{ "metadata": { "document_id": "GAISSF-CRO-027", "title": "GAISSF–EU AI Act Mapping", "version": "1.0", "status": "Draft for Publication", "publisher": "ODA3 Institute", "legal_entity": "ODA3 Pvt Ltd", "publication_date": "29 June 2026", "verification_date": "2026-10-06", "gaissf_baseline": "GAISSF™ v1.0; 59 controls / 9 domains; Applicable-Control Baseline = all 52 D1-D8 controls + applicable D9", "external_baseline": "Regulation (EU) 2024/1689, consolidated text of 27 July 2026, incorporating Regulation (EU) 2026/1744 (Digital Omnibus on AI)", "scope_note": "Article-level informative implementation crosswalk for selected material provisions; not a complete legal concordance, legal opinion, conformity assessment, presumption of conformity, certification credit, or evidence-sufficiency determination.", "official_sources": [ "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27", "https://eur-lex.europa.eu/eli/reg/2026/1744/oj", "https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai", "https://digital-strategy.ec.europa.eu/en/policies/enforcement-ai-act", "https://digital-strategy.ec.europa.eu/en/policies/guidelines-ai-high-risk-systems" ], "physical_ai_boundary": "D9 is additional/conditional where Physical AI or cyber-physical actuation is in scope. PAI-SF™ and CSX-PAISF-004 are mapping/context only and do not establish equivalence, evidence sufficiency, or automatic conformance.", "certification_boundary": "GAISSF certification is not currently offered.", "legal_review": "Second-pass EU AI Act legal consistency review completed against consolidated 27 July 2026 text and Regulation (EU) 2026/1744; independent external legal review remains a publication gate.", "legal_review_date": "2026-10-06" }, "controlled_vocabulary": { "relationship": { "SP": "Strong partial", "P": "Partial", "S": "Supporting", "C": "Contextual", "N": "No material mapping", "O": "Outside scope", "U": "Unable to determine" }, "coverage": [ "High mapping density", "Partial mapping", "Indirect mapping", "No mapped GAISSF control", "Outside scope", "Unable to determine" ] }, "gaissf_controls": [ { "id": "D1-CTL-01", "title": "DATASET PROVENANCE & POISONING PREVENTION", "domain": "D1: MODEL INTEGRITY & ADVERSARIAL ROBUSTNESS", "foundational": "Yes" }, { "id": "D1-CTL-02", "title": "MODEL EXTRACTION RESISTANCE", "domain": "D1: MODEL INTEGRITY & ADVERSARIAL ROBUSTNESS", "foundational": "Yes" }, { "id": "D1-CTL-03", "title": "BEHAVIORAL DRIFT DETECTION", "domain": "D1: MODEL INTEGRITY & ADVERSARIAL ROBUSTNESS", "foundational": "Yes" }, { "id": "D1-CTL-04", "title": "FEDERATED LEARNING POISONING PREVENTION", "domain": "D1: MODEL INTEGRITY & ADVERSARIAL ROBUSTNESS", "foundational": "Yes" }, { "id": "D1-CTL-05", "title": "EMBEDDING SPACE ROBUSTNESS", "domain": "D1: MODEL INTEGRITY & ADVERSARIAL ROBUSTNESS", "foundational": "Yes" }, { "id": "D1-CTL-06", "title": "POST-QUANTUM MODEL SIGNING & CRYPTO HARDENING", "domain": "D1: MODEL INTEGRITY & ADVERSARIAL ROBUSTNESS", "foundational": "Yes" }, { "id": "D1-CTL-07", "title": "LORA/ADAPTER INTEGRITY VERIFICATION", "domain": "D1: MODEL INTEGRITY & ADVERSARIAL ROBUSTNESS", "foundational": "Yes" }, { "id": "D1-CTL-08", "title": "MODEL MERGE ATTACK DETECTION", "domain": "D1: MODEL INTEGRITY & ADVERSARIAL ROBUSTNESS", "foundational": "Yes" }, { "id": "D1-CTL-09", "title": "QUANTIZATION BACKDOOR SCREENING", "domain": "D1: MODEL INTEGRITY & ADVERSARIAL ROBUSTNESS", "foundational": "Yes" }, { "id": "D2-CTL-01", "title": "DIRECT PROMPT INJECTION PREVENTION", "domain": "D2: RUNTIME SECURITY & ADVERSARIAL DEFENSE", "foundational": "Yes" }, { "id": "D2-CTL-02", "title": "INDIRECT PROMPT INJECTION PREVENTION", "domain": "D2: RUNTIME SECURITY & ADVERSARIAL DEFENSE", "foundational": "Yes" }, { "id": "D2-CTL-03", "title": "JAILBREAK RESISTANCE TESTING", "domain": "D2: RUNTIME SECURITY & ADVERSARIAL DEFENSE", "foundational": "Yes" }, { "id": "D2-CTL-04", "title": "MULTI-MODAL INJECTION DEFENSE", "domain": "D2: RUNTIME SECURITY & ADVERSARIAL DEFENSE", "foundational": "Yes" }, { "id": "D2-CTL-05", "title": "FUNCTION CALL/TOOL CALL INJECTION PREVENTION", "domain": "D2: RUNTIME SECURITY & ADVERSARIAL DEFENSE", "foundational": "Yes" }, { "id": "D2-CTL-06", "title": "CROSS-CONTEXT HIJACKING MITIGATION", "domain": "D2: RUNTIME SECURITY & ADVERSARIAL DEFENSE", "foundational": "Yes" }, { "id": "D3-CTL-01", "title": "LEAST AGENCY ENFORCEMENT", "domain": "D3: AGENTIC RISK & AUTONOMOUS SYSTEM SECURITY", "foundational": "Yes" }, { "id": "D3-CTL-02", "title": "INTER-AGENT COMMUNICATION SECURITY", "domain": "D3: AGENTIC RISK & AUTONOMOUS SYSTEM SECURITY", "foundational": "Yes" }, { "id": "D3-CTL-03", "title": "AGENTIC PROMPT CHAINING DETECTION", "domain": "D3: AGENTIC RISK & AUTONOMOUS SYSTEM SECURITY", "foundational": "Yes" }, { "id": "D3-CTL-04", "title": "EMBODIED AI SAFETY CONTROLS", "domain": "D3: AGENTIC RISK & AUTONOMOUS SYSTEM SECURITY", "foundational": "Yes" }, { "id": "D3-CTL-05", "title": "MULTI-AGENT TRUST CHAIN ATTESTATION", "domain": "D3: AGENTIC RISK & AUTONOMOUS SYSTEM SECURITY", "foundational": "Yes" }, { "id": "D3-CTL-06", "title": "PERSISTENT MEMORY EXFILTRATION PREVENTION", "domain": "D3: AGENTIC RISK & AUTONOMOUS SYSTEM SECURITY", "foundational": "Yes" }, { "id": "D3-CTL-07", "title": "SECURE MEMORY LIFECYCLE MANAGEMENT", "domain": "D3: AGENTIC RISK & AUTONOMOUS SYSTEM SECURITY", "foundational": "Yes" }, { "id": "D4-CTL-01", "title": "AI BILL OF MATERIALS (AI BOM) MAINTENANCE", "domain": "D4: SUPPLY CHAIN & THIRD-PARTY AI SECURITY", "foundational": "Yes" }, { "id": "D4-CTL-02", "title": "MODEL FILE & ARTIFACT SCANNING", "domain": "D4: SUPPLY CHAIN & THIRD-PARTY AI SECURITY", "foundational": "Yes" }, { "id": "D4-CTL-03", "title": "MODEL HUB & REGISTRY VETTING", "domain": "D4: SUPPLY CHAIN & THIRD-PARTY AI SECURITY", "foundational": "Yes" }, { "id": "D4-CTL-04", "title": "MCP SERVER BEHAVIORAL MONITORING", "domain": "D4: SUPPLY CHAIN & THIRD-PARTY AI SECURITY", "foundational": "Yes" }, { "id": "D4-CTL-05", "title": "THIRD-PARTY AI API SECURITY ASSESSMENT", "domain": "D4: SUPPLY CHAIN & THIRD-PARTY AI SECURITY", "foundational": "Yes" }, { "id": "D4-CTL-06", "title": "SHADOW AI DISCOVERY & GOVERNANCE", "domain": "D4: SUPPLY CHAIN & THIRD-PARTY AI SECURITY", "foundational": "Yes" }, { "id": "D4-CTL-07", "title": "AI SOFTWARE COMPOSITION ANALYSIS (SCA)", "domain": "D4: SUPPLY CHAIN & THIRD-PARTY AI SECURITY", "foundational": "Yes" }, { "id": "D5-CTL-01", "title": "HARMFUL CONTENT BLOCKING", "domain": "D5: CONTENT SAFETY & OUTPUT INTEGRITY", "foundational": "Yes" }, { "id": "D5-CTL-02", "title": "PII LEAKAGE PREVENTION", "domain": "D5: CONTENT SAFETY & OUTPUT INTEGRITY", "foundational": "Yes" }, { "id": "D5-CTL-03", "title": "COPYRIGHT DETECTION", "domain": "D5: CONTENT SAFETY & OUTPUT INTEGRITY", "foundational": "Yes" }, { "id": "D5-CTL-04", "title": "AI WATERMARKING ROBUSTNESS", "domain": "D5: CONTENT SAFETY & OUTPUT INTEGRITY", "foundational": "Yes" }, { "id": "D5-CTL-05", "title": "PRIVACY-BY-DESIGN VERIFICATION", "domain": "D5: CONTENT SAFETY & OUTPUT INTEGRITY", "foundational": "Yes" }, { "id": "D5-CTL-06", "title": "PRIVACY-PRESERVING ML VALIDATION", "domain": "D5: CONTENT SAFETY & OUTPUT INTEGRITY", "foundational": "Yes" }, { "id": "D6-CTL-01", "title": "HUMAN-IN-THE-LOOP FOR HIGH-RISK ACTIONS", "domain": "D6: GOVERNANCE, ACCOUNTABILITY & HUMAN OVERSIGHT", "foundational": "Yes" }, { "id": "D6-CTL-02", "title": "AUDIT TRAIL COMPLETENESS", "domain": "D6: GOVERNANCE, ACCOUNTABILITY & HUMAN OVERSIGHT", "foundational": "Yes" }, { "id": "D6-CTL-03", "title": "AI MODEL CARD COMPLETENESS", "domain": "D6: GOVERNANCE, ACCOUNTABILITY & HUMAN OVERSIGHT", "foundational": "Yes" }, { "id": "D6-CTL-04", "title": "AI INCIDENT RESPONSE READINESS", "domain": "D6: GOVERNANCE, ACCOUNTABILITY & HUMAN OVERSIGHT", "foundational": "Yes" }, { "id": "D6-CTL-05", "title": "MODEL DEPRECATION & DECOMMISSIONING", "domain": "D6: GOVERNANCE, ACCOUNTABILITY & HUMAN OVERSIGHT", "foundational": "Yes" }, { "id": "D6-CTL-06", "title": "THIRD-PARTY AI VENDOR GOVERNANCE", "domain": "D6: GOVERNANCE, ACCOUNTABILITY & HUMAN OVERSIGHT", "foundational": "Yes" }, { "id": "D6-CTL-07", "title": "AI RESILIENCE & BUSINESS CONTINUITY", "domain": "D6: GOVERNANCE, ACCOUNTABILITY & HUMAN OVERSIGHT", "foundational": "Yes" }, { "id": "D7-CTL-H01", "title": "AI-GENERATED PHISHING SIMULATION", "domain": "D7: HUMAN & SOCIETAL HARMS", "foundational": "Yes" }, { "id": "D7-CTL-H02", "title": "DEEPFAKE DETECTION TRAINING", "domain": "D7: HUMAN & SOCIETAL HARMS", "foundational": "Yes" }, { "id": "D7-CTL-H03", "title": "OUT-OF-BAND AUTHENTICATION", "domain": "D7: HUMAN & SOCIETAL HARMS", "foundational": "Yes" }, { "id": "D7-CTL-H04", "title": "AI SOCIAL ENGINEERING IR", "domain": "D7: HUMAN & SOCIETAL HARMS", "foundational": "Yes" }, { "id": "D7-CTL-H05", "title": "AI-ENHANCED EXTERNAL ATTACK DEFENSE", "domain": "D7: HUMAN & SOCIETAL HARMS", "foundational": "Yes" }, { "id": "D8-CTL-01", "title": "EU AI ACT RISK TIER MAPPING", "domain": "D8: REGULATORY ALIGNMENT & COMPLIANCE", "foundational": "Yes" }, { "id": "D8-CTL-02", "title": "ISO 42001 GAP ANALYSIS", "domain": "D8: REGULATORY ALIGNMENT & COMPLIANCE", "foundational": "Yes" }, { "id": "D8-CTL-03", "title": "GPAI TECHNICAL DOCUMENTATION VERIFICATION", "domain": "D8: REGULATORY ALIGNMENT & COMPLIANCE", "foundational": "Yes" }, { "id": "D8-CTL-04", "title": "DORA ICT INCIDENT REPORTING (FINANCIAL SECTOR)", "domain": "D8: REGULATORY ALIGNMENT & COMPLIANCE", "foundational": "Yes" }, { "id": "D8-CTL-05", "title": "NIST SP 800-218A COMPLIANCE CHECK", "domain": "D8: REGULATORY ALIGNMENT & COMPLIANCE", "foundational": "Yes" }, { "id": "D9-CTL-01", "title": "PHYSICAL HARM BOUNDARY ENFORCEMENT", "domain": "D9: PHYSICAL AI SAFETY", "foundational": "No — apply where physical AI is in scope" }, { "id": "D9-CTL-02", "title": "SAFE STATE AND GRACEFUL DEGRADATION", "domain": "D9: PHYSICAL AI SAFETY", "foundational": "No — apply where physical AI is in scope" }, { "id": "D9-CTL-03", "title": "HUMAN OVERRIDE AND EMERGENCY STOP", "domain": "D9: PHYSICAL AI SAFETY", "foundational": "No — apply where physical AI is in scope" }, { "id": "D9-CTL-04", "title": "CYBER-PHYSICAL ATTACK DETECTION", "domain": "D9: PHYSICAL AI SAFETY", "foundational": "No — apply where physical AI is in scope" }, { "id": "D9-CTL-05", "title": "PHYSICAL ENVIRONMENT INTEGRITY MONITORING", "domain": "D9: PHYSICAL AI SAFETY", "foundational": "No — apply where physical AI is in scope" }, { "id": "D9-CTL-06", "title": "ACTUATOR COMMAND VERIFICATION", "domain": "D9: PHYSICAL AI SAFETY", "foundational": "No — apply where physical AI is in scope" }, { "id": "D9-CTL-07", "title": "PHYSICAL INCIDENT EVIDENCE PRESERVATION", "domain": "D9: PHYSICAL AI SAFETY", "foundational": "No — apply where physical AI is in scope" } ], "eu_ai_act_provisions": [ { "article": 1, "title": "Subject matter", "group": "General", "application_status": "Applicable since 2 February 2025 under Article 113(a) (Chapter I).", "official_source": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27#art_1", "mapped_control_count": 0, "coverage_status": "No mapped GAISSF control", "mapped_controls": [], "legal_note": "Regulation (EU) 2026/1744 amended Article 1(2)(g) to extend the innovation-support focus expressly to small mid-cap enterprises (SMCs) as well as SMEs/start-ups." }, { "article": 2, "title": "Scope", "group": "General", "application_status": "Applicable since 2 February 2025 under Article 113(a) (Chapter I); scope was amended from 27 July 2026 by Regulation (EU) 2026/1744.", "official_source": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27#art_2", "mapped_control_count": 0, "coverage_status": "No mapped GAISSF control", "mapped_controls": [], "legal_note": "Digital Omnibus Article 2 changes are material. For Article 6(1) systems related to products under Annex I Section B, only Article 6(1), Article 60a and Articles 102-112 apply unless the sectoral legislation integrates additional AI Act requirements. Article 2(13) also permits limitations for certain Article 6(1)/Annex I Section A systems where sectoral law provides equivalent or higher protection, subject to the Regulation conditions." }, { "article": 3, "title": "Definitions", "group": "General", "application_status": "Applicable since 2 February 2025 under Article 113(a) (Chapter I); definitions were amended from 27 July 2026 by Regulation (EU) 2026/1744.", "official_source": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27#art_3", "mapped_control_count": 0, "coverage_status": "No mapped GAISSF control", "mapped_controls": [], "legal_note": "The 2026 amendment clarified the definition of “safety component” and inserted definitions for SME and SMC. Those changes can affect Article 6(1) classification and proportionality provisions elsewhere in the Act." }, { "article": 4, "title": "AI literacy", "group": "General", "application_status": "Applicable since 2 February 2025 under Article 113(a); Article 4 was replaced from 27 July 2026 by Regulation (EU) 2026/1744.", "official_source": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27#art_4", "mapped_control_count": 4, "coverage_status": "Partial mapping", "mapped_controls": [ "D6-CTL-01", "D6-CTL-02", "D6-CTL-05", "D6-CTL-07" ], "legal_note": "The amended Article 4 requires providers and deployers to take measures to support AI literacy, but expressly does not require them to guarantee a specific literacy level for each individual." }, { "article": 5, "title": "Prohibited AI practices", "group": "Prohibited practices", "application_status": "Generally applicable since 2 February 2025; Article 5(1)(ba), 5(1)(bb), 5(1a) and 5(1b) apply from 2 December 2026 under amended Article 113(a).", "official_source": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27#art_5", "mapped_control_count": 6, "coverage_status": "Partial mapping", "mapped_controls": [ "D5-CTL-01", "D5-CTL-02", "D5-CTL-03", "D5-CTL-04", "D5-CTL-05", "D7-CTL-H03" ], "legal_note": "The 2026 amendment added prohibitions concerning specified non-consensual intimate material and child sexual-abuse material; these new provisions have the separate 2 December 2026 application date." }, { "article": 6, "title": "Classification rules for high-risk AI systems", "group": "Classification", "application_status": "Article 6(5) applies from 2 August 2026; the remainder of Chapter III Section 1 applies from 2 December 2027 for Article 6(2)/Annex III systems and from 2 August 2028 for Article 6(1)/Annex I systems.", "official_source": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27#art_6", "mapped_control_count": 0, "coverage_status": "No mapped GAISSF control", "mapped_controls": [], "legal_note": "Regulation (EU) 2026/1744 inserted Article 6(1a)-(1c), narrowing when AI used only for non-safety assistance/optimisation/convenience/quality control qualifies as a safety component and clarifying the third-party-conformity-assessment condition. Article 6(5) remains on the 2 August 2026 track; the rest of Section 1 follows the delayed high-risk dates." }, { "article": 8, "title": "Compliance with the requirements", "group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "official_source": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27#art_8", "mapped_control_count": 0, "coverage_status": "No mapped GAISSF control", "mapped_controls": [] }, { "article": 9, "title": "Risk management system", "group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "official_source": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27#art_9", "mapped_control_count": 49, "coverage_status": "High mapping density", "mapped_controls": [ "D1-CTL-01", "D1-CTL-02", "D1-CTL-04", "D1-CTL-05", "D1-CTL-06", "D1-CTL-07", "D1-CTL-08", "D1-CTL-09", "D2-CTL-01", "D2-CTL-02", "D2-CTL-03", "D2-CTL-04", "D2-CTL-05", "D2-CTL-06", "D3-CTL-01", "D3-CTL-02", "D3-CTL-03", "D3-CTL-04", "D3-CTL-05", "D3-CTL-06", "D3-CTL-07", "D4-CTL-06", "D5-CTL-01", "D5-CTL-02", "D5-CTL-03", "D5-CTL-04", "D5-CTL-05", "D5-CTL-06", "D6-CTL-01", "D6-CTL-02", "D6-CTL-03", "D6-CTL-04", "D6-CTL-05", "D6-CTL-06", "D6-CTL-07", "D7-CTL-H01", "D7-CTL-H02", "D7-CTL-H03", "D7-CTL-H04", "D7-CTL-H05", "D8-CTL-03", "D8-CTL-05", "D9-CTL-01", "D9-CTL-02", "D9-CTL-03", "D9-CTL-04", "D9-CTL-05", "D9-CTL-06", "D9-CTL-07" ] }, { "article": 10, "title": "Data and data governance", "group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "official_source": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27#art_10", "mapped_control_count": 0, "coverage_status": "No mapped GAISSF control", "mapped_controls": [], "legal_note": "Article 10 now cross-refers to new Article 4a for exceptional processing of special-category personal data for bias detection/correction, subject to strict safeguards. Article 4a is current law but is not separately mapped in this v1.0 crosswalk." }, { "article": 11, "title": "Technical documentation", "group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "official_source": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27#art_11", "mapped_control_count": 7, "coverage_status": "Partial mapping", "mapped_controls": [ "D4-CTL-01", "D4-CTL-02", "D4-CTL-03", "D4-CTL-04", "D4-CTL-05", "D4-CTL-07", "D8-CTL-02" ], "legal_note": "Article 11(1) was amended so SMEs, start-ups and SMCs may use a Commission simplified technical-documentation form; notified bodies must accept that form for conformity assessment." }, { "article": 12, "title": "Record-keeping", "group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "official_source": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27#art_12", "mapped_control_count": 2, "coverage_status": "Indirect mapping", "mapped_controls": [ "D8-CTL-04", "D9-CTL-07" ] }, { "article": 13, "title": "Transparency and provision of information to deployers", "group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "official_source": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27#art_13", "mapped_control_count": 10, "coverage_status": "High mapping density", "mapped_controls": [ "D2-CTL-01", "D2-CTL-02", "D2-CTL-03", "D2-CTL-04", "D5-CTL-01", "D5-CTL-02", "D5-CTL-03", "D5-CTL-04", "D5-CTL-05", "D5-CTL-06" ] }, { "article": 14, "title": "Human oversight", "group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "official_source": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27#art_14", "mapped_control_count": 27, "coverage_status": "High mapping density", "mapped_controls": [ "D2-CTL-02", "D2-CTL-03", "D2-CTL-04", "D2-CTL-05", "D3-CTL-01", "D3-CTL-02", "D3-CTL-03", "D3-CTL-04", "D3-CTL-05", "D3-CTL-06", "D3-CTL-07", "D5-CTL-01", "D5-CTL-02", "D5-CTL-03", "D5-CTL-05", "D5-CTL-06", "D7-CTL-H01", "D7-CTL-H02", "D7-CTL-H03", "D7-CTL-H04", "D7-CTL-H05", "D9-CTL-01", "D9-CTL-02", "D9-CTL-03", "D9-CTL-04", "D9-CTL-06", "D9-CTL-07" ] }, { "article": 15, "title": "Accuracy, robustness and cybersecurity", "group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "official_source": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27#art_15", "mapped_control_count": 44, "coverage_status": "High mapping density", "mapped_controls": [ "D1-CTL-01", "D1-CTL-02", "D1-CTL-03", "D1-CTL-04", "D1-CTL-05", "D1-CTL-06", "D1-CTL-07", "D1-CTL-08", "D1-CTL-09", "D2-CTL-01", "D2-CTL-02", "D2-CTL-03", "D2-CTL-04", "D2-CTL-05", "D2-CTL-06", "D3-CTL-02", "D3-CTL-03", "D3-CTL-04", "D3-CTL-05", "D3-CTL-06", "D3-CTL-07", "D4-CTL-01", "D4-CTL-02", "D4-CTL-03", "D4-CTL-04", "D4-CTL-05", "D4-CTL-06", "D4-CTL-07", "D5-CTL-04", "D5-CTL-06", "D6-CTL-04", "D6-CTL-06", "D7-CTL-H01", "D7-CTL-H02", "D7-CTL-H04", "D7-CTL-H05", "D8-CTL-02", "D8-CTL-05", "D9-CTL-01", "D9-CTL-02", "D9-CTL-03", "D9-CTL-04", "D9-CTL-05", "D9-CTL-06" ] }, { "article": 16, "title": "Obligations of providers of high-risk AI systems", "group": "Provider obligations", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "official_source": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27#art_16", "mapped_control_count": 0, "coverage_status": "No mapped GAISSF control", "mapped_controls": [] }, { "article": 17, "title": "Quality management system", "group": "Provider obligations", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "official_source": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27#art_17", "mapped_control_count": 12, "coverage_status": "High mapping density", "mapped_controls": [ "D1-CTL-01", "D4-CTL-01", "D4-CTL-02", "D4-CTL-03", "D4-CTL-04", "D4-CTL-05", "D4-CTL-06", "D4-CTL-07", "D6-CTL-03", "D6-CTL-06", "D8-CTL-02", "D8-CTL-03" ], "legal_note": "Article 17(2) was amended so implementation of quality-management-system elements is proportionate to provider size, expressly including SMEs/start-ups and SMCs, without reducing the required level of protection or compliance." }, { "article": 18, "title": "Documentation keeping", "group": "Provider obligations", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "official_source": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27#art_18", "mapped_control_count": 0, "coverage_status": "No mapped GAISSF control", "mapped_controls": [] }, { "article": 19, "title": "Automatically generated logs", "group": "Provider obligations", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "official_source": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27#art_19", "mapped_control_count": 1, "coverage_status": "Indirect mapping", "mapped_controls": [ "D9-CTL-07" ] }, { "article": 20, "title": "Corrective actions and duty of information", "group": "Provider obligations", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "official_source": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27#art_20", "mapped_control_count": 2, "coverage_status": "Indirect mapping", "mapped_controls": [ "D1-CTL-03", "D8-CTL-04" ] }, { "article": 21, "title": "Cooperation with competent authorities", "group": "Provider obligations", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "official_source": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27#art_21", "mapped_control_count": 1, "coverage_status": "Indirect mapping", "mapped_controls": [ "D6-CTL-04" ] }, { "article": 22, "title": "Authorised representatives of providers of high-risk AI systems", "group": "Supply chain roles", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "official_source": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27#art_22", "mapped_control_count": 1, "coverage_status": "Indirect mapping", "mapped_controls": [ "D8-CTL-02" ] }, { "article": 23, "title": "Obligations of importers", "group": "Supply chain roles", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "official_source": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27#art_23", "mapped_control_count": 0, "coverage_status": "No mapped GAISSF control", "mapped_controls": [] }, { "article": 24, "title": "Obligations of distributors", "group": "Supply chain roles", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "official_source": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27#art_24", "mapped_control_count": 0, "coverage_status": "No mapped GAISSF control", "mapped_controls": [] }, { "article": 25, "title": "Responsibilities along the AI value chain", "group": "Supply chain roles", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems; paragraphs 2 and 4 were amended from 27 July 2026.", "official_source": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27#art_25", "mapped_control_count": 6, "coverage_status": "Partial mapping", "mapped_controls": [ "D4-CTL-01", "D4-CTL-02", "D4-CTL-03", "D4-CTL-04", "D4-CTL-06", "D4-CTL-07" ], "legal_note": "The 2026 amendment strengthened information, technical-access and assistance duties when provider responsibility shifts, and amended written-agreement duties with third-party suppliers. Article 99(4) now expressly includes Article 25(2) and (4)." }, { "article": 26, "title": "Obligations of deployers of high-risk AI systems", "group": "Deployer obligations", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "official_source": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27#art_26", "mapped_control_count": 15, "coverage_status": "High mapping density", "mapped_controls": [ "D2-CTL-01", "D2-CTL-05", "D3-CTL-01", "D3-CTL-02", "D3-CTL-03", "D3-CTL-04", "D3-CTL-05", "D3-CTL-06", "D3-CTL-07", "D6-CTL-01", "D6-CTL-02", "D6-CTL-03", "D6-CTL-05", "D6-CTL-07", "D9-CTL-05" ] }, { "article": 27, "title": "Fundamental rights impact assessment for high-risk AI systems", "group": "Deployer obligations", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems; paragraph 4 was amended from 27 July 2026 to permit DPIA cross-referencing/reuse where obligations are already met.", "official_source": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27#art_27", "mapped_control_count": 13, "coverage_status": "High mapping density", "mapped_controls": [ "D3-CTL-01", "D6-CTL-01", "D6-CTL-02", "D6-CTL-03", "D6-CTL-04", "D6-CTL-05", "D6-CTL-06", "D6-CTL-07", "D7-CTL-H01", "D7-CTL-H02", "D7-CTL-H03", "D7-CTL-H04", "D7-CTL-H05" ], "legal_note": "The amended Article 27(4) allows a deployer to cross-reference or reuse relevant DPIA sections where the Article 27 obligation is already met through a GDPR/LED data-protection impact assessment." }, { "article": 43, "title": "Conformity assessment", "group": "Conformity", "application_status": "Generally applicable from 2 August 2026. Its operative high-risk conformity-assessment duties depend on the applicable Article 6 pathway, the delayed Chapter III Sections 1-3 dates, Article 2 sectoral-law rules, and Article 111 transitions.", "official_source": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27#art_43", "mapped_control_count": 13, "coverage_status": "High mapping density", "mapped_controls": [ "D1-CTL-05", "D1-CTL-06", "D1-CTL-07", "D1-CTL-08", "D1-CTL-09", "D2-CTL-06", "D8-CTL-03", "D8-CTL-05", "D9-CTL-01", "D9-CTL-02", "D9-CTL-03", "D9-CTL-04", "D9-CTL-06" ], "legal_note": "Articles 43, 47, 48 and 49 were not themselves moved wholesale to 2 December 2027. They remain on the general application track, while their operative high-risk duties depend on the underlying high-risk pathway and delayed Chapter III Sections 1-3. Article 43(3) was replaced by Regulation (EU) 2026/1744 for Annex I Section A systems. Relevant notified bodies may assess AI Act Section 2 requirements through the sectoral conformity-assessment route; certain already-notified bodies must apply for AI Act designation by 28 January 2028. This does not move Article 43 itself to 2 December 2027." }, { "article": 47, "title": "EU declaration of conformity", "group": "Conformity", "application_status": "Generally applicable from 2 August 2026. Its operative declaration-of-conformity duties depend on the applicable high-risk pathway and delayed Chapter III Sections 1-3 dates.", "official_source": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27#art_47", "mapped_control_count": 0, "coverage_status": "No mapped GAISSF control", "mapped_controls": [] }, { "article": 48, "title": "CE marking", "group": "Conformity", "application_status": "Generally applicable from 2 August 2026. Its operative CE-marking duties depend on the applicable high-risk pathway and delayed Chapter III Sections 1-3 dates.", "official_source": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27#art_48", "mapped_control_count": 0, "coverage_status": "No mapped GAISSF control", "mapped_controls": [] }, { "article": 49, "title": "Registration", "group": "Conformity", "application_status": "Generally applicable from 2 August 2026. Registration duties must be read with the applicable high-risk pathway, Article 6(5), and delayed Chapter III Sections 1-3 dates.", "official_source": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27#art_49", "mapped_control_count": 0, "coverage_status": "No mapped GAISSF control", "mapped_controls": [], "legal_note": "Registration obligations remain on the general application track, but the Digital Omnibus simplified the Annex VIII registration content for Article 6(3) systems treated as non-high-risk. Registration analysis therefore depends on Article 6 status and the current Annex VIII data fields." }, { "article": 50, "title": "Transparency obligations for providers and deployers of certain AI systems", "group": "Transparency", "application_status": "Applicable from 2 August 2026; Article 111(4) gives pre-2 August 2026 synthetic-content systems until 2 December 2026 to comply with Article 50(2).", "official_source": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27#art_50", "mapped_control_count": 0, "coverage_status": "No mapped GAISSF control", "mapped_controls": [], "legal_note": "Article 50 remains on the 2 August 2026 track. Regulation (EU) 2026/1744 added the Article 111(4) transition for pre-existing synthetic-content systems and amended Article 50(7) on codes of practice." }, { "article": 51, "title": "Classification of general-purpose AI models as general-purpose AI models with systemic risk", "group": "GPAI", "application_status": "Chapter V applicable since 2 August 2025. Article 101 fine powers apply from 2 August 2026; pre-2 August 2025 GPAI models have the Article 111(3) transition until 2 August 2027.", "official_source": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27#art_51", "mapped_control_count": 1, "coverage_status": "Indirect mapping", "mapped_controls": [ "D8-CTL-01" ] }, { "article": 52, "title": "Procedure", "group": "GPAI", "application_status": "Chapter V applicable since 2 August 2025. Article 101 fine powers apply from 2 August 2026; pre-2 August 2025 GPAI models have the Article 111(3) transition until 2 August 2027.", "official_source": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27#art_52", "mapped_control_count": 0, "coverage_status": "No mapped GAISSF control", "mapped_controls": [] }, { "article": 53, "title": "Obligations for providers of general-purpose AI models", "group": "GPAI", "application_status": "Chapter V applicable since 2 August 2025. Article 101 fine powers apply from 2 August 2026; pre-2 August 2025 GPAI models have the Article 111(3) transition until 2 August 2027.", "official_source": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27#art_53", "mapped_control_count": 2, "coverage_status": "Indirect mapping", "mapped_controls": [ "D4-CTL-05", "D8-CTL-01" ] }, { "article": 54, "title": "Authorised representatives of providers of general-purpose AI models", "group": "GPAI", "application_status": "Chapter V applicable since 2 August 2025. Article 101 fine powers apply from 2 August 2026; pre-2 August 2025 GPAI models have the Article 111(3) transition until 2 August 2027.", "official_source": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27#art_54", "mapped_control_count": 1, "coverage_status": "Indirect mapping", "mapped_controls": [ "D8-CTL-01" ] }, { "article": 55, "title": "Obligations of providers of general-purpose AI models with systemic risk", "group": "GPAI systemic risk", "application_status": "Chapter V applicable since 2 August 2025. Article 101 fine powers apply from 2 August 2026; pre-2 August 2025 GPAI models have the Article 111(3) transition until 2 August 2027.", "official_source": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27#art_55", "mapped_control_count": 7, "coverage_status": "Partial mapping", "mapped_controls": [ "D1-CTL-01", "D1-CTL-02", "D1-CTL-04", "D2-CTL-06", "D8-CTL-01", "D8-CTL-03", "D8-CTL-05" ] }, { "article": 56, "title": "Codes of practice", "group": "GPAI", "application_status": "Chapter V applicable since 2 August 2025. Article 101 fine powers apply from 2 August 2026; pre-2 August 2025 GPAI models have the Article 111(3) transition until 2 August 2027.", "official_source": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27#art_56", "mapped_control_count": 0, "coverage_status": "No mapped GAISSF control", "mapped_controls": [] }, { "article": 57, "title": "AI regulatory sandboxes", "group": "Innovation", "application_status": "Generally applicable from 2 August 2026; amended Article 57(1) requires at least one national AI regulatory sandbox to be operational by 2 August 2027.", "official_source": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27#art_57", "mapped_control_count": 0, "coverage_status": "No mapped GAISSF control", "mapped_controls": [], "legal_note": "The Digital Omnibus moved the Article 57(1) national-sandbox operational deadline to 2 August 2027." }, { "article": 59, "title": "Further processing of personal data for developing certain AI systems in the public interest in the AI regulatory sandbox", "group": "Innovation", "application_status": "Generally applicable from 2 August 2026; processing remains conditional on the strict Article 59 safeguards and applicable EU data-protection law.", "official_source": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27#art_59", "mapped_control_count": 0, "coverage_status": "No mapped GAISSF control", "mapped_controls": [], "legal_note": "Article 59 is a narrow legal basis within AI regulatory sandboxes and does not replace GDPR, Regulation (EU) 2018/1725, Directive 2002/58/EC or Directive (EU) 2016/680." }, { "article": 72, "title": "Post-market monitoring by providers and post-market monitoring plan for high-risk AI systems", "group": "Monitoring", "application_status": "Generally applicable from 2 August 2026; because Article 72 addresses high-risk AI systems, practical obligations must be read with the applicable Article 6 pathway, delayed Chapter III dates and Article 111 transitions.", "official_source": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27#art_72", "mapped_control_count": 10, "coverage_status": "High mapping density", "mapped_controls": [ "D1-CTL-02", "D1-CTL-03", "D1-CTL-04", "D1-CTL-05", "D1-CTL-06", "D1-CTL-07", "D1-CTL-08", "D1-CTL-09", "D8-CTL-04", "D9-CTL-05" ], "legal_note": "Article 72(3) was replaced. The post-market monitoring plan remains part of Annex IV technical documentation, and the Commission must adopt guidance including a template by 2 September 2027." }, { "article": 73, "title": "Reporting of serious incidents", "group": "Incident reporting", "application_status": "Generally applicable from 2 August 2026; because Article 73 addresses high-risk AI systems, practical obligations must be read with the applicable Article 6 pathway, delayed Chapter III dates and Article 111 transitions. Reporting deadlines are immediate and no later than 15 days ordinarily, 2 days for widespread infringement or Article 3(49)(b) incidents, and 10 days where a death occurs, subject to the statutory triggers.", "official_source": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27#art_73", "mapped_control_count": 2, "coverage_status": "Indirect mapping", "mapped_controls": [ "D1-CTL-03", "D8-CTL-04" ], "legal_note": "Article 73(2)-(4): report immediately after the relevant causal-link/suspicion trigger and in any event no later than 15 days ordinarily; 2 days for widespread infringement or an Article 3(49)(b) serious incident; 10 days for death. Article 74(1a), inserted by the Digital Omnibus, creates a reporting-route derogation for high-risk systems under AI Office competence: incidents are reported to the AI Office and Article 73(2)-(9) applies mutatis mutandis." }, { "article": 78, "title": "Confidentiality", "group": "Governance", "application_status": "Applicable since 2 August 2025 under Article 113(b).", "official_source": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27#art_78", "mapped_control_count": 0, "coverage_status": "No mapped GAISSF control", "mapped_controls": [] }, { "article": 79, "title": "Procedure for dealing with AI systems presenting a risk at national level", "group": "Market surveillance", "application_status": "Generally applicable from 2 August 2026; enforcement against high-risk systems must be read with the provisions that are applicable to the relevant system and actor at the time.", "official_source": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27#art_79", "mapped_control_count": 0, "coverage_status": "No mapped GAISSF control", "mapped_controls": [] }, { "article": 80, "title": "Procedure for dealing with AI systems classified by the provider as non-high-risk in application of Annex III", "group": "Market surveillance", "application_status": "Generally applicable from 2 August 2026; Article 80 concerns Annex III systems treated by the provider as non-high-risk and must be read with Article 6 and the applicable timing rules.", "official_source": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27#art_80", "mapped_control_count": 0, "coverage_status": "No mapped GAISSF control", "mapped_controls": [] }, { "article": 86, "title": "Right to explanation of individual decision-making", "group": "Rights", "application_status": "Generally applicable from 2 August 2026; the right applies only within Article 86 conditions and does not displace rights otherwise provided under Union law.", "official_source": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27#art_86", "mapped_control_count": 0, "coverage_status": "No mapped GAISSF control", "mapped_controls": [] }, { "article": 95, "title": "Codes of conduct for voluntary application of specific requirements", "group": "Voluntary", "application_status": "Generally applicable from 2 August 2026; voluntary codes do not create a presumption of conformity unless another legal instrument expressly provides one.", "official_source": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27#art_95", "mapped_control_count": 0, "coverage_status": "No mapped GAISSF control", "mapped_controls": [], "legal_note": "Article 95(4) was amended to require the AI Office and Member States to take account of the specific interests and needs of SMEs/start-ups and SMCs when encouraging voluntary codes of conduct." }, { "article": 99, "title": "Penalties", "group": "Enforcement", "application_status": "Applicable since 2 August 2025 under Article 113(b) (Chapter XII); amended from 27 July 2026 by Regulation (EU) 2026/1744. Penalty exposure depends on the underlying infringed provision being applicable.", "official_source": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27#art_99", "mapped_control_count": 0, "coverage_status": "No mapped GAISSF control", "mapped_controls": [], "legal_note": "Article 99(3): up to EUR 35,000,000 or 7% worldwide annual turnover (whichever is higher) for Article 5 prohibitions. Article 99(4): up to EUR 15,000,000 or 3% for listed operator/notified-body duties, now including Article 25(2) and (4). Article 99(5): up to EUR 7,500,000 or 1% for incorrect, incomplete or misleading information. SMEs are subject to the lower of the amount/percentage under Article 99(6); SMC treatment was added in Article 99(6a) for paragraphs 4 and 5." }, { "article": 110, "title": "Amendment to Directive (EU) 2020/1828", "group": "Amendment", "application_status": "Applicable from 27 July 2026 under amended Article 113(d).", "official_source": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27#art_110", "mapped_control_count": 0, "coverage_status": "No mapped GAISSF control", "mapped_controls": [] }, { "article": 111, "title": "AI systems already placed on the market or put into service and general-purpose AI models already placed on the market", "group": "Transition", "application_status": "Generally applicable from 2 August 2026. Transitional rules include 31 December 2030 for certain Annex X large-scale IT systems, significant-change treatment for pre-application high-risk systems, 2 August 2030 for high-risk systems intended for public-authority use, 2 August 2027 for pre-2 August 2025 GPAI models, and 2 December 2026 for pre-2 August 2026 systems subject to Article 50(2).", "official_source": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27#art_111", "mapped_control_count": 0, "coverage_status": "No mapped GAISSF control", "mapped_controls": [], "legal_note": "Article 111 materially limits how legacy systems are treated. Do not assume a pre-existing high-risk system must immediately satisfy every delayed Chapter III requirement: the significant-change rule and specific 2030 public-authority deadline must be assessed." }, { "article": 112, "title": "Evaluation and review", "group": "Review", "application_status": "Generally applicable from 2 August 2026; evaluation and review duties contain their own milestones, including 2 August 2028, 2 August 2029 and 2 August 2031.", "official_source": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27#art_112", "mapped_control_count": 0, "coverage_status": "No mapped GAISSF control", "mapped_controls": [], "legal_note": "Article 112 contains recurring and one-off review milestones: annual review of Annex III/Article 5 while the relevant delegation remains in force; 2 August 2028 reviews (with recurring cycles for several topics); 2 August 2029 and every four years thereafter for the general evaluation report; and an enforcement-structure assessment by 2 August 2031." }, { "article": 113, "title": "Entry into force and application", "group": "Application", "application_status": "In force since 1 August 2024; Article 113 sets the phased application schedule, including 2 February 2025, 2 August 2025, 27 July 2026, 2 August 2026, 2 December 2026, 2 December 2027 and 2 August 2028 milestones.", "official_source": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27#art_113", "mapped_control_count": 0, "coverage_status": "No mapped GAISSF control", "mapped_controls": [], "legal_note": "Application date is not the same as entry into force. This crosswalk distinguishes the 1 August 2024 entry-into-force date from phased dates of application." } ], "forward_mappings": [ { "record_id": "GAISSF-CRO-027-MAP-0001", "gaissf_id": "D1-CTL-01", "gaissf_title": "DATASET PROVENANCE & POISONING PREVENTION", "domain": "D1: MODEL INTEGRITY & ADVERSARIAL ROBUSTNESS", "article": 15, "article_title": "Accuracy, robustness and cybersecurity", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "SP", "coverage": "Partial mapping", "confidence": "High", "rationale": "GAISSF D1-CTL-01 operationalises part of Article 15 through Hash verification + source allowlist + poisoning detection. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 15 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 15" }, { "record_id": "GAISSF-CRO-027-MAP-0002", "gaissf_id": "D1-CTL-01", "gaissf_title": "DATASET PROVENANCE & POISONING PREVENTION", "domain": "D1: MODEL INTEGRITY & ADVERSARIAL ROBUSTNESS", "article": 9, "article_title": "Risk management system", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "SP", "coverage": "Partial mapping", "confidence": "High", "rationale": "GAISSF D1-CTL-01 operationalises part of Article 9 through Hash verification + source allowlist + poisoning detection. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 9 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 9" }, { "record_id": "GAISSF-CRO-027-MAP-0003", "gaissf_id": "D1-CTL-01", "gaissf_title": "DATASET PROVENANCE & POISONING PREVENTION", "domain": "D1: MODEL INTEGRITY & ADVERSARIAL ROBUSTNESS", "article": 17, "article_title": "Quality management system", "article_group": "Provider obligations", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "SP", "coverage": "Partial mapping", "confidence": "High", "rationale": "GAISSF D1-CTL-01 operationalises part of Article 17 through Hash verification + source allowlist + poisoning detection. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 17 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 17" }, { "record_id": "GAISSF-CRO-027-MAP-0004", "gaissf_id": "D1-CTL-01", "gaissf_title": "DATASET PROVENANCE & POISONING PREVENTION", "domain": "D1: MODEL INTEGRITY & ADVERSARIAL ROBUSTNESS", "article": 55, "article_title": "Obligations of providers of general-purpose AI models with systemic risk", "article_group": "GPAI systemic risk", "application_status": "Chapter V applicable since 2 August 2025. Article 101 fine powers apply from 2 August 2026; pre-2 August 2025 GPAI models have the Article 111(3) transition until 2 August 2027.", "relationship": "P", "coverage": "Partial mapping", "confidence": "Medium-High", "rationale": "GAISSF D1-CTL-01 operationalises part of Article 55 through Hash verification + source allowlist + poisoning detection. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 55 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 55" }, { "record_id": "GAISSF-CRO-027-MAP-0005", "gaissf_id": "D1-CTL-02", "gaissf_title": "MODEL EXTRACTION RESISTANCE", "domain": "D1: MODEL INTEGRITY & ADVERSARIAL ROBUSTNESS", "article": 15, "article_title": "Accuracy, robustness and cybersecurity", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "SP", "coverage": "Partial mapping", "confidence": "High", "rationale": "GAISSF D1-CTL-02 operationalises part of Article 15 through Rate limiting + diversity detection + extraction monitoring. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 15 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 15" }, { "record_id": "GAISSF-CRO-027-MAP-0006", "gaissf_id": "D1-CTL-02", "gaissf_title": "MODEL EXTRACTION RESISTANCE", "domain": "D1: MODEL INTEGRITY & ADVERSARIAL ROBUSTNESS", "article": 72, "article_title": "Post-market monitoring by providers and post-market monitoring plan for high-risk AI systems", "article_group": "Monitoring", "application_status": "Generally applicable from 2 August 2026; because Article 72 addresses high-risk AI systems, practical obligations must be read with the applicable Article 6 pathway, delayed Chapter III dates and Article 111 transitions.", "relationship": "P", "coverage": "Partial mapping", "confidence": "Medium-High", "rationale": "GAISSF D1-CTL-02 operationalises part of Article 72 through Rate limiting + diversity detection + extraction monitoring. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 72 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 72" }, { "record_id": "GAISSF-CRO-027-MAP-0007", "gaissf_id": "D1-CTL-02", "gaissf_title": "MODEL EXTRACTION RESISTANCE", "domain": "D1: MODEL INTEGRITY & ADVERSARIAL ROBUSTNESS", "article": 55, "article_title": "Obligations of providers of general-purpose AI models with systemic risk", "article_group": "GPAI systemic risk", "application_status": "Chapter V applicable since 2 August 2025. Article 101 fine powers apply from 2 August 2026; pre-2 August 2025 GPAI models have the Article 111(3) transition until 2 August 2027.", "relationship": "P", "coverage": "Partial mapping", "confidence": "Medium-High", "rationale": "GAISSF D1-CTL-02 operationalises part of Article 55 through Rate limiting + diversity detection + extraction monitoring. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 55 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 55" }, { "record_id": "GAISSF-CRO-027-MAP-0008", "gaissf_id": "D1-CTL-02", "gaissf_title": "MODEL EXTRACTION RESISTANCE", "domain": "D1: MODEL INTEGRITY & ADVERSARIAL ROBUSTNESS", "article": 9, "article_title": "Risk management system", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "SP", "coverage": "Partial mapping", "confidence": "High", "rationale": "GAISSF D1-CTL-02 operationalises part of Article 9 through Rate limiting + diversity detection + extraction monitoring. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 9 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 9" }, { "record_id": "GAISSF-CRO-027-MAP-0009", "gaissf_id": "D1-CTL-03", "gaissf_title": "BEHAVIORAL DRIFT DETECTION", "domain": "D1: MODEL INTEGRITY & ADVERSARIAL ROBUSTNESS", "article": 72, "article_title": "Post-market monitoring by providers and post-market monitoring plan for high-risk AI systems", "article_group": "Monitoring", "application_status": "Generally applicable from 2 August 2026; because Article 72 addresses high-risk AI systems, practical obligations must be read with the applicable Article 6 pathway, delayed Chapter III dates and Article 111 transitions.", "relationship": "P", "coverage": "Partial mapping", "confidence": "Medium-High", "rationale": "GAISSF D1-CTL-03 operationalises part of Article 72 through Baseline profiling + KL divergence monitoring + accuracy tracking. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 72 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 72" }, { "record_id": "GAISSF-CRO-027-MAP-0010", "gaissf_id": "D1-CTL-03", "gaissf_title": "BEHAVIORAL DRIFT DETECTION", "domain": "D1: MODEL INTEGRITY & ADVERSARIAL ROBUSTNESS", "article": 15, "article_title": "Accuracy, robustness and cybersecurity", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "SP", "coverage": "Partial mapping", "confidence": "High", "rationale": "GAISSF D1-CTL-03 operationalises part of Article 15 through Baseline profiling + KL divergence monitoring + accuracy tracking. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 15 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 15" }, { "record_id": "GAISSF-CRO-027-MAP-0011", "gaissf_id": "D1-CTL-03", "gaissf_title": "BEHAVIORAL DRIFT DETECTION", "domain": "D1: MODEL INTEGRITY & ADVERSARIAL ROBUSTNESS", "article": 20, "article_title": "Corrective actions and duty of information", "article_group": "Provider obligations", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "P", "coverage": "Partial mapping", "confidence": "Medium-High", "rationale": "GAISSF D1-CTL-03 operationalises part of Article 20 through Baseline profiling + KL divergence monitoring + accuracy tracking. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 20 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 20" }, { "record_id": "GAISSF-CRO-027-MAP-0012", "gaissf_id": "D1-CTL-03", "gaissf_title": "BEHAVIORAL DRIFT DETECTION", "domain": "D1: MODEL INTEGRITY & ADVERSARIAL ROBUSTNESS", "article": 73, "article_title": "Reporting of serious incidents", "article_group": "Incident reporting", "application_status": "Generally applicable from 2 August 2026; because Article 73 addresses high-risk AI systems, practical obligations must be read with the applicable Article 6 pathway, delayed Chapter III dates and Article 111 transitions. Reporting deadlines are immediate and no later than 15 days ordinarily, 2 days for widespread infringement or Article 3(49)(b) incidents, and 10 days where a death occurs, subject to the statutory triggers.", "relationship": "P", "coverage": "Partial mapping", "confidence": "Medium-High", "rationale": "GAISSF D1-CTL-03 operationalises part of Article 73 through Baseline profiling + KL divergence monitoring + accuracy tracking. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 73 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 73" }, { "record_id": "GAISSF-CRO-027-MAP-0013", "gaissf_id": "D1-CTL-04", "gaissf_title": "FEDERATED LEARNING POISONING PREVENTION", "domain": "D1: MODEL INTEGRITY & ADVERSARIAL ROBUSTNESS", "article": 9, "article_title": "Risk management system", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "SP", "coverage": "Partial mapping", "confidence": "High", "rationale": "GAISSF D1-CTL-04 operationalises part of Article 9 through Gradient anomaly detection + robust aggregation. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 9 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 9" }, { "record_id": "GAISSF-CRO-027-MAP-0014", "gaissf_id": "D1-CTL-04", "gaissf_title": "FEDERATED LEARNING POISONING PREVENTION", "domain": "D1: MODEL INTEGRITY & ADVERSARIAL ROBUSTNESS", "article": 15, "article_title": "Accuracy, robustness and cybersecurity", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "SP", "coverage": "Partial mapping", "confidence": "High", "rationale": "GAISSF D1-CTL-04 operationalises part of Article 15 through Gradient anomaly detection + robust aggregation. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 15 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 15" }, { "record_id": "GAISSF-CRO-027-MAP-0015", "gaissf_id": "D1-CTL-04", "gaissf_title": "FEDERATED LEARNING POISONING PREVENTION", "domain": "D1: MODEL INTEGRITY & ADVERSARIAL ROBUSTNESS", "article": 55, "article_title": "Obligations of providers of general-purpose AI models with systemic risk", "article_group": "GPAI systemic risk", "application_status": "Chapter V applicable since 2 August 2025. Article 101 fine powers apply from 2 August 2026; pre-2 August 2025 GPAI models have the Article 111(3) transition until 2 August 2027.", "relationship": "P", "coverage": "Partial mapping", "confidence": "Medium-High", "rationale": "GAISSF D1-CTL-04 operationalises part of Article 55 through Gradient anomaly detection + robust aggregation. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 55 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 55" }, { "record_id": "GAISSF-CRO-027-MAP-0016", "gaissf_id": "D1-CTL-04", "gaissf_title": "FEDERATED LEARNING POISONING PREVENTION", "domain": "D1: MODEL INTEGRITY & ADVERSARIAL ROBUSTNESS", "article": 72, "article_title": "Post-market monitoring by providers and post-market monitoring plan for high-risk AI systems", "article_group": "Monitoring", "application_status": "Generally applicable from 2 August 2026; because Article 72 addresses high-risk AI systems, practical obligations must be read with the applicable Article 6 pathway, delayed Chapter III dates and Article 111 transitions.", "relationship": "P", "coverage": "Partial mapping", "confidence": "Medium-High", "rationale": "GAISSF D1-CTL-04 operationalises part of Article 72 through Gradient anomaly detection + robust aggregation. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 72 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 72" }, { "record_id": "GAISSF-CRO-027-MAP-0017", "gaissf_id": "D1-CTL-05", "gaissf_title": "EMBEDDING SPACE ROBUSTNESS", "domain": "D1: MODEL INTEGRITY & ADVERSARIAL ROBUSTNESS", "article": 9, "article_title": "Risk management system", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "SP", "coverage": "Partial mapping", "confidence": "High", "rationale": "GAISSF D1-CTL-05 operationalises part of Article 9 through Adversarial training + independently evaluated robustness measurement. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 9 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 9" }, { "record_id": "GAISSF-CRO-027-MAP-0018", "gaissf_id": "D1-CTL-05", "gaissf_title": "EMBEDDING SPACE ROBUSTNESS", "domain": "D1: MODEL INTEGRITY & ADVERSARIAL ROBUSTNESS", "article": 15, "article_title": "Accuracy, robustness and cybersecurity", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "SP", "coverage": "Partial mapping", "confidence": "High", "rationale": "GAISSF D1-CTL-05 operationalises part of Article 15 through Adversarial training + independently evaluated robustness measurement. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 15 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 15" }, { "record_id": "GAISSF-CRO-027-MAP-0019", "gaissf_id": "D1-CTL-05", "gaissf_title": "EMBEDDING SPACE ROBUSTNESS", "domain": "D1: MODEL INTEGRITY & ADVERSARIAL ROBUSTNESS", "article": 72, "article_title": "Post-market monitoring by providers and post-market monitoring plan for high-risk AI systems", "article_group": "Monitoring", "application_status": "Generally applicable from 2 August 2026; because Article 72 addresses high-risk AI systems, practical obligations must be read with the applicable Article 6 pathway, delayed Chapter III dates and Article 111 transitions.", "relationship": "P", "coverage": "Partial mapping", "confidence": "Medium-High", "rationale": "GAISSF D1-CTL-05 operationalises part of Article 72 through Adversarial training + independently evaluated robustness measurement. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 72 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 72" }, { "record_id": "GAISSF-CRO-027-MAP-0020", "gaissf_id": "D1-CTL-05", "gaissf_title": "EMBEDDING SPACE ROBUSTNESS", "domain": "D1: MODEL INTEGRITY & ADVERSARIAL ROBUSTNESS", "article": 43, "article_title": "Conformity assessment", "article_group": "Conformity", "application_status": "Generally applicable from 2 August 2026. Its operative high-risk conformity-assessment duties depend on the applicable Article 6 pathway, the delayed Chapter III Sections 1-3 dates, Article 2 sectoral-law rules, and Article 111 transitions.", "relationship": "S", "coverage": "Indirect mapping", "confidence": "Medium", "rationale": "GAISSF D1-CTL-05 operationalises part of Article 43 through Adversarial training + independently evaluated robustness measurement. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 43 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 43" }, { "record_id": "GAISSF-CRO-027-MAP-0021", "gaissf_id": "D1-CTL-06", "gaissf_title": "POST-QUANTUM MODEL SIGNING & CRYPTO HARDENING", "domain": "D1: MODEL INTEGRITY & ADVERSARIAL ROBUSTNESS", "article": 15, "article_title": "Accuracy, robustness and cybersecurity", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "S", "coverage": "Indirect mapping", "confidence": "Medium", "rationale": "GAISSF D1-CTL-06 operationalises part of Article 15 through PQC signing (ML-DSA/SLH-DSA) + PQC key exchange (ML-KEM). The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 15 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 15" }, { "record_id": "GAISSF-CRO-027-MAP-0022", "gaissf_id": "D1-CTL-06", "gaissf_title": "POST-QUANTUM MODEL SIGNING & CRYPTO HARDENING", "domain": "D1: MODEL INTEGRITY & ADVERSARIAL ROBUSTNESS", "article": 9, "article_title": "Risk management system", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "S", "coverage": "Indirect mapping", "confidence": "Medium", "rationale": "GAISSF D1-CTL-06 operationalises part of Article 9 through PQC signing (ML-DSA/SLH-DSA) + PQC key exchange (ML-KEM). The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 9 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 9" }, { "record_id": "GAISSF-CRO-027-MAP-0023", "gaissf_id": "D1-CTL-06", "gaissf_title": "POST-QUANTUM MODEL SIGNING & CRYPTO HARDENING", "domain": "D1: MODEL INTEGRITY & ADVERSARIAL ROBUSTNESS", "article": 72, "article_title": "Post-market monitoring by providers and post-market monitoring plan for high-risk AI systems", "article_group": "Monitoring", "application_status": "Generally applicable from 2 August 2026; because Article 72 addresses high-risk AI systems, practical obligations must be read with the applicable Article 6 pathway, delayed Chapter III dates and Article 111 transitions.", "relationship": "P", "coverage": "Partial mapping", "confidence": "Medium-High", "rationale": "GAISSF D1-CTL-06 operationalises part of Article 72 through PQC signing (ML-DSA/SLH-DSA) + PQC key exchange (ML-KEM). The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 72 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 72" }, { "record_id": "GAISSF-CRO-027-MAP-0024", "gaissf_id": "D1-CTL-06", "gaissf_title": "POST-QUANTUM MODEL SIGNING & CRYPTO HARDENING", "domain": "D1: MODEL INTEGRITY & ADVERSARIAL ROBUSTNESS", "article": 43, "article_title": "Conformity assessment", "article_group": "Conformity", "application_status": "Generally applicable from 2 August 2026. Its operative high-risk conformity-assessment duties depend on the applicable Article 6 pathway, the delayed Chapter III Sections 1-3 dates, Article 2 sectoral-law rules, and Article 111 transitions.", "relationship": "S", "coverage": "Indirect mapping", "confidence": "Medium", "rationale": "GAISSF D1-CTL-06 operationalises part of Article 43 through PQC signing (ML-DSA/SLH-DSA) + PQC key exchange (ML-KEM). The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 43 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 43" }, { "record_id": "GAISSF-CRO-027-MAP-0025", "gaissf_id": "D1-CTL-07", "gaissf_title": "LORA/ADAPTER INTEGRITY VERIFICATION", "domain": "D1: MODEL INTEGRITY & ADVERSARIAL ROBUSTNESS", "article": 15, "article_title": "Accuracy, robustness and cybersecurity", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "S", "coverage": "Indirect mapping", "confidence": "Medium", "rationale": "GAISSF D1-CTL-07 operationalises part of Article 15 through Adapter scanning + provenance verification + registry allowlist. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 15 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 15" }, { "record_id": "GAISSF-CRO-027-MAP-0026", "gaissf_id": "D1-CTL-07", "gaissf_title": "LORA/ADAPTER INTEGRITY VERIFICATION", "domain": "D1: MODEL INTEGRITY & ADVERSARIAL ROBUSTNESS", "article": 9, "article_title": "Risk management system", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "S", "coverage": "Indirect mapping", "confidence": "Medium", "rationale": "GAISSF D1-CTL-07 operationalises part of Article 9 through Adapter scanning + provenance verification + registry allowlist. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 9 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 9" }, { "record_id": "GAISSF-CRO-027-MAP-0027", "gaissf_id": "D1-CTL-07", "gaissf_title": "LORA/ADAPTER INTEGRITY VERIFICATION", "domain": "D1: MODEL INTEGRITY & ADVERSARIAL ROBUSTNESS", "article": 72, "article_title": "Post-market monitoring by providers and post-market monitoring plan for high-risk AI systems", "article_group": "Monitoring", "application_status": "Generally applicable from 2 August 2026; because Article 72 addresses high-risk AI systems, practical obligations must be read with the applicable Article 6 pathway, delayed Chapter III dates and Article 111 transitions.", "relationship": "P", "coverage": "Partial mapping", "confidence": "Medium-High", "rationale": "GAISSF D1-CTL-07 operationalises part of Article 72 through Adapter scanning + provenance verification + registry allowlist. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 72 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 72" }, { "record_id": "GAISSF-CRO-027-MAP-0028", "gaissf_id": "D1-CTL-07", "gaissf_title": "LORA/ADAPTER INTEGRITY VERIFICATION", "domain": "D1: MODEL INTEGRITY & ADVERSARIAL ROBUSTNESS", "article": 43, "article_title": "Conformity assessment", "article_group": "Conformity", "application_status": "Generally applicable from 2 August 2026. Its operative high-risk conformity-assessment duties depend on the applicable Article 6 pathway, the delayed Chapter III Sections 1-3 dates, Article 2 sectoral-law rules, and Article 111 transitions.", "relationship": "S", "coverage": "Indirect mapping", "confidence": "Medium", "rationale": "GAISSF D1-CTL-07 operationalises part of Article 43 through Adapter scanning + provenance verification + registry allowlist. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 43 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 43" }, { "record_id": "GAISSF-CRO-027-MAP-0029", "gaissf_id": "D1-CTL-08", "gaissf_title": "MODEL MERGE ATTACK DETECTION", "domain": "D1: MODEL INTEGRITY & ADVERSARIAL ROBUSTNESS", "article": 9, "article_title": "Risk management system", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "S", "coverage": "Indirect mapping", "confidence": "Medium", "rationale": "GAISSF D1-CTL-08 operationalises part of Article 9 through Pre-registration behavioural evaluation + regression testing. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 9 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 9" }, { "record_id": "GAISSF-CRO-027-MAP-0030", "gaissf_id": "D1-CTL-08", "gaissf_title": "MODEL MERGE ATTACK DETECTION", "domain": "D1: MODEL INTEGRITY & ADVERSARIAL ROBUSTNESS", "article": 15, "article_title": "Accuracy, robustness and cybersecurity", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "S", "coverage": "Indirect mapping", "confidence": "Medium", "rationale": "GAISSF D1-CTL-08 operationalises part of Article 15 through Pre-registration behavioural evaluation + regression testing. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 15 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 15" }, { "record_id": "GAISSF-CRO-027-MAP-0031", "gaissf_id": "D1-CTL-08", "gaissf_title": "MODEL MERGE ATTACK DETECTION", "domain": "D1: MODEL INTEGRITY & ADVERSARIAL ROBUSTNESS", "article": 43, "article_title": "Conformity assessment", "article_group": "Conformity", "application_status": "Generally applicable from 2 August 2026. Its operative high-risk conformity-assessment duties depend on the applicable Article 6 pathway, the delayed Chapter III Sections 1-3 dates, Article 2 sectoral-law rules, and Article 111 transitions.", "relationship": "S", "coverage": "Indirect mapping", "confidence": "Medium", "rationale": "GAISSF D1-CTL-08 operationalises part of Article 43 through Pre-registration behavioural evaluation + regression testing. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 43 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 43" }, { "record_id": "GAISSF-CRO-027-MAP-0032", "gaissf_id": "D1-CTL-08", "gaissf_title": "MODEL MERGE ATTACK DETECTION", "domain": "D1: MODEL INTEGRITY & ADVERSARIAL ROBUSTNESS", "article": 72, "article_title": "Post-market monitoring by providers and post-market monitoring plan for high-risk AI systems", "article_group": "Monitoring", "application_status": "Generally applicable from 2 August 2026; because Article 72 addresses high-risk AI systems, practical obligations must be read with the applicable Article 6 pathway, delayed Chapter III dates and Article 111 transitions.", "relationship": "P", "coverage": "Partial mapping", "confidence": "Medium-High", "rationale": "GAISSF D1-CTL-08 operationalises part of Article 72 through Pre-registration behavioural evaluation + regression testing. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 72 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 72" }, { "record_id": "GAISSF-CRO-027-MAP-0033", "gaissf_id": "D1-CTL-09", "gaissf_title": "QUANTIZATION BACKDOOR SCREENING", "domain": "D1: MODEL INTEGRITY & ADVERSARIAL ROBUSTNESS", "article": 72, "article_title": "Post-market monitoring by providers and post-market monitoring plan for high-risk AI systems", "article_group": "Monitoring", "application_status": "Generally applicable from 2 August 2026; because Article 72 addresses high-risk AI systems, practical obligations must be read with the applicable Article 6 pathway, delayed Chapter III dates and Article 111 transitions.", "relationship": "P", "coverage": "Partial mapping", "confidence": "Medium-High", "rationale": "GAISSF D1-CTL-09 operationalises part of Article 72 through Cross-precision behavioural comparison + delta threshold monitoring. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 72 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 72" }, { "record_id": "GAISSF-CRO-027-MAP-0034", "gaissf_id": "D1-CTL-09", "gaissf_title": "QUANTIZATION BACKDOOR SCREENING", "domain": "D1: MODEL INTEGRITY & ADVERSARIAL ROBUSTNESS", "article": 9, "article_title": "Risk management system", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "SP", "coverage": "Partial mapping", "confidence": "High", "rationale": "GAISSF D1-CTL-09 operationalises part of Article 9 through Cross-precision behavioural comparison + delta threshold monitoring. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 9 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 9" }, { "record_id": "GAISSF-CRO-027-MAP-0035", "gaissf_id": "D1-CTL-09", "gaissf_title": "QUANTIZATION BACKDOOR SCREENING", "domain": "D1: MODEL INTEGRITY & ADVERSARIAL ROBUSTNESS", "article": 15, "article_title": "Accuracy, robustness and cybersecurity", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "SP", "coverage": "Partial mapping", "confidence": "High", "rationale": "GAISSF D1-CTL-09 operationalises part of Article 15 through Cross-precision behavioural comparison + delta threshold monitoring. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 15 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 15" }, { "record_id": "GAISSF-CRO-027-MAP-0036", "gaissf_id": "D1-CTL-09", "gaissf_title": "QUANTIZATION BACKDOOR SCREENING", "domain": "D1: MODEL INTEGRITY & ADVERSARIAL ROBUSTNESS", "article": 43, "article_title": "Conformity assessment", "article_group": "Conformity", "application_status": "Generally applicable from 2 August 2026. Its operative high-risk conformity-assessment duties depend on the applicable Article 6 pathway, the delayed Chapter III Sections 1-3 dates, Article 2 sectoral-law rules, and Article 111 transitions.", "relationship": "S", "coverage": "Indirect mapping", "confidence": "Medium", "rationale": "GAISSF D1-CTL-09 operationalises part of Article 43 through Cross-precision behavioural comparison + delta threshold monitoring. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 43 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 43" }, { "record_id": "GAISSF-CRO-027-MAP-0037", "gaissf_id": "D2-CTL-01", "gaissf_title": "DIRECT PROMPT INJECTION PREVENTION", "domain": "D2: RUNTIME SECURITY & ADVERSARIAL DEFENSE", "article": 15, "article_title": "Accuracy, robustness and cybersecurity", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "SP", "coverage": "Partial mapping", "confidence": "High", "rationale": "GAISSF D2-CTL-01 operationalises part of Article 15 through Input validation + adversarial pattern matching + system prompt isolation + guardrail sidecar. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 15 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 15" }, { "record_id": "GAISSF-CRO-027-MAP-0038", "gaissf_id": "D2-CTL-01", "gaissf_title": "DIRECT PROMPT INJECTION PREVENTION", "domain": "D2: RUNTIME SECURITY & ADVERSARIAL DEFENSE", "article": 9, "article_title": "Risk management system", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "SP", "coverage": "Partial mapping", "confidence": "High", "rationale": "GAISSF D2-CTL-01 operationalises part of Article 9 through Input validation + adversarial pattern matching + system prompt isolation + guardrail sidecar. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 9 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 9" }, { "record_id": "GAISSF-CRO-027-MAP-0039", "gaissf_id": "D2-CTL-01", "gaissf_title": "DIRECT PROMPT INJECTION PREVENTION", "domain": "D2: RUNTIME SECURITY & ADVERSARIAL DEFENSE", "article": 26, "article_title": "Obligations of deployers of high-risk AI systems", "article_group": "Deployer obligations", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "P", "coverage": "Partial mapping", "confidence": "Medium-High", "rationale": "GAISSF D2-CTL-01 operationalises part of Article 26 through Input validation + adversarial pattern matching + system prompt isolation + guardrail sidecar. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 26 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 26" }, { "record_id": "GAISSF-CRO-027-MAP-0040", "gaissf_id": "D2-CTL-01", "gaissf_title": "DIRECT PROMPT INJECTION PREVENTION", "domain": "D2: RUNTIME SECURITY & ADVERSARIAL DEFENSE", "article": 13, "article_title": "Transparency and provision of information to deployers", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "P", "coverage": "Partial mapping", "confidence": "Medium-High", "rationale": "GAISSF D2-CTL-01 operationalises part of Article 13 through Input validation + adversarial pattern matching + system prompt isolation + guardrail sidecar. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 13 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 13" }, { "record_id": "GAISSF-CRO-027-MAP-0041", "gaissf_id": "D2-CTL-02", "gaissf_title": "INDIRECT PROMPT INJECTION PREVENTION", "domain": "D2: RUNTIME SECURITY & ADVERSARIAL DEFENSE", "article": 15, "article_title": "Accuracy, robustness and cybersecurity", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "S", "coverage": "Indirect mapping", "confidence": "Medium", "rationale": "GAISSF D2-CTL-02 operationalises part of Article 15 through Contextual separation + source allowlisting + output validation + RAG sanitization pipeline. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 15 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 15" }, { "record_id": "GAISSF-CRO-027-MAP-0042", "gaissf_id": "D2-CTL-02", "gaissf_title": "INDIRECT PROMPT INJECTION PREVENTION", "domain": "D2: RUNTIME SECURITY & ADVERSARIAL DEFENSE", "article": 9, "article_title": "Risk management system", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "S", "coverage": "Indirect mapping", "confidence": "Medium", "rationale": "GAISSF D2-CTL-02 operationalises part of Article 9 through Contextual separation + source allowlisting + output validation + RAG sanitization pipeline. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 9 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 9" }, { "record_id": "GAISSF-CRO-027-MAP-0043", "gaissf_id": "D2-CTL-02", "gaissf_title": "INDIRECT PROMPT INJECTION PREVENTION", "domain": "D2: RUNTIME SECURITY & ADVERSARIAL DEFENSE", "article": 14, "article_title": "Human oversight", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "P", "coverage": "Partial mapping", "confidence": "Medium-High", "rationale": "GAISSF D2-CTL-02 operationalises part of Article 14 through Contextual separation + source allowlisting + output validation + RAG sanitization pipeline. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 14 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 14" }, { "record_id": "GAISSF-CRO-027-MAP-0044", "gaissf_id": "D2-CTL-02", "gaissf_title": "INDIRECT PROMPT INJECTION PREVENTION", "domain": "D2: RUNTIME SECURITY & ADVERSARIAL DEFENSE", "article": 13, "article_title": "Transparency and provision of information to deployers", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "P", "coverage": "Partial mapping", "confidence": "Medium-High", "rationale": "GAISSF D2-CTL-02 operationalises part of Article 13 through Contextual separation + source allowlisting + output validation + RAG sanitization pipeline. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 13 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 13" }, { "record_id": "GAISSF-CRO-027-MAP-0045", "gaissf_id": "D2-CTL-03", "gaissf_title": "JAILBREAK RESISTANCE TESTING", "domain": "D2: RUNTIME SECURITY & ADVERSARIAL DEFENSE", "article": 9, "article_title": "Risk management system", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "SP", "coverage": "Partial mapping", "confidence": "High", "rationale": "GAISSF D2-CTL-03 operationalises part of Article 9 through Quarterly red-team prompt library + adversarial training + automated refusal monitoring. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 9 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 9" }, { "record_id": "GAISSF-CRO-027-MAP-0046", "gaissf_id": "D2-CTL-03", "gaissf_title": "JAILBREAK RESISTANCE TESTING", "domain": "D2: RUNTIME SECURITY & ADVERSARIAL DEFENSE", "article": 15, "article_title": "Accuracy, robustness and cybersecurity", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "SP", "coverage": "Partial mapping", "confidence": "High", "rationale": "GAISSF D2-CTL-03 operationalises part of Article 15 through Quarterly red-team prompt library + adversarial training + automated refusal monitoring. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 15 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 15" }, { "record_id": "GAISSF-CRO-027-MAP-0047", "gaissf_id": "D2-CTL-03", "gaissf_title": "JAILBREAK RESISTANCE TESTING", "domain": "D2: RUNTIME SECURITY & ADVERSARIAL DEFENSE", "article": 14, "article_title": "Human oversight", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "P", "coverage": "Partial mapping", "confidence": "Medium-High", "rationale": "GAISSF D2-CTL-03 operationalises part of Article 14 through Quarterly red-team prompt library + adversarial training + automated refusal monitoring. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 14 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 14" }, { "record_id": "GAISSF-CRO-027-MAP-0048", "gaissf_id": "D2-CTL-03", "gaissf_title": "JAILBREAK RESISTANCE TESTING", "domain": "D2: RUNTIME SECURITY & ADVERSARIAL DEFENSE", "article": 13, "article_title": "Transparency and provision of information to deployers", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "P", "coverage": "Partial mapping", "confidence": "Medium-High", "rationale": "GAISSF D2-CTL-03 operationalises part of Article 13 through Quarterly red-team prompt library + adversarial training + automated refusal monitoring. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 13 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 13" }, { "record_id": "GAISSF-CRO-027-MAP-0049", "gaissf_id": "D2-CTL-04", "gaissf_title": "MULTI-MODAL INJECTION DEFENSE", "domain": "D2: RUNTIME SECURITY & ADVERSARIAL DEFENSE", "article": 9, "article_title": "Risk management system", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "S", "coverage": "Indirect mapping", "confidence": "Medium", "rationale": "GAISSF D2-CTL-04 operationalises part of Article 9 through Multi-modal content scanning + steganography detection + modality-specific guardrails. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 9 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 9" }, { "record_id": "GAISSF-CRO-027-MAP-0050", "gaissf_id": "D2-CTL-04", "gaissf_title": "MULTI-MODAL INJECTION DEFENSE", "domain": "D2: RUNTIME SECURITY & ADVERSARIAL DEFENSE", "article": 15, "article_title": "Accuracy, robustness and cybersecurity", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "S", "coverage": "Indirect mapping", "confidence": "Medium", "rationale": "GAISSF D2-CTL-04 operationalises part of Article 15 through Multi-modal content scanning + steganography detection + modality-specific guardrails. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 15 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 15" }, { "record_id": "GAISSF-CRO-027-MAP-0051", "gaissf_id": "D2-CTL-04", "gaissf_title": "MULTI-MODAL INJECTION DEFENSE", "domain": "D2: RUNTIME SECURITY & ADVERSARIAL DEFENSE", "article": 13, "article_title": "Transparency and provision of information to deployers", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "P", "coverage": "Partial mapping", "confidence": "Medium-High", "rationale": "GAISSF D2-CTL-04 operationalises part of Article 13 through Multi-modal content scanning + steganography detection + modality-specific guardrails. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 13 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 13" }, { "record_id": "GAISSF-CRO-027-MAP-0052", "gaissf_id": "D2-CTL-04", "gaissf_title": "MULTI-MODAL INJECTION DEFENSE", "domain": "D2: RUNTIME SECURITY & ADVERSARIAL DEFENSE", "article": 14, "article_title": "Human oversight", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "P", "coverage": "Partial mapping", "confidence": "Medium-High", "rationale": "GAISSF D2-CTL-04 operationalises part of Article 14 through Multi-modal content scanning + steganography detection + modality-specific guardrails. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 14 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 14" }, { "record_id": "GAISSF-CRO-027-MAP-0053", "gaissf_id": "D2-CTL-05", "gaissf_title": "FUNCTION CALL/TOOL CALL INJECTION PREVENTION", "domain": "D2: RUNTIME SECURITY & ADVERSARIAL DEFENSE", "article": 9, "article_title": "Risk management system", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "S", "coverage": "Indirect mapping", "confidence": "Medium", "rationale": "GAISSF D2-CTL-05 operationalises part of Article 9 through Parameter schema validation + allowlist enforcement + sandboxed execution. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 9 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 9" }, { "record_id": "GAISSF-CRO-027-MAP-0054", "gaissf_id": "D2-CTL-05", "gaissf_title": "FUNCTION CALL/TOOL CALL INJECTION PREVENTION", "domain": "D2: RUNTIME SECURITY & ADVERSARIAL DEFENSE", "article": 15, "article_title": "Accuracy, robustness and cybersecurity", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "S", "coverage": "Indirect mapping", "confidence": "Medium", "rationale": "GAISSF D2-CTL-05 operationalises part of Article 15 through Parameter schema validation + allowlist enforcement + sandboxed execution. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 15 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 15" }, { "record_id": "GAISSF-CRO-027-MAP-0055", "gaissf_id": "D2-CTL-05", "gaissf_title": "FUNCTION CALL/TOOL CALL INJECTION PREVENTION", "domain": "D2: RUNTIME SECURITY & ADVERSARIAL DEFENSE", "article": 14, "article_title": "Human oversight", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "P", "coverage": "Partial mapping", "confidence": "Medium-High", "rationale": "GAISSF D2-CTL-05 operationalises part of Article 14 through Parameter schema validation + allowlist enforcement + sandboxed execution. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 14 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 14" }, { "record_id": "GAISSF-CRO-027-MAP-0056", "gaissf_id": "D2-CTL-05", "gaissf_title": "FUNCTION CALL/TOOL CALL INJECTION PREVENTION", "domain": "D2: RUNTIME SECURITY & ADVERSARIAL DEFENSE", "article": 26, "article_title": "Obligations of deployers of high-risk AI systems", "article_group": "Deployer obligations", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "P", "coverage": "Partial mapping", "confidence": "Medium-High", "rationale": "GAISSF D2-CTL-05 operationalises part of Article 26 through Parameter schema validation + allowlist enforcement + sandboxed execution. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 26 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 26" }, { "record_id": "GAISSF-CRO-027-MAP-0057", "gaissf_id": "D2-CTL-06", "gaissf_title": "CROSS-CONTEXT HIJACKING MITIGATION", "domain": "D2: RUNTIME SECURITY & ADVERSARIAL DEFENSE", "article": 9, "article_title": "Risk management system", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "S", "coverage": "Indirect mapping", "confidence": "Medium", "rationale": "GAISSF D2-CTL-06 operationalises part of Article 9 through Context window segmentation + prompt anchoring + attention boundary enforcement. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 9 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 9" }, { "record_id": "GAISSF-CRO-027-MAP-0058", "gaissf_id": "D2-CTL-06", "gaissf_title": "CROSS-CONTEXT HIJACKING MITIGATION", "domain": "D2: RUNTIME SECURITY & ADVERSARIAL DEFENSE", "article": 15, "article_title": "Accuracy, robustness and cybersecurity", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "S", "coverage": "Indirect mapping", "confidence": "Medium", "rationale": "GAISSF D2-CTL-06 operationalises part of Article 15 through Context window segmentation + prompt anchoring + attention boundary enforcement. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 15 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 15" }, { "record_id": "GAISSF-CRO-027-MAP-0059", "gaissf_id": "D2-CTL-06", "gaissf_title": "CROSS-CONTEXT HIJACKING MITIGATION", "domain": "D2: RUNTIME SECURITY & ADVERSARIAL DEFENSE", "article": 43, "article_title": "Conformity assessment", "article_group": "Conformity", "application_status": "Generally applicable from 2 August 2026. Its operative high-risk conformity-assessment duties depend on the applicable Article 6 pathway, the delayed Chapter III Sections 1-3 dates, Article 2 sectoral-law rules, and Article 111 transitions.", "relationship": "S", "coverage": "Indirect mapping", "confidence": "Medium", "rationale": "GAISSF D2-CTL-06 operationalises part of Article 43 through Context window segmentation + prompt anchoring + attention boundary enforcement. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 43 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 43" }, { "record_id": "GAISSF-CRO-027-MAP-0060", "gaissf_id": "D2-CTL-06", "gaissf_title": "CROSS-CONTEXT HIJACKING MITIGATION", "domain": "D2: RUNTIME SECURITY & ADVERSARIAL DEFENSE", "article": 55, "article_title": "Obligations of providers of general-purpose AI models with systemic risk", "article_group": "GPAI systemic risk", "application_status": "Chapter V applicable since 2 August 2025. Article 101 fine powers apply from 2 August 2026; pre-2 August 2025 GPAI models have the Article 111(3) transition until 2 August 2027.", "relationship": "P", "coverage": "Partial mapping", "confidence": "Medium-High", "rationale": "GAISSF D2-CTL-06 operationalises part of Article 55 through Context window segmentation + prompt anchoring + attention boundary enforcement. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 55 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 55" }, { "record_id": "GAISSF-CRO-027-MAP-0061", "gaissf_id": "D3-CTL-01", "gaissf_title": "LEAST AGENCY ENFORCEMENT", "domain": "D3: AGENTIC RISK & AUTONOMOUS SYSTEM SECURITY", "article": 9, "article_title": "Risk management system", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "S", "coverage": "Indirect mapping", "confidence": "Medium", "rationale": "GAISSF D3-CTL-01 operationalises part of Article 9 through Role-based tool scoping + policy-as-code + dynamic permission revocation. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 9 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 9" }, { "record_id": "GAISSF-CRO-027-MAP-0062", "gaissf_id": "D3-CTL-01", "gaissf_title": "LEAST AGENCY ENFORCEMENT", "domain": "D3: AGENTIC RISK & AUTONOMOUS SYSTEM SECURITY", "article": 26, "article_title": "Obligations of deployers of high-risk AI systems", "article_group": "Deployer obligations", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "P", "coverage": "Partial mapping", "confidence": "Medium-High", "rationale": "GAISSF D3-CTL-01 operationalises part of Article 26 through Role-based tool scoping + policy-as-code + dynamic permission revocation. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 26 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 26" }, { "record_id": "GAISSF-CRO-027-MAP-0063", "gaissf_id": "D3-CTL-01", "gaissf_title": "LEAST AGENCY ENFORCEMENT", "domain": "D3: AGENTIC RISK & AUTONOMOUS SYSTEM SECURITY", "article": 27, "article_title": "Fundamental rights impact assessment for high-risk AI systems", "article_group": "Deployer obligations", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems; paragraph 4 was amended from 27 July 2026 to permit DPIA cross-referencing/reuse where obligations are already met.", "relationship": "P", "coverage": "Partial mapping", "confidence": "Medium-High", "rationale": "GAISSF D3-CTL-01 operationalises part of Article 27 through Role-based tool scoping + policy-as-code + dynamic permission revocation. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 27 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 27" }, { "record_id": "GAISSF-CRO-027-MAP-0064", "gaissf_id": "D3-CTL-01", "gaissf_title": "LEAST AGENCY ENFORCEMENT", "domain": "D3: AGENTIC RISK & AUTONOMOUS SYSTEM SECURITY", "article": 14, "article_title": "Human oversight", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "P", "coverage": "Partial mapping", "confidence": "Medium-High", "rationale": "GAISSF D3-CTL-01 operationalises part of Article 14 through Role-based tool scoping + policy-as-code + dynamic permission revocation. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 14 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 14" }, { "record_id": "GAISSF-CRO-027-MAP-0065", "gaissf_id": "D3-CTL-02", "gaissf_title": "INTER-AGENT COMMUNICATION SECURITY", "domain": "D3: AGENTIC RISK & AUTONOMOUS SYSTEM SECURITY", "article": 9, "article_title": "Risk management system", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "SP", "coverage": "Partial mapping", "confidence": "High", "rationale": "GAISSF D3-CTL-02 operationalises part of Article 9 through mTLS for agent mesh + message signing + payload validation. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 9 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 9" }, { "record_id": "GAISSF-CRO-027-MAP-0066", "gaissf_id": "D3-CTL-02", "gaissf_title": "INTER-AGENT COMMUNICATION SECURITY", "domain": "D3: AGENTIC RISK & AUTONOMOUS SYSTEM SECURITY", "article": 14, "article_title": "Human oversight", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "P", "coverage": "Partial mapping", "confidence": "Medium-High", "rationale": "GAISSF D3-CTL-02 operationalises part of Article 14 through mTLS for agent mesh + message signing + payload validation. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 14 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 14" }, { "record_id": "GAISSF-CRO-027-MAP-0067", "gaissf_id": "D3-CTL-02", "gaissf_title": "INTER-AGENT COMMUNICATION SECURITY", "domain": "D3: AGENTIC RISK & AUTONOMOUS SYSTEM SECURITY", "article": 15, "article_title": "Accuracy, robustness and cybersecurity", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "SP", "coverage": "Partial mapping", "confidence": "High", "rationale": "GAISSF D3-CTL-02 operationalises part of Article 15 through mTLS for agent mesh + message signing + payload validation. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 15 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 15" }, { "record_id": "GAISSF-CRO-027-MAP-0068", "gaissf_id": "D3-CTL-02", "gaissf_title": "INTER-AGENT COMMUNICATION SECURITY", "domain": "D3: AGENTIC RISK & AUTONOMOUS SYSTEM SECURITY", "article": 26, "article_title": "Obligations of deployers of high-risk AI systems", "article_group": "Deployer obligations", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "P", "coverage": "Partial mapping", "confidence": "Medium-High", "rationale": "GAISSF D3-CTL-02 operationalises part of Article 26 through mTLS for agent mesh + message signing + payload validation. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 26 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 26" }, { "record_id": "GAISSF-CRO-027-MAP-0069", "gaissf_id": "D3-CTL-03", "gaissf_title": "AGENTIC PROMPT CHAINING DETECTION", "domain": "D3: AGENTIC RISK & AUTONOMOUS SYSTEM SECURITY", "article": 9, "article_title": "Risk management system", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "S", "coverage": "Indirect mapping", "confidence": "Medium", "rationale": "GAISSF D3-CTL-03 operationalises part of Article 9 through Cross-session behavioural correlation + chain pattern detection + anomaly scoring. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 9 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 9" }, { "record_id": "GAISSF-CRO-027-MAP-0070", "gaissf_id": "D3-CTL-03", "gaissf_title": "AGENTIC PROMPT CHAINING DETECTION", "domain": "D3: AGENTIC RISK & AUTONOMOUS SYSTEM SECURITY", "article": 14, "article_title": "Human oversight", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "P", "coverage": "Partial mapping", "confidence": "Medium-High", "rationale": "GAISSF D3-CTL-03 operationalises part of Article 14 through Cross-session behavioural correlation + chain pattern detection + anomaly scoring. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 14 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 14" }, { "record_id": "GAISSF-CRO-027-MAP-0071", "gaissf_id": "D3-CTL-03", "gaissf_title": "AGENTIC PROMPT CHAINING DETECTION", "domain": "D3: AGENTIC RISK & AUTONOMOUS SYSTEM SECURITY", "article": 15, "article_title": "Accuracy, robustness and cybersecurity", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "S", "coverage": "Indirect mapping", "confidence": "Medium", "rationale": "GAISSF D3-CTL-03 operationalises part of Article 15 through Cross-session behavioural correlation + chain pattern detection + anomaly scoring. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 15 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 15" }, { "record_id": "GAISSF-CRO-027-MAP-0072", "gaissf_id": "D3-CTL-03", "gaissf_title": "AGENTIC PROMPT CHAINING DETECTION", "domain": "D3: AGENTIC RISK & AUTONOMOUS SYSTEM SECURITY", "article": 26, "article_title": "Obligations of deployers of high-risk AI systems", "article_group": "Deployer obligations", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "P", "coverage": "Partial mapping", "confidence": "Medium-High", "rationale": "GAISSF D3-CTL-03 operationalises part of Article 26 through Cross-session behavioural correlation + chain pattern detection + anomaly scoring. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 26 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 26" }, { "record_id": "GAISSF-CRO-027-MAP-0073", "gaissf_id": "D3-CTL-04", "gaissf_title": "EMBODIED AI SAFETY CONTROLS", "domain": "D3: AGENTIC RISK & AUTONOMOUS SYSTEM SECURITY", "article": 9, "article_title": "Risk management system", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "SP", "coverage": "Partial mapping", "confidence": "High", "rationale": "GAISSF D3-CTL-04 operationalises part of Article 9 through Sensor integrity verification + safety interlocks + fail-safe state enforcement. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 9 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 9" }, { "record_id": "GAISSF-CRO-027-MAP-0074", "gaissf_id": "D3-CTL-04", "gaissf_title": "EMBODIED AI SAFETY CONTROLS", "domain": "D3: AGENTIC RISK & AUTONOMOUS SYSTEM SECURITY", "article": 14, "article_title": "Human oversight", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "P", "coverage": "Partial mapping", "confidence": "Medium-High", "rationale": "GAISSF D3-CTL-04 operationalises part of Article 14 through Sensor integrity verification + safety interlocks + fail-safe state enforcement. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 14 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 14" }, { "record_id": "GAISSF-CRO-027-MAP-0075", "gaissf_id": "D3-CTL-04", "gaissf_title": "EMBODIED AI SAFETY CONTROLS", "domain": "D3: AGENTIC RISK & AUTONOMOUS SYSTEM SECURITY", "article": 15, "article_title": "Accuracy, robustness and cybersecurity", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "SP", "coverage": "Partial mapping", "confidence": "High", "rationale": "GAISSF D3-CTL-04 operationalises part of Article 15 through Sensor integrity verification + safety interlocks + fail-safe state enforcement. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 15 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 15" }, { "record_id": "GAISSF-CRO-027-MAP-0076", "gaissf_id": "D3-CTL-04", "gaissf_title": "EMBODIED AI SAFETY CONTROLS", "domain": "D3: AGENTIC RISK & AUTONOMOUS SYSTEM SECURITY", "article": 26, "article_title": "Obligations of deployers of high-risk AI systems", "article_group": "Deployer obligations", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "P", "coverage": "Partial mapping", "confidence": "Medium-High", "rationale": "GAISSF D3-CTL-04 operationalises part of Article 26 through Sensor integrity verification + safety interlocks + fail-safe state enforcement. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 26 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 26" }, { "record_id": "GAISSF-CRO-027-MAP-0077", "gaissf_id": "D3-CTL-05", "gaissf_title": "MULTI-AGENT TRUST CHAIN ATTESTATION", "domain": "D3: AGENTIC RISK & AUTONOMOUS SYSTEM SECURITY", "article": 9, "article_title": "Risk management system", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "S", "coverage": "Indirect mapping", "confidence": "Medium", "rationale": "GAISSF D3-CTL-05 operationalises part of Article 9 through SPIFFE/SPIRE workload identity + short-lived certificates + continuous attestation. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 9 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 9" }, { "record_id": "GAISSF-CRO-027-MAP-0078", "gaissf_id": "D3-CTL-05", "gaissf_title": "MULTI-AGENT TRUST CHAIN ATTESTATION", "domain": "D3: AGENTIC RISK & AUTONOMOUS SYSTEM SECURITY", "article": 15, "article_title": "Accuracy, robustness and cybersecurity", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "S", "coverage": "Indirect mapping", "confidence": "Medium", "rationale": "GAISSF D3-CTL-05 operationalises part of Article 15 through SPIFFE/SPIRE workload identity + short-lived certificates + continuous attestation. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 15 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 15" }, { "record_id": "GAISSF-CRO-027-MAP-0079", "gaissf_id": "D3-CTL-05", "gaissf_title": "MULTI-AGENT TRUST CHAIN ATTESTATION", "domain": "D3: AGENTIC RISK & AUTONOMOUS SYSTEM SECURITY", "article": 14, "article_title": "Human oversight", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "P", "coverage": "Partial mapping", "confidence": "Medium-High", "rationale": "GAISSF D3-CTL-05 operationalises part of Article 14 through SPIFFE/SPIRE workload identity + short-lived certificates + continuous attestation. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 14 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 14" }, { "record_id": "GAISSF-CRO-027-MAP-0080", "gaissf_id": "D3-CTL-05", "gaissf_title": "MULTI-AGENT TRUST CHAIN ATTESTATION", "domain": "D3: AGENTIC RISK & AUTONOMOUS SYSTEM SECURITY", "article": 26, "article_title": "Obligations of deployers of high-risk AI systems", "article_group": "Deployer obligations", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "P", "coverage": "Partial mapping", "confidence": "Medium-High", "rationale": "GAISSF D3-CTL-05 operationalises part of Article 26 through SPIFFE/SPIRE workload identity + short-lived certificates + continuous attestation. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 26 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 26" }, { "record_id": "GAISSF-CRO-027-MAP-0081", "gaissf_id": "D3-CTL-06", "gaissf_title": "PERSISTENT MEMORY EXFILTRATION PREVENTION", "domain": "D3: AGENTIC RISK & AUTONOMOUS SYSTEM SECURITY", "article": 15, "article_title": "Accuracy, robustness and cybersecurity", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "SP", "coverage": "Partial mapping", "confidence": "High", "rationale": "GAISSF D3-CTL-06 operationalises part of Article 15 through User-scoped memory isolation + encryption at rest + query-level access controls. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 15 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 15" }, { "record_id": "GAISSF-CRO-027-MAP-0082", "gaissf_id": "D3-CTL-06", "gaissf_title": "PERSISTENT MEMORY EXFILTRATION PREVENTION", "domain": "D3: AGENTIC RISK & AUTONOMOUS SYSTEM SECURITY", "article": 9, "article_title": "Risk management system", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "SP", "coverage": "Partial mapping", "confidence": "High", "rationale": "GAISSF D3-CTL-06 operationalises part of Article 9 through User-scoped memory isolation + encryption at rest + query-level access controls. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 9 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 9" }, { "record_id": "GAISSF-CRO-027-MAP-0083", "gaissf_id": "D3-CTL-06", "gaissf_title": "PERSISTENT MEMORY EXFILTRATION PREVENTION", "domain": "D3: AGENTIC RISK & AUTONOMOUS SYSTEM SECURITY", "article": 14, "article_title": "Human oversight", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "P", "coverage": "Partial mapping", "confidence": "Medium-High", "rationale": "GAISSF D3-CTL-06 operationalises part of Article 14 through User-scoped memory isolation + encryption at rest + query-level access controls. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 14 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 14" }, { "record_id": "GAISSF-CRO-027-MAP-0084", "gaissf_id": "D3-CTL-06", "gaissf_title": "PERSISTENT MEMORY EXFILTRATION PREVENTION", "domain": "D3: AGENTIC RISK & AUTONOMOUS SYSTEM SECURITY", "article": 26, "article_title": "Obligations of deployers of high-risk AI systems", "article_group": "Deployer obligations", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "P", "coverage": "Partial mapping", "confidence": "Medium-High", "rationale": "GAISSF D3-CTL-06 operationalises part of Article 26 through User-scoped memory isolation + encryption at rest + query-level access controls. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 26 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 26" }, { "record_id": "GAISSF-CRO-027-MAP-0085", "gaissf_id": "D3-CTL-07", "gaissf_title": "SECURE MEMORY LIFECYCLE MANAGEMENT", "domain": "D3: AGENTIC RISK & AUTONOMOUS SYSTEM SECURITY", "article": 9, "article_title": "Risk management system", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "S", "coverage": "Indirect mapping", "confidence": "Medium", "rationale": "GAISSF D3-CTL-07 operationalises part of Article 9 through Cryptographic deletion + lifecycle policy enforcement + retention auditing. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 9 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 9" }, { "record_id": "GAISSF-CRO-027-MAP-0086", "gaissf_id": "D3-CTL-07", "gaissf_title": "SECURE MEMORY LIFECYCLE MANAGEMENT", "domain": "D3: AGENTIC RISK & AUTONOMOUS SYSTEM SECURITY", "article": 15, "article_title": "Accuracy, robustness and cybersecurity", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "S", "coverage": "Indirect mapping", "confidence": "Medium", "rationale": "GAISSF D3-CTL-07 operationalises part of Article 15 through Cryptographic deletion + lifecycle policy enforcement + retention auditing. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 15 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 15" }, { "record_id": "GAISSF-CRO-027-MAP-0087", "gaissf_id": "D3-CTL-07", "gaissf_title": "SECURE MEMORY LIFECYCLE MANAGEMENT", "domain": "D3: AGENTIC RISK & AUTONOMOUS SYSTEM SECURITY", "article": 26, "article_title": "Obligations of deployers of high-risk AI systems", "article_group": "Deployer obligations", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "P", "coverage": "Partial mapping", "confidence": "Medium-High", "rationale": "GAISSF D3-CTL-07 operationalises part of Article 26 through Cryptographic deletion + lifecycle policy enforcement + retention auditing. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 26 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 26" }, { "record_id": "GAISSF-CRO-027-MAP-0088", "gaissf_id": "D3-CTL-07", "gaissf_title": "SECURE MEMORY LIFECYCLE MANAGEMENT", "domain": "D3: AGENTIC RISK & AUTONOMOUS SYSTEM SECURITY", "article": 14, "article_title": "Human oversight", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "P", "coverage": "Partial mapping", "confidence": "Medium-High", "rationale": "GAISSF D3-CTL-07 operationalises part of Article 14 through Cryptographic deletion + lifecycle policy enforcement + retention auditing. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 14 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 14" }, { "record_id": "GAISSF-CRO-027-MAP-0089", "gaissf_id": "D4-CTL-01", "gaissf_title": "AI BILL OF MATERIALS (AI BOM) MAINTENANCE", "domain": "D4: SUPPLY CHAIN & THIRD-PARTY AI SECURITY", "article": 15, "article_title": "Accuracy, robustness and cybersecurity", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "S", "coverage": "Indirect mapping", "confidence": "Medium", "rationale": "GAISSF D4-CTL-01 operationalises part of Article 15 through Automated BOM generation + version tracking + registry synchronization. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 15 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 15" }, { "record_id": "GAISSF-CRO-027-MAP-0090", "gaissf_id": "D4-CTL-01", "gaissf_title": "AI BILL OF MATERIALS (AI BOM) MAINTENANCE", "domain": "D4: SUPPLY CHAIN & THIRD-PARTY AI SECURITY", "article": 17, "article_title": "Quality management system", "article_group": "Provider obligations", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "S", "coverage": "Indirect mapping", "confidence": "Medium", "rationale": "GAISSF D4-CTL-01 operationalises part of Article 17 through Automated BOM generation + version tracking + registry synchronization. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 17 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 17" }, { "record_id": "GAISSF-CRO-027-MAP-0091", "gaissf_id": "D4-CTL-01", "gaissf_title": "AI BILL OF MATERIALS (AI BOM) MAINTENANCE", "domain": "D4: SUPPLY CHAIN & THIRD-PARTY AI SECURITY", "article": 11, "article_title": "Technical documentation", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "P", "coverage": "Partial mapping", "confidence": "Medium-High", "rationale": "GAISSF D4-CTL-01 operationalises part of Article 11 through Automated BOM generation + version tracking + registry synchronization. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 11 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 11" }, { "record_id": "GAISSF-CRO-027-MAP-0092", "gaissf_id": "D4-CTL-01", "gaissf_title": "AI BILL OF MATERIALS (AI BOM) MAINTENANCE", "domain": "D4: SUPPLY CHAIN & THIRD-PARTY AI SECURITY", "article": 25, "article_title": "Responsibilities along the AI value chain", "article_group": "Supply chain roles", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems; paragraphs 2 and 4 were amended from 27 July 2026.", "relationship": "P", "coverage": "Partial mapping", "confidence": "Medium-High", "rationale": "GAISSF D4-CTL-01 operationalises part of Article 25 through Automated BOM generation + version tracking + registry synchronization. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 25 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 25" }, { "record_id": "GAISSF-CRO-027-MAP-0093", "gaissf_id": "D4-CTL-02", "gaissf_title": "MODEL FILE & ARTIFACT SCANNING", "domain": "D4: SUPPLY CHAIN & THIRD-PARTY AI SECURITY", "article": 15, "article_title": "Accuracy, robustness and cybersecurity", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "S", "coverage": "Indirect mapping", "confidence": "Medium", "rationale": "GAISSF D4-CTL-02 operationalises part of Article 15 through Static analysis + deserialization sandboxing + signature verification. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 15 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 15" }, { "record_id": "GAISSF-CRO-027-MAP-0094", "gaissf_id": "D4-CTL-02", "gaissf_title": "MODEL FILE & ARTIFACT SCANNING", "domain": "D4: SUPPLY CHAIN & THIRD-PARTY AI SECURITY", "article": 17, "article_title": "Quality management system", "article_group": "Provider obligations", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "S", "coverage": "Indirect mapping", "confidence": "Medium", "rationale": "GAISSF D4-CTL-02 operationalises part of Article 17 through Static analysis + deserialization sandboxing + signature verification. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 17 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 17" }, { "record_id": "GAISSF-CRO-027-MAP-0095", "gaissf_id": "D4-CTL-02", "gaissf_title": "MODEL FILE & ARTIFACT SCANNING", "domain": "D4: SUPPLY CHAIN & THIRD-PARTY AI SECURITY", "article": 11, "article_title": "Technical documentation", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "P", "coverage": "Partial mapping", "confidence": "Medium-High", "rationale": "GAISSF D4-CTL-02 operationalises part of Article 11 through Static analysis + deserialization sandboxing + signature verification. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 11 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 11" }, { "record_id": "GAISSF-CRO-027-MAP-0096", "gaissf_id": "D4-CTL-02", "gaissf_title": "MODEL FILE & ARTIFACT SCANNING", "domain": "D4: SUPPLY CHAIN & THIRD-PARTY AI SECURITY", "article": 25, "article_title": "Responsibilities along the AI value chain", "article_group": "Supply chain roles", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems; paragraphs 2 and 4 were amended from 27 July 2026.", "relationship": "P", "coverage": "Partial mapping", "confidence": "Medium-High", "rationale": "GAISSF D4-CTL-02 operationalises part of Article 25 through Static analysis + deserialization sandboxing + signature verification. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 25 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 25" }, { "record_id": "GAISSF-CRO-027-MAP-0097", "gaissf_id": "D4-CTL-03", "gaissf_title": "MODEL HUB & REGISTRY VETTING", "domain": "D4: SUPPLY CHAIN & THIRD-PARTY AI SECURITY", "article": 11, "article_title": "Technical documentation", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "P", "coverage": "Partial mapping", "confidence": "Medium-High", "rationale": "GAISSF D4-CTL-03 operationalises part of Article 11 through Provenance verification + license compliance + security scorecard. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 11 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 11" }, { "record_id": "GAISSF-CRO-027-MAP-0098", "gaissf_id": "D4-CTL-03", "gaissf_title": "MODEL HUB & REGISTRY VETTING", "domain": "D4: SUPPLY CHAIN & THIRD-PARTY AI SECURITY", "article": 15, "article_title": "Accuracy, robustness and cybersecurity", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "SP", "coverage": "Partial mapping", "confidence": "High", "rationale": "GAISSF D4-CTL-03 operationalises part of Article 15 through Provenance verification + license compliance + security scorecard. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 15 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 15" }, { "record_id": "GAISSF-CRO-027-MAP-0099", "gaissf_id": "D4-CTL-03", "gaissf_title": "MODEL HUB & REGISTRY VETTING", "domain": "D4: SUPPLY CHAIN & THIRD-PARTY AI SECURITY", "article": 17, "article_title": "Quality management system", "article_group": "Provider obligations", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "SP", "coverage": "Partial mapping", "confidence": "High", "rationale": "GAISSF D4-CTL-03 operationalises part of Article 17 through Provenance verification + license compliance + security scorecard. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 17 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 17" }, { "record_id": "GAISSF-CRO-027-MAP-0100", "gaissf_id": "D4-CTL-03", "gaissf_title": "MODEL HUB & REGISTRY VETTING", "domain": "D4: SUPPLY CHAIN & THIRD-PARTY AI SECURITY", "article": 25, "article_title": "Responsibilities along the AI value chain", "article_group": "Supply chain roles", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems; paragraphs 2 and 4 were amended from 27 July 2026.", "relationship": "P", "coverage": "Partial mapping", "confidence": "Medium-High", "rationale": "GAISSF D4-CTL-03 operationalises part of Article 25 through Provenance verification + license compliance + security scorecard. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 25 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 25" }, { "record_id": "GAISSF-CRO-027-MAP-0101", "gaissf_id": "D4-CTL-04", "gaissf_title": "MCP SERVER BEHAVIORAL MONITORING", "domain": "D4: SUPPLY CHAIN & THIRD-PARTY AI SECURITY", "article": 15, "article_title": "Accuracy, robustness and cybersecurity", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "SP", "coverage": "Partial mapping", "confidence": "High", "rationale": "GAISSF D4-CTL-04 operationalises part of Article 15 through Tool-call logging + anomaly detection + access control enforcement. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 15 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 15" }, { "record_id": "GAISSF-CRO-027-MAP-0102", "gaissf_id": "D4-CTL-04", "gaissf_title": "MCP SERVER BEHAVIORAL MONITORING", "domain": "D4: SUPPLY CHAIN & THIRD-PARTY AI SECURITY", "article": 25, "article_title": "Responsibilities along the AI value chain", "article_group": "Supply chain roles", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems; paragraphs 2 and 4 were amended from 27 July 2026.", "relationship": "P", "coverage": "Partial mapping", "confidence": "Medium-High", "rationale": "GAISSF D4-CTL-04 operationalises part of Article 25 through Tool-call logging + anomaly detection + access control enforcement. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 25 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 25" }, { "record_id": "GAISSF-CRO-027-MAP-0103", "gaissf_id": "D4-CTL-04", "gaissf_title": "MCP SERVER BEHAVIORAL MONITORING", "domain": "D4: SUPPLY CHAIN & THIRD-PARTY AI SECURITY", "article": 11, "article_title": "Technical documentation", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "P", "coverage": "Partial mapping", "confidence": "Medium-High", "rationale": "GAISSF D4-CTL-04 operationalises part of Article 11 through Tool-call logging + anomaly detection + access control enforcement. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 11 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 11" }, { "record_id": "GAISSF-CRO-027-MAP-0104", "gaissf_id": "D4-CTL-04", "gaissf_title": "MCP SERVER BEHAVIORAL MONITORING", "domain": "D4: SUPPLY CHAIN & THIRD-PARTY AI SECURITY", "article": 17, "article_title": "Quality management system", "article_group": "Provider obligations", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "SP", "coverage": "Partial mapping", "confidence": "High", "rationale": "GAISSF D4-CTL-04 operationalises part of Article 17 through Tool-call logging + anomaly detection + access control enforcement. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 17 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 17" }, { "record_id": "GAISSF-CRO-027-MAP-0105", "gaissf_id": "D4-CTL-05", "gaissf_title": "THIRD-PARTY AI API SECURITY ASSESSMENT", "domain": "D4: SUPPLY CHAIN & THIRD-PARTY AI SECURITY", "article": 15, "article_title": "Accuracy, robustness and cybersecurity", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "SP", "coverage": "Partial mapping", "confidence": "High", "rationale": "GAISSF D4-CTL-05 operationalises part of Article 15 through Contractual security requirements + penetration testing + data flow mapping. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 15 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 15" }, { "record_id": "GAISSF-CRO-027-MAP-0106", "gaissf_id": "D4-CTL-05", "gaissf_title": "THIRD-PARTY AI API SECURITY ASSESSMENT", "domain": "D4: SUPPLY CHAIN & THIRD-PARTY AI SECURITY", "article": 11, "article_title": "Technical documentation", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "P", "coverage": "Partial mapping", "confidence": "Medium-High", "rationale": "GAISSF D4-CTL-05 operationalises part of Article 11 through Contractual security requirements + penetration testing + data flow mapping. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 11 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 11" }, { "record_id": "GAISSF-CRO-027-MAP-0107", "gaissf_id": "D4-CTL-05", "gaissf_title": "THIRD-PARTY AI API SECURITY ASSESSMENT", "domain": "D4: SUPPLY CHAIN & THIRD-PARTY AI SECURITY", "article": 17, "article_title": "Quality management system", "article_group": "Provider obligations", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "SP", "coverage": "Partial mapping", "confidence": "High", "rationale": "GAISSF D4-CTL-05 operationalises part of Article 17 through Contractual security requirements + penetration testing + data flow mapping. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 17 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 17" }, { "record_id": "GAISSF-CRO-027-MAP-0108", "gaissf_id": "D4-CTL-05", "gaissf_title": "THIRD-PARTY AI API SECURITY ASSESSMENT", "domain": "D4: SUPPLY CHAIN & THIRD-PARTY AI SECURITY", "article": 53, "article_title": "Obligations for providers of general-purpose AI models", "article_group": "GPAI", "application_status": "Chapter V applicable since 2 August 2025. Article 101 fine powers apply from 2 August 2026; pre-2 August 2025 GPAI models have the Article 111(3) transition until 2 August 2027.", "relationship": "P", "coverage": "Partial mapping", "confidence": "Medium-High", "rationale": "GAISSF D4-CTL-05 operationalises part of Article 53 through Contractual security requirements + penetration testing + data flow mapping. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 53 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 53" }, { "record_id": "GAISSF-CRO-027-MAP-0109", "gaissf_id": "D4-CTL-06", "gaissf_title": "SHADOW AI DISCOVERY & GOVERNANCE", "domain": "D4: SUPPLY CHAIN & THIRD-PARTY AI SECURITY", "article": 17, "article_title": "Quality management system", "article_group": "Provider obligations", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "S", "coverage": "Indirect mapping", "confidence": "Medium", "rationale": "GAISSF D4-CTL-06 operationalises part of Article 17 through Network traffic analysis + SaaS discovery + policy enforcement. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 17 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 17" }, { "record_id": "GAISSF-CRO-027-MAP-0110", "gaissf_id": "D4-CTL-06", "gaissf_title": "SHADOW AI DISCOVERY & GOVERNANCE", "domain": "D4: SUPPLY CHAIN & THIRD-PARTY AI SECURITY", "article": 15, "article_title": "Accuracy, robustness and cybersecurity", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "S", "coverage": "Indirect mapping", "confidence": "Medium", "rationale": "GAISSF D4-CTL-06 operationalises part of Article 15 through Network traffic analysis + SaaS discovery + policy enforcement. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 15 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 15" }, { "record_id": "GAISSF-CRO-027-MAP-0111", "gaissf_id": "D4-CTL-06", "gaissf_title": "SHADOW AI DISCOVERY & GOVERNANCE", "domain": "D4: SUPPLY CHAIN & THIRD-PARTY AI SECURITY", "article": 25, "article_title": "Responsibilities along the AI value chain", "article_group": "Supply chain roles", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems; paragraphs 2 and 4 were amended from 27 July 2026.", "relationship": "P", "coverage": "Partial mapping", "confidence": "Medium-High", "rationale": "GAISSF D4-CTL-06 operationalises part of Article 25 through Network traffic analysis + SaaS discovery + policy enforcement. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 25 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 25" }, { "record_id": "GAISSF-CRO-027-MAP-0112", "gaissf_id": "D4-CTL-06", "gaissf_title": "SHADOW AI DISCOVERY & GOVERNANCE", "domain": "D4: SUPPLY CHAIN & THIRD-PARTY AI SECURITY", "article": 9, "article_title": "Risk management system", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "S", "coverage": "Indirect mapping", "confidence": "Medium", "rationale": "GAISSF D4-CTL-06 operationalises part of Article 9 through Network traffic analysis + SaaS discovery + policy enforcement. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 9 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 9" }, { "record_id": "GAISSF-CRO-027-MAP-0113", "gaissf_id": "D4-CTL-07", "gaissf_title": "AI SOFTWARE COMPOSITION ANALYSIS (SCA)", "domain": "D4: SUPPLY CHAIN & THIRD-PARTY AI SECURITY", "article": 11, "article_title": "Technical documentation", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "P", "coverage": "Partial mapping", "confidence": "Medium-High", "rationale": "GAISSF D4-CTL-07 operationalises part of Article 11 through Dependency scanning + CVE matching + automated patching. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 11 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 11" }, { "record_id": "GAISSF-CRO-027-MAP-0114", "gaissf_id": "D4-CTL-07", "gaissf_title": "AI SOFTWARE COMPOSITION ANALYSIS (SCA)", "domain": "D4: SUPPLY CHAIN & THIRD-PARTY AI SECURITY", "article": 15, "article_title": "Accuracy, robustness and cybersecurity", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "S", "coverage": "Indirect mapping", "confidence": "Medium", "rationale": "GAISSF D4-CTL-07 operationalises part of Article 15 through Dependency scanning + CVE matching + automated patching. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 15 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 15" }, { "record_id": "GAISSF-CRO-027-MAP-0115", "gaissf_id": "D4-CTL-07", "gaissf_title": "AI SOFTWARE COMPOSITION ANALYSIS (SCA)", "domain": "D4: SUPPLY CHAIN & THIRD-PARTY AI SECURITY", "article": 17, "article_title": "Quality management system", "article_group": "Provider obligations", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "S", "coverage": "Indirect mapping", "confidence": "Medium", "rationale": "GAISSF D4-CTL-07 operationalises part of Article 17 through Dependency scanning + CVE matching + automated patching. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 17 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 17" }, { "record_id": "GAISSF-CRO-027-MAP-0116", "gaissf_id": "D4-CTL-07", "gaissf_title": "AI SOFTWARE COMPOSITION ANALYSIS (SCA)", "domain": "D4: SUPPLY CHAIN & THIRD-PARTY AI SECURITY", "article": 25, "article_title": "Responsibilities along the AI value chain", "article_group": "Supply chain roles", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems; paragraphs 2 and 4 were amended from 27 July 2026.", "relationship": "P", "coverage": "Partial mapping", "confidence": "Medium-High", "rationale": "GAISSF D4-CTL-07 operationalises part of Article 25 through Dependency scanning + CVE matching + automated patching. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 25 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 25" }, { "record_id": "GAISSF-CRO-027-MAP-0117", "gaissf_id": "D5-CTL-01", "gaissf_title": "HARMFUL CONTENT BLOCKING", "domain": "D5: CONTENT SAFETY & OUTPUT INTEGRITY", "article": 9, "article_title": "Risk management system", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "S", "coverage": "Indirect mapping", "confidence": "Medium", "rationale": "GAISSF D5-CTL-01 operationalises part of Article 9 through Content safety classifier + refusal engine. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 9 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 9" }, { "record_id": "GAISSF-CRO-027-MAP-0118", "gaissf_id": "D5-CTL-01", "gaissf_title": "HARMFUL CONTENT BLOCKING", "domain": "D5: CONTENT SAFETY & OUTPUT INTEGRITY", "article": 5, "article_title": "Prohibited AI practices", "article_group": "Prohibited practices", "application_status": "Generally applicable since 2 February 2025; Article 5(1)(ba), 5(1)(bb), 5(1a) and 5(1b) apply from 2 December 2026 under amended Article 113(a).", "relationship": "S", "coverage": "Indirect mapping", "confidence": "Medium", "rationale": "GAISSF D5-CTL-01 operationalises part of Article 5 through Content safety classifier + refusal engine. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 5 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 5" }, { "record_id": "GAISSF-CRO-027-MAP-0119", "gaissf_id": "D5-CTL-01", "gaissf_title": "HARMFUL CONTENT BLOCKING", "domain": "D5: CONTENT SAFETY & OUTPUT INTEGRITY", "article": 13, "article_title": "Transparency and provision of information to deployers", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "P", "coverage": "Partial mapping", "confidence": "Medium-High", "rationale": "GAISSF D5-CTL-01 operationalises part of Article 13 through Content safety classifier + refusal engine. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 13 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 13" }, { "record_id": "GAISSF-CRO-027-MAP-0120", "gaissf_id": "D5-CTL-01", "gaissf_title": "HARMFUL CONTENT BLOCKING", "domain": "D5: CONTENT SAFETY & OUTPUT INTEGRITY", "article": 14, "article_title": "Human oversight", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "P", "coverage": "Partial mapping", "confidence": "Medium-High", "rationale": "GAISSF D5-CTL-01 operationalises part of Article 14 through Content safety classifier + refusal engine. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 14 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 14" }, { "record_id": "GAISSF-CRO-027-MAP-0121", "gaissf_id": "D5-CTL-02", "gaissf_title": "PII LEAKAGE PREVENTION", "domain": "D5: CONTENT SAFETY & OUTPUT INTEGRITY", "article": 9, "article_title": "Risk management system", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "SP", "coverage": "Partial mapping", "confidence": "High", "rationale": "GAISSF D5-CTL-02 operationalises part of Article 9 through PII detection + masking + access controls. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 9 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 9" }, { "record_id": "GAISSF-CRO-027-MAP-0122", "gaissf_id": "D5-CTL-02", "gaissf_title": "PII LEAKAGE PREVENTION", "domain": "D5: CONTENT SAFETY & OUTPUT INTEGRITY", "article": 5, "article_title": "Prohibited AI practices", "article_group": "Prohibited practices", "application_status": "Generally applicable since 2 February 2025; Article 5(1)(ba), 5(1)(bb), 5(1a) and 5(1b) apply from 2 December 2026 under amended Article 113(a).", "relationship": "S", "coverage": "Indirect mapping", "confidence": "Medium", "rationale": "GAISSF D5-CTL-02 operationalises part of Article 5 through PII detection + masking + access controls. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 5 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 5" }, { "record_id": "GAISSF-CRO-027-MAP-0123", "gaissf_id": "D5-CTL-02", "gaissf_title": "PII LEAKAGE PREVENTION", "domain": "D5: CONTENT SAFETY & OUTPUT INTEGRITY", "article": 13, "article_title": "Transparency and provision of information to deployers", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "P", "coverage": "Partial mapping", "confidence": "Medium-High", "rationale": "GAISSF D5-CTL-02 operationalises part of Article 13 through PII detection + masking + access controls. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 13 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 13" }, { "record_id": "GAISSF-CRO-027-MAP-0124", "gaissf_id": "D5-CTL-02", "gaissf_title": "PII LEAKAGE PREVENTION", "domain": "D5: CONTENT SAFETY & OUTPUT INTEGRITY", "article": 14, "article_title": "Human oversight", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "P", "coverage": "Partial mapping", "confidence": "Medium-High", "rationale": "GAISSF D5-CTL-02 operationalises part of Article 14 through PII detection + masking + access controls. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 14 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 14" }, { "record_id": "GAISSF-CRO-027-MAP-0125", "gaissf_id": "D5-CTL-03", "gaissf_title": "COPYRIGHT DETECTION", "domain": "D5: CONTENT SAFETY & OUTPUT INTEGRITY", "article": 9, "article_title": "Risk management system", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "S", "coverage": "Indirect mapping", "confidence": "Medium", "rationale": "GAISSF D5-CTL-03 operationalises part of Article 9 through n-gram overlap detection + refusal. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 9 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 9" }, { "record_id": "GAISSF-CRO-027-MAP-0126", "gaissf_id": "D5-CTL-03", "gaissf_title": "COPYRIGHT DETECTION", "domain": "D5: CONTENT SAFETY & OUTPUT INTEGRITY", "article": 5, "article_title": "Prohibited AI practices", "article_group": "Prohibited practices", "application_status": "Generally applicable since 2 February 2025; Article 5(1)(ba), 5(1)(bb), 5(1a) and 5(1b) apply from 2 December 2026 under amended Article 113(a).", "relationship": "S", "coverage": "Indirect mapping", "confidence": "Medium", "rationale": "GAISSF D5-CTL-03 operationalises part of Article 5 through n-gram overlap detection + refusal. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 5 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 5" }, { "record_id": "GAISSF-CRO-027-MAP-0127", "gaissf_id": "D5-CTL-03", "gaissf_title": "COPYRIGHT DETECTION", "domain": "D5: CONTENT SAFETY & OUTPUT INTEGRITY", "article": 13, "article_title": "Transparency and provision of information to deployers", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "P", "coverage": "Partial mapping", "confidence": "Medium-High", "rationale": "GAISSF D5-CTL-03 operationalises part of Article 13 through n-gram overlap detection + refusal. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 13 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 13" }, { "record_id": "GAISSF-CRO-027-MAP-0128", "gaissf_id": "D5-CTL-03", "gaissf_title": "COPYRIGHT DETECTION", "domain": "D5: CONTENT SAFETY & OUTPUT INTEGRITY", "article": 14, "article_title": "Human oversight", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "P", "coverage": "Partial mapping", "confidence": "Medium-High", "rationale": "GAISSF D5-CTL-03 operationalises part of Article 14 through n-gram overlap detection + refusal. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 14 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 14" }, { "record_id": "GAISSF-CRO-027-MAP-0129", "gaissf_id": "D5-CTL-04", "gaissf_title": "AI WATERMARKING ROBUSTNESS", "domain": "D5: CONTENT SAFETY & OUTPUT INTEGRITY", "article": 9, "article_title": "Risk management system", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "SP", "coverage": "Partial mapping", "confidence": "High", "rationale": "GAISSF D5-CTL-04 operationalises part of Article 9 through C2PA-compliant watermarking + tamper resistance testing. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 9 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 9" }, { "record_id": "GAISSF-CRO-027-MAP-0130", "gaissf_id": "D5-CTL-04", "gaissf_title": "AI WATERMARKING ROBUSTNESS", "domain": "D5: CONTENT SAFETY & OUTPUT INTEGRITY", "article": 15, "article_title": "Accuracy, robustness and cybersecurity", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "SP", "coverage": "Partial mapping", "confidence": "High", "rationale": "GAISSF D5-CTL-04 operationalises part of Article 15 through C2PA-compliant watermarking + tamper resistance testing. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 15 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 15" }, { "record_id": "GAISSF-CRO-027-MAP-0131", "gaissf_id": "D5-CTL-04", "gaissf_title": "AI WATERMARKING ROBUSTNESS", "domain": "D5: CONTENT SAFETY & OUTPUT INTEGRITY", "article": 5, "article_title": "Prohibited AI practices", "article_group": "Prohibited practices", "application_status": "Generally applicable since 2 February 2025; Article 5(1)(ba), 5(1)(bb), 5(1a) and 5(1b) apply from 2 December 2026 under amended Article 113(a).", "relationship": "S", "coverage": "Indirect mapping", "confidence": "Medium", "rationale": "GAISSF D5-CTL-04 operationalises part of Article 5 through C2PA-compliant watermarking + tamper resistance testing. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 5 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 5" }, { "record_id": "GAISSF-CRO-027-MAP-0132", "gaissf_id": "D5-CTL-04", "gaissf_title": "AI WATERMARKING ROBUSTNESS", "domain": "D5: CONTENT SAFETY & OUTPUT INTEGRITY", "article": 13, "article_title": "Transparency and provision of information to deployers", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "P", "coverage": "Partial mapping", "confidence": "Medium-High", "rationale": "GAISSF D5-CTL-04 operationalises part of Article 13 through C2PA-compliant watermarking + tamper resistance testing. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 13 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 13" }, { "record_id": "GAISSF-CRO-027-MAP-0133", "gaissf_id": "D5-CTL-05", "gaissf_title": "PRIVACY-BY-DESIGN VERIFICATION", "domain": "D5: CONTENT SAFETY & OUTPUT INTEGRITY", "article": 9, "article_title": "Risk management system", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "S", "coverage": "Indirect mapping", "confidence": "Medium", "rationale": "GAISSF D5-CTL-05 operationalises part of Article 9 through Data minimization + purpose limitation + machine unlearning. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 9 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 9" }, { "record_id": "GAISSF-CRO-027-MAP-0134", "gaissf_id": "D5-CTL-05", "gaissf_title": "PRIVACY-BY-DESIGN VERIFICATION", "domain": "D5: CONTENT SAFETY & OUTPUT INTEGRITY", "article": 5, "article_title": "Prohibited AI practices", "article_group": "Prohibited practices", "application_status": "Generally applicable since 2 February 2025; Article 5(1)(ba), 5(1)(bb), 5(1a) and 5(1b) apply from 2 December 2026 under amended Article 113(a).", "relationship": "S", "coverage": "Indirect mapping", "confidence": "Medium", "rationale": "GAISSF D5-CTL-05 operationalises part of Article 5 through Data minimization + purpose limitation + machine unlearning. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 5 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 5" }, { "record_id": "GAISSF-CRO-027-MAP-0135", "gaissf_id": "D5-CTL-05", "gaissf_title": "PRIVACY-BY-DESIGN VERIFICATION", "domain": "D5: CONTENT SAFETY & OUTPUT INTEGRITY", "article": 13, "article_title": "Transparency and provision of information to deployers", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "P", "coverage": "Partial mapping", "confidence": "Medium-High", "rationale": "GAISSF D5-CTL-05 operationalises part of Article 13 through Data minimization + purpose limitation + machine unlearning. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 13 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 13" }, { "record_id": "GAISSF-CRO-027-MAP-0136", "gaissf_id": "D5-CTL-05", "gaissf_title": "PRIVACY-BY-DESIGN VERIFICATION", "domain": "D5: CONTENT SAFETY & OUTPUT INTEGRITY", "article": 14, "article_title": "Human oversight", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "P", "coverage": "Partial mapping", "confidence": "Medium-High", "rationale": "GAISSF D5-CTL-05 operationalises part of Article 14 through Data minimization + purpose limitation + machine unlearning. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 14 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 14" }, { "record_id": "GAISSF-CRO-027-MAP-0137", "gaissf_id": "D5-CTL-06", "gaissf_title": "PRIVACY-PRESERVING ML VALIDATION", "domain": "D5: CONTENT SAFETY & OUTPUT INTEGRITY", "article": 9, "article_title": "Risk management system", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "S", "coverage": "Indirect mapping", "confidence": "Medium", "rationale": "GAISSF D5-CTL-06 operationalises part of Article 9 through Differential privacy + membership inference testing. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 9 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 9" }, { "record_id": "GAISSF-CRO-027-MAP-0138", "gaissf_id": "D5-CTL-06", "gaissf_title": "PRIVACY-PRESERVING ML VALIDATION", "domain": "D5: CONTENT SAFETY & OUTPUT INTEGRITY", "article": 15, "article_title": "Accuracy, robustness and cybersecurity", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "S", "coverage": "Indirect mapping", "confidence": "Medium", "rationale": "GAISSF D5-CTL-06 operationalises part of Article 15 through Differential privacy + membership inference testing. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 15 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 15" }, { "record_id": "GAISSF-CRO-027-MAP-0139", "gaissf_id": "D5-CTL-06", "gaissf_title": "PRIVACY-PRESERVING ML VALIDATION", "domain": "D5: CONTENT SAFETY & OUTPUT INTEGRITY", "article": 13, "article_title": "Transparency and provision of information to deployers", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "P", "coverage": "Partial mapping", "confidence": "Medium-High", "rationale": "GAISSF D5-CTL-06 operationalises part of Article 13 through Differential privacy + membership inference testing. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 13 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 13" }, { "record_id": "GAISSF-CRO-027-MAP-0140", "gaissf_id": "D5-CTL-06", "gaissf_title": "PRIVACY-PRESERVING ML VALIDATION", "domain": "D5: CONTENT SAFETY & OUTPUT INTEGRITY", "article": 14, "article_title": "Human oversight", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "P", "coverage": "Partial mapping", "confidence": "Medium-High", "rationale": "GAISSF D5-CTL-06 operationalises part of Article 14 through Differential privacy + membership inference testing. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 14 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 14" }, { "record_id": "GAISSF-CRO-027-MAP-0141", "gaissf_id": "D6-CTL-01", "gaissf_title": "HUMAN-IN-THE-LOOP FOR HIGH-RISK ACTIONS", "domain": "D6: GOVERNANCE, ACCOUNTABILITY & HUMAN OVERSIGHT", "article": 9, "article_title": "Risk management system", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "SP", "coverage": "Partial mapping", "confidence": "High", "rationale": "GAISSF D6-CTL-01 operationalises part of Article 9 through Approval workflow + policy enforcement + audit log. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 9 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 9" }, { "record_id": "GAISSF-CRO-027-MAP-0142", "gaissf_id": "D6-CTL-01", "gaissf_title": "HUMAN-IN-THE-LOOP FOR HIGH-RISK ACTIONS", "domain": "D6: GOVERNANCE, ACCOUNTABILITY & HUMAN OVERSIGHT", "article": 27, "article_title": "Fundamental rights impact assessment for high-risk AI systems", "article_group": "Deployer obligations", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems; paragraph 4 was amended from 27 July 2026 to permit DPIA cross-referencing/reuse where obligations are already met.", "relationship": "P", "coverage": "Partial mapping", "confidence": "Medium-High", "rationale": "GAISSF D6-CTL-01 operationalises part of Article 27 through Approval workflow + policy enforcement + audit log. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 27 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 27" }, { "record_id": "GAISSF-CRO-027-MAP-0143", "gaissf_id": "D6-CTL-01", "gaissf_title": "HUMAN-IN-THE-LOOP FOR HIGH-RISK ACTIONS", "domain": "D6: GOVERNANCE, ACCOUNTABILITY & HUMAN OVERSIGHT", "article": 26, "article_title": "Obligations of deployers of high-risk AI systems", "article_group": "Deployer obligations", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "P", "coverage": "Partial mapping", "confidence": "Medium-High", "rationale": "GAISSF D6-CTL-01 operationalises part of Article 26 through Approval workflow + policy enforcement + audit log. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 26 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 26" }, { "record_id": "GAISSF-CRO-027-MAP-0144", "gaissf_id": "D6-CTL-01", "gaissf_title": "HUMAN-IN-THE-LOOP FOR HIGH-RISK ACTIONS", "domain": "D6: GOVERNANCE, ACCOUNTABILITY & HUMAN OVERSIGHT", "article": 4, "article_title": "AI literacy", "article_group": "General", "application_status": "Applicable since 2 February 2025 under Article 113(a); Article 4 was replaced from 27 July 2026 by Regulation (EU) 2026/1744.", "relationship": "S", "coverage": "Indirect mapping", "confidence": "Medium", "rationale": "GAISSF D6-CTL-01 operationalises part of Article 4 through Approval workflow + policy enforcement + audit log. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 4 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 4" }, { "record_id": "GAISSF-CRO-027-MAP-0145", "gaissf_id": "D6-CTL-02", "gaissf_title": "AUDIT TRAIL COMPLETENESS", "domain": "D6: GOVERNANCE, ACCOUNTABILITY & HUMAN OVERSIGHT", "article": 9, "article_title": "Risk management system", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "S", "coverage": "Indirect mapping", "confidence": "Medium", "rationale": "GAISSF D6-CTL-02 operationalises part of Article 9 through Structured logging + SIEM integration + retention enforcement. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 9 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 9" }, { "record_id": "GAISSF-CRO-027-MAP-0146", "gaissf_id": "D6-CTL-02", "gaissf_title": "AUDIT TRAIL COMPLETENESS", "domain": "D6: GOVERNANCE, ACCOUNTABILITY & HUMAN OVERSIGHT", "article": 27, "article_title": "Fundamental rights impact assessment for high-risk AI systems", "article_group": "Deployer obligations", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems; paragraph 4 was amended from 27 July 2026 to permit DPIA cross-referencing/reuse where obligations are already met.", "relationship": "P", "coverage": "Partial mapping", "confidence": "Medium-High", "rationale": "GAISSF D6-CTL-02 operationalises part of Article 27 through Structured logging + SIEM integration + retention enforcement. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 27 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 27" }, { "record_id": "GAISSF-CRO-027-MAP-0147", "gaissf_id": "D6-CTL-02", "gaissf_title": "AUDIT TRAIL COMPLETENESS", "domain": "D6: GOVERNANCE, ACCOUNTABILITY & HUMAN OVERSIGHT", "article": 26, "article_title": "Obligations of deployers of high-risk AI systems", "article_group": "Deployer obligations", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "P", "coverage": "Partial mapping", "confidence": "Medium-High", "rationale": "GAISSF D6-CTL-02 operationalises part of Article 26 through Structured logging + SIEM integration + retention enforcement. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 26 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 26" }, { "record_id": "GAISSF-CRO-027-MAP-0148", "gaissf_id": "D6-CTL-02", "gaissf_title": "AUDIT TRAIL COMPLETENESS", "domain": "D6: GOVERNANCE, ACCOUNTABILITY & HUMAN OVERSIGHT", "article": 4, "article_title": "AI literacy", "article_group": "General", "application_status": "Applicable since 2 February 2025 under Article 113(a); Article 4 was replaced from 27 July 2026 by Regulation (EU) 2026/1744.", "relationship": "S", "coverage": "Indirect mapping", "confidence": "Medium", "rationale": "GAISSF D6-CTL-02 operationalises part of Article 4 through Structured logging + SIEM integration + retention enforcement. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 4 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 4" }, { "record_id": "GAISSF-CRO-027-MAP-0149", "gaissf_id": "D6-CTL-03", "gaissf_title": "AI MODEL CARD COMPLETENESS", "domain": "D6: GOVERNANCE, ACCOUNTABILITY & HUMAN OVERSIGHT", "article": 27, "article_title": "Fundamental rights impact assessment for high-risk AI systems", "article_group": "Deployer obligations", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems; paragraph 4 was amended from 27 July 2026 to permit DPIA cross-referencing/reuse where obligations are already met.", "relationship": "P", "coverage": "Partial mapping", "confidence": "Medium-High", "rationale": "GAISSF D6-CTL-03 operationalises part of Article 27 through Standardized template + version control + public accessibility. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 27 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 27" }, { "record_id": "GAISSF-CRO-027-MAP-0150", "gaissf_id": "D6-CTL-03", "gaissf_title": "AI MODEL CARD COMPLETENESS", "domain": "D6: GOVERNANCE, ACCOUNTABILITY & HUMAN OVERSIGHT", "article": 9, "article_title": "Risk management system", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "SP", "coverage": "Partial mapping", "confidence": "High", "rationale": "GAISSF D6-CTL-03 operationalises part of Article 9 through Standardized template + version control + public accessibility. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 9 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 9" }, { "record_id": "GAISSF-CRO-027-MAP-0151", "gaissf_id": "D6-CTL-03", "gaissf_title": "AI MODEL CARD COMPLETENESS", "domain": "D6: GOVERNANCE, ACCOUNTABILITY & HUMAN OVERSIGHT", "article": 26, "article_title": "Obligations of deployers of high-risk AI systems", "article_group": "Deployer obligations", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "P", "coverage": "Partial mapping", "confidence": "Medium-High", "rationale": "GAISSF D6-CTL-03 operationalises part of Article 26 through Standardized template + version control + public accessibility. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 26 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 26" }, { "record_id": "GAISSF-CRO-027-MAP-0152", "gaissf_id": "D6-CTL-03", "gaissf_title": "AI MODEL CARD COMPLETENESS", "domain": "D6: GOVERNANCE, ACCOUNTABILITY & HUMAN OVERSIGHT", "article": 17, "article_title": "Quality management system", "article_group": "Provider obligations", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "SP", "coverage": "Partial mapping", "confidence": "High", "rationale": "GAISSF D6-CTL-03 operationalises part of Article 17 through Standardized template + version control + public accessibility. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 17 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 17" }, { "record_id": "GAISSF-CRO-027-MAP-0153", "gaissf_id": "D6-CTL-04", "gaissf_title": "AI INCIDENT RESPONSE READINESS", "domain": "D6: GOVERNANCE, ACCOUNTABILITY & HUMAN OVERSIGHT", "article": 9, "article_title": "Risk management system", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "S", "coverage": "Indirect mapping", "confidence": "Medium", "rationale": "GAISSF D6-CTL-04 operationalises part of Article 9 through AI-IR runbook + tabletop exercises + containment automation. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 9 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 9" }, { "record_id": "GAISSF-CRO-027-MAP-0154", "gaissf_id": "D6-CTL-04", "gaissf_title": "AI INCIDENT RESPONSE READINESS", "domain": "D6: GOVERNANCE, ACCOUNTABILITY & HUMAN OVERSIGHT", "article": 27, "article_title": "Fundamental rights impact assessment for high-risk AI systems", "article_group": "Deployer obligations", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems; paragraph 4 was amended from 27 July 2026 to permit DPIA cross-referencing/reuse where obligations are already met.", "relationship": "P", "coverage": "Partial mapping", "confidence": "Medium-High", "rationale": "GAISSF D6-CTL-04 operationalises part of Article 27 through AI-IR runbook + tabletop exercises + containment automation. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 27 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 27" }, { "record_id": "GAISSF-CRO-027-MAP-0155", "gaissf_id": "D6-CTL-04", "gaissf_title": "AI INCIDENT RESPONSE READINESS", "domain": "D6: GOVERNANCE, ACCOUNTABILITY & HUMAN OVERSIGHT", "article": 21, "article_title": "Cooperation with competent authorities", "article_group": "Provider obligations", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "S", "coverage": "Indirect mapping", "confidence": "Medium", "rationale": "GAISSF D6-CTL-04 operationalises part of Article 21 through AI-IR runbook + tabletop exercises + containment automation. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 21 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 21" }, { "record_id": "GAISSF-CRO-027-MAP-0156", "gaissf_id": "D6-CTL-04", "gaissf_title": "AI INCIDENT RESPONSE READINESS", "domain": "D6: GOVERNANCE, ACCOUNTABILITY & HUMAN OVERSIGHT", "article": 15, "article_title": "Accuracy, robustness and cybersecurity", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "S", "coverage": "Indirect mapping", "confidence": "Medium", "rationale": "GAISSF D6-CTL-04 operationalises part of Article 15 through AI-IR runbook + tabletop exercises + containment automation. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 15 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 15" }, { "record_id": "GAISSF-CRO-027-MAP-0157", "gaissf_id": "D6-CTL-05", "gaissf_title": "MODEL DEPRECATION & DECOMMISSIONING", "domain": "D6: GOVERNANCE, ACCOUNTABILITY & HUMAN OVERSIGHT", "article": 9, "article_title": "Risk management system", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "S", "coverage": "Indirect mapping", "confidence": "Medium", "rationale": "GAISSF D6-CTL-05 operationalises part of Article 9 through Access revocation + decommission audit + scheduled lifecycle. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 9 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 9" }, { "record_id": "GAISSF-CRO-027-MAP-0158", "gaissf_id": "D6-CTL-05", "gaissf_title": "MODEL DEPRECATION & DECOMMISSIONING", "domain": "D6: GOVERNANCE, ACCOUNTABILITY & HUMAN OVERSIGHT", "article": 27, "article_title": "Fundamental rights impact assessment for high-risk AI systems", "article_group": "Deployer obligations", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems; paragraph 4 was amended from 27 July 2026 to permit DPIA cross-referencing/reuse where obligations are already met.", "relationship": "P", "coverage": "Partial mapping", "confidence": "Medium-High", "rationale": "GAISSF D6-CTL-05 operationalises part of Article 27 through Access revocation + decommission audit + scheduled lifecycle. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 27 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 27" }, { "record_id": "GAISSF-CRO-027-MAP-0159", "gaissf_id": "D6-CTL-05", "gaissf_title": "MODEL DEPRECATION & DECOMMISSIONING", "domain": "D6: GOVERNANCE, ACCOUNTABILITY & HUMAN OVERSIGHT", "article": 26, "article_title": "Obligations of deployers of high-risk AI systems", "article_group": "Deployer obligations", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "P", "coverage": "Partial mapping", "confidence": "Medium-High", "rationale": "GAISSF D6-CTL-05 operationalises part of Article 26 through Access revocation + decommission audit + scheduled lifecycle. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 26 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 26" }, { "record_id": "GAISSF-CRO-027-MAP-0160", "gaissf_id": "D6-CTL-05", "gaissf_title": "MODEL DEPRECATION & DECOMMISSIONING", "domain": "D6: GOVERNANCE, ACCOUNTABILITY & HUMAN OVERSIGHT", "article": 4, "article_title": "AI literacy", "article_group": "General", "application_status": "Applicable since 2 February 2025 under Article 113(a); Article 4 was replaced from 27 July 2026 by Regulation (EU) 2026/1744.", "relationship": "S", "coverage": "Indirect mapping", "confidence": "Medium", "rationale": "GAISSF D6-CTL-05 operationalises part of Article 4 through Access revocation + decommission audit + scheduled lifecycle. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 4 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 4" }, { "record_id": "GAISSF-CRO-027-MAP-0161", "gaissf_id": "D6-CTL-06", "gaissf_title": "THIRD-PARTY AI VENDOR GOVERNANCE", "domain": "D6: GOVERNANCE, ACCOUNTABILITY & HUMAN OVERSIGHT", "article": 17, "article_title": "Quality management system", "article_group": "Provider obligations", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "SP", "coverage": "Partial mapping", "confidence": "High", "rationale": "GAISSF D6-CTL-06 operationalises part of Article 17 through Contractual security requirements + annual assessment + audit rights. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 17 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 17" }, { "record_id": "GAISSF-CRO-027-MAP-0162", "gaissf_id": "D6-CTL-06", "gaissf_title": "THIRD-PARTY AI VENDOR GOVERNANCE", "domain": "D6: GOVERNANCE, ACCOUNTABILITY & HUMAN OVERSIGHT", "article": 15, "article_title": "Accuracy, robustness and cybersecurity", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "SP", "coverage": "Partial mapping", "confidence": "High", "rationale": "GAISSF D6-CTL-06 operationalises part of Article 15 through Contractual security requirements + annual assessment + audit rights. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 15 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 15" }, { "record_id": "GAISSF-CRO-027-MAP-0163", "gaissf_id": "D6-CTL-06", "gaissf_title": "THIRD-PARTY AI VENDOR GOVERNANCE", "domain": "D6: GOVERNANCE, ACCOUNTABILITY & HUMAN OVERSIGHT", "article": 9, "article_title": "Risk management system", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "SP", "coverage": "Partial mapping", "confidence": "High", "rationale": "GAISSF D6-CTL-06 operationalises part of Article 9 through Contractual security requirements + annual assessment + audit rights. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 9 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 9" }, { "record_id": "GAISSF-CRO-027-MAP-0164", "gaissf_id": "D6-CTL-06", "gaissf_title": "THIRD-PARTY AI VENDOR GOVERNANCE", "domain": "D6: GOVERNANCE, ACCOUNTABILITY & HUMAN OVERSIGHT", "article": 27, "article_title": "Fundamental rights impact assessment for high-risk AI systems", "article_group": "Deployer obligations", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems; paragraph 4 was amended from 27 July 2026 to permit DPIA cross-referencing/reuse where obligations are already met.", "relationship": "P", "coverage": "Partial mapping", "confidence": "Medium-High", "rationale": "GAISSF D6-CTL-06 operationalises part of Article 27 through Contractual security requirements + annual assessment + audit rights. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 27 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 27" }, { "record_id": "GAISSF-CRO-027-MAP-0165", "gaissf_id": "D6-CTL-07", "gaissf_title": "AI RESILIENCE & BUSINESS CONTINUITY", "domain": "D6: GOVERNANCE, ACCOUNTABILITY & HUMAN OVERSIGHT", "article": 9, "article_title": "Risk management system", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "S", "coverage": "Indirect mapping", "confidence": "Medium", "rationale": "GAISSF D6-CTL-07 operationalises part of Article 9 through Failover systems + degraded mode + RTO/RPO definition. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 9 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 9" }, { "record_id": "GAISSF-CRO-027-MAP-0166", "gaissf_id": "D6-CTL-07", "gaissf_title": "AI RESILIENCE & BUSINESS CONTINUITY", "domain": "D6: GOVERNANCE, ACCOUNTABILITY & HUMAN OVERSIGHT", "article": 27, "article_title": "Fundamental rights impact assessment for high-risk AI systems", "article_group": "Deployer obligations", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems; paragraph 4 was amended from 27 July 2026 to permit DPIA cross-referencing/reuse where obligations are already met.", "relationship": "P", "coverage": "Partial mapping", "confidence": "Medium-High", "rationale": "GAISSF D6-CTL-07 operationalises part of Article 27 through Failover systems + degraded mode + RTO/RPO definition. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 27 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 27" }, { "record_id": "GAISSF-CRO-027-MAP-0167", "gaissf_id": "D6-CTL-07", "gaissf_title": "AI RESILIENCE & BUSINESS CONTINUITY", "domain": "D6: GOVERNANCE, ACCOUNTABILITY & HUMAN OVERSIGHT", "article": 26, "article_title": "Obligations of deployers of high-risk AI systems", "article_group": "Deployer obligations", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "P", "coverage": "Partial mapping", "confidence": "Medium-High", "rationale": "GAISSF D6-CTL-07 operationalises part of Article 26 through Failover systems + degraded mode + RTO/RPO definition. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 26 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 26" }, { "record_id": "GAISSF-CRO-027-MAP-0168", "gaissf_id": "D6-CTL-07", "gaissf_title": "AI RESILIENCE & BUSINESS CONTINUITY", "domain": "D6: GOVERNANCE, ACCOUNTABILITY & HUMAN OVERSIGHT", "article": 4, "article_title": "AI literacy", "article_group": "General", "application_status": "Applicable since 2 February 2025 under Article 113(a); Article 4 was replaced from 27 July 2026 by Regulation (EU) 2026/1744.", "relationship": "S", "coverage": "Indirect mapping", "confidence": "Medium", "rationale": "GAISSF D6-CTL-07 operationalises part of Article 4 through Failover systems + degraded mode + RTO/RPO definition. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 4 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 4" }, { "record_id": "GAISSF-CRO-027-MAP-0169", "gaissf_id": "D7-CTL-H01", "gaissf_title": "AI-GENERATED PHISHING SIMULATION", "domain": "D7: HUMAN & SOCIETAL HARMS", "article": 9, "article_title": "Risk management system", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "S", "coverage": "Indirect mapping", "confidence": "Medium", "rationale": "GAISSF D7-CTL-H01 operationalises part of Article 9 through Simulation campaigns + click tracking + remedial training. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 9 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 9" }, { "record_id": "GAISSF-CRO-027-MAP-0170", "gaissf_id": "D7-CTL-H01", "gaissf_title": "AI-GENERATED PHISHING SIMULATION", "domain": "D7: HUMAN & SOCIETAL HARMS", "article": 14, "article_title": "Human oversight", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "P", "coverage": "Partial mapping", "confidence": "Medium-High", "rationale": "GAISSF D7-CTL-H01 operationalises part of Article 14 through Simulation campaigns + click tracking + remedial training. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 14 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 14" }, { "record_id": "GAISSF-CRO-027-MAP-0171", "gaissf_id": "D7-CTL-H01", "gaissf_title": "AI-GENERATED PHISHING SIMULATION", "domain": "D7: HUMAN & SOCIETAL HARMS", "article": 27, "article_title": "Fundamental rights impact assessment for high-risk AI systems", "article_group": "Deployer obligations", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems; paragraph 4 was amended from 27 July 2026 to permit DPIA cross-referencing/reuse where obligations are already met.", "relationship": "P", "coverage": "Partial mapping", "confidence": "Medium-High", "rationale": "GAISSF D7-CTL-H01 operationalises part of Article 27 through Simulation campaigns + click tracking + remedial training. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 27 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 27" }, { "record_id": "GAISSF-CRO-027-MAP-0172", "gaissf_id": "D7-CTL-H01", "gaissf_title": "AI-GENERATED PHISHING SIMULATION", "domain": "D7: HUMAN & SOCIETAL HARMS", "article": 15, "article_title": "Accuracy, robustness and cybersecurity", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "S", "coverage": "Indirect mapping", "confidence": "Medium", "rationale": "GAISSF D7-CTL-H01 operationalises part of Article 15 through Simulation campaigns + click tracking + remedial training. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 15 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 15" }, { "record_id": "GAISSF-CRO-027-MAP-0173", "gaissf_id": "D7-CTL-H02", "gaissf_title": "DEEPFAKE DETECTION TRAINING", "domain": "D7: HUMAN & SOCIETAL HARMS", "article": 9, "article_title": "Risk management system", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "S", "coverage": "Indirect mapping", "confidence": "Medium", "rationale": "GAISSF D7-CTL-H02 operationalises part of Article 9 through Training modules + quiz + simulated attacks. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 9 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 9" }, { "record_id": "GAISSF-CRO-027-MAP-0174", "gaissf_id": "D7-CTL-H02", "gaissf_title": "DEEPFAKE DETECTION TRAINING", "domain": "D7: HUMAN & SOCIETAL HARMS", "article": 14, "article_title": "Human oversight", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "P", "coverage": "Partial mapping", "confidence": "Medium-High", "rationale": "GAISSF D7-CTL-H02 operationalises part of Article 14 through Training modules + quiz + simulated attacks. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 14 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 14" }, { "record_id": "GAISSF-CRO-027-MAP-0175", "gaissf_id": "D7-CTL-H02", "gaissf_title": "DEEPFAKE DETECTION TRAINING", "domain": "D7: HUMAN & SOCIETAL HARMS", "article": 27, "article_title": "Fundamental rights impact assessment for high-risk AI systems", "article_group": "Deployer obligations", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems; paragraph 4 was amended from 27 July 2026 to permit DPIA cross-referencing/reuse where obligations are already met.", "relationship": "P", "coverage": "Partial mapping", "confidence": "Medium-High", "rationale": "GAISSF D7-CTL-H02 operationalises part of Article 27 through Training modules + quiz + simulated attacks. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 27 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 27" }, { "record_id": "GAISSF-CRO-027-MAP-0176", "gaissf_id": "D7-CTL-H02", "gaissf_title": "DEEPFAKE DETECTION TRAINING", "domain": "D7: HUMAN & SOCIETAL HARMS", "article": 15, "article_title": "Accuracy, robustness and cybersecurity", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "S", "coverage": "Indirect mapping", "confidence": "Medium", "rationale": "GAISSF D7-CTL-H02 operationalises part of Article 15 through Training modules + quiz + simulated attacks. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 15 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 15" }, { "record_id": "GAISSF-CRO-027-MAP-0177", "gaissf_id": "D7-CTL-H03", "gaissf_title": "OUT-OF-BAND AUTHENTICATION", "domain": "D7: HUMAN & SOCIETAL HARMS", "article": 9, "article_title": "Risk management system", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "S", "coverage": "Indirect mapping", "confidence": "Medium", "rationale": "GAISSF D7-CTL-H03 operationalises part of Article 9 through Independent channel verification + policy enforcement. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 9 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 9" }, { "record_id": "GAISSF-CRO-027-MAP-0178", "gaissf_id": "D7-CTL-H03", "gaissf_title": "OUT-OF-BAND AUTHENTICATION", "domain": "D7: HUMAN & SOCIETAL HARMS", "article": 27, "article_title": "Fundamental rights impact assessment for high-risk AI systems", "article_group": "Deployer obligations", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems; paragraph 4 was amended from 27 July 2026 to permit DPIA cross-referencing/reuse where obligations are already met.", "relationship": "P", "coverage": "Partial mapping", "confidence": "Medium-High", "rationale": "GAISSF D7-CTL-H03 operationalises part of Article 27 through Independent channel verification + policy enforcement. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 27 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 27" }, { "record_id": "GAISSF-CRO-027-MAP-0179", "gaissf_id": "D7-CTL-H03", "gaissf_title": "OUT-OF-BAND AUTHENTICATION", "domain": "D7: HUMAN & SOCIETAL HARMS", "article": 14, "article_title": "Human oversight", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "P", "coverage": "Partial mapping", "confidence": "Medium-High", "rationale": "GAISSF D7-CTL-H03 operationalises part of Article 14 through Independent channel verification + policy enforcement. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 14 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 14" }, { "record_id": "GAISSF-CRO-027-MAP-0180", "gaissf_id": "D7-CTL-H03", "gaissf_title": "OUT-OF-BAND AUTHENTICATION", "domain": "D7: HUMAN & SOCIETAL HARMS", "article": 5, "article_title": "Prohibited AI practices", "article_group": "Prohibited practices", "application_status": "Generally applicable since 2 February 2025; Article 5(1)(ba), 5(1)(bb), 5(1a) and 5(1b) apply from 2 December 2026 under amended Article 113(a).", "relationship": "S", "coverage": "Indirect mapping", "confidence": "Medium", "rationale": "GAISSF D7-CTL-H03 operationalises part of Article 5 through Independent channel verification + policy enforcement. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 5 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 5" }, { "record_id": "GAISSF-CRO-027-MAP-0181", "gaissf_id": "D7-CTL-H04", "gaissf_title": "AI SOCIAL ENGINEERING IR", "domain": "D7: HUMAN & SOCIETAL HARMS", "article": 9, "article_title": "Risk management system", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "S", "coverage": "Indirect mapping", "confidence": "Medium", "rationale": "GAISSF D7-CTL-H04 operationalises part of Article 9 through Tabletop exercises + IR plan + verification triggers. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 9 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 9" }, { "record_id": "GAISSF-CRO-027-MAP-0182", "gaissf_id": "D7-CTL-H04", "gaissf_title": "AI SOCIAL ENGINEERING IR", "domain": "D7: HUMAN & SOCIETAL HARMS", "article": 27, "article_title": "Fundamental rights impact assessment for high-risk AI systems", "article_group": "Deployer obligations", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems; paragraph 4 was amended from 27 July 2026 to permit DPIA cross-referencing/reuse where obligations are already met.", "relationship": "P", "coverage": "Partial mapping", "confidence": "Medium-High", "rationale": "GAISSF D7-CTL-H04 operationalises part of Article 27 through Tabletop exercises + IR plan + verification triggers. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 27 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 27" }, { "record_id": "GAISSF-CRO-027-MAP-0183", "gaissf_id": "D7-CTL-H04", "gaissf_title": "AI SOCIAL ENGINEERING IR", "domain": "D7: HUMAN & SOCIETAL HARMS", "article": 14, "article_title": "Human oversight", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "P", "coverage": "Partial mapping", "confidence": "Medium-High", "rationale": "GAISSF D7-CTL-H04 operationalises part of Article 14 through Tabletop exercises + IR plan + verification triggers. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 14 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 14" }, { "record_id": "GAISSF-CRO-027-MAP-0184", "gaissf_id": "D7-CTL-H04", "gaissf_title": "AI SOCIAL ENGINEERING IR", "domain": "D7: HUMAN & SOCIETAL HARMS", "article": 15, "article_title": "Accuracy, robustness and cybersecurity", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "S", "coverage": "Indirect mapping", "confidence": "Medium", "rationale": "GAISSF D7-CTL-H04 operationalises part of Article 15 through Tabletop exercises + IR plan + verification triggers. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 15 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 15" }, { "record_id": "GAISSF-CRO-027-MAP-0185", "gaissf_id": "D7-CTL-H05", "gaissf_title": "AI-ENHANCED EXTERNAL ATTACK DEFENSE", "domain": "D7: HUMAN & SOCIETAL HARMS", "article": 9, "article_title": "Risk management system", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "S", "coverage": "Indirect mapping", "confidence": "Medium", "rationale": "GAISSF D7-CTL-H05 operationalises part of Article 9 through AI-generated phishing detection + SOC tuning + response automation. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 9 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 9" }, { "record_id": "GAISSF-CRO-027-MAP-0186", "gaissf_id": "D7-CTL-H05", "gaissf_title": "AI-ENHANCED EXTERNAL ATTACK DEFENSE", "domain": "D7: HUMAN & SOCIETAL HARMS", "article": 27, "article_title": "Fundamental rights impact assessment for high-risk AI systems", "article_group": "Deployer obligations", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems; paragraph 4 was amended from 27 July 2026 to permit DPIA cross-referencing/reuse where obligations are already met.", "relationship": "P", "coverage": "Partial mapping", "confidence": "Medium-High", "rationale": "GAISSF D7-CTL-H05 operationalises part of Article 27 through AI-generated phishing detection + SOC tuning + response automation. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 27 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 27" }, { "record_id": "GAISSF-CRO-027-MAP-0187", "gaissf_id": "D7-CTL-H05", "gaissf_title": "AI-ENHANCED EXTERNAL ATTACK DEFENSE", "domain": "D7: HUMAN & SOCIETAL HARMS", "article": 14, "article_title": "Human oversight", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "P", "coverage": "Partial mapping", "confidence": "Medium-High", "rationale": "GAISSF D7-CTL-H05 operationalises part of Article 14 through AI-generated phishing detection + SOC tuning + response automation. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 14 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 14" }, { "record_id": "GAISSF-CRO-027-MAP-0188", "gaissf_id": "D7-CTL-H05", "gaissf_title": "AI-ENHANCED EXTERNAL ATTACK DEFENSE", "domain": "D7: HUMAN & SOCIETAL HARMS", "article": 15, "article_title": "Accuracy, robustness and cybersecurity", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "S", "coverage": "Indirect mapping", "confidence": "Medium", "rationale": "GAISSF D7-CTL-H05 operationalises part of Article 15 through AI-generated phishing detection + SOC tuning + response automation. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 15 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 15" }, { "record_id": "GAISSF-CRO-027-MAP-0189", "gaissf_id": "D8-CTL-01", "gaissf_title": "EU AI ACT RISK TIER MAPPING", "domain": "D8: REGULATORY ALIGNMENT & COMPLIANCE", "article": 51, "article_title": "Classification of general-purpose AI models as general-purpose AI models with systemic risk", "article_group": "GPAI", "application_status": "Chapter V applicable since 2 August 2025. Article 101 fine powers apply from 2 August 2026; pre-2 August 2025 GPAI models have the Article 111(3) transition until 2 August 2027.", "relationship": "S", "coverage": "Indirect mapping", "confidence": "Medium", "rationale": "GAISSF D8-CTL-01 operationalises part of Article 51 through Risk classification framework + conformity assessment. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 51 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 51" }, { "record_id": "GAISSF-CRO-027-MAP-0190", "gaissf_id": "D8-CTL-01", "gaissf_title": "EU AI ACT RISK TIER MAPPING", "domain": "D8: REGULATORY ALIGNMENT & COMPLIANCE", "article": 53, "article_title": "Obligations for providers of general-purpose AI models", "article_group": "GPAI", "application_status": "Chapter V applicable since 2 August 2025. Article 101 fine powers apply from 2 August 2026; pre-2 August 2025 GPAI models have the Article 111(3) transition until 2 August 2027.", "relationship": "P", "coverage": "Partial mapping", "confidence": "Medium-High", "rationale": "GAISSF D8-CTL-01 operationalises part of Article 53 through Risk classification framework + conformity assessment. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 53 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 53" }, { "record_id": "GAISSF-CRO-027-MAP-0191", "gaissf_id": "D8-CTL-01", "gaissf_title": "EU AI ACT RISK TIER MAPPING", "domain": "D8: REGULATORY ALIGNMENT & COMPLIANCE", "article": 54, "article_title": "Authorised representatives of providers of general-purpose AI models", "article_group": "GPAI", "application_status": "Chapter V applicable since 2 August 2025. Article 101 fine powers apply from 2 August 2026; pre-2 August 2025 GPAI models have the Article 111(3) transition until 2 August 2027.", "relationship": "S", "coverage": "Indirect mapping", "confidence": "Medium", "rationale": "GAISSF D8-CTL-01 operationalises part of Article 54 through Risk classification framework + conformity assessment. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 54 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 54" }, { "record_id": "GAISSF-CRO-027-MAP-0192", "gaissf_id": "D8-CTL-01", "gaissf_title": "EU AI ACT RISK TIER MAPPING", "domain": "D8: REGULATORY ALIGNMENT & COMPLIANCE", "article": 55, "article_title": "Obligations of providers of general-purpose AI models with systemic risk", "article_group": "GPAI systemic risk", "application_status": "Chapter V applicable since 2 August 2025. Article 101 fine powers apply from 2 August 2026; pre-2 August 2025 GPAI models have the Article 111(3) transition until 2 August 2027.", "relationship": "P", "coverage": "Partial mapping", "confidence": "Medium-High", "rationale": "GAISSF D8-CTL-01 operationalises part of Article 55 through Risk classification framework + conformity assessment. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 55 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 55" }, { "record_id": "GAISSF-CRO-027-MAP-0193", "gaissf_id": "D8-CTL-02", "gaissf_title": "ISO 42001 GAP ANALYSIS", "domain": "D8: REGULATORY ALIGNMENT & COMPLIANCE", "article": 11, "article_title": "Technical documentation", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "P", "coverage": "Partial mapping", "confidence": "Medium-High", "rationale": "GAISSF D8-CTL-02 operationalises part of Article 11 through Gap analysis methodology + remediation tracking. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 11 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 11" }, { "record_id": "GAISSF-CRO-027-MAP-0194", "gaissf_id": "D8-CTL-02", "gaissf_title": "ISO 42001 GAP ANALYSIS", "domain": "D8: REGULATORY ALIGNMENT & COMPLIANCE", "article": 17, "article_title": "Quality management system", "article_group": "Provider obligations", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "S", "coverage": "Indirect mapping", "confidence": "Medium", "rationale": "GAISSF D8-CTL-02 operationalises part of Article 17 through Gap analysis methodology + remediation tracking. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 17 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 17" }, { "record_id": "GAISSF-CRO-027-MAP-0195", "gaissf_id": "D8-CTL-02", "gaissf_title": "ISO 42001 GAP ANALYSIS", "domain": "D8: REGULATORY ALIGNMENT & COMPLIANCE", "article": 15, "article_title": "Accuracy, robustness and cybersecurity", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "S", "coverage": "Indirect mapping", "confidence": "Medium", "rationale": "GAISSF D8-CTL-02 operationalises part of Article 15 through Gap analysis methodology + remediation tracking. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 15 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 15" }, { "record_id": "GAISSF-CRO-027-MAP-0196", "gaissf_id": "D8-CTL-02", "gaissf_title": "ISO 42001 GAP ANALYSIS", "domain": "D8: REGULATORY ALIGNMENT & COMPLIANCE", "article": 22, "article_title": "Authorised representatives of providers of high-risk AI systems", "article_group": "Supply chain roles", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "S", "coverage": "Indirect mapping", "confidence": "Medium", "rationale": "GAISSF D8-CTL-02 operationalises part of Article 22 through Gap analysis methodology + remediation tracking. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 22 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 22" }, { "record_id": "GAISSF-CRO-027-MAP-0197", "gaissf_id": "D8-CTL-03", "gaissf_title": "GPAI TECHNICAL DOCUMENTATION VERIFICATION", "domain": "D8: REGULATORY ALIGNMENT & COMPLIANCE", "article": 17, "article_title": "Quality management system", "article_group": "Provider obligations", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "S", "coverage": "Indirect mapping", "confidence": "Medium", "rationale": "GAISSF D8-CTL-03 operationalises part of Article 17 through Technical documentation + training data summary + copyright attestation. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 17 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 17" }, { "record_id": "GAISSF-CRO-027-MAP-0198", "gaissf_id": "D8-CTL-03", "gaissf_title": "GPAI TECHNICAL DOCUMENTATION VERIFICATION", "domain": "D8: REGULATORY ALIGNMENT & COMPLIANCE", "article": 55, "article_title": "Obligations of providers of general-purpose AI models with systemic risk", "article_group": "GPAI systemic risk", "application_status": "Chapter V applicable since 2 August 2025. Article 101 fine powers apply from 2 August 2026; pre-2 August 2025 GPAI models have the Article 111(3) transition until 2 August 2027.", "relationship": "P", "coverage": "Partial mapping", "confidence": "Medium-High", "rationale": "GAISSF D8-CTL-03 operationalises part of Article 55 through Technical documentation + training data summary + copyright attestation. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 55 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 55" }, { "record_id": "GAISSF-CRO-027-MAP-0199", "gaissf_id": "D8-CTL-03", "gaissf_title": "GPAI TECHNICAL DOCUMENTATION VERIFICATION", "domain": "D8: REGULATORY ALIGNMENT & COMPLIANCE", "article": 43, "article_title": "Conformity assessment", "article_group": "Conformity", "application_status": "Generally applicable from 2 August 2026. Its operative high-risk conformity-assessment duties depend on the applicable Article 6 pathway, the delayed Chapter III Sections 1-3 dates, Article 2 sectoral-law rules, and Article 111 transitions.", "relationship": "S", "coverage": "Indirect mapping", "confidence": "Medium", "rationale": "GAISSF D8-CTL-03 operationalises part of Article 43 through Technical documentation + training data summary + copyright attestation. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 43 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 43" }, { "record_id": "GAISSF-CRO-027-MAP-0200", "gaissf_id": "D8-CTL-03", "gaissf_title": "GPAI TECHNICAL DOCUMENTATION VERIFICATION", "domain": "D8: REGULATORY ALIGNMENT & COMPLIANCE", "article": 9, "article_title": "Risk management system", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "S", "coverage": "Indirect mapping", "confidence": "Medium", "rationale": "GAISSF D8-CTL-03 operationalises part of Article 9 through Technical documentation + training data summary + copyright attestation. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 9 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 9" }, { "record_id": "GAISSF-CRO-027-MAP-0201", "gaissf_id": "D8-CTL-04", "gaissf_title": "DORA ICT INCIDENT REPORTING (FINANCIAL SECTOR)", "domain": "D8: REGULATORY ALIGNMENT & COMPLIANCE", "article": 12, "article_title": "Record-keeping", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "P", "coverage": "Partial mapping", "confidence": "Medium-High", "rationale": "GAISSF D8-CTL-04 operationalises part of Article 12 through Incident classification + notification workflow + SLA monitoring. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 12 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 12" }, { "record_id": "GAISSF-CRO-027-MAP-0202", "gaissf_id": "D8-CTL-04", "gaissf_title": "DORA ICT INCIDENT REPORTING (FINANCIAL SECTOR)", "domain": "D8: REGULATORY ALIGNMENT & COMPLIANCE", "article": 20, "article_title": "Corrective actions and duty of information", "article_group": "Provider obligations", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "P", "coverage": "Partial mapping", "confidence": "Medium-High", "rationale": "GAISSF D8-CTL-04 operationalises part of Article 20 through Incident classification + notification workflow + SLA monitoring. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 20 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 20" }, { "record_id": "GAISSF-CRO-027-MAP-0203", "gaissf_id": "D8-CTL-04", "gaissf_title": "DORA ICT INCIDENT REPORTING (FINANCIAL SECTOR)", "domain": "D8: REGULATORY ALIGNMENT & COMPLIANCE", "article": 72, "article_title": "Post-market monitoring by providers and post-market monitoring plan for high-risk AI systems", "article_group": "Monitoring", "application_status": "Generally applicable from 2 August 2026; because Article 72 addresses high-risk AI systems, practical obligations must be read with the applicable Article 6 pathway, delayed Chapter III dates and Article 111 transitions.", "relationship": "P", "coverage": "Partial mapping", "confidence": "Medium-High", "rationale": "GAISSF D8-CTL-04 operationalises part of Article 72 through Incident classification + notification workflow + SLA monitoring. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 72 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 72" }, { "record_id": "GAISSF-CRO-027-MAP-0204", "gaissf_id": "D8-CTL-04", "gaissf_title": "DORA ICT INCIDENT REPORTING (FINANCIAL SECTOR)", "domain": "D8: REGULATORY ALIGNMENT & COMPLIANCE", "article": 73, "article_title": "Reporting of serious incidents", "article_group": "Incident reporting", "application_status": "Generally applicable from 2 August 2026; because Article 73 addresses high-risk AI systems, practical obligations must be read with the applicable Article 6 pathway, delayed Chapter III dates and Article 111 transitions. Reporting deadlines are immediate and no later than 15 days ordinarily, 2 days for widespread infringement or Article 3(49)(b) incidents, and 10 days where a death occurs, subject to the statutory triggers.", "relationship": "P", "coverage": "Partial mapping", "confidence": "Medium-High", "rationale": "GAISSF D8-CTL-04 operationalises part of Article 73 through Incident classification + notification workflow + SLA monitoring. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 73 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 73" }, { "record_id": "GAISSF-CRO-027-MAP-0205", "gaissf_id": "D8-CTL-05", "gaissf_title": "NIST SP 800-218A COMPLIANCE CHECK", "domain": "D8: REGULATORY ALIGNMENT & COMPLIANCE", "article": 43, "article_title": "Conformity assessment", "article_group": "Conformity", "application_status": "Generally applicable from 2 August 2026. Its operative high-risk conformity-assessment duties depend on the applicable Article 6 pathway, the delayed Chapter III Sections 1-3 dates, Article 2 sectoral-law rules, and Article 111 transitions.", "relationship": "S", "coverage": "Indirect mapping", "confidence": "Medium", "rationale": "GAISSF D8-CTL-05 operationalises part of Article 43 through Secure development practices + attestation. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 43 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 43" }, { "record_id": "GAISSF-CRO-027-MAP-0206", "gaissf_id": "D8-CTL-05", "gaissf_title": "NIST SP 800-218A COMPLIANCE CHECK", "domain": "D8: REGULATORY ALIGNMENT & COMPLIANCE", "article": 9, "article_title": "Risk management system", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "S", "coverage": "Indirect mapping", "confidence": "Medium", "rationale": "GAISSF D8-CTL-05 operationalises part of Article 9 through Secure development practices + attestation. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 9 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 9" }, { "record_id": "GAISSF-CRO-027-MAP-0207", "gaissf_id": "D8-CTL-05", "gaissf_title": "NIST SP 800-218A COMPLIANCE CHECK", "domain": "D8: REGULATORY ALIGNMENT & COMPLIANCE", "article": 15, "article_title": "Accuracy, robustness and cybersecurity", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "S", "coverage": "Indirect mapping", "confidence": "Medium", "rationale": "GAISSF D8-CTL-05 operationalises part of Article 15 through Secure development practices + attestation. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 15 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 15" }, { "record_id": "GAISSF-CRO-027-MAP-0208", "gaissf_id": "D8-CTL-05", "gaissf_title": "NIST SP 800-218A COMPLIANCE CHECK", "domain": "D8: REGULATORY ALIGNMENT & COMPLIANCE", "article": 55, "article_title": "Obligations of providers of general-purpose AI models with systemic risk", "article_group": "GPAI systemic risk", "application_status": "Chapter V applicable since 2 August 2025. Article 101 fine powers apply from 2 August 2026; pre-2 August 2025 GPAI models have the Article 111(3) transition until 2 August 2027.", "relationship": "P", "coverage": "Partial mapping", "confidence": "Medium-High", "rationale": "GAISSF D8-CTL-05 operationalises part of Article 55 through Secure development practices + attestation. The relationship is limited to the control's stated scope and does not establish legal compliance.", "residual_gap": "Article 55 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 55" }, { "record_id": "GAISSF-CRO-027-MAP-0209", "gaissf_id": "D9-CTL-01", "gaissf_title": "PHYSICAL HARM BOUNDARY ENFORCEMENT", "domain": "D9: PHYSICAL AI SAFETY", "article": 9, "article_title": "Risk management system", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "SP", "coverage": "Partial mapping", "confidence": "High", "rationale": "GAISSF D9-CTL-01 (Physical Harm Boundary Enforcement) provides control objectives and evidence expectations that may support part of Article 9 (Risk management system) where Physical AI or cyber-physical actuation is in scope. The mapping does not prescribe a universal safety-integrity level, design-assurance level, architecture, product certification, or implementation method, and does not establish legal compliance.", "residual_gap": "Article 9 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 9" }, { "record_id": "GAISSF-CRO-027-MAP-0210", "gaissf_id": "D9-CTL-01", "gaissf_title": "PHYSICAL HARM BOUNDARY ENFORCEMENT", "domain": "D9: PHYSICAL AI SAFETY", "article": 15, "article_title": "Accuracy, robustness and cybersecurity", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "SP", "coverage": "Partial mapping", "confidence": "High", "rationale": "GAISSF D9-CTL-01 (Physical Harm Boundary Enforcement) provides control objectives and evidence expectations that may support part of Article 15 (Accuracy, robustness and cybersecurity) where Physical AI or cyber-physical actuation is in scope. The mapping does not prescribe a universal safety-integrity level, design-assurance level, architecture, product certification, or implementation method, and does not establish legal compliance.", "residual_gap": "Article 15 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 15" }, { "record_id": "GAISSF-CRO-027-MAP-0211", "gaissf_id": "D9-CTL-01", "gaissf_title": "PHYSICAL HARM BOUNDARY ENFORCEMENT", "domain": "D9: PHYSICAL AI SAFETY", "article": 14, "article_title": "Human oversight", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "P", "coverage": "Partial mapping", "confidence": "Medium-High", "rationale": "GAISSF D9-CTL-01 (Physical Harm Boundary Enforcement) provides control objectives and evidence expectations that may support part of Article 14 (Human oversight) where Physical AI or cyber-physical actuation is in scope. The mapping does not prescribe a universal safety-integrity level, design-assurance level, architecture, product certification, or implementation method, and does not establish legal compliance.", "residual_gap": "Article 14 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 14" }, { "record_id": "GAISSF-CRO-027-MAP-0212", "gaissf_id": "D9-CTL-01", "gaissf_title": "PHYSICAL HARM BOUNDARY ENFORCEMENT", "domain": "D9: PHYSICAL AI SAFETY", "article": 43, "article_title": "Conformity assessment", "article_group": "Conformity", "application_status": "Generally applicable from 2 August 2026. Its operative high-risk conformity-assessment duties depend on the applicable Article 6 pathway, the delayed Chapter III Sections 1-3 dates, Article 2 sectoral-law rules, and Article 111 transitions.", "relationship": "S", "coverage": "Indirect mapping", "confidence": "Medium", "rationale": "GAISSF D9-CTL-01 (Physical Harm Boundary Enforcement) provides control objectives and evidence expectations that may support part of Article 43 (Conformity assessment) where Physical AI or cyber-physical actuation is in scope. The mapping does not prescribe a universal safety-integrity level, design-assurance level, architecture, product certification, or implementation method, and does not establish legal compliance.", "residual_gap": "Article 43 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 43" }, { "record_id": "GAISSF-CRO-027-MAP-0213", "gaissf_id": "D9-CTL-02", "gaissf_title": "SAFE STATE AND GRACEFUL DEGRADATION", "domain": "D9: PHYSICAL AI SAFETY", "article": 9, "article_title": "Risk management system", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "SP", "coverage": "Partial mapping", "confidence": "High", "rationale": "GAISSF D9-CTL-02 (Safe State And Graceful Degradation) provides control objectives and evidence expectations that may support part of Article 9 (Risk management system) where Physical AI or cyber-physical actuation is in scope. The mapping does not prescribe a universal safety-integrity level, design-assurance level, architecture, product certification, or implementation method, and does not establish legal compliance.", "residual_gap": "Article 9 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 9" }, { "record_id": "GAISSF-CRO-027-MAP-0214", "gaissf_id": "D9-CTL-02", "gaissf_title": "SAFE STATE AND GRACEFUL DEGRADATION", "domain": "D9: PHYSICAL AI SAFETY", "article": 15, "article_title": "Accuracy, robustness and cybersecurity", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "SP", "coverage": "Partial mapping", "confidence": "High", "rationale": "GAISSF D9-CTL-02 (Safe State And Graceful Degradation) provides control objectives and evidence expectations that may support part of Article 15 (Accuracy, robustness and cybersecurity) where Physical AI or cyber-physical actuation is in scope. The mapping does not prescribe a universal safety-integrity level, design-assurance level, architecture, product certification, or implementation method, and does not establish legal compliance.", "residual_gap": "Article 15 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 15" }, { "record_id": "GAISSF-CRO-027-MAP-0215", "gaissf_id": "D9-CTL-02", "gaissf_title": "SAFE STATE AND GRACEFUL DEGRADATION", "domain": "D9: PHYSICAL AI SAFETY", "article": 14, "article_title": "Human oversight", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "P", "coverage": "Partial mapping", "confidence": "Medium-High", "rationale": "GAISSF D9-CTL-02 (Safe State And Graceful Degradation) provides control objectives and evidence expectations that may support part of Article 14 (Human oversight) where Physical AI or cyber-physical actuation is in scope. The mapping does not prescribe a universal safety-integrity level, design-assurance level, architecture, product certification, or implementation method, and does not establish legal compliance.", "residual_gap": "Article 14 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 14" }, { "record_id": "GAISSF-CRO-027-MAP-0216", "gaissf_id": "D9-CTL-02", "gaissf_title": "SAFE STATE AND GRACEFUL DEGRADATION", "domain": "D9: PHYSICAL AI SAFETY", "article": 43, "article_title": "Conformity assessment", "article_group": "Conformity", "application_status": "Generally applicable from 2 August 2026. Its operative high-risk conformity-assessment duties depend on the applicable Article 6 pathway, the delayed Chapter III Sections 1-3 dates, Article 2 sectoral-law rules, and Article 111 transitions.", "relationship": "S", "coverage": "Indirect mapping", "confidence": "Medium", "rationale": "GAISSF D9-CTL-02 (Safe State And Graceful Degradation) provides control objectives and evidence expectations that may support part of Article 43 (Conformity assessment) where Physical AI or cyber-physical actuation is in scope. The mapping does not prescribe a universal safety-integrity level, design-assurance level, architecture, product certification, or implementation method, and does not establish legal compliance.", "residual_gap": "Article 43 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 43" }, { "record_id": "GAISSF-CRO-027-MAP-0217", "gaissf_id": "D9-CTL-03", "gaissf_title": "HUMAN OVERRIDE AND EMERGENCY STOP", "domain": "D9: PHYSICAL AI SAFETY", "article": 9, "article_title": "Risk management system", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "SP", "coverage": "Partial mapping", "confidence": "High", "rationale": "GAISSF D9-CTL-03 (Human Override And Emergency Stop) provides control objectives and evidence expectations that may support part of Article 9 (Risk management system) where Physical AI or cyber-physical actuation is in scope. The mapping does not prescribe a universal safety-integrity level, design-assurance level, architecture, product certification, or implementation method, and does not establish legal compliance.", "residual_gap": "Article 9 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 9" }, { "record_id": "GAISSF-CRO-027-MAP-0218", "gaissf_id": "D9-CTL-03", "gaissf_title": "HUMAN OVERRIDE AND EMERGENCY STOP", "domain": "D9: PHYSICAL AI SAFETY", "article": 14, "article_title": "Human oversight", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "P", "coverage": "Partial mapping", "confidence": "Medium-High", "rationale": "GAISSF D9-CTL-03 (Human Override And Emergency Stop) provides control objectives and evidence expectations that may support part of Article 14 (Human oversight) where Physical AI or cyber-physical actuation is in scope. The mapping does not prescribe a universal safety-integrity level, design-assurance level, architecture, product certification, or implementation method, and does not establish legal compliance.", "residual_gap": "Article 14 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 14" }, { "record_id": "GAISSF-CRO-027-MAP-0219", "gaissf_id": "D9-CTL-03", "gaissf_title": "HUMAN OVERRIDE AND EMERGENCY STOP", "domain": "D9: PHYSICAL AI SAFETY", "article": 15, "article_title": "Accuracy, robustness and cybersecurity", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "SP", "coverage": "Partial mapping", "confidence": "High", "rationale": "GAISSF D9-CTL-03 (Human Override And Emergency Stop) provides control objectives and evidence expectations that may support part of Article 15 (Accuracy, robustness and cybersecurity) where Physical AI or cyber-physical actuation is in scope. The mapping does not prescribe a universal safety-integrity level, design-assurance level, architecture, product certification, or implementation method, and does not establish legal compliance.", "residual_gap": "Article 15 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 15" }, { "record_id": "GAISSF-CRO-027-MAP-0220", "gaissf_id": "D9-CTL-03", "gaissf_title": "HUMAN OVERRIDE AND EMERGENCY STOP", "domain": "D9: PHYSICAL AI SAFETY", "article": 43, "article_title": "Conformity assessment", "article_group": "Conformity", "application_status": "Generally applicable from 2 August 2026. Its operative high-risk conformity-assessment duties depend on the applicable Article 6 pathway, the delayed Chapter III Sections 1-3 dates, Article 2 sectoral-law rules, and Article 111 transitions.", "relationship": "S", "coverage": "Indirect mapping", "confidence": "Medium", "rationale": "GAISSF D9-CTL-03 (Human Override And Emergency Stop) provides control objectives and evidence expectations that may support part of Article 43 (Conformity assessment) where Physical AI or cyber-physical actuation is in scope. The mapping does not prescribe a universal safety-integrity level, design-assurance level, architecture, product certification, or implementation method, and does not establish legal compliance.", "residual_gap": "Article 43 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 43" }, { "record_id": "GAISSF-CRO-027-MAP-0221", "gaissf_id": "D9-CTL-04", "gaissf_title": "CYBER-PHYSICAL ATTACK DETECTION", "domain": "D9: PHYSICAL AI SAFETY", "article": 9, "article_title": "Risk management system", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "SP", "coverage": "Partial mapping", "confidence": "High", "rationale": "GAISSF D9-CTL-04 (Cyber-Physical Attack Detection) provides control objectives and evidence expectations that may support part of Article 9 (Risk management system) where Physical AI or cyber-physical actuation is in scope. The mapping does not prescribe a universal safety-integrity level, design-assurance level, architecture, product certification, or implementation method, and does not establish legal compliance.", "residual_gap": "Article 9 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 9" }, { "record_id": "GAISSF-CRO-027-MAP-0222", "gaissf_id": "D9-CTL-04", "gaissf_title": "CYBER-PHYSICAL ATTACK DETECTION", "domain": "D9: PHYSICAL AI SAFETY", "article": 15, "article_title": "Accuracy, robustness and cybersecurity", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "SP", "coverage": "Partial mapping", "confidence": "High", "rationale": "GAISSF D9-CTL-04 (Cyber-Physical Attack Detection) provides control objectives and evidence expectations that may support part of Article 15 (Accuracy, robustness and cybersecurity) where Physical AI or cyber-physical actuation is in scope. The mapping does not prescribe a universal safety-integrity level, design-assurance level, architecture, product certification, or implementation method, and does not establish legal compliance.", "residual_gap": "Article 15 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 15" }, { "record_id": "GAISSF-CRO-027-MAP-0223", "gaissf_id": "D9-CTL-04", "gaissf_title": "CYBER-PHYSICAL ATTACK DETECTION", "domain": "D9: PHYSICAL AI SAFETY", "article": 43, "article_title": "Conformity assessment", "article_group": "Conformity", "application_status": "Generally applicable from 2 August 2026. Its operative high-risk conformity-assessment duties depend on the applicable Article 6 pathway, the delayed Chapter III Sections 1-3 dates, Article 2 sectoral-law rules, and Article 111 transitions.", "relationship": "S", "coverage": "Indirect mapping", "confidence": "Medium", "rationale": "GAISSF D9-CTL-04 (Cyber-Physical Attack Detection) provides control objectives and evidence expectations that may support part of Article 43 (Conformity assessment) where Physical AI or cyber-physical actuation is in scope. The mapping does not prescribe a universal safety-integrity level, design-assurance level, architecture, product certification, or implementation method, and does not establish legal compliance.", "residual_gap": "Article 43 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 43" }, { "record_id": "GAISSF-CRO-027-MAP-0224", "gaissf_id": "D9-CTL-04", "gaissf_title": "CYBER-PHYSICAL ATTACK DETECTION", "domain": "D9: PHYSICAL AI SAFETY", "article": 14, "article_title": "Human oversight", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "P", "coverage": "Partial mapping", "confidence": "Medium-High", "rationale": "GAISSF D9-CTL-04 (Cyber-Physical Attack Detection) provides control objectives and evidence expectations that may support part of Article 14 (Human oversight) where Physical AI or cyber-physical actuation is in scope. The mapping does not prescribe a universal safety-integrity level, design-assurance level, architecture, product certification, or implementation method, and does not establish legal compliance.", "residual_gap": "Article 14 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 14" }, { "record_id": "GAISSF-CRO-027-MAP-0225", "gaissf_id": "D9-CTL-05", "gaissf_title": "PHYSICAL ENVIRONMENT INTEGRITY MONITORING", "domain": "D9: PHYSICAL AI SAFETY", "article": 9, "article_title": "Risk management system", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "SP", "coverage": "Partial mapping", "confidence": "High", "rationale": "GAISSF D9-CTL-05 (Physical Environment Integrity Monitoring) provides control objectives and evidence expectations that may support part of Article 9 (Risk management system) where Physical AI or cyber-physical actuation is in scope. The mapping does not prescribe a universal safety-integrity level, design-assurance level, architecture, product certification, or implementation method, and does not establish legal compliance.", "residual_gap": "Article 9 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 9" }, { "record_id": "GAISSF-CRO-027-MAP-0226", "gaissf_id": "D9-CTL-05", "gaissf_title": "PHYSICAL ENVIRONMENT INTEGRITY MONITORING", "domain": "D9: PHYSICAL AI SAFETY", "article": 15, "article_title": "Accuracy, robustness and cybersecurity", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "SP", "coverage": "Partial mapping", "confidence": "High", "rationale": "GAISSF D9-CTL-05 (Physical Environment Integrity Monitoring) provides control objectives and evidence expectations that may support part of Article 15 (Accuracy, robustness and cybersecurity) where Physical AI or cyber-physical actuation is in scope. The mapping does not prescribe a universal safety-integrity level, design-assurance level, architecture, product certification, or implementation method, and does not establish legal compliance.", "residual_gap": "Article 15 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 15" }, { "record_id": "GAISSF-CRO-027-MAP-0227", "gaissf_id": "D9-CTL-05", "gaissf_title": "PHYSICAL ENVIRONMENT INTEGRITY MONITORING", "domain": "D9: PHYSICAL AI SAFETY", "article": 26, "article_title": "Obligations of deployers of high-risk AI systems", "article_group": "Deployer obligations", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "P", "coverage": "Partial mapping", "confidence": "Medium-High", "rationale": "GAISSF D9-CTL-05 (Physical Environment Integrity Monitoring) provides control objectives and evidence expectations that may support part of Article 26 (Obligations of deployers of high-risk AI systems) where Physical AI or cyber-physical actuation is in scope. The mapping does not prescribe a universal safety-integrity level, design-assurance level, architecture, product certification, or implementation method, and does not establish legal compliance.", "residual_gap": "Article 26 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 26" }, { "record_id": "GAISSF-CRO-027-MAP-0228", "gaissf_id": "D9-CTL-05", "gaissf_title": "PHYSICAL ENVIRONMENT INTEGRITY MONITORING", "domain": "D9: PHYSICAL AI SAFETY", "article": 72, "article_title": "Post-market monitoring by providers and post-market monitoring plan for high-risk AI systems", "article_group": "Monitoring", "application_status": "Generally applicable from 2 August 2026; because Article 72 addresses high-risk AI systems, practical obligations must be read with the applicable Article 6 pathway, delayed Chapter III dates and Article 111 transitions.", "relationship": "P", "coverage": "Partial mapping", "confidence": "Medium-High", "rationale": "GAISSF D9-CTL-05 (Physical Environment Integrity Monitoring) provides control objectives and evidence expectations that may support part of Article 72 (Post-market monitoring by providers and post-market monitoring plan for high-risk AI systems) where Physical AI or cyber-physical actuation is in scope. The mapping does not prescribe a universal safety-integrity level, design-assurance level, architecture, product certification, or implementation method, and does not establish legal compliance.", "residual_gap": "Article 72 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 72" }, { "record_id": "GAISSF-CRO-027-MAP-0229", "gaissf_id": "D9-CTL-06", "gaissf_title": "ACTUATOR COMMAND VERIFICATION", "domain": "D9: PHYSICAL AI SAFETY", "article": 9, "article_title": "Risk management system", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "S", "coverage": "Indirect mapping", "confidence": "Medium", "rationale": "GAISSF D9-CTL-06 (Actuator Command Verification) provides control objectives and evidence expectations that may support part of Article 9 (Risk management system) where Physical AI or cyber-physical actuation is in scope. The mapping does not prescribe a universal safety-integrity level, design-assurance level, architecture, product certification, or implementation method, and does not establish legal compliance.", "residual_gap": "Article 9 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 9" }, { "record_id": "GAISSF-CRO-027-MAP-0230", "gaissf_id": "D9-CTL-06", "gaissf_title": "ACTUATOR COMMAND VERIFICATION", "domain": "D9: PHYSICAL AI SAFETY", "article": 15, "article_title": "Accuracy, robustness and cybersecurity", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "S", "coverage": "Indirect mapping", "confidence": "Medium", "rationale": "GAISSF D9-CTL-06 (Actuator Command Verification) provides control objectives and evidence expectations that may support part of Article 15 (Accuracy, robustness and cybersecurity) where Physical AI or cyber-physical actuation is in scope. The mapping does not prescribe a universal safety-integrity level, design-assurance level, architecture, product certification, or implementation method, and does not establish legal compliance.", "residual_gap": "Article 15 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 15" }, { "record_id": "GAISSF-CRO-027-MAP-0231", "gaissf_id": "D9-CTL-06", "gaissf_title": "ACTUATOR COMMAND VERIFICATION", "domain": "D9: PHYSICAL AI SAFETY", "article": 14, "article_title": "Human oversight", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "P", "coverage": "Partial mapping", "confidence": "Medium-High", "rationale": "GAISSF D9-CTL-06 (Actuator Command Verification) provides control objectives and evidence expectations that may support part of Article 14 (Human oversight) where Physical AI or cyber-physical actuation is in scope. The mapping does not prescribe a universal safety-integrity level, design-assurance level, architecture, product certification, or implementation method, and does not establish legal compliance.", "residual_gap": "Article 14 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 14" }, { "record_id": "GAISSF-CRO-027-MAP-0232", "gaissf_id": "D9-CTL-06", "gaissf_title": "ACTUATOR COMMAND VERIFICATION", "domain": "D9: PHYSICAL AI SAFETY", "article": 43, "article_title": "Conformity assessment", "article_group": "Conformity", "application_status": "Generally applicable from 2 August 2026. Its operative high-risk conformity-assessment duties depend on the applicable Article 6 pathway, the delayed Chapter III Sections 1-3 dates, Article 2 sectoral-law rules, and Article 111 transitions.", "relationship": "S", "coverage": "Indirect mapping", "confidence": "Medium", "rationale": "GAISSF D9-CTL-06 (Actuator Command Verification) provides control objectives and evidence expectations that may support part of Article 43 (Conformity assessment) where Physical AI or cyber-physical actuation is in scope. The mapping does not prescribe a universal safety-integrity level, design-assurance level, architecture, product certification, or implementation method, and does not establish legal compliance.", "residual_gap": "Article 43 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 43" }, { "record_id": "GAISSF-CRO-027-MAP-0233", "gaissf_id": "D9-CTL-07", "gaissf_title": "PHYSICAL INCIDENT EVIDENCE PRESERVATION", "domain": "D9: PHYSICAL AI SAFETY", "article": 9, "article_title": "Risk management system", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "SP", "coverage": "Partial mapping", "confidence": "High", "rationale": "GAISSF D9-CTL-07 (Physical Incident Evidence Preservation) provides control objectives and evidence expectations that may support part of Article 9 (Risk management system) where Physical AI or cyber-physical actuation is in scope. The mapping does not prescribe a universal safety-integrity level, design-assurance level, architecture, product certification, or implementation method, and does not establish legal compliance.", "residual_gap": "Article 9 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 9" }, { "record_id": "GAISSF-CRO-027-MAP-0234", "gaissf_id": "D9-CTL-07", "gaissf_title": "PHYSICAL INCIDENT EVIDENCE PRESERVATION", "domain": "D9: PHYSICAL AI SAFETY", "article": 14, "article_title": "Human oversight", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "P", "coverage": "Partial mapping", "confidence": "Medium-High", "rationale": "GAISSF D9-CTL-07 (Physical Incident Evidence Preservation) provides control objectives and evidence expectations that may support part of Article 14 (Human oversight) where Physical AI or cyber-physical actuation is in scope. The mapping does not prescribe a universal safety-integrity level, design-assurance level, architecture, product certification, or implementation method, and does not establish legal compliance.", "residual_gap": "Article 14 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 14" }, { "record_id": "GAISSF-CRO-027-MAP-0235", "gaissf_id": "D9-CTL-07", "gaissf_title": "PHYSICAL INCIDENT EVIDENCE PRESERVATION", "domain": "D9: PHYSICAL AI SAFETY", "article": 12, "article_title": "Record-keeping", "article_group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "P", "coverage": "Partial mapping", "confidence": "Medium-High", "rationale": "GAISSF D9-CTL-07 (Physical Incident Evidence Preservation) provides control objectives and evidence expectations that may support part of Article 12 (Record-keeping) where Physical AI or cyber-physical actuation is in scope. The mapping does not prescribe a universal safety-integrity level, design-assurance level, architecture, product certification, or implementation method, and does not establish legal compliance.", "residual_gap": "Article 12 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 12" }, { "record_id": "GAISSF-CRO-027-MAP-0236", "gaissf_id": "D9-CTL-07", "gaissf_title": "PHYSICAL INCIDENT EVIDENCE PRESERVATION", "domain": "D9: PHYSICAL AI SAFETY", "article": 19, "article_title": "Automatically generated logs", "article_group": "Provider obligations", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "relationship": "S", "coverage": "Indirect mapping", "confidence": "Medium", "rationale": "GAISSF D9-CTL-07 (Physical Incident Evidence Preservation) provides control objectives and evidence expectations that may support part of Article 19 (Automatically generated logs) where Physical AI or cyber-physical actuation is in scope. The mapping does not prescribe a universal safety-integrity level, design-assurance level, architecture, product certification, or implementation method, and does not establish legal compliance.", "residual_gap": "Article 19 also depends on legal role, system classification, territorial scope, procedural duties, and evidence requirements not established by this control alone.", "gaissf_source": "GAISSF-NOR-004 v1.0", "eu_source": "Regulation (EU) 2024/1689, Article 19" } ], "reverse_article_coverage": [ { "article": 1, "article_title": "Subject matter", "group": "General", "application_status": "Applicable since 2 February 2025 under Article 113(a) (Chapter I).", "mapped_controls": [], "mapped_count": 0, "coverage_status": "No mapped GAISSF control", "residual_gap": "Legal applicability, actor-specific duties, conformity procedures, and competent-authority expectations require separate legal analysis." }, { "article": 2, "article_title": "Scope", "group": "General", "application_status": "Applicable since 2 February 2025 under Article 113(a) (Chapter I); scope was amended from 27 July 2026 by Regulation (EU) 2026/1744.", "mapped_controls": [], "mapped_count": 0, "coverage_status": "No mapped GAISSF control", "residual_gap": "Legal applicability, actor-specific duties, conformity procedures, and competent-authority expectations require separate legal analysis.", "legal_note": "Digital Omnibus Article 2 changes are material. For Article 6(1) systems related to products under Annex I Section B, only Article 6(1), Article 60a and Articles 102-112 apply unless the sectoral legislation integrates additional AI Act requirements. Article 2(13) also permits limitations for certain Article 6(1)/Annex I Section A systems where sectoral law provides equivalent or higher protection, subject to the Regulation conditions." }, { "article": 3, "article_title": "Definitions", "group": "General", "application_status": "Applicable since 2 February 2025 under Article 113(a) (Chapter I); definitions were amended from 27 July 2026 by Regulation (EU) 2026/1744.", "mapped_controls": [], "mapped_count": 0, "coverage_status": "No mapped GAISSF control", "residual_gap": "Legal applicability, actor-specific duties, conformity procedures, and competent-authority expectations require separate legal analysis." }, { "article": 4, "article_title": "AI literacy", "group": "General", "application_status": "Applicable since 2 February 2025 under Article 113(a); Article 4 was replaced from 27 July 2026 by Regulation (EU) 2026/1744.", "mapped_controls": [ "D6-CTL-01", "D6-CTL-02", "D6-CTL-05", "D6-CTL-07" ], "mapped_count": 4, "coverage_status": "Partial mapping", "residual_gap": "Legal applicability, actor-specific duties, conformity procedures, and competent-authority expectations require separate legal analysis.", "legal_note": "The amended Article 4 requires providers and deployers to take measures to support AI literacy, but expressly does not require them to guarantee a specific literacy level for each individual." }, { "article": 5, "article_title": "Prohibited AI practices", "group": "Prohibited practices", "application_status": "Generally applicable since 2 February 2025; Article 5(1)(ba), 5(1)(bb), 5(1a) and 5(1b) apply from 2 December 2026 under amended Article 113(a).", "mapped_controls": [ "D5-CTL-01", "D5-CTL-02", "D5-CTL-03", "D5-CTL-04", "D5-CTL-05", "D7-CTL-H03" ], "mapped_count": 6, "coverage_status": "Partial mapping", "residual_gap": "Legal applicability, actor-specific duties, conformity procedures, and competent-authority expectations require separate legal analysis.", "legal_note": "The 2026 amendment added prohibitions concerning specified non-consensual intimate material and child sexual-abuse material; these new provisions have the separate 2 December 2026 application date." }, { "article": 6, "article_title": "Classification rules for high-risk AI systems", "group": "Classification", "application_status": "Article 6(5) applies from 2 August 2026; the remainder of Chapter III Section 1 applies from 2 December 2027 for Article 6(2)/Annex III systems and from 2 August 2028 for Article 6(1)/Annex I systems.", "mapped_controls": [], "mapped_count": 0, "coverage_status": "No mapped GAISSF control", "residual_gap": "Legal applicability, actor-specific duties, conformity procedures, and competent-authority expectations require separate legal analysis." }, { "article": 8, "article_title": "Compliance with the requirements", "group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "mapped_controls": [], "mapped_count": 0, "coverage_status": "No mapped GAISSF control", "residual_gap": "Legal applicability, actor-specific duties, conformity procedures, and competent-authority expectations require separate legal analysis." }, { "article": 9, "article_title": "Risk management system", "group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "mapped_controls": [ "D1-CTL-01", "D1-CTL-02", "D1-CTL-04", "D1-CTL-05", "D1-CTL-06", "D1-CTL-07", "D1-CTL-08", "D1-CTL-09", "D2-CTL-01", "D2-CTL-02", "D2-CTL-03", "D2-CTL-04", "D2-CTL-05", "D2-CTL-06", "D3-CTL-01", "D3-CTL-02", "D3-CTL-03", "D3-CTL-04", "D3-CTL-05", "D3-CTL-06", "D3-CTL-07", "D4-CTL-06", "D5-CTL-01", "D5-CTL-02", "D5-CTL-03", "D5-CTL-04", "D5-CTL-05", "D5-CTL-06", "D6-CTL-01", "D6-CTL-02", "D6-CTL-03", "D6-CTL-04", "D6-CTL-05", "D6-CTL-06", "D6-CTL-07", "D7-CTL-H01", "D7-CTL-H02", "D7-CTL-H03", "D7-CTL-H04", "D7-CTL-H05", "D8-CTL-03", "D8-CTL-05", "D9-CTL-01", "D9-CTL-02", "D9-CTL-03", "D9-CTL-04", "D9-CTL-05", "D9-CTL-06", "D9-CTL-07" ], "mapped_count": 49, "coverage_status": "High mapping density", "residual_gap": "Legal applicability, actor-specific duties, conformity procedures, and competent-authority expectations require separate legal analysis." }, { "article": 10, "article_title": "Data and data governance", "group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "mapped_controls": [], "mapped_count": 0, "coverage_status": "No mapped GAISSF control", "residual_gap": "Legal applicability, actor-specific duties, conformity procedures, and competent-authority expectations require separate legal analysis.", "legal_note": "Article 10 now cross-refers to new Article 4a for exceptional processing of special-category personal data for bias detection/correction, subject to strict safeguards. Article 4a is current law but is not separately mapped in this v1.0 crosswalk." }, { "article": 11, "article_title": "Technical documentation", "group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "mapped_controls": [ "D4-CTL-01", "D4-CTL-02", "D4-CTL-03", "D4-CTL-04", "D4-CTL-05", "D4-CTL-07", "D8-CTL-02" ], "mapped_count": 7, "coverage_status": "Partial mapping", "residual_gap": "Legal applicability, actor-specific duties, conformity procedures, and competent-authority expectations require separate legal analysis." }, { "article": 12, "article_title": "Record-keeping", "group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "mapped_controls": [ "D8-CTL-04", "D9-CTL-07" ], "mapped_count": 2, "coverage_status": "Indirect mapping", "residual_gap": "Legal applicability, actor-specific duties, conformity procedures, and competent-authority expectations require separate legal analysis." }, { "article": 13, "article_title": "Transparency and provision of information to deployers", "group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "mapped_controls": [ "D2-CTL-01", "D2-CTL-02", "D2-CTL-03", "D2-CTL-04", "D5-CTL-01", "D5-CTL-02", "D5-CTL-03", "D5-CTL-04", "D5-CTL-05", "D5-CTL-06" ], "mapped_count": 10, "coverage_status": "High mapping density", "residual_gap": "Legal applicability, actor-specific duties, conformity procedures, and competent-authority expectations require separate legal analysis." }, { "article": 14, "article_title": "Human oversight", "group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "mapped_controls": [ "D2-CTL-02", "D2-CTL-03", "D2-CTL-04", "D2-CTL-05", "D3-CTL-01", "D3-CTL-02", "D3-CTL-03", "D3-CTL-04", "D3-CTL-05", "D3-CTL-06", "D3-CTL-07", "D5-CTL-01", "D5-CTL-02", "D5-CTL-03", "D5-CTL-05", "D5-CTL-06", "D7-CTL-H01", "D7-CTL-H02", "D7-CTL-H03", "D7-CTL-H04", "D7-CTL-H05", "D9-CTL-01", "D9-CTL-02", "D9-CTL-03", "D9-CTL-04", "D9-CTL-06", "D9-CTL-07" ], "mapped_count": 27, "coverage_status": "High mapping density", "residual_gap": "Legal applicability, actor-specific duties, conformity procedures, and competent-authority expectations require separate legal analysis." }, { "article": 15, "article_title": "Accuracy, robustness and cybersecurity", "group": "High-risk requirements", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "mapped_controls": [ "D1-CTL-01", "D1-CTL-02", "D1-CTL-03", "D1-CTL-04", "D1-CTL-05", "D1-CTL-06", "D1-CTL-07", "D1-CTL-08", "D1-CTL-09", "D2-CTL-01", "D2-CTL-02", "D2-CTL-03", "D2-CTL-04", "D2-CTL-05", "D2-CTL-06", "D3-CTL-02", "D3-CTL-03", "D3-CTL-04", "D3-CTL-05", "D3-CTL-06", "D3-CTL-07", "D4-CTL-01", "D4-CTL-02", "D4-CTL-03", "D4-CTL-04", "D4-CTL-05", "D4-CTL-06", "D4-CTL-07", "D5-CTL-04", "D5-CTL-06", "D6-CTL-04", "D6-CTL-06", "D7-CTL-H01", "D7-CTL-H02", "D7-CTL-H04", "D7-CTL-H05", "D8-CTL-02", "D8-CTL-05", "D9-CTL-01", "D9-CTL-02", "D9-CTL-03", "D9-CTL-04", "D9-CTL-05", "D9-CTL-06" ], "mapped_count": 44, "coverage_status": "High mapping density", "residual_gap": "Legal applicability, actor-specific duties, conformity procedures, and competent-authority expectations require separate legal analysis." }, { "article": 16, "article_title": "Obligations of providers of high-risk AI systems", "group": "Provider obligations", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "mapped_controls": [], "mapped_count": 0, "coverage_status": "No mapped GAISSF control", "residual_gap": "Legal applicability, actor-specific duties, conformity procedures, and competent-authority expectations require separate legal analysis." }, { "article": 17, "article_title": "Quality management system", "group": "Provider obligations", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "mapped_controls": [ "D1-CTL-01", "D4-CTL-01", "D4-CTL-02", "D4-CTL-03", "D4-CTL-04", "D4-CTL-05", "D4-CTL-06", "D4-CTL-07", "D6-CTL-03", "D6-CTL-06", "D8-CTL-02", "D8-CTL-03" ], "mapped_count": 12, "coverage_status": "High mapping density", "residual_gap": "Legal applicability, actor-specific duties, conformity procedures, and competent-authority expectations require separate legal analysis." }, { "article": 18, "article_title": "Documentation keeping", "group": "Provider obligations", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "mapped_controls": [], "mapped_count": 0, "coverage_status": "No mapped GAISSF control", "residual_gap": "Legal applicability, actor-specific duties, conformity procedures, and competent-authority expectations require separate legal analysis." }, { "article": 19, "article_title": "Automatically generated logs", "group": "Provider obligations", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "mapped_controls": [ "D9-CTL-07" ], "mapped_count": 1, "coverage_status": "Indirect mapping", "residual_gap": "Legal applicability, actor-specific duties, conformity procedures, and competent-authority expectations require separate legal analysis." }, { "article": 20, "article_title": "Corrective actions and duty of information", "group": "Provider obligations", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "mapped_controls": [ "D1-CTL-03", "D8-CTL-04" ], "mapped_count": 2, "coverage_status": "Indirect mapping", "residual_gap": "Legal applicability, actor-specific duties, conformity procedures, and competent-authority expectations require separate legal analysis." }, { "article": 21, "article_title": "Cooperation with competent authorities", "group": "Provider obligations", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "mapped_controls": [ "D6-CTL-04" ], "mapped_count": 1, "coverage_status": "Indirect mapping", "residual_gap": "Legal applicability, actor-specific duties, conformity procedures, and competent-authority expectations require separate legal analysis." }, { "article": 22, "article_title": "Authorised representatives of providers of high-risk AI systems", "group": "Supply chain roles", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "mapped_controls": [ "D8-CTL-02" ], "mapped_count": 1, "coverage_status": "Indirect mapping", "residual_gap": "Legal applicability, actor-specific duties, conformity procedures, and competent-authority expectations require separate legal analysis." }, { "article": 23, "article_title": "Obligations of importers", "group": "Supply chain roles", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "mapped_controls": [], "mapped_count": 0, "coverage_status": "No mapped GAISSF control", "residual_gap": "Legal applicability, actor-specific duties, conformity procedures, and competent-authority expectations require separate legal analysis." }, { "article": 24, "article_title": "Obligations of distributors", "group": "Supply chain roles", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "mapped_controls": [], "mapped_count": 0, "coverage_status": "No mapped GAISSF control", "residual_gap": "Legal applicability, actor-specific duties, conformity procedures, and competent-authority expectations require separate legal analysis." }, { "article": 25, "article_title": "Responsibilities along the AI value chain", "group": "Supply chain roles", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems; paragraphs 2 and 4 were amended from 27 July 2026.", "mapped_controls": [ "D4-CTL-01", "D4-CTL-02", "D4-CTL-03", "D4-CTL-04", "D4-CTL-06", "D4-CTL-07" ], "mapped_count": 6, "coverage_status": "Partial mapping", "residual_gap": "Legal applicability, actor-specific duties, conformity procedures, and competent-authority expectations require separate legal analysis.", "legal_note": "The 2026 amendment strengthened information, technical-access and assistance duties when provider responsibility shifts, and amended written-agreement duties with third-party suppliers. Article 99(4) now expressly includes Article 25(2) and (4)." }, { "article": 26, "article_title": "Obligations of deployers of high-risk AI systems", "group": "Deployer obligations", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems, subject to Article 2 sectoral-law rules and Article 111 transitional provisions.", "mapped_controls": [ "D2-CTL-01", "D2-CTL-05", "D3-CTL-01", "D3-CTL-02", "D3-CTL-03", "D3-CTL-04", "D3-CTL-05", "D3-CTL-06", "D3-CTL-07", "D6-CTL-01", "D6-CTL-02", "D6-CTL-03", "D6-CTL-05", "D6-CTL-07", "D9-CTL-05" ], "mapped_count": 15, "coverage_status": "High mapping density", "residual_gap": "Legal applicability, actor-specific duties, conformity procedures, and competent-authority expectations require separate legal analysis." }, { "article": 27, "article_title": "Fundamental rights impact assessment for high-risk AI systems", "group": "Deployer obligations", "application_status": "Applies from 2 December 2027 for Article 6(2)/Annex III high-risk systems and from 2 August 2028 for Article 6(1)/Annex I high-risk systems; paragraph 4 was amended from 27 July 2026 to permit DPIA cross-referencing/reuse where obligations are already met.", "mapped_controls": [ "D3-CTL-01", "D6-CTL-01", "D6-CTL-02", "D6-CTL-03", "D6-CTL-04", "D6-CTL-05", "D6-CTL-06", "D6-CTL-07", "D7-CTL-H01", "D7-CTL-H02", "D7-CTL-H03", "D7-CTL-H04", "D7-CTL-H05" ], "mapped_count": 13, "coverage_status": "High mapping density", "residual_gap": "Legal applicability, actor-specific duties, conformity procedures, and competent-authority expectations require separate legal analysis.", "legal_note": "The amended Article 27(4) allows a deployer to cross-reference or reuse relevant DPIA sections where the Article 27 obligation is already met through a GDPR/LED data-protection impact assessment." }, { "article": 43, "article_title": "Conformity assessment", "group": "Conformity", "application_status": "Generally applicable from 2 August 2026. Its operative high-risk conformity-assessment duties depend on the applicable Article 6 pathway, the delayed Chapter III Sections 1-3 dates, Article 2 sectoral-law rules, and Article 111 transitions.", "mapped_controls": [ "D1-CTL-05", "D1-CTL-06", "D1-CTL-07", "D1-CTL-08", "D1-CTL-09", "D2-CTL-06", "D8-CTL-03", "D8-CTL-05", "D9-CTL-01", "D9-CTL-02", "D9-CTL-03", "D9-CTL-04", "D9-CTL-06" ], "mapped_count": 13, "coverage_status": "High mapping density", "residual_gap": "Legal applicability, actor-specific duties, conformity procedures, and competent-authority expectations require separate legal analysis.", "legal_note": "Articles 43, 47, 48 and 49 were not themselves moved wholesale to 2 December 2027. They remain on the general application track, while their operative high-risk duties depend on the underlying high-risk pathway and delayed Chapter III Sections 1-3." }, { "article": 47, "article_title": "EU declaration of conformity", "group": "Conformity", "application_status": "Generally applicable from 2 August 2026. Its operative declaration-of-conformity duties depend on the applicable high-risk pathway and delayed Chapter III Sections 1-3 dates.", "mapped_controls": [], "mapped_count": 0, "coverage_status": "No mapped GAISSF control", "residual_gap": "Legal applicability, actor-specific duties, conformity procedures, and competent-authority expectations require separate legal analysis." }, { "article": 48, "article_title": "CE marking", "group": "Conformity", "application_status": "Generally applicable from 2 August 2026. Its operative CE-marking duties depend on the applicable high-risk pathway and delayed Chapter III Sections 1-3 dates.", "mapped_controls": [], "mapped_count": 0, "coverage_status": "No mapped GAISSF control", "residual_gap": "Legal applicability, actor-specific duties, conformity procedures, and competent-authority expectations require separate legal analysis." }, { "article": 49, "article_title": "Registration", "group": "Conformity", "application_status": "Generally applicable from 2 August 2026. Registration duties must be read with the applicable high-risk pathway, Article 6(5), and delayed Chapter III Sections 1-3 dates.", "mapped_controls": [], "mapped_count": 0, "coverage_status": "No mapped GAISSF control", "residual_gap": "Legal applicability, actor-specific duties, conformity procedures, and competent-authority expectations require separate legal analysis." }, { "article": 50, "article_title": "Transparency obligations for providers and deployers of certain AI systems", "group": "Transparency", "application_status": "Applicable from 2 August 2026; Article 111(4) gives pre-2 August 2026 synthetic-content systems until 2 December 2026 to comply with Article 50(2).", "mapped_controls": [], "mapped_count": 0, "coverage_status": "No mapped GAISSF control", "residual_gap": "Legal applicability, actor-specific duties, conformity procedures, and competent-authority expectations require separate legal analysis.", "legal_note": "Article 50 remains on the 2 August 2026 track. Regulation (EU) 2026/1744 added the Article 111(4) transition for pre-existing synthetic-content systems and amended Article 50(7) on codes of practice." }, { "article": 51, "article_title": "Classification of general-purpose AI models as general-purpose AI models with systemic risk", "group": "GPAI", "application_status": "Chapter V applicable since 2 August 2025. Article 101 fine powers apply from 2 August 2026; pre-2 August 2025 GPAI models have the Article 111(3) transition until 2 August 2027.", "mapped_controls": [ "D8-CTL-01" ], "mapped_count": 1, "coverage_status": "Indirect mapping", "residual_gap": "Legal applicability, actor-specific duties, conformity procedures, and competent-authority expectations require separate legal analysis." }, { "article": 52, "article_title": "Procedure", "group": "GPAI", "application_status": "Chapter V applicable since 2 August 2025. Article 101 fine powers apply from 2 August 2026; pre-2 August 2025 GPAI models have the Article 111(3) transition until 2 August 2027.", "mapped_controls": [], "mapped_count": 0, "coverage_status": "No mapped GAISSF control", "residual_gap": "Legal applicability, actor-specific duties, conformity procedures, and competent-authority expectations require separate legal analysis." }, { "article": 53, "article_title": "Obligations for providers of general-purpose AI models", "group": "GPAI", "application_status": "Chapter V applicable since 2 August 2025. Article 101 fine powers apply from 2 August 2026; pre-2 August 2025 GPAI models have the Article 111(3) transition until 2 August 2027.", "mapped_controls": [ "D4-CTL-05", "D8-CTL-01" ], "mapped_count": 2, "coverage_status": "Indirect mapping", "residual_gap": "Legal applicability, actor-specific duties, conformity procedures, and competent-authority expectations require separate legal analysis." }, { "article": 54, "article_title": "Authorised representatives of providers of general-purpose AI models", "group": "GPAI", "application_status": "Chapter V applicable since 2 August 2025. Article 101 fine powers apply from 2 August 2026; pre-2 August 2025 GPAI models have the Article 111(3) transition until 2 August 2027.", "mapped_controls": [ "D8-CTL-01" ], "mapped_count": 1, "coverage_status": "Indirect mapping", "residual_gap": "Legal applicability, actor-specific duties, conformity procedures, and competent-authority expectations require separate legal analysis." }, { "article": 55, "article_title": "Obligations of providers of general-purpose AI models with systemic risk", "group": "GPAI systemic risk", "application_status": "Chapter V applicable since 2 August 2025. Article 101 fine powers apply from 2 August 2026; pre-2 August 2025 GPAI models have the Article 111(3) transition until 2 August 2027.", "mapped_controls": [ "D1-CTL-01", "D1-CTL-02", "D1-CTL-04", "D2-CTL-06", "D8-CTL-01", "D8-CTL-03", "D8-CTL-05" ], "mapped_count": 7, "coverage_status": "Partial mapping", "residual_gap": "Legal applicability, actor-specific duties, conformity procedures, and competent-authority expectations require separate legal analysis." }, { "article": 56, "article_title": "Codes of practice", "group": "GPAI", "application_status": "Chapter V applicable since 2 August 2025. Article 101 fine powers apply from 2 August 2026; pre-2 August 2025 GPAI models have the Article 111(3) transition until 2 August 2027.", "mapped_controls": [], "mapped_count": 0, "coverage_status": "No mapped GAISSF control", "residual_gap": "Legal applicability, actor-specific duties, conformity procedures, and competent-authority expectations require separate legal analysis." }, { "article": 57, "article_title": "AI regulatory sandboxes", "group": "Innovation", "application_status": "Generally applicable from 2 August 2026; amended Article 57(1) requires at least one national AI regulatory sandbox to be operational by 2 August 2027.", "mapped_controls": [], "mapped_count": 0, "coverage_status": "No mapped GAISSF control", "residual_gap": "Legal applicability, actor-specific duties, conformity procedures, and competent-authority expectations require separate legal analysis.", "legal_note": "The Digital Omnibus moved the Article 57(1) national-sandbox operational deadline to 2 August 2027." }, { "article": 59, "article_title": "Further processing of personal data for developing certain AI systems in the public interest in the AI regulatory sandbox", "group": "Innovation", "application_status": "Generally applicable from 2 August 2026; processing remains conditional on the strict Article 59 safeguards and applicable EU data-protection law.", "mapped_controls": [], "mapped_count": 0, "coverage_status": "No mapped GAISSF control", "residual_gap": "Legal applicability, actor-specific duties, conformity procedures, and competent-authority expectations require separate legal analysis.", "legal_note": "Article 59 is a narrow legal basis within AI regulatory sandboxes and does not replace GDPR, Regulation (EU) 2018/1725, Directive 2002/58/EC or Directive (EU) 2016/680." }, { "article": 72, "article_title": "Post-market monitoring by providers and post-market monitoring plan for high-risk AI systems", "group": "Monitoring", "application_status": "Generally applicable from 2 August 2026; because Article 72 addresses high-risk AI systems, practical obligations must be read with the applicable Article 6 pathway, delayed Chapter III dates and Article 111 transitions.", "mapped_controls": [ "D1-CTL-02", "D1-CTL-03", "D1-CTL-04", "D1-CTL-05", "D1-CTL-06", "D1-CTL-07", "D1-CTL-08", "D1-CTL-09", "D8-CTL-04", "D9-CTL-05" ], "mapped_count": 10, "coverage_status": "High mapping density", "residual_gap": "Legal applicability, actor-specific duties, conformity procedures, and competent-authority expectations require separate legal analysis." }, { "article": 73, "article_title": "Reporting of serious incidents", "group": "Incident reporting", "application_status": "Generally applicable from 2 August 2026; because Article 73 addresses high-risk AI systems, practical obligations must be read with the applicable Article 6 pathway, delayed Chapter III dates and Article 111 transitions. Reporting deadlines are immediate and no later than 15 days ordinarily, 2 days for widespread infringement or Article 3(49)(b) incidents, and 10 days where a death occurs, subject to the statutory triggers.", "mapped_controls": [ "D1-CTL-03", "D8-CTL-04" ], "mapped_count": 2, "coverage_status": "Indirect mapping", "residual_gap": "Legal applicability, actor-specific duties, conformity procedures, and competent-authority expectations require separate legal analysis.", "legal_note": "Article 73(2)-(4): report immediately after the relevant causal-link/suspicion trigger and in any event no later than 15 days ordinarily; 2 days for widespread infringement or an Article 3(49)(b) serious incident; 10 days for death. Article 74(1a), inserted by the Digital Omnibus, creates a reporting-route derogation for high-risk systems under AI Office competence: incidents are reported to the AI Office and Article 73(2)-(9) applies mutatis mutandis." }, { "article": 78, "article_title": "Confidentiality", "group": "Governance", "application_status": "Applicable since 2 August 2025 under Article 113(b).", "mapped_controls": [], "mapped_count": 0, "coverage_status": "No mapped GAISSF control", "residual_gap": "Legal applicability, actor-specific duties, conformity procedures, and competent-authority expectations require separate legal analysis." }, { "article": 79, "article_title": "Procedure for dealing with AI systems presenting a risk at national level", "group": "Market surveillance", "application_status": "Generally applicable from 2 August 2026; enforcement against high-risk systems must be read with the provisions that are applicable to the relevant system and actor at the time.", "mapped_controls": [], "mapped_count": 0, "coverage_status": "No mapped GAISSF control", "residual_gap": "Legal applicability, actor-specific duties, conformity procedures, and competent-authority expectations require separate legal analysis." }, { "article": 80, "article_title": "Procedure for dealing with AI systems classified by the provider as non-high-risk in application of Annex III", "group": "Market surveillance", "application_status": "Generally applicable from 2 August 2026; Article 80 concerns Annex III systems treated by the provider as non-high-risk and must be read with Article 6 and the applicable timing rules.", "mapped_controls": [], "mapped_count": 0, "coverage_status": "No mapped GAISSF control", "residual_gap": "Legal applicability, actor-specific duties, conformity procedures, and competent-authority expectations require separate legal analysis." }, { "article": 86, "article_title": "Right to explanation of individual decision-making", "group": "Rights", "application_status": "Generally applicable from 2 August 2026; the right applies only within Article 86 conditions and does not displace rights otherwise provided under Union law.", "mapped_controls": [], "mapped_count": 0, "coverage_status": "No mapped GAISSF control", "residual_gap": "Legal applicability, actor-specific duties, conformity procedures, and competent-authority expectations require separate legal analysis." }, { "article": 95, "article_title": "Codes of conduct for voluntary application of specific requirements", "group": "Voluntary", "application_status": "Generally applicable from 2 August 2026; voluntary codes do not create a presumption of conformity unless another legal instrument expressly provides one.", "mapped_controls": [], "mapped_count": 0, "coverage_status": "No mapped GAISSF control", "residual_gap": "Legal applicability, actor-specific duties, conformity procedures, and competent-authority expectations require separate legal analysis." }, { "article": 99, "article_title": "Penalties", "group": "Enforcement", "application_status": "Applicable since 2 August 2025 under Article 113(b) (Chapter XII); amended from 27 July 2026 by Regulation (EU) 2026/1744. Penalty exposure depends on the underlying infringed provision being applicable.", "mapped_controls": [], "mapped_count": 0, "coverage_status": "No mapped GAISSF control", "residual_gap": "Legal applicability, actor-specific duties, conformity procedures, and competent-authority expectations require separate legal analysis.", "legal_note": "Article 99(3): up to EUR 35,000,000 or 7% worldwide annual turnover (whichever is higher) for Article 5 prohibitions. Article 99(4): up to EUR 15,000,000 or 3% for listed operator/notified-body duties, now including Article 25(2) and (4). Article 99(5): up to EUR 7,500,000 or 1% for incorrect, incomplete or misleading information. SMEs are subject to the lower of the amount/percentage under Article 99(6); SMC treatment was added in Article 99(6a) for paragraphs 4 and 5." }, { "article": 110, "article_title": "Amendment to Directive (EU) 2020/1828", "group": "Review", "application_status": "Applicable from 27 July 2026 under amended Article 113(d).", "mapped_controls": [], "mapped_count": 0, "coverage_status": "No mapped GAISSF control", "residual_gap": "Legal applicability, actor-specific duties, conformity procedures, and competent-authority expectations require separate legal analysis." }, { "article": 111, "article_title": "AI systems already placed on the market or put into service and general-purpose AI models already placed on the market", "group": "Transition", "application_status": "Generally applicable from 2 August 2026. Transitional rules include 31 December 2030 for certain Annex X large-scale IT systems, significant-change treatment for pre-application high-risk systems, 2 August 2030 for high-risk systems intended for public-authority use, 2 August 2027 for pre-2 August 2025 GPAI models, and 2 December 2026 for pre-2 August 2026 systems subject to Article 50(2).", "mapped_controls": [], "mapped_count": 0, "coverage_status": "No mapped GAISSF control", "residual_gap": "Legal applicability, actor-specific duties, conformity procedures, and competent-authority expectations require separate legal analysis.", "legal_note": "Article 111 materially limits how legacy systems are treated. Do not assume a pre-existing high-risk system must immediately satisfy every delayed Chapter III requirement: the significant-change rule and specific 2030 public-authority deadline must be assessed." }, { "article": 112, "article_title": "Evaluation and review", "group": "Amendments", "application_status": "Generally applicable from 2 August 2026; evaluation and review duties contain their own milestones, including 2 August 2028, 2 August 2029 and 2 August 2031.", "mapped_controls": [], "mapped_count": 0, "coverage_status": "No mapped GAISSF control", "residual_gap": "Legal applicability, actor-specific duties, conformity procedures, and competent-authority expectations require separate legal analysis." }, { "article": 113, "article_title": "Entry into force and application", "group": "Application", "application_status": "In force since 1 August 2024; Article 113 sets the phased application schedule, including 2 February 2025, 2 August 2025, 27 July 2026, 2 August 2026, 2 December 2026, 2 December 2027 and 2 August 2028 milestones.", "mapped_controls": [], "mapped_count": 0, "coverage_status": "No mapped GAISSF control", "residual_gap": "Legal applicability, actor-specific duties, conformity procedures, and competent-authority expectations require separate legal analysis.", "legal_note": "Application date is not the same as entry into force. This crosswalk distinguishes the 1 August 2024 entry-into-force date from phased dates of application." } ], "limitations": [ "Mapping is not legal advice or proof of compliance.", "Applicability depends on role, territorial scope, system classification and effective date.", "Future amendments, delegated acts, implementing acts, standards and guidance require revalidation.", "The mapping is informative only and does not establish legal equivalence, automatic conformance, a presumption of conformity, certification credit, evidence sufficiency, or operating effectiveness.", "Regulation (EU) 2024/1689 is mapped against the consolidated text of 27 July 2026 incorporating Regulation (EU) 2026/1744; users must revalidate later amendments, delegated or implementing acts, standards, codes and authority guidance at the date of reliance.", "D9 is additional/conditional where Physical AI or cyber-physical actuation is in scope. PAI-SF™ and CSX-PAISF-004 remain mapping/context only.", "GAISSF certification is not currently offered.", "The 2026 Digital Omnibus inserted Article 4a and Article 60a and amended multiple mapped provisions. This v1.0 crosswalk does not create standalone mapping records for every new or amended paragraph; users must read the current legal text.", "Article 2 sectoral-law interactions can narrow which AI Act requirements apply to Article 6(1) product systems. A generic control mapping cannot determine that sector-specific legal effect.", "Penalty figures are statutory maxima and do not predict or determine a penalty in any case; competent authorities apply Article 99 criteria and applicable national enforcement rules.", "The selected article set is not a complete index of the consolidated AI Act. Regulation (EU) 2026/1744 inserted Article 4a, Article 60a and Articles 75a-75d and materially amended Article 75. These provisions can affect privacy/bias processing, real-world testing, serious-incident routing and AI Office enforcement even though they do not receive standalone GAISSF mapping records in this v1.0 edition.", "Article 42(3), inserted by Regulation (EU) 2026/1744, can create a presumption of conformity with Article 15 cybersecurity requirements for qualifying high-risk AI systems within Regulation (EU) 2024/2847. This legal presumption is external to GAISSF and must not be inferred from a GAISSF control mapping.", "Article 101 is not separately mapped. It remains relevant to enforcement of GPAI-provider obligations and applies from 2 August 2026 under Article 113(b).", "Future delegated acts under Article 2(13), due by 2 August 2027, may limit specified Articles 9-15 and 17-25 requirements for certain Article 6(1)/Annex I Section A systems where sectoral law provides equivalent or higher protection. This crosswalk must be revalidated when those delegated acts are adopted." ], "legal_review_notes": [ { "topic": "Article 113 application schedule", "finding": "Corrected Articles 1-3 to 2 February 2025; retained delayed Chapter III Sections 1-3 dates; distinguished entry into force from application." }, { "topic": "Article 99", "finding": "Corrected Article 99 to the 2 August 2025 Chapter XII application date and added current penalty bands plus 2026 amendments." }, { "topic": "Article 73", "finding": "Added 15-day / 2-day / 10-day reporting windows and the Article 74(1a) AI Office reporting-route derogation." }, { "topic": "Article 2 sectoral interaction", "finding": "Added Digital Omnibus scope limitations for Annex I Section B and Article 2(13) sectoral-equivalence mechanism." }, { "topic": "Digital Omnibus additions not separately mapped", "finding": "Article 4a and Article 60a are current law but are not assigned standalone mapping records in this v1.0 crosswalk; this is disclosed rather than silently treated as covered." }, { "topic": "Physical AI mapping hygiene", "finding": "Removed prescriptive SIL/DAL/design-assurance implementation language from D9 mapping rationales; retained conditional D9 and PAI-SF/CSX mapping-only boundary." }, { "topic": "Digital Omnibus completeness pass", "finding": "Reviewed the selected provisions against Regulation (EU) 2026/1744 amendment points and added missing changes for Articles 1, 3, 6, 11, 17, 43, 49, 72, 95 and 112." }, { "topic": "Current-law provisions outside standalone mapping set", "finding": "Explicitly disclosed Articles 4a, 60a and 75a-75d, amended Article 75, Article 42(3) and Article 101 as legal dependencies not represented by standalone mapping records." }, { "topic": "Article 43 legal effect", "finding": "Preserved the general application date while adding the amended Annex I Section A conformity-assessment route and 28 January 2028 notified-body designation deadline." }, { "topic": "Article 72 implementation instrument", "finding": "Added the statutory 2 September 2027 deadline for Commission post-market-monitoring-plan guidance/template." }, { "topic": "Workbook parity", "finding": "Verified Article 113 is present across JSON, DOCX, Markdown and the XLSX Article, Reverse and Gap registers; the public artifacts consistently retain the same 51-provision scope." } ] }