Mapping policy checks to EU AI Act obligations

Why map rules to articles at all

When an agent operates in an Annex III high-risk use, the deployer — not the model provider — carries the duties. Mapping each policy rule to the article it supports turns a vague "we're governed" claim into a concrete, evidencable control. It also tells you which obligations you have no rule for yet.

The map agents actually use

Refund / spend approval gate → Art. 14 (human oversight). A high-value action requires a person in the loop.
Data-residency block → Art. 9 / Chapter IV (data governance). Personal data stays in its permitted region.
Logged policy decision → Art. 12 (record-keeping / logging of high-risk activity).
Input validation + fallback → Art. 15 (accuracy, robustness, cyber-security).
Risk controls across the pipeline → Art. 9 (risk management system).

What the map does not prove

A rule mapped to Art. 14 is evidence of a control, not a conformity certificate. Conformity is the deployer's responsibility across the full system, and the mapping should be validated with qualified counsel — especially because the Digital Omnibus has delayed several high-risk obligations. Annex III extensions currently track toward 2 December 2027; verify the current effective date before committing a timeline.

Using the map in practice

Extract your rules, label each with the obligation it supports, and keep the list next to your conformity assessment. When an auditor asks "where is your Art. 14 oversight?", you point at the rule and its log — not at a paragraph in a PDF.

Authoritative references

EU AI Act (Reg. 2024/1689), Art. 9 / 12 / 14 / 15: https://eur-lex.europa.eu/eli/reg/2024/1689/oj
AI Act explorer: https://artificialintelligenceact.eu/
European Commission AI policy: https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai

FAQ

Does mapping a rule to an article make me EU AI Act compliant?

No. The map is evidence of a control, not a conformity certificate. Conformity is the deployer's responsibility across the full system and should be validated with qualified counsel.

Which obligations do agent policy rules usually support?

Approval gates map to Art. 14 (oversight); data-residency blocks to Art. 9 / Chapter IV; logged decisions to Art. 12; input validation to Art. 15; pipeline risk controls to Art. 9.

Who carries the EU AI Act duties for an agent — the model maker or the deployer?

For Annex III high-risk uses, most duties (Art. 9, 12, 14, 15) land on the deployer, not the model provider. Policy checks help the deployer evidence those controls.

What is the current effective date for Annex III high-risk obligations?

Under the Digital Omnibus, several high-risk obligations have been delayed. Annex III extensions currently track toward 2 December 2027 — verify the current effective date with counsel before relying on a timeline.

Is AgentPolicy a legal opinion?

No. AgentPolicy helps you extract enforceable rules and see where they map to EU AI Act obligations. It is decision-support, not a legal opinion, a certification, or a guarantee of conformity.

## Disclaimer

Disclaimer (decision-support, not legal advice): AgentPolicy is a tool that helps teams turn policy text into agent-callable checks and a compliance checklist. It is not a legal opinion, a compliance certificate, or a guarantee that an agent is safe or compliant. EU AI Act conformity depends on the full deployed system and is the responsibility of the deploying organization. Verify current obligations and effective dates with qualified counsel before relying on any timeline.

Try AgentPolicy to map your policy rules to EU AI Act obligations and export the evidence — try AgentPolicy.