AI Act Obligation Mapperevery EU AI Act obligation, mapped to the controls you run
For general counsel and AI compliance leads at AI vendors. Free directory; USD 499 conformance kit.

The EU AI Act obligation directory: what each article requires, and the controls behind it

Read from the real rules, not invented. Every answer AI Act Obligation Mapper gives points to the official rule behind it, so you can check any line yourself. Read from EU AI Act, NIST AI Risk Management Framework (AI RMF 1.0) and ISO/IEC 42001:2023.

Read from the real rules153 held rules behind itCross-checked against 59 related standardsCheck any line yourself

The EU AI Act obligation directory lists all 43 obligations the Act places on AI providers, deployers, importers, distributors and general-purpose model providers, one page each. Every page says what the article requires, who it binds, the evidence it calls for and the NIST AI RMF and ISO/IEC 42001 controls behind it. The directory is free; the conformance kit is USD 499.

Browse the 43 obligationsGet the kit, USD 499Compare the plans
Three colleagues at a table reviewing printed documents by hand
The Act lands on a named party in the value chain, not on a category of software. Read your own obligations first, then the controls you already run behind them: every page names the party, the article and the evidence, and the free directory stays free.

Browse the 43 obligations

9 groups, 37 with a linked NIST AI RMF or ISO/IEC 42001 control, 6 left unlinked and marked so. Type an article number or a word to filter.

General Provisions and Prohibited Practices

  1. Art.4AI literacy
  2. Art.5Prohibited AI practices

High-Risk Classification and Requirements

  1. Art.6Classification rules for high-risk AI systems
  2. Art.8Compliance with the requirements
  3. Art.9Risk management system
  4. Art.10Data and data governance
  5. Art.11Technical documentation
  6. Art.12Record-keeping (logs)
  7. Art.13Transparency and provision of information to deployers
  8. Art.14Human oversight
  9. Art.15Accuracy, robustness and cybersecurity

High-Risk Operator Obligations

  1. Art.16Obligations of providers of high-risk AI systems
  2. Art.17Quality management system
  3. Art.18Documentation keeping
  4. Art.19Automatically generated logs
  5. Art.20Corrective actions and duty of information
  6. Art.21Cooperation with competent authorities
  7. Art.22Authorised representatives of providers of high-risk AI systems
  8. Art.23Obligations of importers
  9. Art.24Obligations of distributors
  10. Art.25Responsibilities along the AI value chain
  11. Art.26Obligations of deployers of high-risk AI systems
  12. Art.27Fundamental rights impact assessment for high-risk AI systems

Notified Bodies, Standards and Conformity Assessment

  1. Art.41Common specifications
  2. Art.43Conformity assessment
  3. Art.46Derogation from conformity assessment procedure
  4. Art.47EU declaration of conformity
  5. Art.48CE marking
  6. Art.49Registration

Transparency Obligations

  1. Art.50Transparency obligations for providers and deployers of certain AI systems

General-Purpose AI Models

  1. Art.51Classification of general-purpose AI models as general-purpose AI models with systemic risk
  2. Art.52Procedure
  3. Art.53Obligations for providers of general-purpose AI models
  4. Art.54Authorised representatives of providers of general-purpose AI models
  5. Art.55Obligations of providers of GPAI models with systemic risk

Innovation Measures

  1. Art.59Further processing of personal data for developing certain AI systems in the public interest in the AI regulatory sandbox
  2. Art.60Testing of high-risk AI systems in real world conditions outside AI regulatory sandboxes
  3. Art.61Informed consent to participate in testing in real world conditions outside AI regulatory sandboxes

Governance and EU Database

  1. Art.71EU database for high-risk AI systems

Post-Market Monitoring, Market Surveillance and Rights

  1. Art.72Post-market monitoring by providers and post-market monitoring plan for high-risk AI systems
  2. Art.73Reporting of serious incidents
  3. Art.86Right to explanation of individual decision-making
  4. Art.87Reporting of infringements and protection of reporting persons

Who has to follow the EU AI Act, and who does not?

The Act binds operators in the AI value chain: providers who place a system or a model on the Union market, deployers who use one in the Union, importers and distributors who move one into the Union, and the authorised representatives of providers established outside the Union. A rule lands on the party named in the article, not on everyone who touches the system. Some duties fall on any operator (the prohibitions in Article 5, the transparency duties in Article 50), others only on providers, and others only on deployers. Each page below names the party.

Which EU AI Act articles create obligations?

This directory carries 43 of them across 9 groups, from AI literacy (Article 4) and the prohibitions (Article 5) through high-risk classification, the provider and deployer duties, conformity assessment, the general-purpose AI model duties, and post-market monitoring. It is the operational core, not the recitals and not the annexes.

When do the EU AI Act obligations apply?

The Act applies in stages. The prohibitions and AI literacy applied first; the general-purpose model duties next; the transparency duties in August 2026; and the high-risk duties for stand-alone Annex III systems now fall on 2 December 2027, with AI embedded in regulated products on 2 August 2028, after the Digital Omnibus on AI amended Article 113. The dates are below, each with its source.

DateWhat applies
2 February 2025AI literacy (Article 4) and the prohibited practices (Article 5) apply. Most of Chapter I and Chapter II. source
2 August 2025Notified bodies (Chapter III, Section 4), the general-purpose AI model duties (Chapter V), governance (Chapter VII) and confidentiality (Article 78). source
27 July 2026Regulation (EU) 2026/1744, the Digital Omnibus on AI, enters into force and amends the application dates in Article 113. Articles 102 to 110 apply. source
2 August 2026Article 50 transparency duties apply, except the marking duty in Article 50(2) for systems already on the market, which moves to 2 December 2026. source
2 December 2026The Article 50(2) marking duty bites for systems already on the market at 2 August 2026, and the new prohibitions on non-consensual intimate imagery and child sexual abuse material apply. source
2 December 2027The high-risk obligations for stand-alone systems listed in Annex III apply (Article 6(2)). This was 2 August 2026 before the Omnibus. source
2 August 2028The high-risk obligations for AI embedded in regulated products listed in Annex I apply (Article 6(1)). This was 2 August 2027 before the Omnibus. source

Dates are Article 113 of Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744 (the Digital Omnibus on AI), verified on 2026-10-16 against the European Commission AI Act Service Desk. The schedule changed once and can change again; this page is dated for that reason.

Which obligations apply to general-purpose AI models?

Chapter V of the Act adds duties for providers of general-purpose AI models, including classification for systemic risk, the technical documentation, a copyright policy and a public training-content summary, and extra duties where systemic risk applies. These apply from 2 August 2025. Article 53 and Article 55 are the core.

Which obligations apply to high-risk AI systems?

For systems classified as high-risk, Chapter III sets requirements (a risk management system, data governance, technical documentation, logging, transparency to deployers, human oversight, accuracy and cybersecurity) and then splits the operator duties between providers, deployers, importers and distributors. Article 26 is the deployer duty and Article 16 is the provider duty.

How does each page line up with the NIST AI RMF and ISO/IEC 42001?

Each page shows the NIST AI RMF and ISO/IEC 42001 controls the held rule set records as topical matches, each with its confidence and the one-line reason. 37 of 43 obligations carry at least one linked control, across 71 NIST links and 79 ISO links. A link is a reading, not a proof: it does not establish that meeting one requirement satisfies the other, and it is not certification.

What does the free directory include, and what does the kit cost?

The directory is free: every obligation page, the four-market view and the answers. The conformance kit is USD 499 one off, and the obligation watch is USD 49 a month or USD 490 a year. The kit renders the set for your roles, adds the evidence register and exports the CSV; the watch tells you when the obligation set changes. See the pricing.

What the directory does not do

It does not give legal advice, does not decide whether the Act applies to you, does not certify, and does not file your evidence. It explains obligations and points to the article, and it names the scope question rather than guessing an answer. Compare it with a consultant, a spreadsheet and the free explorers.

How is it built and kept current?

Every page is generated from one held record: the EU AI Act rule set, exported from our rule set at build time, with the control text, the article reference and the cross-references. Nothing on a page is written at your request and no model is called. When the rule set or the Act changes, the record is refreshed and the pages are rebuilt. Read how it is built.

The rules this is built from

Nothing here is invented. AI Act Obligation Mapper reads the official rules listed below, by market, and every answer points to the one it came from. The same rules are cross-checked against related standards, the way a compliance team checks them.

Other

189 controls kept in full. Cross-checked against 59 related standards.

See the standards How this is built