← Frameworks / EU AI Act / Control Mappings

Regulation (EU) 2024/1689 (Artificial Intelligence Act), as amended by Regulation (EU) 2026/1744

The European Union's law on artificial intelligence. It prohibits certain AI practices, sets requirements for high-risk AI systems (risk management, data governance, technical documentation, logging, transparency, human oversight, accuracy, robustness and cybersecurity) and the duties of their providers, deployers, importers and distributors, and sets obligations for providers of general-purpose AI models and transparency obligations for certain AI systems. It applies in stages: AI literacy and the prohibitions from February 2025, general-purpose AI models from August 2025, and high-risk systems from December 2027 or August 2028 after the 2026 amendments.

Controls: 90

Total Mappings: 167

Publisher: European Parliament and Council of the European Union Version: 2024/1689, as amended by 2026/1744

EU AI Act → SP 800-53 SP 800-53 → EU AI Act Coverage Analysis

AC (6) AT (2) AU (10) CA (5) CM (4) CP (3) IR (4) PE (2) PL (2) PM (8) PS (2) PT (5) RA (6) SA (12) SC (5) SI (10) SR (4)

AC Access Control

Control	Name	EU AI Act References
AC-03	Access Enforcement	Art.4aArt.15(5)Art.55(1)(d)
AC-04	Information Flow Enforcement	Art.4aArt.14(1)-(3)
AC-06	Least Privilege	Art.4a
AC-08	System Use Notification	Art.50(1)
AC-16	Security and Privacy Attributes	Art.50(2)Art.50(4)
AC-23	Data Mining Protection	Art.15(5)

AT Awareness and Training

Control	Name	EU AI Act References
AT-02	Literacy Training and Awareness	Art.4
AT-03	Role-based Training	Art.4Art.26(1)-(2)

AU Audit and Accountability

Control	Name	EU AI Act References
AU-02	Event Logging	Art.12
AU-03	Content of Audit Records	Art.12
AU-04	Audit Log Storage Capacity	Art.19Art.26(6)
AU-07	Audit Record Reduction and Report Generation	Art.21
AU-08	Time Stamps	Art.12
AU-09	Protection of Audit Information	Art.19Art.26(6)
AU-10	Non-repudiation	Art.50(2)
AU-11	Audit Record Retention	Art.19Art.26(6)
AU-12	Audit Record Generation	Art.4aArt.12
AU-16	Cross-organizational Audit Logging	Art.21

CA Security Assessment and Authorization

Control	Name	EU AI Act References
CA-02	Control Assessments	Art.9(6)-(8)Art.43
CA-05	Plan of Action and Milestones	Art.20
CA-06	Authorization	Art.9(5)Art.43
CA-07	Continuous Monitoring	Art.9(1)-(2)Art.15(1)-(4)Art.17Art.26(5)Art.72
CA-08	Penetration Testing	Art.15(5)Art.55(1)(a)

CM Configuration Management

Control	Name	EU AI Act References
CM-03	Configuration Change Control	Art.17
CM-04	Impact Analyses	Art.43
CM-10	Software Usage Restrictions	Art.53(1)(c)
CM-13	Data Action Mapping	Art.10(1)-(2)

CP Contingency Planning

Control	Name	EU AI Act References
CP-02	Contingency Plan	Art.15(1)-(4)
CP-09	System Backup	Art.15(1)-(4)
CP-12	Safe Mode	Art.14(4)

IR Incident Response

Control	Name	EU AI Act References
IR-04	Incident Handling	Art.15(5)Art.20Art.26(5)Art.55(1)(c)Art.73
IR-05	Incident Monitoring	Art.55(1)(c)
IR-06	Incident Reporting	Art.20Art.26(5)Art.55(1)(c)Art.73
IR-08	Incident Response Plan	Art.17

PE Physical and Environmental Protection

Control	Name	EU AI Act References
PE-03	Physical Access Control	Art.55(1)(d)
PE-10	Emergency Shutoff	Art.14(4)

PL Planning

Control	Name	EU AI Act References
PL-02	System Security and Privacy Plans	Art.11
PL-04	Rules of Behavior	Art.26(1)-(2)

PM Program Management

Control	Name	EU AI Act References
PM-01	Information Security Program Plan	Art.17
PM-09	Risk Management Strategy	Art.9(1)-(2)Art.17Art.55(1)(b)
PM-22	Personally Identifiable Information Quality Management	Art.10(1)-(2)Art.10(3)-(4)
PM-23	Data Governance Body	Art.10(1)-(2)
PM-25	Minimization of Personally Identifiable Information Used in Testing, Training, and Research	Art.4a
PM-26	Complaint Management	Art.27Art.86
PM-28	Risk Framing	Art.9(5)
PM-32	Purposing	Art.26(1)-(2)

PS Personnel Security

Control	Name	EU AI Act References
PS-06	Access Agreements	Art.4a
PS-09	Position Descriptions	Art.26(1)-(2)

PT Personally Identifiable Information Processing and Transparency

Control	Name	EU AI Act References
PT-02	Authority to Process Personally Identifiable Information	Art.4aArt.50(3)
PT-03	Personally Identifiable Information Processing Purposes	Art.4aArt.5Art.10(1)-(2)
PT-04	Consent	Art.5
PT-05	Privacy Notice	Art.26(7)Art.26(11)Art.50(1)Art.50(3)
PT-07	Specific Categories of Personally Identifiable Information	Art.4aArt.50(3)

RA Risk Assessment

Control	Name	EU AI Act References
RA-01	Policy and Procedures	Art.9(1)-(2)
RA-02	Security Categorization	Art.6(4)
RA-03	Risk Assessment	Art.6(4)Art.9(1)-(2)Art.9(9)Art.27Art.55(1)(b)
RA-05	Vulnerability Monitoring and Scanning	Art.15(5)Art.55(1)(d)
RA-07	Risk Response	Art.9(1)-(2)Art.9(5)Art.55(1)(b)
RA-08	Privacy Impact Assessments	Art.26(9)Art.27

SA System and Services Acquisition

Control	Name	EU AI Act References
SA-01	Policy and Procedures	Art.17
SA-02	Allocation of Resources	Art.17
SA-03	System Development Life Cycle	Art.9(1)-(2)Art.17
SA-04	Acquisition Process	Art.25(4)
SA-05	System Documentation	Art.9(5)Art.11Art.13Art.14(4)Art.53(1)(a)-(b)
SA-08	Security and Privacy Engineering Principles	Art.9(5)
SA-09	External System Services	Art.25(4)
SA-11	Developer Testing and Evaluation	Art.9(6)-(8)Art.17Art.53(1)(a)-(b)Art.55(1)(a)
SA-15	Development Process, Standards, and Tools	Art.9(6)-(8)Art.17
SA-16	Developer-provided Training	Art.9(5)
SA-17	Developer Security and Privacy Architecture and Design	Art.11Art.53(1)(a)-(b)
SA-24	Design For Cyber Resiliency	Art.15(1)-(4)

SC System and Communications Protection

Control	Name	EU AI Act References
SC-07	Boundary Protection	Art.55(1)(d)
SC-16	Transmission of Security and Privacy Attributes	Art.50(2)
SC-24	Fail in Known State	Art.15(1)-(4)
SC-28	Protection of Information at Rest	Art.4aArt.15(5)Art.55(1)(d)
SC-42	Sensor Capability and Data	Art.50(3)

SI System and Information Integrity

Control	Name	EU AI Act References
SI-02	Flaw Remediation	Art.15(5)Art.20
SI-04	System Monitoring	Art.14(4)Art.15(5)Art.26(5)Art.55(1)(d)
SI-07	Software, Firmware, and Information Integrity	Art.14(1)-(3)Art.15(5)Art.55(1)(d)
SI-10	Information Input Validation	Art.10(3)-(4)Art.14(4)Art.15(1)-(4)Art.15(5)Art.26(4)
SI-12	Information Management and Retention	Art.4aArt.17Art.18Art.23Art.47
SI-13	Predictable Failure Prevention	Art.15(1)-(4)
SI-15	Information Output Filtering	Art.5Art.15(5)
SI-17	Fail-safe Procedures	Art.15(1)-(4)
SI-18	Personally Identifiable Information Quality Operations	Art.10(3)-(4)Art.26(4)
SI-19	De-identification	Art.4a

SR Supply Chain Risk Management

Control	Name	EU AI Act References
SR-04	Provenance	Art.10(1)-(2)Art.15(5)Art.53(1)(d)
SR-05	Acquisition Strategies, Tools, and Methods	Art.17Art.23Art.24
SR-08	Notification Agreements	Art.20Art.23Art.24Art.25(4)
SR-11	Component Authenticity	Art.23