable AI Office notification and submission provisions.
**Relationship:** `DIRECT / CONDITIONAL`
**Activities:**
* prepare;
* review;
* approve;
* submit;
* retain;
* follow up.
***
# 49. Control `EUAI-CTRL-LIT-001`
**Name:** AI Literacy Governance
**Mapped Requirement:**
* Article 4.
**Relationship:** `DIRECT`
**Activities:**
* identify relevant people;
* assess context;
* define measures;
* deliver measures;
* retain evidence;
* review.
The amended Article 4 emphasizes measures supporting AI literacy and does not require providers/deployers to guarantee a specific level for each individual. The control should therefore remain contextual and proportionate.
***
# 50. Control `EUAI-CTRL-LIT-002`
**Name:** Role-Based AI Literacy
**Mapped Requirements:**
* Article 4;
* related human-oversight obligations.
**Relationship:** `DIRECT / SUPPORTING`
**Activities:**
* role analysis;
* system-context analysis;
* learning needs;
* targeted measures;
* evidence.
***
# 51. Control `EUAI-CTRL-FR-001`
**Name:** Fundamental-Rights Impact Governance
**Mapped Requirement:**
* Article 27 where applicable;
* related rights protections.
**Relationship:** `DIRECT / CONDITIONAL / CRITICAL`
**Activities:**
* identify affected persons;
* rights analysis;
* impact assessment;
* mitigation;
* residual impact;
* monitoring.
***
# 52. Control `EUAI-CTRL-FR-002`
**Name:** Rights and Bias Monitoring
**Mapped Requirements:**
* applicable fundamental-rights and anti-bias provisions.
**Relationship:** `DIRECT / SUPPORTING`
**Activities:**
* bias detection;
* disparity monitoring;
* rights indicators;
* complaints;
* remediation.
***
# 53. Control `EUAI-CTRL-FR-003`
**Name:** AI Rights Complaint Management
**Mapped Requirements:**
* applicable complaints and rights provisions;
* Article 85 where relevant;
* Article 86 where relevant.
**Relationship:** `DIRECT / CONDITIONAL`
**Activities:**
* complaint intake;
* jurisdiction;
* investigation;
* response;
* remediation;
* regulatory escalation.
***
# 54. Control `EUAI-CTRL-FR-004`
**Name:** AI-Assisted Decision Human Review
**Mapped Requirements:**
* applicable human-oversight and decision-information requirements.
**Relationship:** `DIRECT / CONDITIONAL`
**Activities:**
* human review;
* evidence review;
* challenge;
* decision;
* communication.
***
# 55. Control `EUAI-CTRL-MON-001`
**Name:** High-Risk AI Lifecycle Monitoring
**Mapped Requirements:**
* Articles 9, 12, 15;
* applicable monitoring obligations.
**Relationship:** `DIRECT`
**Activities:**
* performance;
* robustness;
* security;
* incidents;
* risk;
* changes;
* human oversight.
***
# 56. Control `EUAI-CTRL-MON-002`
**Name:** Post-Market AI Monitoring
**Mapped Requirements:**
* applicable post-market monitoring provisions;
* Annex-related requirements.
**Relationship:** `DIRECT / CONDITIONAL`
**Activities:**
* collect performance information;
* identify incidents;
* corrective action;
* maintain records;
* reassessment.
***
# 57. Control `EUAI-CTRL-INC-001`
**Name:** Serious AI Incident Management
**Mapped Requirements:**
* applicable AI Act incident provisions.
**Relationship:** `DIRECT / CRITICAL`
**Activities:**
* detection;
* classification;
* containment;
* investigation;
* reporting determination;
* evidence;
* corrective action;
* follow-up.
***
# 58. Control `EUAI-CTRL-INC-002`
**Name:** Regulatory Incident Escalation
**Objective:**
Ensure potential statutory incidents are evaluated for external notification.
**Relationship:** `DIRECT / CONDITIONAL`
**Activities:**
* legal review;
* authority identification;
* notification decision;
* submission;
* evidence.
***
# 59. Control `EUAI-CTRL-CHG-001`
**Name:** AI Act Regulatory Change Assessment
**Mapped Requirements:**
All applicable provisions where material changes can affect regulatory applicability.
**Relationship:** `DIRECT`
**Activities:**
* change intake;
* legal impact;
* classification impact;
* controls;
* documentation;
* conformity;
* registration;
* evidence;
* approval.
***
# 60. Control `EUAI-CTRL-CHG-002`
**Name:** Significant-Change Assessment
**Mapped Requirement:**
* applicable Article 111 transition and significant-change provisions.
**Relationship:** `DIRECT / CRITICAL`
**Activities:**
* original system status;
* change analysis;
* significant-change determination;
* legal consequences;
* reassessment.
***
# 61. Control `EUAI-CTRL-AUTH-001`
**Name:** Regulatory Authority Register
**Mapped Requirements:**
* governance and supervisory provisions.
**Relationship:** `SUPPORTING`
**Activities:**
* identify authority;
* jurisdiction;
* competence;
* contact;
* source;
* review.
***
# 62. Control `EUAI-CTRL-AUTH-002`
**Name:** Regulatory Information Request Management
**Mapped Requirements:**
* applicable supervisory powers.
**Relationship:** `DIRECT / CONDITIONAL`
**Activities:**
* request intake;
* authenticity verification;
* scope;
* evidence;
* review;
* response;
* follow-up.
***
# 63. Control `EUAI-CTRL-AUTH-003`
**Name:** Regulatory Inspection and Investigation Response
**Mapped Requirements:**
* applicable market-surveillance and AI Office investigative powers.
**Relationship:** `DIRECT / CONDITIONAL`
**Activities:**
* inspection readiness;
* evidence preservation;
* response team;
* legal review;
* authority coordination;
* findings;
* remediation.
The 2026 amendment introduced more detailed AI Office supervisory powers, including information requests and inspections for AI systems within its competence.
***
# 64. Control `EUAI-CTRL-AUTH-004`
**Name:** Regulatory Commitment Management
**Mapped Requirements:**
* applicable AI Office commitment mechanisms.
**Relationship:** `DIRECT / CONDITIONAL`
**Activities:**
* commitment record;
* owner;
* deadline;
* evidence;
* verification;
* closure.
***
# 65. Control `EUAI-CTRL-AUTH-005`
**Name:** Regulatory Enforcement Event Management
**Mapped Requirements:**
* applicable enforcement and penalty provisions.
**Relationship:** `DIRECT / CRITICAL`
**Activities:**
* regulatory finding;
* penalty;
* corrective action;
* management escalation;
* response;
* evidence;
* assurance.
***
# 66. Control `EUAI-CTRL-EVD-001`
**Name:** EU AI Act Evidence Management
**Objective:**
Ensure evidence relating to AI Act obligations is attributable, current, traceable, protected, and retained.
**Relationship:** `SUPPORTING / CROSS-CUTTING`
**Evidence Types:**
* assessments;
* approvals;
* technical documentation;
* logs;
* monitoring;
* incidents;
* conformity;
* registrations;
* regulatory communications;
* assurance.
***
# 67. Control `EUAI-CTRL-EVD-002`
**Name:** EU AI Act Evidence Integrity
**Objective:**
Protect the integrity of evidence used to demonstrate governance and regulatory implementation.
**Activities:**
* metadata;
* versioning;
* timestamps;
* checksum where appropriate;
* access control;
* retention.
***
# 68. Control `EUAI-CTRL-ASSR-001`
**Name:** EU AI Act Governance Assurance
**Objective:**
Provide objective assessment of applicable AIGO controls and evidence.
**Relationship:** `SUPPORTING`
**Assurance Areas:**
* classification;
* risk;
* controls;
* documentation;
* evidence;
* monitoring;
* incidents;
* regulatory interaction.
***
# 69. Control `EUAI-CTRL-ASSR-002`
**Name:** High-Risk AI Independent Assurance
**Mapped Requirements:**
Applicable high-risk governance requirements.
**Relationship:** `SUPPORTING / CONDITIONAL`
**Objective:**
Provide enhanced assurance where risk, impact, or regulatory significance warrants it.
***
# 70. Control `EUAI-CTRL-IMP-001`
**Name:** Regulatory Corrective Action
**Mapped Requirements:**
Applicable AI Act corrective-action obligations.
**Relationship:** `DIRECT`
**Activities:**
* finding;
* root cause;
* corrective action;
* owner;
* deadline;
* verification;
* closure.
***
# 71. Control `EUAI-CTRL-IMP-002`
**Name:** EU AI Act Continuous Improvement
**Objective:**
Translate incidents, regulatory changes, assurance findings, and evidence gaps into controlled improvements.
**Relationship:** `SUPPORTING`
***
# 72. Control `EUAI-CTRL-RET-001`
**Name:** AI Regulatory Retirement Governance
**Mapped Requirements:**
Applicable continuing obligations after system retirement.
**Relationship:** `SUPPORTING / CONDITIONAL`
**Activities:**
* record retention;
* regulatory evidence;
* certificate history;
* registration;
* incidents;
* post-market obligations;
* closure.
***
# 73. Control `EUAI-CTRL-TPG-001`
**Name:** AI Provider and Supplier Regulatory Due Diligence
**Mapped Requirements:**
Applicable provider, importer, distributor, and downstream governance requirements.
**Relationship:** `DIRECT / CONDITIONAL`
**Activities:**
* role determination;
* supplier assessment;
* documentation;
* incident obligations;
* change notification;
* contract requirements;
* evidence.
***
# 74. Control `EUAI-CTRL-TPG-002`
**Name:** GPAI Supplier Governance
**Mapped Requirements:**
Applicable GPAI downstream-provider requirements.
**Relationship:** `DIRECT / CONDITIONAL`
**Activities:**
* provider status;
* model version;
* technical documentation;
* downstream information;
* safety/security;
* incident notification;
* changes.
***
# 75. Control `EUAI-CTRL-APP-002`
**Name:** Regulatory Timeline Applicability
**Mapped Requirement:**
* Article 111;
* Article 113;
* related transitional rules.
**Relationship:** `DIRECT`
**Activities:**
* application date;
* transition;
* actor;
* AI category;
* significant change;
* public-authority status.
The authoritative operational timeline is maintained in:
`11-AIGO-EU-AI-Act-Applicability-and-Timeline-v0.1.md`
***
# 76. Control `EUAI-CTRL-APP-003`
**Name:** Early-Readiness Governance
**Objective:**
Allow future AI Act requirements to be implemented before their statutory application date while clearly distinguishing legal status from internal implementation status.
**Relationship:** `SUPPORTING`
***
# 77. Control `EUAI-CTRL-APP-004`
**Name:** Transitional-System Governance
**Objective:**
Manage AI systems subject to transitional provisions.
**Activities:**
* historical market date;
* original version;
* current version;
* significant-change assessment;
* transition deadline;
* evidence.
***
# 78. Control `EUAI-CTRL-CONF-007`
**Name:** Annex XIV Conformity-Body Coding
**Mapped Requirement:**
* Annex XIV.
**Relationship:** `DIRECT / CONDITIONAL`
**Activities:**
* determine AI-system type;
* assign relevant code where applicable;
* verify conformity-body scope;
* maintain evidence.
***
# 79. Control `EUAI-CTRL-REG-002`
**Name:** Registration Data Consistency
**Objective:**
Ensure information submitted to EU registration systems matches authoritative AIGO records.
**Relationship:** `SUPPORTING / CRITICAL`
**Checks:**
* system ID;
* provider;
* intended purpose;
* classification;
* version;
* registration status.
***
# 80. Control `EUAI-CTRL-DOC-003`
**Name:** EU AI Act Document Consistency
**Objective:**
Prevent contradictions among regulatory documentation.
**Relationships:**
* AI System Profile;
* Risk;
* Classification;
* Technical Documentation;
* Declaration;
* Certificate;
* Registration;
* Monitoring.
**Relationship:** `SUPPORTING / CROSS-CUTTING`
***
# 81. Control `EUAI-CTRL-TRANS-007`
**Name:** Transparency Transition Governance
**Objective:**
Manage transitional Article 50 obligations for eligible pre-existing systems.
**Relationship:** `DIRECT / CONDITIONAL`
**Activities:**
* market-placement date;
* system type;
* transition eligibility;
* deadline;
* implementation;
* evidence.
***
# 82. Control `EUAI-CTRL-FR-005`
**Name:** Fundamental-Rights Change Impact Assessment
**Objective:**
Ensure material AI changes are reviewed for rights impact.
**Relationship:** `DIRECT / CONDITIONAL`
**Triggers:**
* new affected population;
* new purpose;
* new decision authority;
* new data;
* new model;
* new deployment context.
***
# 83. Control `EUAI-CTRL-GOV-001`
**Name:** AI Act Regulatory Governance
**Objective:**
Maintain accountability for EU AI Act implementation.
**Relationship:** `DIRECT / CROSS-CUTTING`
**Activities:**
* assign owners;
* define accountability;
* approve policy;
* review regulatory change;
* monitor compliance;
* report to management.
***
# 84. Control `EUAI-CTRL-GOV-002`
**Name:** AI Act Management Review
**Mapped Requirements:**
Supporting requirements concerning governance, monitoring, corrective action, and accountability.
**Relationship:** `SUPPORTING`
**Inputs:**
* regulatory changes;
* control coverage;
* evidence coverage;
* incidents;
* assurance;
* complaints;
* upcoming dates;
* supplier issues.
***
# 85. Control `EUAI-CTRL-GOV-003`
**Name:** AI Act Legal / Compliance Review
**Objective:**
Provide formal review of material legal interpretations and applicability decisions.
**Relationship:** `SUPPORTING / CRITICAL`
**Triggers:**
* Article 5 uncertainty;
* high-risk classification uncertainty;
* conformity-path uncertainty;
* systemic-risk GPAI determination;
* rights impact;
* major regulatory change.
***
# 86. Control `EUAI-CTRL-GOV-004`
**Name:** Regulatory Source Currency
**Objective:**
Ensure legal and official implementation sources are current.
**Activities:**
* source monitoring;
* source review;
* version;
* amendment identification;
* mapping updates.
**Relationship:** `SUPPORTING / CROSS-CUTTING`
***
# 87. Control `EUAI-CTRL-INC-003`
**Name:** Rights-Impact Incident Escalation
**Mapped Areas:**
* fundamental-rights governance;
* complaints;
* monitoring;
* high-risk AI.
**Relationship:** `DIRECT / CONDITIONAL`
***
# 88. Control `EUAI-CTRL-INC-004`
**Name:** Transparency Incident Escalation
**Mapped Areas:**
* Article 50.
**Relationship:** `DIRECT / CONDITIONAL`
Potential events:
* missing disclosure;
* broken marking;
* unlabeled deepfake;
* incorrect biometric notification.
***
# 89. Control `EUAI-CTRL-INC-005`
**Name:** GPAI Serious-Incident Escalation
**Mapped Areas:**
* GPAI serious incidents;
* AI Office interaction.
**Relationship:** `DIRECT / CONDITIONAL`
***
# 90. Control `EUAI-CTRL-CHG-003`
**Name:** Regulatory Documentation Impact
**Objective:**
Ensure legal changes create updates to:
* policies;
* procedures;
* templates;
* schemas;
* mappings;
* controls.
**Relationship:** `SUPPORTING / CROSS-CUTTING`
***
# 91. Control `EUAI-CTRL-CHG-004`
**Name:** Conformity-Impact Change Assessment
**Mapped Areas:**
* high-risk AI;
* conformity;
* declarations;
* certificates;
* registration.
**Relationship:** `DIRECT / CONDITIONAL`
***
# 92. Control `EUAI-CTRL-CHG-005`
**Name:** GPAI Model Change Assessment
**Mapped Areas:**
* GPAI;
* systemic risk;
* significant modification.
**Relationship:** `DIRECT / CONDITIONAL`
***
# 93. Control `EUAI-CTRL-RET-002`
**Name:** Regulatory Record Retention
**Mapped Areas:**
* evidence;
* conformity;
* registration;
* incidents;
* regulatory interaction.
**Relationship:** `DIRECT / SUPPORTING`
The retention period must come from the applicable legal and organizational requirements rather than a universal AIGO value.
***
# 94. Control `EUAI-CTRL-ASSR-003`
**Name:** Regulatory Evidence Readiness Assurance
**Objective:**
Assess whether the organization can demonstrate relevant implementation through authoritative evidence.
**Relationship:** `SUPPORTING`
***
# 95. EU AI Act Master Control Matrix
| AIGO Control Domain | Principal EU AI Act Areas |
| -------------------- | --------------------------------------------------- |
| Applicability | Article 2, Article 6, GPAI, Article 50, transitions |
| Governance | Articles 64–68, accountability |
| Classification | Article 6, Annex I, Annex III |
| Prohibited Practices | Article 5 |
| Risk | Article 9 |
| Data | Article 10 |
| Documentation | Article 11, Annex IV |
| Record Keeping | Article 12 |
| Transparency | Article 50 |
| Human Oversight | Article 14 |
| Performance | Article 15 |
| Robustness | Article 15 |
| Cybersecurity | Article 15 / GPAI security |
| Quality | Article 17 |
| Conformity | Articles 43–48 |
| Registration | Article 49 |
| GPAI | Articles 51–56 and related provisions |
| AI Literacy | Article 4 |
| Fundamental Rights | Article 27 and related rights provisions |
| Monitoring | Post-market / lifecycle monitoring |
| Incident | Serious incidents and corrective action |
| Change | Significant changes / lifecycle changes |
| Authority | AI Office / national authorities |
| Evidence | Cross-cutting |
| Assurance | Cross-cutting |
| Improvement | Corrective action / continual improvement |
| Retirement | Continuing records / lifecycle closure |
***
# 96. Control-to-AIGO Artifact Mapping
| Control Area | Schema | Template / Artifact |
| -------------------- | ---------------------------- | ------------------------------------- |
| Applicability | Assessment | AI Classification / Assessment |
| Classification | AI System / Assessment | AI Classification |
| Prohibited Practices | Assessment | Approval / Assessment |
| Risk | Risk | AI Risk Assessment |
| Data | Control / Assessment | Data Governance evidence |
| Documentation | Evidence | Technical Documentation |
| Record Keeping | Evidence | Evidence Record |
| Transparency | Control / Evidence | AI System Profile / Evidence |
| Human Oversight | Control | AI System Profile / Training evidence |
| Conformity | Assessment / Assurance | Conformity evidence |
| Registration | AI System / Evidence | Registration record |
| GPAI | AI System / Risk / Evidence | GPAI documentation |
| AI Literacy | Assessment / Evidence | Learning records |
| Rights | Risk / Assessment / Evidence | Rights assessment |
| Monitoring | Monitoring | Monitoring Template |
| Incident | Incident | Incident Template |
| Change | Change | Change Management Template |
| Assurance | Assurance | Assurance Template |
| Improvement | Improvement | Continuous Improvement Template |
| Retirement | Retirement | Retirement Template |
***
# 97. Control Priority Levels
Each mapped control should have an AIGO priority:
```text theme={null}
CRITICAL
HIGH
MEDIUM
LOW
INFORMATIONAL
```
Criticality should depend on:
* legal significance;
* impact;
* safety;
* fundamental rights;
* regulatory exposure;
* likelihood of material harm.
***
# 98. Critical Control Examples
The following will normally warrant critical treatment where applicable:
```text theme={null}
EUAI-CTRL-PROH-001
EUAI-CTRL-RISK-001
EUAI-CTRL-DATA-001
EUAI-CTRL-DOC-001
EUAI-CTRL-HUM-001
EUAI-CTRL-SEC-001
EUAI-CTRL-GPAI-006
EUAI-CTRL-CONF-001
EUAI-CTRL-CONF-003
EUAI-CTRL-INC-001
EUAI-CTRL-FR-001
```
Criticality should be adjusted for system and legal applicability.
***
# 99. Control Applicability
A control should never be considered mandatory merely because it appears in this mapping.
A control may be:
```text theme={null}
APPLICABLE
CONDITIONAL
NOT_APPLICABLE
FUTURE_APPLICABLE
TRANSITIONAL
```
The applicability determination should be documented.
***
# 100. Control Implementation Status
An operational implementation status should be separate:
```text theme={null}
NOT_IMPLEMENTED
PLANNED
IMPLEMENTED
IMPLEMENTED_EARLY
PARTIALLY_IMPLEMENTED
EVIDENCED
ASSESSED
ASSURED
```
***
# 101. Control Effectiveness
Control existence is distinct from effectiveness.
Recommended model:
```text theme={null}
CONTROL_DEFINED
↓
CONTROL_IMPLEMENTED
↓
CONTROL_OPERATING
↓
CONTROL_TESTED
↓
CONTROL_EFFECTIVE
```
The final effectiveness judgment requires evidence and assessment.
***
# 102. Control Evidence
Each control should have defined evidence types.
Example:
```text theme={null}
Control:
EUAI-CTRL-PROH-001
Evidence:
- applicability assessment
- Article 5 screening
- intended-purpose statement
- legal review
- approval decision
```
***
# 103. Control Monitoring
Each material control should have monitoring indicators.
Example:
```text theme={null}
Control:
EUAI-CTRL-TRANS-002
Indicators:
- marking coverage
- detection success
- failure incidents
- content samples
- system changes
```
***
# 104. Control Assurance
Material controls should be linked to assurance activities.
Example:
```text theme={null}
Control
↓
Evidence
↓
Testing
↓
Assurance
↓
Finding
↓
Improvement
```
***
# 105. Control Exceptions
A control exception must identify:
* control;
* legal requirement;
* reason;
* risk;
* compensating measure;
* authority;
* expiry;
* review.
AIGO risk acceptance cannot authorize conduct prohibited by law.
***
# 106. Control Coverage
A future EU AI Act Control Coverage report should calculate:
```text theme={null}
Applicable Controls
↓
Controls Defined
↓
Controls Implemented
↓
Controls Evidenced
↓
Controls Assessed
↓
Controls Assured
```
The report should separately display critical gaps.
***
# 107. Evidence Coverage
The EU AI Act Evidence Coverage Validator should use this mapping to determine:
* evidence required;
* evidence available;
* evidence current;
* evidence valid;
* evidence reviewed.
***
# 108. Traceability Coverage
Each material legal requirement should be traceable to:
```text theme={null}
Requirement
↓
Control
↓
Assessment
↓
Evidence
↓
Monitoring
↓
Assurance
```
Broken chains should be findings.
***
# 109. Regulatory Source Traceability
Every control mapping should identify:
* legal instrument;
* article;
* paragraph where applicable;
* Annex;
* amendment;
* source version.
This prevents generic references such as "AI Act compliance" from becoming the only traceability record.
***
# 110. Current Amendment Rule
Where Regulation (EU) 2026/1744 changes a requirement, the control mapping shall:
1. identify the amended requirement;
2. identify the affected control;
3. identify the effective date;
4. identify transition;
5. update evidence requirements;
6. update procedures if needed;
7. revalidate the mapping.
Regulation (EU) 2026/1744 is the current amendment baseline for this version.
***
# 111. Timeline Integration
The control applicability engine shall reference:
`11-AIGO-EU-AI-Act-Applicability-and-Timeline-v0.1.md`
Controls must support:
```text theme={null}
CURRENTLY_APPLICABLE
FUTURE_APPLICABLE
TRANSITIONAL
IMPLEMENTED_EARLY
```
***
# 112. High-Risk Timeline Integration
The control engine should distinguish:
```text theme={null}
Article 6(2) / Annex III
→ 2 December 2027
Article 6(1) / Annex I
→ 2 August 2028
```
These dates must not be collapsed into a single high-risk deadline.
***
# 113. Control and Public-Authority Transition
The engine should support the public-authority high-risk transition through:
```text theme={null}
PUBLIC_AUTHORITY_USE
+
HIGH_RISK
+
Article 111 transition
=
Applicable transition logic
```
The exact legal result must be determined from the current provision.
***
# 114. Control and Significant Change
Controls must support regulatory reactivation after material change.
Example:
```text theme={null}
Pre-existing High-Risk System
↓
Significant Change
↓
Chapter III applicability assessment
↓
Controls activated
```
***
# 115. Control and Article 50 Transition
For eligible pre-existing synthetic-content systems, transparency marking controls should record:
* market date;
* transition eligibility;
* deadline;
* implementation;
* evidence.
***
# 116. GPAI Control Timeline
GPAI controls should be treated as current from:
**2 August 2025**
subject to transitional treatment for pre-existing models and the specific obligations involved.
***
# 117. AI Literacy Control Timeline
AI literacy controls should be treated as currently applicable from:
**2 February 2025**
with the amended Article 4 context reflected in the control design.
***
# 118. Governance Control Timeline
Governance controls are currently applicable according to the AI Act's staged application framework.
AIGO should not defer governance implementation until high-risk application dates.
***
# 119. Control Governance
Each control should have:
* control owner;
* control objective;
* applicability;
* operating procedure;
* frequency;
* evidence;
* monitoring;
* escalation;
* assurance;
* change trigger;
* exception process.
***
# 120. Control Owner Model
Recommended ownership fields:
```text theme={null}
ACCOUNTABLE_OWNER
CONTROL_OWNER
OPERATIONAL_OWNER
LEGAL_REVIEWER
EVIDENCE_OWNER
ASSURANCE_OWNER
```
Not every control requires different people in every field.
***
# 121. Control Frequency
Possible values:
```text theme={null}
CONTINUOUS
PER_TRANSACTION
PER_SYSTEM
PER_CHANGE
QUARTERLY
SEMI_ANNUAL
ANNUAL
EVENT_DRIVEN
```
The frequency should be based on risk and legal requirements.
***
# 122. Control Operating Model
A control specification should include:
```text theme={null}
Objective
Scope
Applicability
Owner
Frequency
Procedure
Inputs
Outputs
Evidence
Monitoring
Escalation
Exception
Assurance
Review
```
***
# 123. Control Failure
A control failure should create a finding.
Potential lifecycle:
```text theme={null}
Control Failure
↓
Incident / Finding
↓
Risk
↓
Corrective Action
↓
Change
↓
Retest
↓
Evidence
↓
Assurance
```
***
# 124. Control Effectiveness Evidence
Control effectiveness should be supported by:
* testing;
* operating records;
* monitoring;
* evidence;
* assurance.
Policy existence alone is insufficient.
***
# 125. Cross-Control Dependencies
Many controls depend on others.
Examples:
```text theme={null}
Applicability
↓
Classification
↓
High-Risk Controls
```
```text theme={null}
Classification
↓
Conformity
↓
Registration
```
```text theme={null}
Incident
↓
Change
↓
Documentation
```
```text theme={null}
GPAI Classification
↓
Systemic Risk
↓
Safety / Security
↓
Regulatory Submission
```
***
# 126. Control Dependency Validation
The Reference Validator should verify that:
* mapped control IDs exist;
* dependent controls resolve;
* referenced schemas exist;
* referenced templates exist.
***
# 127. Control Consistency Validation
The Framework Consistency Checker should verify that:
* the same control is not described differently in multiple mappings;
* control names are consistent;
* AIGO control IDs remain stable;
* legal sources are consistent;
* applicability logic is consistent.
***
# 128. Control Documentation Integrity
The Document Integrity Checker should ensure the control-mapping document remains:
* complete;
* readable;
* correctly versioned;
* structurally consistent;
* linked to the registry.
***
# 129. Control Repository Health
The Repository Health Checker should report:
* missing controls;
* duplicate control IDs;
* orphaned controls;
* controls without evidence;
* critical control gaps;
* stale regulatory mappings.
***
# 130. Control Mapping Findings
Potential findings include:
```text theme={null}
CONTROL_MAPPING_MISSING
CONTROL_REFERENCE_INVALID
CONTROL_OWNER_MISSING
CONTROL_APPLICABILITY_UNRESOLVED
CONTROL_EVIDENCE_MISSING
CONTROL_MONITORING_MISSING
CONTROL_ASSURANCE_MISSING
CONTROL_DEPENDENCY_BROKEN
CONTROL_VERSION_CONFLICT
CRITICAL_CONTROL_GAP
REGULATORY_CONTROL_OUTDATED
```
***
# 131. Control Mapping Quality Criteria
A high-quality EU AI Act control mapping should be:
* source-traceable;
* applicability-aware;
* operational;
* testable;
* evidence-linked;
* monitorable;
* assurability-aware;
* version-controlled;
* aligned with AIGO schemas;
* aligned with the central timeline.
***
# 132. Control Coverage Metrics
Potential metrics:
| Metric | Purpose |
| ----------------------- | ------------------- |
| Applicable Controls | Scope |
| Controls Defined | Design coverage |
| Controls Implemented | Implementation |
| Controls Evidenced | Evidence coverage |
| Controls Assessed | Assessment |
| Controls Assured | Assurance |
| Critical Control Gaps | Risk |
| Overdue Control Reviews | Governance |
| Stale Mappings | Regulatory currency |
***
# 133. Control Mapping Release Gate
Before approval of this control mapping, verify:
```text theme={null}
Legal Sources Current
Control IDs Valid
Control Owners Defined
Applicability Logic Defined
Timeline References Current
Evidence Links Defined
Monitoring Links Defined
Assurance Links Defined
Critical Controls Identified
Cross-References Valid
Registry Updated
```
***
# 134. Relationship to Main Mapping
This document provides detailed control relationships.
The master mapping:
`01-AIGO-EU-AI-Act-Mapping-v0.1.md`
provides the high-level legal-to-AIGO crosswalk.
The two documents should remain consistent.
***
# 135. Relationship to Prohibited-Practice Mapping
The prohibited-practice mapping is authoritative for detailed Article 5 categories.
This document maps those requirements to controls.
***
# 136. Relationship to High-Risk Mapping
The high-risk mapping is authoritative for detailed Article 6 and Chapter III analysis.
This document translates the resulting requirements into controls.
***
# 137. Relationship to Transparency Mapping
The transparency mapping is authoritative for detailed Article 50 analysis.
This document provides Article 50 control implementations.
***
# 138. Relationship to GPAI Mapping
The GPAI mapping is authoritative for detailed GPAI requirements.
This document provides GPAI controls.
***
# 139. Relationship to Rights Mapping
The Rights and Remedies mapping is authoritative for detailed rights and remedy analysis.
This document provides corresponding controls.
***
# 140. Relationship to Conformity Mapping
The Conformity and Documentation mapping is authoritative for conformity procedures and documentation analysis.
This document provides the corresponding operational controls.
***
# 141. Relationship to Annex Mapping
The Annex mapping is authoritative for Annex-specific relationships.
This document maps the relevant Annex requirements to controls.
***
# 142. Relationship to Timeline Mapping
The Applicability and Timeline mapping is the authoritative timeline source.
This document must not establish independent competing deadlines.
***
# 143. Relationship to Evidence and Assurance
The Evidence and Assurance mapping should define how the control evidence is retained and how controls are assured.
The detailed mapping file:
`13-AIGO-EU-AI-Act-Evidence-and-Assurance-Mapping-v0.1.md`
will provide that layer.
***
# 144. Machine-Readable Future Model
A future control mapping schema may represent:
```json id="9m5p9w" theme={null}
{
"mappingId": "EUAI-CTRL-RISK-001",
"legalSource": {
"instrument": "Regulation (EU) 2024/1689",
"article": "9"
},
"relationship": "DIRECT",
"aigoControlId": "AIGO-CTRL-...",
"applicability": "CONDITIONAL",
"priority": "CRITICAL",
"evidence": [],
"monitoring": [],
"assurance": [],
"status": "MAPPED"
}
```
The future machine-readable schema should use the existing AIGO Control Schema rather than creating an uncontrolled parallel control definition.
***
# 145. Control Mapping Registry Requirements
The mapping registry should ultimately record:
```text theme={null}
mappingId
legalSource
article
paragraph
annex
relationship
aigoControlId
applicability
priority
implementationStatus
evidenceRequirements
monitoringRequirements
assuranceRequirements
effectiveDate
transition
reviewStatus
```
***
# 146. Legal Compliance Boundary
This mapping establishes:
> which AIGO control is intended to address the mapped requirement.
It does not establish:
> that the organization complies with the requirement.
That determination requires:
* applicable-law analysis;
* factual evidence;
* control implementation;
* operating effectiveness;
* assurance;
* and, where relevant, statutory conformity or regulatory determination.
***
# 147. Control Exceptions and Risk Acceptance
AIGO risk acceptance cannot authorize conduct that is prohibited by applicable law.
For lawful but risky activities, an organization may use its approved risk-acceptance process where permitted.
The control mapping should therefore distinguish:
```text theme={null}
LEGAL_PROHIBITION
```
from:
```text theme={null}
RESIDUAL_ORGANIZATIONAL_RISK
```
***
# 148. Control Review Frequency
Controls should be reviewed:
* at least annually;
* after legal changes;
* after material incidents;
* after major AI-system changes;
* after material assurance findings;
* when control effectiveness is questioned.
***
# 149. Regulatory Change Review
A control mapping should be reviewed after:
* AI Act amendments;
* delegated acts;
* implementing acts;
* Commission guidance;
* AI Office guidance;
* AI Board recommendations;
* standards affecting implementation.
Regulation (EU) 2026/1744 is the current amendment baseline and must be monitored for implementation effects.
***
# 150. Control Mapping Governance
The control mapping should have:
* Mapping Owner;
* Legal/Compliance Reviewer;
* AI Governance Owner;
* Control Owner;
* Evidence Owner;
* Assurance Reviewer;
* Framework Architect.
***
# 151. Control Mapping Assurance
An independent reviewer should verify, where appropriate:
* legal-source accuracy;
* completeness;
* control suitability;
* traceability;
* evidence;
* timeline;
* criticality.
***
# 152. Control Mapping Improvement
Improvements should be generated from:
* legal changes;
* incidents;
* assurance findings;
* control failures;
* evidence gaps;
* implementation experience.
***
# 153. Control Mapping Retirement
A control mapping entry may be retired when:
* legal requirement is repealed;
* control is superseded;
* AIGO architecture changes;
* regulatory relationship is no longer applicable.
Historical mappings should remain recoverable.
***
# 154. Historical Control Mapping
A historical control mapping should preserve:
* legal version;
* control version;
* applicability date;
* status;
* supersession reason.
This supports historical auditability.
***
# 155. Current Regulatory Baseline
This document's legal baseline is:
```text theme={null}
Regulation (EU) 2024/1689
+
Regulation (EU) 2026/1744
```
The 2026 amendment is the current amendment included in version 0.1 of this mapping.
***
# 156. Validation Requirements
The control mapping should pass:
### Legal Validation
Every material control relationship has a legal source.
### Reference Validation
AIGO control IDs resolve.
### Applicability Validation
Conditional controls identify their conditions.
### Timeline Validation
Dates reference the authoritative timeline.
### Traceability Validation
Requirement → Control → Evidence chain exists.
### Coverage Validation
Critical requirements are mapped.
### Consistency Validation
Control names and IDs are consistent across the AIGO repository.
### Document Integrity Validation
The mapping document and registry are structurally sound.
***
# 157. Limitations
This mapping cannot independently establish:
* legal compliance;
* control effectiveness;
* statutory conformity;
* validity of a regulatory interpretation;
* adequacy of evidence;
* adequacy of a notified body;
* legality of a specific AI deployment.
Those determinations require appropriate factual, technical, legal, and assurance review.
***
# 158. Relationship to Repository Health
The Repository Health Checker should treat this mapping as a core cross-reference layer.
Potential repository-health checks include:
```text theme={null}
Control Mapping Present
Control IDs Valid
Critical Requirements Covered
Evidence Relationships Present
Timeline Relationships Present
No Orphaned Controls
No Duplicate Mapping IDs
No Stale Legal Source
```
***
# 159. Final Control-Mapping Lifecycle
The intended AIGO control lifecycle is:
```text theme={null}
Legal Requirement
↓
Applicability
↓
Control Mapping
↓
Control Definition
↓
Implementation
↓
Evidence
↓
Monitoring
↓
Assessment
↓
Assurance
↓
Finding
↓
Improvement
↓
Revalidation
```
***
# 160. Document Control
| Field | Value |
| ------------------------- | ----------------------------------- |
| Document | AIGO EU AI Act AIGO Control Mapping |
| Version | 0.1 |
| Status | Draft |
| Document Identifier | `AIGO-MAP-EUAI-012` |
| Document Type | EU AI Act Mapping |
| Primary Purpose | Requirement-to-control crosswalk |
| Primary Legal Instrument | Regulation (EU) 2024/1689 |
| Amendment Baseline | Regulation (EU) 2026/1744 |
| Owner | |
| Legal/Compliance Reviewer | |
| Governance Reviewer | |
| Control Reviewer | |
| Framework Architect | |
| Approved By | |
| Effective Date | |
| Next Review Date | |
***
# 161. Document Status
**Document:** AIGO — EU AI Act AIGO Control Mapping
**Version:** 0.1
**Status:** Draft
**Working Name:** AIGO
**Full Name:** AI Governance Operating Framework
**Document Identifier:** `AIGO-MAP-EUAI-012`
**Document Type:** EU AI Act Mapping
This document establishes the detailed control-level crosswalk between the EU AI Act and the AIGO AI Governance Operating Framework, including applicability, classification, prohibited practices, risk, data, documentation, record keeping, transparency, human oversight, performance, robustness, cybersecurity, quality, conformity, registration, GPAI, AI literacy, fundamental rights, monitoring, incidents, change management, regulatory interaction, evidence, assurance, improvement, and retirement.
End of Document