Skip to main content

Regulation map

The EU AI Act, article by article.

Articles 12, 14 and 26 of the EU AI Act, mapped to elan1 controls for agents used in credit, insurance and care. Free to read, no form.

Book a demoAll regulation maps
Last reviewed
Access
Read free · no form
A lawyer takes a bound statute volume from black steel shelving in a skylit reading room

In short

The short answer.

What does the EU AI Act ask of an AI agent?

Regulation (EU) 2024/1689 regulates AI by risk. An agent is high-risk when it is used for something the Act lists, such as credit scoring or life and health insurance pricing. When it is, logging and human oversight become legal duties, for providers and for the businesses that deploy them.

Applies to
Providers placing AI systems on the EU market, deployers using them in the EU, and providers and deployers elsewhere when the system's output is used in the EU. An Indian business serving EU customers can be in scope.
Key dates
  1. 1 Aug 2024The Act enters into force.
  2. 2 Feb 2025Prohibited practices (Article 5) and the AI literacy duty (Article 4) apply.
  3. 2 Aug 2025Obligations for general-purpose AI models, governance and penalties apply.
  4. 2 Aug 2026The Act's general date of application.
  5. 2 Dec 2027High-risk duties for stand-alone systems listed in Annex III, as moved by the Digital Omnibus on AI.
  6. 2 Aug 2028High-risk duties for AI embedded in products covered by Annex I, such as medical devices and machinery.

Clause by clause

Each duty, and the control that answers it.

EU AI Act, clause by clause, mapped to elan1 controls, with the claim IDs behind each control
Clause, and what it askselan1 controlMapped toClaim IDs
Article 12: record-keepingThe system must automatically log events over its lifetime, so its operation can be traced.elan1 Govern writes a 16-field record for every action, including refusals, that an auditor can verify offline.
  • elan1 Govern
Article 14: human oversightPeople assigned to oversee the system must be able to understand it, decide not to use its output, override it, and interrupt it through a stop button or similar procedure.Risky actions wait for a named person, who can refuse; one emergency stop pauses every agent at once.
  • elan1 Govern
Article 14: overrideThe person overseeing the system can decide not to use its output, or override it.In credit and clinical intake, elan1 Decide is recommend-only, so a person always makes the decision.
  • elan1 Decide
Article 26: deployer dutiesUse the system as instructed, assign oversight to competent people, monitor it, and keep the logs under the deployer's control for at least six months.Records are kept for as long as your policy sets, well beyond the six-month minimum if you choose.
  • elan1 Govern
No claim ID

Mappings are drafts for your counsel and auditors. They are not certification, legal advice or regulator approval.

What this map does not claim.

  • elan1 does not provide conformity assessment. Whether a particular use is high-risk, and who is its provider, are questions for your counsel.
  • ISO/IEC 42001 certification is not, on its own, conformity with the EU AI Act.

By industry

Where this rule shows up.

Read more

The explainer, and the official text.

Official text.

Verify a receipt

Questions

EU AI Act, plainly.

Only when it is used for something the Act lists. Classification follows use under Article 6 and Annex III, which includes credit scoring of natural persons, risk assessment and pricing in life and health insurance, and emergency patient triage. An agent that drafts emails is unlikely to be high-risk; the same agent deciding a loan would be.

The Act entered into force on 1 August 2024. Prohibited practices applied from 2 February 2025 and general-purpose AI obligations from 2 August 2025. Under the Digital Omnibus on AI adopted in 2026, high-risk duties for Annex III systems apply from 2 December 2027, and for AI in Annex I products from 2 August 2028.

It can. The Act applies to providers placing AI systems on the EU market, to deployers using them in the EU, and to providers and deployers elsewhere when the system's output is used in the EU. An Indian business whose AI output is used for EU customers may be in scope; ask your counsel to confirm.

Under Article 99, prohibited practices can draw fines of up to €35 million or 7% of worldwide annual turnover, whichever is higher. Breaches of most other obligations, including the high-risk duties, can draw up to €15 million or 3%. Whether a particular use is high-risk, and who its provider is, are questions for your counsel.

No. elan1 does not assess conformity and is not a conformity assessment body. It supplies evidence an assessment can use: automatic logs of every agent action, as Article 12 asks, and a named person who can decide not to use an output, override it or stop it, as Article 14 asks. Whether a particular use is high-risk, and who is its provider, are questions for your counsel.

No. Mappings are drafts for your counsel and auditors. They are not certification, legal advice or regulator approval. Each row names the clause or duty, what it asks, the elan1 control that answers it and, where one is assigned, the claim ID behind it, so your counsel and auditors can test each mapping against the receipts.

Other maps

The other rules we map.

All regulation maps

Start with one process.

Put one agent on the path. We'll show you the receipt.

Book a demo
  • Allowed · Approved by Asha R.
  • Held for CFO
  • Refused · rule 4.2
Illustrative data.

Start with one process.

Add the next when it holds.

Book a demo
Approvals · Kolam ComponentsIllustrative
  • Allowed · Approved by Asha R.
  • Held for CFO
  • Refused · rule 4.2
RCPT-0042 · signed · chained
A product view with three decisions: allowed and approved by Asha R., held for the CFO, and refused under rule 4.2. Illustrative data.