EU AI ActEuropean Union · 2024

Regulation (EU) 2024/1689

Binding law across the EU. Risk-tiered: prohibits unacceptable uses, imposes heavy obligations on high-risk AI, transparency duties on limited-risk, and special rules for general-purpose AI models. Fines up to €35M / 7% turnover.

Open in explorer →Take guided tour

// On this page

Chap I - General Chap II - Prohibited Chap III - High-risk classification Chap III §2 - High-risk requirements Chap III §3 - Providers Chap III §3 - Supply chain Chap III §3 - Deployers Chap IV - Transparency Chap V - GPAI Chap IX - Post-market Chap XII - Penalties

// Walkthrough

Read EU AI Act as a step-by-step path

Each section shows the intent, the steps, and the equivalent provisions in the other two frameworks.

Section 1 of 11

Chap I - General

2 items

// Why this section exists

Scope, definitions and the cross-cutting AI literacy duty (Art.4) that applies to every provider and deployer.

// Step-by-step

1Confirm whether the regulation applies to you (provider, deployer, importer, distributor).
2Implement AI literacy across staff dealing with AI.

// In the other frameworks

ISO 42001

Cl.7.2/7.3 cover competence and awareness.

NIST AI RMF

GOVERN 3 covers workforce.

Step 1Article 3

Definitions (AI system, provider, deployer)

Defines AI system, GPAI model, provider, deployer, distributor, importer.

// Maps to

ISO 42001Clause 4.3

NIST AI RMFMAP 1.1

Step 2Article 4

AI literacy

Providers and deployers must ensure sufficient AI literacy of staff dealing with AI systems.

// Maps to

ISO 42001Clause 7.2 Clause 7.3 Annex A.4.6

NIST AI RMFGOVERN 3.1 GOVERN 3.2

Section 2 of 11

Chap II - Prohibited

1 items

// Why this section exists

A short list of AI uses that are simply banned. The hard floor of the regime.

// Step-by-step

1Screen every use case against Article 5 before design.
2Document the screen and keep evidence.

// In the other frameworks

ISO 42001

No direct equivalent - ISO will not stop you doing something unethical that is technically conformant.

NIST AI RMF

GOVERN 1 captures legal obligations; the rest is left to the organisation.

Step 1Article 5

Prohibited AI practices

Bans manipulative AI, social scoring, untargeted scraping for face DBs, certain biometric uses, etc.

// Maps to

ISO 42001No direct equivalent in ISO 42001.

NIST AI RMFNo direct equivalent in NIST AI RMF.

Section 3 of 11

Chap III - High-risk classification

1 items

// Why this section exists

The core of the Act. Classification (Art.6 + Annex III), then a stack of obligations: risk management, data, documentation, logs, transparency, oversight, accuracy.

// Step-by-step

1Classify the system against Annex III and Art.6.
2Run a risk-management system continuously (Art.9).
3Meet data-governance duties (Art.10).
4Produce technical documentation (Art.11 + Annex IV).
5Build in logging (Art.12), transparency (Art.13), oversight (Art.14).
6Demonstrate accuracy, robustness, cybersecurity (Art.15).
7Operate a QMS (Art.17).
8Pass conformity assessment and register (Art.43/49).
9Deployers: oversight + FRIA where required (Art.26/27).

// In the other frameworks

ISO 42001

ISO 42001 + Annex A gives you most of the management-system evidence: Cl.6 → Art.9; Cl.7.5 → Art.11; A.7 → Art.10; A.6.2.4 → Art.15; A.8/A.9 → Art.13/14.

NIST AI RMF

MAP/MEASURE/MANAGE cycle satisfies most of the substantive content but NIST will not produce a conformity dossier on its own.

Step 1Article 6

Classification rules for high-risk AI

Defines what counts as high-risk AI (Annex I product safety + Annex III use cases).

// Maps to

ISO 42001No direct equivalent in ISO 42001.

NIST AI RMFMAP 1.1

Section 4 of 11

Chap III §2 - High-risk requirements

8 items

8 items in this section. Click any item to see its cross-framework mapping in the explorer.

Step 1Article 8

Compliance with high-risk requirements

High-risk AI must comply with requirements in Section 2 (Art. 9–15).

// Maps to

ISO 42001Clause 4.4

NIST AI RMFGOVERN 1.1

Step 2Article 9

Risk management system

Continuous, iterative risk management process across the AI lifecycle.

// Maps to

ISO 42001Clause 6.1.1 Clause 6.1.2 Clause 6.1.3 Clause 8.2+4

NIST AI RMFMAP 5.1 MEASURE 1.1 MANAGE 1.1 GOVERN 1.4+2

Step 3Article 10

Data and data governance

Training/validation/test datasets must be relevant, representative, error-free, complete; bias examined.

// Maps to

ISO 42001Annex A.4.2 Annex A.7.2 Annex A.4.3 Annex A.7.3+3

NIST AI RMFMAP 2.3 MEASURE 2.10 MEASURE 2.11

Step 4Article 11

Technical documentation

Technical documentation drawn up before placing on market, kept up to date (Annex IV).

// Maps to

ISO 42001Clause 7.5 Annex A.4.2 Annex A.6.2.3 Annex A.6.2.7

NIST AI RMFGOVERN 1.4 MAP 4.2 MEASURE 2.1 MAP 2.1

Step 5Article 12

Record-keeping (logs)

High-risk AI must automatically log events for traceability throughout its lifecycle.

// Maps to

ISO 42001Clause 7.5 Annex A.6.2.8

NIST AI RMFMEASURE 2.5 MANAGE 4.1

Step 6Article 13

Transparency & info to deployers

Instructions for use enabling deployers to interpret output and use the AI appropriately.

// Maps to

ISO 42001Annex A.8.2 Clause 7.4 Annex A.8.5

NIST AI RMFGOVERN 5.1 MEASURE 2.8 MEASURE 2.9 GOVERN 1.2+2

Step 7Article 14

Human oversight

Designed to be effectively overseen by natural persons during use.

// Maps to

ISO 42001Annex A.9.2 Clause 7.2 Annex A.9.4

NIST AI RMFMAP 5.2 MANAGE 1.2 MANAGE 2.3 GOVERN 1.2+1

Step 8Article 15

Accuracy, robustness & cybersecurity

Appropriate level of accuracy, robustness and cybersecurity throughout lifecycle.

// Maps to

ISO 42001Annex A.6.2.4 Clause 9.1 Annex A.4.5

NIST AI RMFMEASURE 2.5 MEASURE 2.6 MEASURE 2.7 MAP 2.3+3

Section 5 of 11

Chap III §3 - Providers

4 items

4 items in this section. Click any item to see its cross-framework mapping in the explorer.

Step 1Article 16

Obligations of providers of high-risk AI

Providers must ensure compliance, name, QMS, documentation, registration, etc.

// Maps to

ISO 42001Clause 4.3 Clause 4.4 Annex A.6.2.5

NIST AI RMFGOVERN 1.1

Step 2Article 17

Quality management system

Providers establish a QMS covering compliance, design, testing, post-market, etc.

// Maps to

ISO 42001Clause 4.4 Clause 5.2 Clause 8.1 Clause 9.2+7

NIST AI RMFGOVERN 1.1

Step 3Article 18

Documentation keeping

Providers keep technical documentation, QMS docs, declarations for 10 years.

// Maps to

ISO 42001Clause 7.5 Annex A.6.2.7

NIST AI RMFGOVERN 1.4

Step 4Article 20

Corrective actions and duty of information

Providers must take corrective action and inform authorities of non-conforming AI.

// Maps to

ISO 42001Clause 10.2

NIST AI RMFMANAGE 4.3

Section 6 of 11

Chap III §3 - Supply chain

1 items

1 items in this section. Click any item to see its cross-framework mapping in the explorer.

Step 1Article 25

Responsibilities along the AI value chain

Distributors, importers, deployers may become providers under conditions.

// Maps to

ISO 42001Annex A.10.2 Annex A.10.3 Annex A.10.4

NIST AI RMFGOVERN 6.1 GOVERN 6.2 MAP 4.1

Section 7 of 11

Chap III §3 - Deployers

2 items

2 items in this section. Click any item to see its cross-framework mapping in the explorer.

Step 1Article 26

Obligations of deployers

Deployers use AI per instructions, ensure human oversight, monitor and log.

// Maps to

ISO 42001Clause 5.1 Clause 5.3 Annex A.3.2 Annex A.9.2+5

NIST AI RMFGOVERN 2.1 GOVERN 2.2 GOVERN 2.3

Step 2Article 27

Fundamental rights impact assessment (FRIA)

Certain deployers of high-risk AI must perform a Fundamental Rights Impact Assessment.

// Maps to

ISO 42001Clause 6.1.4 Clause 8.4 Annex A.5.2 Clause 4.2+3

NIST AI RMFMAP 3.1 MAP 5.1 GOVERN 5.1 MAP 1.2+1

Section 8 of 11

Chap IV - Transparency

1 items

// Why this section exists

Limited-risk obligations: tell people they are interacting with AI and label AI-generated content.

// Step-by-step

1Add user-facing notice for chatbots and similar systems.
2Label deepfakes and synthetic media.

// In the other frameworks

ISO 42001

Annex A.8.

NIST AI RMF

MEASURE 2.8 (explainability) + MANAGE 2.3.

Step 1Article 50

Transparency for certain AI systems

Disclose AI interaction, label deepfakes, mark synthetic content.

// Maps to

ISO 42001Annex A.8.2 Annex A.8.3 Annex A.8.5

NIST AI RMFMEASURE 2.8

Section 9 of 11

Chap V - GPAI

3 items

// Why this section exists

General-purpose AI models have their own duties - documentation, downstream info, copyright policy, and stricter rules for systemic-risk models.

// Step-by-step

1Determine if you're a GPAI provider; if yes, prepare the Art.53 info pack.
2Assess whether your model has systemic risk (Art.51).
3If systemic: model evaluations, mitigation, incident reporting, cybersecurity (Art.55).

// In the other frameworks

ISO 42001

Annex A.10 + 7.5 cover the supplier and documentation angle.

NIST AI RMF

GOVERN 6 + MAP 4.

Step 1Article 51

Classification of GPAI with systemic risk

Defines when a general-purpose AI model has systemic risk (compute threshold etc.).

// Maps to

ISO 42001No direct equivalent in ISO 42001.

NIST AI RMFNo direct equivalent in NIST AI RMF.

Step 2Article 53