EU Regulatory Crosswalk
Verification required. EU claims on this page were compiled on 7 October 2026 from secondary sources and from memory of the legal text. On 10 October 2026, 12 rows were checked against the Official Journal or the issuing body's own page; they are tagged [Verified] and carry the URL. Every other claim is tagged [Reported], [Recalled], [Conflict] or [Unverified] as explained on the section home page. Check the primary text on EUR-Lex before relying on any of them. This is not legal advice.
One row per instrument in the EU AI Regulatory Hub, with the AI Act also split into five parts (E1a to E1e). Each row gives the wiki controls that relate to the instrument, the control themes from the Framework Adoption Guide and the verification status. The last column holds the primary URL and the date it was retrieved, for the rows that have been checked. A note in brackets says when only part of the row was checked.
The same data is available as a CSV file for GRC tooling: crosswalk.csv.
Legal force sorts each row under one of seven labels, so that law is not mistaken for guidance or for a voluntary framework. The label is this wiki's reading of the sources and carries the same verification caveat as the rest of the row.
| Label | Meaning |
|---|---|
| Binding law | Enacted law or regulation that applies generally in the jurisdiction, including provisions that start on a later date. |
| Binding in scope | Binding only on a sector, a free zone, a state or province, or public bodies. |
| Guidance | Published by a government or regulator, and not binding in itself. |
| Voluntary | A standard, code or framework that an organization chooses to adopt. |
| Proposed | A bill, draft or consultation, or a proposal that lapsed. It is not law. |
| Context | A policy, authority, programme or summary row that sets no rule. |
| Unclear | The sources used do not settle whether it binds. |
| ID | Instrument | Legal force | Type / status | Wiki controls | Control themes | Verification tag | To verify | Primary URL and retrieval date |
|---|---|---|---|---|---|---|---|---|
| E1 | AI Act (Regulation (EU) 2024/1689) as amended by the Digital Omnibus on AI (Regulation (EU) 2026/1744) | Binding law | Binding; phased. Omnibus in force 27 Jul 2026 | All | GOV; RSK; POL; INV; OVS; AUD; CHG; INC | Verified | Original Art. 113 wording; consolidated text | Regulation (EU) 2024/1689; Regulation (EU) 2026/1744, retrieved 10 Oct 2026 |
| E1a | AI Act Art. 5 prohibited practices | Binding law | Applies from 2 Feb 2025; new points (ba) and (bb) from 2 Dec 2026 | AI-CTRL-012; AI-CTRL-011 | GOV; POL | Verified | Full list of prohibited practices | Regulation (EU) 2026/1744, retrieved 10 Oct 2026 |
| E1b | AI Act Art. 4 AI literacy | Binding law | Applies from 2 Feb 2025; reworded by the omnibus as a duty to support AI literacy | AI-CTRL-012 | TRN | Verified | Commission examples under Art. 4(2) | Regulation (EU) 2026/1744, retrieved 10 Oct 2026 |
| E1c | AI Act high-risk (Arts. 9 to 17, 26, 27, 43 to 49, 72, 73) | Binding law | Annex III from 2 Dec 2027; Annex I from 2 Aug 2028 | AI-CTRL-037; AI-CTRL-013; AI-CTRL-038; AI-CTRL-008; AI-CTRL-023; AI-CTRL-034; AI-CTRL-039; AI-CTRL-035 | RSK; PRV; OVS; AUD; INC; CHG | Verified | Article text | Regulation (EU) 2026/1744, retrieved 10 Oct 2026 |
| E1d | AI Act Art. 50 transparency | Binding law | From 2 Aug 2026; systems placed on the market before that date have until 2 Dec 2026 for Art. 50(2) | AI-CTRL-039 | OVS | Verified; Reported | General 2 Aug 2026 date in the original Art. 113 | Regulation (EU) 2026/1744, retrieved 10 Oct 2026 |
| E1e | AI Act GPAI (Arts. 51 to 55) | Binding law | Applies since 2 Aug 2025; enforcement from 2 Aug 2026 | AI-CTRL-014; AI-CTRL-028; AI-CTRL-029 | VND; POL | Reported | Art. 113 text; guidelines | Commission page on the GPAI guidelines, retrieved 10 Oct 2026 (states application from 2 Aug 2025; not the OJ text) |
| E2 | GDPR | Binding law | Binding | AI-CTRL-013; AI-CTRL-007; AI-CTRL-017; AI-CTRL-035 | PRV; XBT; RET; INC | Recalled | Articles; national law | Regulation (EU) 2016/679, retrieved 10 Oct 2026 (title and OJ reference only) |
| E3 | EDPB opinion on AI models and personal data | Guidance | Guidance; Opinion 28/2024, adopted 18 Dec 2024 | AI-CTRL-013 | PRV | Verified | Content | EDPB Opinion 28/2024, retrieved 10 Oct 2026 |
| E4 | Digital Omnibus (data/GDPR) | Proposed | Proposal; not before 2027 | AI-CTRL-013 | PRV | Reported | Status | |
| E5 | NIS2 | Binding law | Binding via national law | AI-CTRL-005; AI-CTRL-035 | INC; VND; BCP | Recalled | National transposition | Directive (EU) 2022/2555, retrieved 10 Oct 2026 (title only) |
| E6 | DORA | Binding in scope | Binding for financial entities | AI-CTRL-014; AI-CTRL-035 | VND; INC; BCP | Reported | Technical standards | Regulation (EU) 2022/2554, retrieved 10 Oct 2026 (title only) |
| E7 | Cyber Resilience Act | Binding law | Applies from 11 Dec 2027; Art. 14 reporting from 11 Sep 2026; Chapter IV from 11 Jun 2026 | AI-CTRL-005; AI-CTRL-008 | INC; AUD | Verified | Scope for AI products | Regulation (EU) 2024/2847, retrieved 10 Oct 2026 |
| E8 | Product Liability Directive (new) | Binding law | Directive; Member States transpose by 9 Dec 2026; applies to products placed on the market after that date | AI-CTRL-037 | RSK | Verified | National transposition | Directive (EU) 2024/2853, retrieved 10 Oct 2026 |
| E9 | Data Act | Binding law | Regulation; applies from 12 Sep 2025 | AI-CTRL-007; AI-CTRL-014 | XBT; VND | Verified | Later dates for Art. 3(1) and Chapter IV | Regulation (EU) 2023/2854, retrieved 10 Oct 2026 |
| E10 | Digital Services Act | Binding law | Regulation | AI-CTRL-039 | OVS | Recalled | Scope for AI | Regulation (EU) 2022/2065, retrieved 10 Oct 2026 (title only) |
| E11 | Copyright TDM opt-out | Binding law | Directive (EU) 2019/790 Art. 4; transposition was due 7 Jun 2021 | AI-CTRL-029 | POL | Verified | National law | Directive (EU) 2019/790, retrieved 10 Oct 2026 |
| E12 | Commission guidelines: prohibited practices | Guidance | Guidance; published 4 Feb 2025 | AI-CTRL-012 | POL | Verified | Content | Commission notice of publication, retrieved 10 Oct 2026 |
| E13 | Commission guidelines: GPAI | Guidance | Guidance (10 Jul 2025) | AI-CTRL-014 | VND | Reported | Content; date (the Commission page shows none, and gives 10 Jul 2025 for the Code of Practice in E15) | Commission page on the GPAI guidelines, retrieved 10 Oct 2026 (title only) |
| E14 | Commission draft guidelines: high-risk classification | Proposed | Draft 19 May 2026; consultation closed 23 Jul 2026 | AI-CTRL-011 | INV | Reported | Final adoption | |
| E15 | GPAI Code of Practice | Voluntary | Voluntary; published 10 Jul 2025 | AI-CTRL-014 | VND | Verified | Signatory list | Commission page on the Code of Practice, retrieved 10 Oct 2026 |
| E16 | Code of Practice on marking and labelling AI content | Voluntary | Voluntary; final 10 Jun 2026 | AI-CTRL-039 | OVS | Reported | Adequacy assessment | |
| E17 | CEN-CENELEC JTC 21 standards (EN 18286:2026; prEN 18228, 18229, 18282, 18284) | Voluntary | EN 18286 approved 12 Jul 2026, OJ citation pending; others draft | AI-CTRL-012; AI-CTRL-037; AI-CTRL-005; AI-CTRL-013 | GOV; RSK; AUD | Reported | Numbers; status | |
| E18 | ISO/IEC 42001 | Voluntary | Voluntary standard | All | GOV; AUD | Recalled | Not harmonised |
The EU instruments behind AI-CTRL-041 and AI-CTRL-042 are listed on the EU drivers page.