Cross-reference
EU AI Act
31 items: 19 met directly by a control at Level 3, 11 partly, 1 deliberately out of scope.
| Ref | Item (our description) | Controls | Note |
|---|---|---|---|
| Art 4 | Make sure staff and others who run or use AI on the organisation's behalf are sufficiently AI literate | PPL-01 direct, PPL-05 partial, PPL-02 partial | PPL-01 Level 3 requires the literacy baseline for all staff and for contractors and others who operate AI on the organisation's behalf, with completion recorded; PPL-05 adds learning suited to role and context, and reaches suppliers and contractors who operate AI for the organisation. Considering the people the AI is used on is not named, but is a factor the Act asks to be taken into account rather than a separate duty. |
| Art 5 | Do not use AI for any prohibited practice | GOV-03 direct, GOV-01 partial, STR-02 partial, RSK-04 partial | GOV-01 Level 3 requires the prohibited uses to include practices banned by law, and GOV-03 Level 3 screens each proposed use against prohibited practices in the approval route. AI added to bought products after purchase reaches that screen through RSK-09 due diligence on updates to existing products. |
| Art 6 | Work out whether each use of AI is high-risk under Annex I or Annex III, and record the reasoning | GOV-06 direct, RSK-04 partial, GOV-03 partial | GOV-06 Level 3 records each inventory entry's regulatory risk classification with reasons, and RSK-04 records the organisation's regulatory role for each use. Where the organisation is the provider and relies on the Art 6(3) derogation, the recorded reasons serve as the documented assessment; registering such a system under Art 49(2) is a provider obligation not itemised here. |
| Art 25 | Know when rebranding, substantially modifying or repurposing an AI system makes the organisation its provider | RSK-04 direct, GOV-03 partial, TEC-05 partial, OPM-04 partial | RSK-04 Level 3 records the organisation's regulatory role (for example provider or deployer) for each use and re-checks it when purpose, branding or the system changes, which catches the three Art 25(1) triggers. Still partial: Art 25(4) written agreements with suppliers of components for a high-risk system; OPM-04 terms cover transparency and model change notice, not the information, capabilities and technical access a provider needs. |
| Art 26(1) | Use high-risk AI in line with the provider's instructions for use, through technical and organisational measures | RSK-09 partial, GOV-03 partial, MON-02 partial, PPL-08 partial | RSK-09 Level 3 obtains the provider's instructions for use before use, approval sets the purpose (GOV-03) and monitoring catches use outside it (MON-02). Still missing: a requirement to build the instructions for use into approval conditions, staff guidance and monitoring, so that use follows them. |
| Art 26(2) | Give human oversight to people with the competence, training, authority and support to do it | RSK-07 direct, PPL-05 partial | RSK-07 Level 3 names who reviews, with what information and authority to override or stop, and requires reviewers to be trained. |
| Art 26(4) | Where it controls input data, make sure it is relevant and sufficiently representative for the intended purpose | DAT-03 direct, RSK-06 partial | DAT-03 Level 3 sets quality requirements for each use that include relevance and representativeness for the intended purpose, assessed before use and at intervals. |
| Art 26(5) | Monitor operation, tell the provider and regulator of risks and suspend use, and report serious incidents | MON-09 direct, MON-02 direct, RSK-04 partial, RSK-09 partial, OPM-09 partial, RSK-07 partial | MON-02 Level 3 monitors AI provided by others against the provider's instructions for use, and MON-09 Level 3 covers serious incident notification with deadlines, the suspension decision, and telling the supplier and, where the law requires, the regulator of risks short of a serious incident. |
| Art 26(6) | Keep automatically generated logs under its control for at least six months, or longer where the law requires | DAT-06 direct, MON-02 partial | DAT-06 Level 3 covers system logs, kept at least as long as the law requires, within records and retention rules applied to every use of AI. MON-02 requires event logging in use. |
| Art 26(7) | Before using high-risk AI at work, inform workers' representatives and the workers affected | CUL-03 direct, CUL-02 partial, PPL-06 partial | CUL-03 Level 3 involves affected staff and their representatives at the design stage of significant uses, which goes beyond informing them. |
| Art 26(8) | Public authority deployers register their use, and do not use a high-risk system missing from the EU database | RSK-09 direct, GOV-09 partial | RSK-09 Level 3 checks regulatory status including registration before use, does not use high-risk AI that is not registered where the law requires it, and tells the provider or distributor; GOV-09 completes registrations the law requires before use. |
| Art 26(9) | Use the provider's transparency information when carrying out a data protection impact assessment | DAT-05 partial, RSK-03 partial, GOV-07 partial, RSK-09 partial | Data protection advice (DAT-05), the privacy part of the impact assessment (RSK-03) and the data protection step in existing governance (GOV-07) cover the assessment, and RSK-09 Level 3 obtains the provider's instructions for use. Still missing: a requirement to use that provider information in the data protection impact assessment. |
| Art 26(10) | Get authorisation for, limit, document and report post-remote biometric identification in criminal investigations | none | out of scope: applies only to law enforcement use of post-remote biometric identification; a sector overlay would be needed. |
| Art 26(11) | Tell people when an Annex III high-risk system makes or helps make decisions about them | RSK-08 direct | RSK-08 Level 3 requires people to be told AI was involved in every decision it supports about them. |
| Art 26(12) | Cooperate with competent authorities acting on the high-risk system | RSK-04 direct, GOV-05 partial | RSK-04 Level 3 names an owner for contact with regulators for each use, alongside an owner for each obligation; GOV-05 names owners per use. |
| Art 27 | Public bodies, providers of public services and some credit and insurance deployers assess fundamental rights impact first | RSK-03 partial, RSK-07 partial, RSK-08 partial, RSK-04 partial | RSK-03 Level 3 assesses rights before go-live, signs off, tracks mitigations and is kept current during use; RSK-04 lists the reporting duties that follow from the organisation's role. Still missing: the set contents (processes, period and frequency of use, categories of people affected, oversight measures, complaint mechanisms) and an explicit duty to notify the market surveillance authority of the results. |
| Art 49(3) | Public authority deployers register themselves and their use of an Annex III high-risk system before use | GOV-09 direct, RSK-04 partial | GOV-09 Level 3 requires any registration the law requires to be completed before use, and GOV-09 applicability is core, so public bodies outside the UK are covered. |
| Art 50(1) | As provider, design AI that interacts with people so they are told it is AI | RSK-08 direct, OPM-06 partial | RSK-08 Level 3 requires people to be told when they are interacting with AI, at first contact, clearly and accessibly, unless it is obvious, which also meets the manner set by Art 50(5). Building this into the design of systems the organisation provides rests on OPM-06 delivery standards. |
| Art 50(2) | As provider of a generative system, mark outputs in a machine-readable way as AI generated | TEC-02 direct | TEC-02 Level 3 requires the reference patterns to mark outputs as AI generated in a machine-readable way where the organisation builds or offers generative AI. The technical quality the Act expects (effective, interoperable, robust and reliable as far as feasible) is left to the technical standard the pattern adopts. |
| Art 50(3) | As deployer of emotion recognition or biometric categorisation, inform the people exposed to it | RSK-08 direct, DAT-05 partial | RSK-08 Level 3 requires people exposed to emotion recognition or biometric categorisation to be told at first contact, clearly and accessibly; DAT-05 covers lawful processing of the personal data. |
| Art 50(4) | As deployer, disclose deep fakes and AI generated text published to inform the public | GOV-10 direct, GOV-09 partial | GOV-10 Level 3 sets rules for reviewing and disclosing AI generated content released outside the organisation, including synthetic media, with disclosure at least as the law requires made clearly at first exposure. This also meets the manner set by Art 50(5). |
| Art 73 | Report serious incidents to the authorities within the legal deadlines where the deployer must do so | MON-09 direct, RSK-04 partial | MON-09 Level 3 defines serious incidents as the law requires and sets routes and deadlines for notifying regulators, which covers the deployer's reporting where it cannot reach the provider (Art 26(5)); RSK-04 lists the reporting duties. |
| Art 86 | Give affected people a clear explanation of the AI's role and the main elements of a high-risk decision | RSK-08 direct, DAT-06 partial | RSK-08 Level 3 gives a meaningful explanation and a route to challenge for every decision about people; DAT-06 keeps the records the explanation needs. |
| Art 9 | Run a documented, continuous risk management system across the high-risk system's lifecycle, with testing | RSK-02 partial, RSK-01 partial, TEC-06 partial, MON-05 partial, RSK-06 partial | RSK-02 assesses and treats risk before approval and, again during live use and on material change, recording residual risk; RSK-01 sets acceptable risk, TEC-06 tests against criteria agreed in advance and MON-05 reviews by risk tier. Still missing: a risk process for each system fed by post-market monitoring data, reasonably foreseeable misuse, residual risk judged acceptable per hazard, and attention to under-18s and other vulnerable groups. |
| Art 10 | Govern training, validation and testing data for quality, representativeness and bias | DAT-03 partial, DAT-08 partial, RSK-06 partial | Quality, including relevance and representativeness for the intended purpose (DAT-03), provenance, with the preparation and labelling steps applied and how any synthetic or augmented data was generated and checked (DAT-08), and bias testing (RSK-06) are covered at organisation level; data set design choices, examination for bias in the training data itself, completeness of each data set, and the conditions for processing special category data to correct bias are system-level detail not required. |
| Art 11 | Draw up and keep current the technical documentation before the system is placed on the market or put into service | TEC-05 partial, OPM-06 partial | TEC-05 keeps documentation for each version suited to regulators; the contents the Act sets in Annex IV are not required. |
| Art 12 | Build automatic event logging into the system for its whole lifetime | MON-02 partial, TEC-02 partial | MON-02 requires event logging while in use; designing the system to record events automatically over its lifetime, with the content needed for traceability and post-market monitoring, is not required. |
| Art 13 | Give deployers instructions for use and enough transparency to understand and use the outputs | TEC-05 partial, RSK-08 partial | TEC-05 provides documentation for users and operators, which states intended purpose and users, how it works, inputs and outputs, known limitations and where it must not be relied on. Still missing from the Act's set contents: accuracy and its metrics, oversight measures and log handling. |
| Art 14 | Design the system so people can oversee it effectively, including override and stop | RSK-07 partial, TEC-04 partial, TEC-02 partial, MON-01 partial | RSK-07 sets the oversight model for each use and TEC-04 makes integrations able to be switched off; TEC-02 patterns build in explainability of outputs and MON-01 measures reliance against accuracy, which shows automation bias in use. Building the full set of oversight measures into each system (tools to interpret outputs, override and a stop function, separate verification by two people for some biometric identification) remains a design duty not required. |
| Art 15 | Achieve and declare appropriate accuracy, robustness and cybersecurity throughout the lifecycle | TEC-06 partial, SEC-06 partial, SEC-01 partial, SEC-02 partial, OPM-09 partial, MON-02 partial, OPM-06 partial | Testing (TEC-06), the security baseline and threat modelling (SEC-01, SEC-02), fallbacks (OPM-09) and drift monitoring (MON-02) cover much, SEC-06 adds security testing against the threat model, and OPM-06 sets accuracy, robustness and reliability requirements at design. Still not explicit: declaring accuracy levels in the instructions, consistent performance across the lifecycle, managing feedback loops in systems that keep learning, and resilience against data poisoning and adversarial inputs as a design requirement. |
| Art 17 | Put a documented quality management system in place for high-risk systems the organisation provides | GOV-01 partial, OPM-06 partial, POR-04 partial, RSK-02 partial, DAT-06 partial, GOV-05 partial, RSK-04 partial, MON-09 partial | Operated as a whole, the framework covers most listed aspects (design and development procedures, testing, data management, risk management, records, resources, accountability). MON-09 covers serious incident reporting and RSK-04 names an owner for contact with regulators. Still missing: a regulatory compliance strategy covering conformity assessment and management of modifications, post-market monitoring under Art 72, and communication with notified bodies. |
References and short descriptions only; see the source publication for its own text. The cross-reference is the author's interpretation and is not endorsed by the publisher. See notices.