Regulation (EU) 2024/1689 (Artificial Intelligence Act), as amended by Regulation (EU) 2026/1744 — SP 800-53 Coverage
How well do NIST SP 800-53 Rev 5 controls address each EU AI Act requirement? This analysis maps from framework clauses back to SP 800-53, with expert coverage weightings and gap identification.
Clause-by-Clause Analysis
Sorted by clauseArt.4 AI literacy of staff and others operating AI systems
Art.4a Special categories of personal data processed for bias detection and correction, and its safeguards
Rationale
PT-07 sets conditions for specific categories of PII, PT-02 and PT-03 document the authority and purpose, and PM-25 limits the PII used in training and research. SI-19 de-identifies, AC-03, AC-04 and AC-06 restrict access and flows to authorised people, PS-06 binds them by access agreements, AU-12 records access, SC-28 protects the data at rest, and SI-12 disposes of it.
Gaps
Whether bias detection could be done with other data, and keeping the reasons for processing special categories in the records of processing, are legal judgements no control makes.
Art.5 Prohibited AI practices
Rationale
PT-03 limits processing to documented purposes, PT-04 asks for consent, and SI-15 checks that output is consistent with expected content.
Gaps
The prohibitions are legal limits on what may be placed on the market or used. No control prohibits an AI practice.
Art.6(4) Documented assessment that an Annex III system is not high-risk
Art.9(1)-(2) Risk management system: established, documented and maintained as a continuous iterative process
Rationale
RA-01 sets risk assessment policy and procedures, RA-03 identifies and updates risks, RA-07 responds to them and PM-09 sets the strategy. SA-03 carries risk management through the life cycle, and CA-07 feeds monitoring back in.
Gaps
Risks to health, safety and fundamental rights, and those from reasonably foreseeable misuse, go beyond the controls' security and privacy focus.
Art.9(5) Risk management measures and acceptable residual risk
Rationale
RA-07 responds to risk, PM-28 documents risk tolerance, CA-06 has residual risk accepted, SA-08 designs risk out, and SA-05 and SA-16 give users documentation and training.
Gaps
Judging residual risk acceptable against the Act's standard is not covered.
Art.9(6)-(8) Testing of high-risk AI systems against defined metrics
Rationale
SA-11 plans and carries out developer testing and evaluation, SA-15 sets the development process and tools, and CA-02 assesses the system against a plan.
Gaps
Testing against prior metrics and probabilistic thresholds for the intended purpose, and in real-world conditions, is not covered.
Art.9(9) Impact on persons under 18 and other vulnerable groups 15%
Rationale
RA-03 determines the likelihood and impact of adverse effects on individuals.
Gaps
No control considers persons under 18 or other vulnerable groups.
Mapped Controls
Art.10(1)-(2) Data governance and management practices for training, validation and testing data
Rationale
PM-23 sets a data governance body, PM-22 manages data quality, SR-04 documents the provenance of data, PT-03 the purpose of its collection, and CM-13 maps the actions taken on it.
Gaps
Examining data sets for bias, and measures to detect, prevent and mitigate it, are not covered.
Art.10(3)-(4) Quality of data sets: relevant, representative, free of errors and complete
Art.11 Technical documentation, drawn up before placing on the market and kept up to date
Art.12 Record-keeping: automatic logging of events over the system's lifetime
Art.13 Transparency to deployers and instructions for use 35%
Rationale
SA-05 gives administrators and users documentation of the system's functions and how to use it.
Gaps
Accuracy levels, known limits, and what deployers need to interpret the output are not specified.
Mapped Controls
Art.14(1)-(3) Human oversight designed into the system
Art.14(4) What the people assigned to oversight must be enabled to do
Rationale
CP-12 enters a safe mode and PE-10 shuts the system off in an emergency, SI-10 provides a manual override, SI-04 monitors for anomalies, and SA-05 gives the overseers documentation.
Gaps
Awareness of automation bias, and correctly interpreting the output, are not covered.
Art.15(1)-(4) Accuracy and robustness, with declared levels, resilience to errors and fail-safe plans
Rationale
SI-13 manages failure and provides standby components, CP-09 backups, CP-02 a contingency plan, SC-24 and SI-17 fail-safe behaviour, SA-24 design for cyber resiliency, SI-10 handling of inconsistent input, and CA-07 monitoring.
Gaps
Declared levels of accuracy, and feedback loops in systems that keep learning, are not covered.
Art.15(5) Cybersecurity, including against data poisoning, model poisoning, adversarial examples and confidentiality attacks
Rationale
SI-07 protects integrity, SR-04 provenance, SI-10 validates input, SI-15 filters output, AC-23 protects against data mining and AC-03 against unauthorised alteration. SC-28 protects data at rest, SI-04 monitors, RA-05 and CA-08 find weaknesses, SI-02 remediates flaws, and IR-04 handles incidents.
Gaps
Attacks particular to AI, such as data poisoning, model poisoning, adversarial examples and model evasion, are not named.
Art.17 Quality management system
Rationale
PM-01 and SA-01 set the programme and its policy, SA-03 and SA-15 the development process, SA-11 testing, CM-03 change control, PM-09 risk management, CA-07 monitoring, IR-08 incident response, SI-12 record-keeping, SA-02 resources and SR-05 acquisition from suppliers.
Gaps
Communication with authorities and an accountability framework for management are not covered.
Art.18 Keeping documentation for ten years 60%
Rationale
SI-12 manages and retains information in line with requirements.
Gaps
The ten-year period and the documents to be kept are the Act's.
Mapped Controls
Art.19 Keeping automatically generated logs
Art.20 Corrective actions and duty of information
Rationale
SI-02 remediates flaws, IR-04 handles incidents, IR-06 reports them, CA-05 plans corrective actions and SR-08 sets notification agreements in the supply chain.
Gaps
Withdrawing, disabling or recalling a system, and informing authorities of a serious risk, are not covered.
Art.21 Cooperation with competent authorities
Art.22 Authorised representatives of providers established outside the Union 0%
Rationale
No SP 800-53 control addresses this clause.
Gaps
Appointing and mandating an authorised representative in the Union is a legal step.
Art.23 Obligations of importers
Rationale
SR-05 assesses components before acceptance, SR-11 detects counterfeit components, SR-08 sets notification agreements, and SI-12 retains records.
Gaps
Verifying the conformity assessment, documentation and CE marking before placing a system on the market is not covered.
Art.24 Obligations of distributors
Art.25(4) Written agreements with suppliers of AI systems, tools, services, components or processes
Rationale
SA-04 puts requirements in acquisition contracts, SA-09 requires external providers to comply, and SR-08 sets notification agreements with supply chain entities.
Gaps
The information, technical access and assistance the provider needs to comply with the Act are not specified.
Art.26(1)-(2) Deployers: use according to the instructions, and human oversight by competent people
Rationale
PL-04 sets rules of behaviour, PM-32 checks use against intended purpose, AT-03 trains people in their roles, and PS-09 documents their responsibilities.
Gaps
Assigning human oversight to people with the necessary authority and support is covered only in part.
Art.26(4) Deployers: input data relevant and representative
Art.26(5) Deployers: monitoring the system's operation, informing the provider and suspending use
Art.26(6) Deployers: keeping the logs
Art.26(7) Deployers: informing workers before use at the workplace 30%
Rationale
PT-05 gives individuals notice about the processing of their PII.
Gaps
Informing workers' representatives and affected workers before use at the workplace is not covered.
Mapped Controls
Art.26(9) Deployers: data protection impact assessment 65%
Rationale
RA-08 conducts privacy impact assessments.
Gaps
Using the provider's information for the assessment required under data protection law is not specified.
Mapped Controls
Art.26(11) Deployers: informing natural persons subject to the system's decisions 45%
Rationale
PT-05 gives individuals notice about the processing of their PII.
Gaps
Notice that a person is subject to a high-risk AI system's decisions is not specified.
Mapped Controls
Art.27 Fundamental rights impact assessment
Art.43 Conformity assessment
Rationale
CA-02 assesses controls against a plan and reports the results, CA-06 authorises the system, and CM-04 analyses the impact of changes, as a substantial modification needs.
Gaps
The conformity assessment procedure, and the role of notified bodies, are legal.
Art.47 EU declaration of conformity 10%
Rationale
SI-12 retains information in line with requirements.
Gaps
Drawing up, signing and updating the EU declaration of conformity is a legal act.
Mapped Controls
Art.48 CE marking 0%
Rationale
No SP 800-53 control addresses this clause.
Gaps
CE marking is a legal requirement.
Art.49 Registration in the EU database 0%
Rationale
No SP 800-53 control addresses this clause.
Gaps
Registration in the EU database is a legal requirement.
Art.50(1) Informing people that they are interacting with an AI system
Art.50(2) Marking synthetic content as artificially generated, in a machine-readable form
Art.50(3) Informing people exposed to emotion recognition or biometric categorisation
Rationale
PT-05 gives notice, PT-07 sets conditions for specific categories of PII such as biometric data, PT-02 documents the authority to process, and SC-42 controls sensor capability and the use of its data.
Gaps
Informing people that emotion recognition or biometric categorisation is in use is not specified.
Art.50(4) Disclosing deep fakes and AI-generated text published to inform the public 20%
Rationale
AC-16 can display attributes on output, such as a label that content is generated.
Gaps
Disclosing deep fakes and AI-generated text published to inform the public is not required.
Mapped Controls
Art.53(1)(a)-(b) General-purpose AI models: technical documentation, and information for downstream providers
Art.53(1)(c) General-purpose AI models: policy to comply with Union copyright law 15%
Rationale
CM-10 uses software and documentation in accordance with copyright law.
Gaps
Training data, and reservations of rights for text and data mining, are not covered.
Mapped Controls
Art.53(1)(d) General-purpose AI models: public summary of the content used for training 10%
Rationale
SR-04 documents the provenance of data, from which a summary could be drawn.
Gaps
No control requires a public summary of training content.
Mapped Controls
Art.55(1)(a) Systemic risk: model evaluation, including adversarial testing
Art.55(1)(b) Systemic risk: assessing and mitigating systemic risks
Art.55(1)(c) Systemic risk: tracking, documenting and reporting serious incidents
Art.55(1)(d) Systemic risk: cybersecurity protection for the model and its physical infrastructure
Rationale
AC-03 and PE-03 control logical and physical access, SC-07 protects the boundary, SC-28 data at rest, SI-07 integrity, SI-04 monitors, and RA-05 finds vulnerabilities.
Gaps
Protection particular to model weights and the model's physical infrastructure is not named.
Art.72 Post-market monitoring system and plan 55%
Rationale
CA-07 implements continuous monitoring.
Gaps
Collecting and analysing data on performance from deployers, and the post-market monitoring plan in the technical documentation, are not covered.
Mapped Controls
Art.73 Reporting serious incidents
Methodology and Disclaimer
This coverage analysis maps from EU AI Act clauses/requirements back to NIST SP 800-53 Rev 5 controls, assessing how well the SP 800-53 control set addresses each framework requirement.
Coverage weighting represents an informed estimate based on control-objective alignment, not a definitive compliance determination. Weightings consider whether SP 800-53 controls address the intent of each framework requirement, even where terminology and structure differ.
This analysis should be validated by qualified assessors for use in compliance or audit activities. The authoritative source for any compliance determination is always the framework itself.