Regulation (EU) 2024/1689 (Artificial Intelligence Act), as amended by Regulation (EU) 2026/1744
The European Union's law on artificial intelligence. It prohibits certain AI practices, sets requirements for high-risk AI systems (risk management, data governance, technical documentation, logging, transparency, human oversight, accuracy, robustness and cybersecurity) and the duties of their providers, deployers, importers and distributors, and sets obligations for providers of general-purpose AI models and transparency obligations for certain AI systems. It applies in stages: AI literacy and the prohibitions from February 2025, general-purpose AI models from August 2025, and high-risk systems from December 2027 or August 2028 after the 2026 amendments.
When it applies
Article 113 of Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744.
- From 2 February 2025
-
Chapters I and II: AI literacy (Article 4) and the prohibited practices of Article 5, except the prohibitions added in 2026.
- From 2 August 2025
-
The obligations of providers of general-purpose AI models (Chapter V, Articles 53 to 55), with Chapter III Section 4, Chapters VII and XII (except Article 101) and Article 78.
- From 27 July 2026
-
Regulation (EU) 2026/1744 in force, with Article 4a, which it inserts.
- From 2 August 2026
-
The rest of the Regulation, including the transparency obligations of Article 50, except as below.
- From 2 December 2026
-
The prohibitions added in 2026: Article 5(1), first subparagraph, points (ba) and (bb), and Article 5(1a) and (1b).
- From 2 December 2027
-
Chapter III, Sections 1 to 3, for AI systems classified as high-risk under Article 6(2) and Annex III, except Article 6(5).
- From 2 August 2028
-
Chapter III, Sections 1 to 3, for AI systems classified as high-risk under Article 6(1) and Annex I.
Most clauses in this mapping are obligations for high-risk AI systems (Chapter III), which apply from 2 December 2027 or 2 August 2028. AI literacy and the prohibitions have applied since 2 February 2025, the obligations of providers of general-purpose AI models since 2 August 2025, and the transparency obligations of Article 50 from 2 August 2026.
How this mapping was made
OSA's own analysis. NIST's catalogue of registered crosswalks has none for the AI Act, and NIST's crosswalk of January 2023 relates the AI RMF's trustworthiness characteristics to the Act as proposed, not to SP 800-53 (checked 26 October 2026). Each of the 52 clauses was rated three times, independently, against the control statements, by AI models. A control is listed for a clause where at least two of the three ratings named it. The coverage figure is the median of the three estimates of how much of the clause an organisation would meet by implementing the listed controls. The rationale and gaps were written after the controls were settled.
Texts
- Regulation (EU) 2024/1689 (Artificial Intelligence Act) (Official Journal of the European Union, 12 July 2024)
- Regulation (EU) 2026/1744 (Digital Omnibus on AI), amending it (Official Journal of the European Union, July 2026; in force 27 July 2026)
- Consolidated text of Regulation (EU) 2024/1689 as at 27 July 2026, from which the clauses are quoted (EU Publications Office, CELEX 02024R1689-20260727)
| Clause | Title | SP 800-53 Controls |
|---|---|---|
| Art.4 | AI literacy of staff and others operating AI systems | |
| Art.4a | Special categories of personal data processed for bias detection and correction, and its safeguards | |
| Art.5 | Prohibited AI practices | |
| Art.6(4) | Documented assessment that an Annex III system is not high-risk | |
| Art.9(1)-(2) | Risk management system: established, documented and maintained as a continuous iterative process | |
| Art.9(5) | Risk management measures and acceptable residual risk | |
| Art.9(6)-(8) | Testing of high-risk AI systems against defined metrics | |
| Art.9(9) | Impact on persons under 18 and other vulnerable groups | |
| Art.10(1)-(2) | Data governance and management practices for training, validation and testing data | |
| Art.10(3)-(4) | Quality of data sets: relevant, representative, free of errors and complete | |
| Art.11 | Technical documentation, drawn up before placing on the market and kept up to date | |
| Art.12 | Record-keeping: automatic logging of events over the system's lifetime | |
| Art.13 | Transparency to deployers and instructions for use | |
| Art.14(1)-(3) | Human oversight designed into the system | |
| Art.14(4) | What the people assigned to oversight must be enabled to do | |
| Art.15(1)-(4) | Accuracy and robustness, with declared levels, resilience to errors and fail-safe plans | |
| Art.15(5) | Cybersecurity, including against data poisoning, model poisoning, adversarial examples and confidentiality attacks | |
| Art.17 | Quality management system | |
| Art.18 | Keeping documentation for ten years | |
| Art.19 | Keeping automatically generated logs | |
| Art.20 | Corrective actions and duty of information | |
| Art.21 | Cooperation with competent authorities | |
| Art.22 | Authorised representatives of providers established outside the Union | |
| Art.23 | Obligations of importers | |
| Art.24 | Obligations of distributors | |
| Art.25(4) | Written agreements with suppliers of AI systems, tools, services, components or processes | |
| Art.26(1)-(2) | Deployers: use according to the instructions, and human oversight by competent people | |
| Art.26(4) | Deployers: input data relevant and representative | |
| Art.26(5) | Deployers: monitoring the system's operation, informing the provider and suspending use | |
| Art.26(6) | Deployers: keeping the logs | |
| Art.26(7) | Deployers: informing workers before use at the workplace | |
| Art.26(9) | Deployers: data protection impact assessment | |
| Art.26(11) | Deployers: informing natural persons subject to the system's decisions | |
| Art.27 | Fundamental rights impact assessment | |
| Art.43 | Conformity assessment | |
| Art.47 | EU declaration of conformity | |
| Art.48 | CE marking | |
| Art.49 | Registration in the EU database | |
| Art.50(1) | Informing people that they are interacting with an AI system | |
| Art.50(2) | Marking synthetic content as artificially generated, in a machine-readable form | |
| Art.50(3) | Informing people exposed to emotion recognition or biometric categorisation | |
| Art.50(4) | Disclosing deep fakes and AI-generated text published to inform the public | |
| Art.53(1)(a)-(b) | General-purpose AI models: technical documentation, and information for downstream providers | |
| Art.53(1)(c) | General-purpose AI models: policy to comply with Union copyright law | |
| Art.53(1)(d) | General-purpose AI models: public summary of the content used for training | |
| Art.55(1)(a) | Systemic risk: model evaluation, including adversarial testing | |
| Art.55(1)(b) | Systemic risk: assessing and mitigating systemic risks | |
| Art.55(1)(c) | Systemic risk: tracking, documenting and reporting serious incidents | |
| Art.55(1)(d) | Systemic risk: cybersecurity protection for the model and its physical infrastructure | |
| Art.72 | Post-market monitoring system and plan | |
| Art.73 | Reporting serious incidents | |
| Art.86 | Explanation of individual decisions to affected persons |