# Regulation (EU) 2024/1689 (Artificial Intelligence Act), as amended by Regulation (EU) 2026/1744 Framework id: `eu_ai_act`. AI Regulation. Publisher: European Parliament and Council of the European Union. Version: 2024/1689, as amended by 2026/1744. Region: EU. Mapping licence: CC BY-SA 4.0. Source text: https://eur-lex.europa.eu/eli/reg/2024/1689/oj Each line is a clause, the NIST SP 800-53 controls OSA maps to it, and OSA's estimate of how far those controls cover it. Clause titles and coverage figures are OSA's own summaries and estimates, so quote the source, not this card. How this mapping was made: OSA's own analysis. NIST's catalogue of registered crosswalks has none for the AI Act, and NIST's crosswalk of January 2023 relates the AI RMF's trustworthiness characteristics to the Act as proposed, not to SP 800-53 (checked 26 October 2026). Each of the 52 clauses was rated three times, independently, against the control statements, by AI models. A control is listed for a clause where at least two of the three ratings named it. The coverage figure is the median of the three estimates of how much of the clause an organisation would meet by implementing the listed controls. The rationale and gaps were written after the controls were settled. Texts: Regulation (EU) 2024/1689 (Artificial Intelligence Act) (Official Journal of the European Union, 12 July 2024); Regulation (EU) 2026/1744 (Digital Omnibus on AI), amending it (Official Journal of the European Union, July 2026; in force 27 July 2026); Consolidated text of Regulation (EU) 2024/1689 as at 27 July 2026, from which the clauses are quoted (EU Publications Office, CELEX 02024R1689-20260727). ## When it applies Source: Article 113 of Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744. - From 2025-02-02: Chapters I and II: AI literacy (Article 4) and the prohibited practices of Article 5, except the prohibitions added in 2026. - From 2025-08-02: The obligations of providers of general-purpose AI models (Chapter V, Articles 53 to 55), with Chapter III Section 4, Chapters VII and XII (except Article 101) and Article 78. - From 2026-07-27: Regulation (EU) 2026/1744 in force, with Article 4a, which it inserts. - From 2026-08-02: The rest of the Regulation, including the transparency obligations of Article 50, except as below. - From 2026-12-02: The prohibitions added in 2026: Article 5(1), first subparagraph, points (ba) and (bb), and Article 5(1a) and (1b). - From 2027-12-02: Chapter III, Sections 1 to 3, for AI systems classified as high-risk under Article 6(2) and Annex III, except Article 6(5). - From 2028-08-02: Chapter III, Sections 1 to 3, for AI systems classified as high-risk under Article 6(1) and Annex I. Most clauses in this mapping are obligations for high-risk AI systems (Chapter III), which apply from 2 December 2027 or 2 August 2028. AI literacy and the prohibitions have applied since 2 February 2025, the obligations of providers of general-purpose AI models since 2 August 2025, and the transparency obligations of Article 50 from 2 August 2026. ## Clauses (52, average coverage 41%) - Art.4 AI literacy of staff and others operating AI systems: AT-02, AT-03 (40%) - Art.4a Special categories of personal data processed for bias detection and correction, and its safeguards: AC-03, AC-04, AC-06, AU-12, PM-25, PS-06, PT-02, PT-03, PT-07, SC-28, SI-12, SI-19 (70%) - Art.5 Prohibited AI practices: PT-03, PT-04, SI-15 (10%) - Art.6(4) Documented assessment that an Annex III system is not high-risk: RA-02, RA-03 (35%) - Art.9(1)-(2) Risk management system: established, documented and maintained as a continuous iterative process: CA-07, PM-09, RA-01, RA-03, RA-07, SA-03 (60%) - Art.9(5) Risk management measures and acceptable residual risk: CA-06, PM-28, RA-07, SA-05, SA-08, SA-16 (55%) - Art.9(6)-(8) Testing of high-risk AI systems against defined metrics: CA-02, SA-11, SA-15 (55%) - Art.9(9) Impact on persons under 18 and other vulnerable groups: RA-03 (15%) - Art.10(1)-(2) Data governance and management practices for training, validation and testing data: CM-13, PM-22, PM-23, PT-03, SR-04 (35%) - Art.10(3)-(4) Quality of data sets: relevant, representative, free of errors and complete: PM-22, SI-10, SI-18 (25%) - Art.11 Technical documentation, drawn up before placing on the market and kept up to date: PL-02, SA-05, SA-17 (45%) - Art.12 Record-keeping: automatic logging of events over the system's lifetime: AU-02, AU-03, AU-08, AU-12 (80%) - Art.13 Transparency to deployers and instructions for use: SA-05 (35%) - Art.14(1)-(3) Human oversight designed into the system: AC-04, SI-07 (20%) - Art.14(4) What the people assigned to oversight must be enabled to do: CP-12, PE-10, SA-05, SI-04, SI-10 (40%) - Art.15(1)-(4) Accuracy and robustness, with declared levels, resilience to errors and fail-safe plans: CA-07, CP-02, CP-09, SA-24, SC-24, SI-10, SI-13, SI-17 (45%) - Art.15(5) Cybersecurity, including against data poisoning, model poisoning, adversarial examples and confidentiality attacks: AC-03, AC-23, CA-08, IR-04, RA-05, SC-28, SI-02, SI-04, SI-07, SI-10, SI-15, SR-04 (65%) - Art.17 Quality management system: CA-07, CM-03, IR-08, PM-01, PM-09, SA-01, SA-02, SA-03, SA-11, SA-15, SI-12, SR-05 (60%) - Art.18 Keeping documentation for ten years: SI-12 (60%) - Art.19 Keeping automatically generated logs: AU-04, AU-09, AU-11 (85%) - Art.20 Corrective actions and duty of information: CA-05, IR-04, IR-06, SI-02, SR-08 (40%) - Art.21 Cooperation with competent authorities: AU-07, AU-16 (25%) - Art.22 Authorised representatives of providers established outside the Union: no control mapped (0%) - Art.23 Obligations of importers: SI-12, SR-05, SR-08, SR-11 (20%) - Art.24 Obligations of distributors: SR-05, SR-08 (15%) - Art.25(4) Written agreements with suppliers of AI systems, tools, services, components or processes: SA-04, SA-09, SR-08 (55%) - Art.26(1)-(2) Deployers: use according to the instructions, and human oversight by competent people: AT-03, PL-04, PM-32, PS-09 (45%) - Art.26(4) Deployers: input data relevant and representative: SI-10, SI-18 (25%) - Art.26(5) Deployers: monitoring the system's operation, informing the provider and suspending use: CA-07, IR-04, IR-06, SI-04 (55%) - Art.26(6) Deployers: keeping the logs: AU-04, AU-09, AU-11 (85%) - Art.26(7) Deployers: informing workers before use at the workplace: PT-05 (30%) - Art.26(9) Deployers: data protection impact assessment: RA-08 (65%) - Art.26(11) Deployers: informing natural persons subject to the system's decisions: PT-05 (45%) - Art.27 Fundamental rights impact assessment: PM-26, RA-03, RA-08 (40%) - Art.43 Conformity assessment: CA-02, CA-06, CM-04 (30%) - Art.47 EU declaration of conformity: SI-12 (10%) - Art.48 CE marking: no control mapped (0%) - Art.49 Registration in the EU database: no control mapped (0%) - Art.50(1) Informing people that they are interacting with an AI system: AC-08, PT-05 (50%) - Art.50(2) Marking synthetic content as artificially generated, in a machine-readable form: AC-16, AU-10, SC-16 (40%) - Art.50(3) Informing people exposed to emotion recognition or biometric categorisation: PT-02, PT-05, PT-07, SC-42 (55%) - Art.50(4) Disclosing deep fakes and AI-generated text published to inform the public: AC-16 (20%) - Art.53(1)(a)-(b) General-purpose AI models: technical documentation, and information for downstream providers: SA-05, SA-11, SA-17 (40%) - Art.53(1)(c) General-purpose AI models: policy to comply with Union copyright law: CM-10 (15%) - Art.53(1)(d) General-purpose AI models: public summary of the content used for training: SR-04 (10%) - Art.55(1)(a) Systemic risk: model evaluation, including adversarial testing: CA-08, SA-11 (50%) - Art.55(1)(b) Systemic risk: assessing and mitigating systemic risks: PM-09, RA-03, RA-07 (40%) - Art.55(1)(c) Systemic risk: tracking, documenting and reporting serious incidents: IR-04, IR-05, IR-06 (70%) - Art.55(1)(d) Systemic risk: cybersecurity protection for the model and its physical infrastructure: AC-03, PE-03, RA-05, SC-07, SC-28, SI-04, SI-07 (70%) - Art.72 Post-market monitoring system and plan: CA-07 (55%) - Art.73 Reporting serious incidents: IR-04, IR-06 (65%) - Art.86 Explanation of individual decisions to affected persons: PM-26 (10%) ## More - A pattern's controls with their clauses in this framework: /api/v1/patterns/{id}/crosswalk?framework=eu_ai_act - Control-to-clause mappings as JSON: /api/v1/frameworks/eu_ai_act?fields=mappings&per_page=100 - Rationale and gaps for each clause, as JSON: https://raw.githubusercontent.com/opensecurityarchitecture/osa-data/main/data/framework-coverage/eu-ai-act.json - Page for people: /frameworks/eu-ai-act/ - Found an error? Open an issue at https://github.com/opensecurityarchitecture/osa-data/issues with the id, what OSA says and what the source says.