AI Act Obligation Mapperevery EU AI Act obligation, mapped to the controls you run

How the obligation pages are built

The directory is generated from one held record: the EU AI Act rule set, exported at build time with each article, the evidence it calls for and the NIST AI RMF and ISO/IEC 42001 controls behind it. Nothing is written while you read, and no model is called. The directory is free; the conformance kit is USD 499.

One record, every output

The same record drives the free pages, the specimen, the paid kit and the CSV export. A correction is not done until the same input gives the same answer in every output, so a page and the kit never disagree.

What is in the record

Why some obligations have no linked control

37 of 43 obligations carry at least one linked control; 6 do not, and those pages say so. A missing link is left missing, never filled with a guess. A link is a topical reading, not a proof that one requirement satisfies another.

How the four-market view is chosen

For each of the United States, the European Union, the United Kingdom and Australia, we look at the held rule sets and choose the ones that actually bear on an AI vendor and its counsel in that market, then name them on the four markets page in that order. Where a market has no AI-specific rule set held, the page names the obligation and says the text is not held rather than quoting something we do not keep.

Dates

The application dates come from Article 113 of Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744. They are verified against the European Commission AI Act Service Desk and the page is dated, because the schedule moved once and can move again. This page does not carry a date it cannot stand behind.

What this is not

It is not legal advice, not a certification, and not a decision about your own scope. It is a reading of the Act with the controls behind it, so your team and your counsel can work from one page per article. Compare it with the alternatives.