EU AI Act
Regulatory framework (binding law)Artificial Intelligence Act - Regulation (EU) 2024/1689 · European Union (European Parliament and Council of the EU)
The EU AI Act is binding law establishing risk tiers and provider obligations enforced through conformity assessment and CE marking, while AITBM is a technical-risk quantification framework that helps providers prioritise and evidence the Act's Article 9 and Article 15 technical duties without ever certifying legal conformity.
| EU AI Act Obligation | Primary AITBM Sub-Metrics | Evidence Use / Notes |
|---|---|---|
| Risk-management system | Whole IVP, ORP, ERS | May trigger a deployment-specific reassessment; the legal duty does not set an AITBM cadence |
| Data and data governance | Pr-1Pr-3Pr-4Fa-3 | Dataset bias and representation testing; minimisation |
| Technical documentation (Annex IV) | Tr-4 | Model lineage; documentation completeness |
| Record-keeping (logging) | Tr-3 | Audit-trail coverage and tamper-evidence |
| Transparency to deployers | Tr-1 | Explainability depth; instructions for use |
| Human oversight | Cn-2 | Intervention and override evidence informs the Aa authority assessment |
| Accuracy, robustness and cybersecurity | Ro-1Ro-2Ro-3Cn-1Cn-3Cn-4 | Attack-success-rate; shift/consistency; security controls |
| Limited-risk transparency obligations | Tr-1Tr-3 | AI-interaction disclosure; synthetic-content labelling |
| GPAI systemic-risk assessment | ORP Cp, ORP Aa | Risk scenarios and dependency evidence feed the SDG; Cp remains graph-derived |
Key findings
- The EU AI Act is binding law and AITBM is not: a favourable ERS does not certify conformity, replace conformity assessment, CE marking, or registration, and carries no legal standing - AITBM only supports the conformity dossier as a due-diligence artifact.
- The dated legal-tier comparison illustrates that legal classification and technical risk are separate. Its displayed scores retain their historical basis; a current assessment must recompute all AITBM inputs under the current specification.
- This crosswalk routes evidence relevant to Articles 9 and 15 into applicable 0.00-1.00 technical rubrics. The Act does not specify AITBM, and AITBM results do not establish compliance with risk-management or post-market-monitoring duties.
- The Act is technology-neutral and does not prescribe AITBM's Cn-5 agent-identity metric or architecture-specific weighting. Regulation (EU) 2026/1744, published July 24 and in force July 27, 2026, defers Annex III high-risk duties to December 2, 2027 and Article 6(1)/Annex I duties to August 2, 2028, except Article 6(5). Article 50 generally applies from August 2, 2026, with a December 2, 2026 transition for Article 50(2) on generative systems already marketed before that date.