REASON

acf.map-ai-act-obligations

Exhaustive enumeration of the AI Act obligations applicable to a qualified use case, split by lifecycle phase (pre-go-live / continuous / on-incident), with articles, deadlines (including Digital Omnibus deferrals), operational actions, and expected evidence.

!Warning

This tool produces a preliminary regulatory map, not legal advice. requires_human_review is always true. Deadlines reflect the AI Act 2024/1689 calendar frozen in the regulatory_snapshot: a lawyer must validate fit to the concrete case before any filing or inspection.

When to use

Use this tool when a system has already been qualified, typically as Annex III high-risk, Annex I, or out of scope, and you now need the exhaustive list of AI Act articles that apply, in what phase, on what applicable date, and what evidence must be ready. This is the output that feeds a compliance plan or the answer to an inspector.

The board-level question the output answers: “What are we accountable for, to whom, and by when?” The critical_path surfaces the five pre-go-live obligations not deferred by Digital Omnibus, the ones to close before any other work.

Input parameters

Five fields, four required. The annex and provider_or_deployer qualification must already be settled upstream (typically by acf.classify-agent or by a lawyer).

annex"iii" | "i" | "none"required

AI Act risk category already qualified. iii = Annex III high-risk (HR, biometrics, critical infrastructure…); i = Annex I (toys, machinery, regulated medical devices); none = out of high-risk scope.

use_casestring (10-500)required

Use-case description. Used to fire internal business rules (recruitment, credit scoring, etc.) that add specific ACF® cards and obligations.

provider_or_deployer"provider" | "deployer" | "both"required

Caller’s AI Act role. deployer adds Art. 26 and Art. 27 (FRIA); provider adds the Art. 9-15 chain + Art. 43.

gpai_usedboolean

Does the system use a GPAI (general-purpose LLM) under the hood? Activates GPAI obligations Art. 51-55 and strengthens Art. 50 (transparency).

locale"en" | "fr"default: "en"

Language of the textual output (article titles, rationales).

Output schema

The output is a structured object splitting obligations by lifecycle phase, plus metadata and signed footer.

obligations{ pre_go_live: Obligation[], continuous: Obligation[], on_incident: Obligation[] }

Obligations classified by phase. Each Obligation carries article, title, requirement, deadline, linked ACF® fiches, operational_actions, evidence_required, and digital_omnibus_deferred.

total_countnumber

Total number of obligations across all phases.

critical_pathstring[]

Up to five pre-go-live obligations not deferred by Digital Omnibus, the list to close as top priority.

confidence"low" | "medium" | "high"

Global confidence level. low if annex=none but rules fired on the use_case (contradiction).

assumptionsstring[]

Explicit assumptions, for example, a detected contradiction between the declared annex and the rules that fired.

gaps_to_validatestring[]

Identified gaps that the human review must close before acting on the map.

rationale_per_ruleRationaleRecord[]

Per-internal-rule trace: id, version, fired (true/false), textual evidence. Feeds the signed audit trail.

requires_human_reviewtrue

Constant. No call returns false.

Example call

A deployer of a CV screening agent (Annex III §4, employment):

map-obligations.tstypescript

import { Client } from "@modelcontextprotocol/sdk/client/index.js";
import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";

const transport = new StdioClientTransport({
  command: "npx",
  args: ["-y", "acf-mcp"],
});
const client = new Client({ name: "demo", version: "1.0" }, {});
await client.connect(transport);

const result = await client.callTool({
  name: "acf.map-ai-act-obligations",
  arguments: {
    annex: "iii",
    use_case:
      "Automated CV screening agent that ranks candidates for a software-engineering role. Outputs a shortlist that recruiters use as a starting point.",
    provider_or_deployer: "deployer",
    gpai_used: true,
    locale: "en",
  },
});

console.log(JSON.stringify(result.content, null, 2));

Response

response.jsonjson

{
  "obligations": {
    "pre_go_live": [
      {
        "article": "art-9",
        "title": "Risk management system",
        "requirement": "Establish, implement, document, maintain a risk management system across the lifecycle.",
        "deadline": "2027-12-02",
        "fiches": [
          "ACF-03",
          "ACF-P6",
          "ACF-12"
        ],
        "operational_actions": [
          "Stand up risk register",
          "Define risk methodology",
          "Review quarterly"
        ],
        "evidence_required": [
          "Risk register",
          "Methodology doc"
        ],
        "digital_omnibus_deferred": true
      },
      {
        "article": "art-10",
        "title": "Data and data governance",
        "requirement": "Training/validation/testing data sets governance + quality requirements.",
        "deadline": "2027-12-02",
        "fiches": [
          "ACF-03",
          "ACF-P6",
          "ACF-12"
        ],
        "operational_actions": [
          "Document data sources",
          "Run bias evaluation",
          "Document data drift monitoring"
        ],
        "evidence_required": [
          "Data inventory",
          "Bias evaluation report"
        ],
        "digital_omnibus_deferred": true
      },
      {
        "article": "art-11",
        "title": "Technical documentation",
        "requirement": "Maintain technical documentation per Annex IV.",
        "deadline": "2027-12-02",
        "fiches": [
          "ACF-03",
          "ACF-P6",
          "ACF-12"
        ],
        "operational_actions": [
          "Author Annex IV-aligned tech doc"
        ],
        "evidence_required": [
          "Technical documentation"
        ],
        "digital_omnibus_deferred": true
      },
      {
        "article": "art-13",
        "title": "Transparency to deployers",
        "requirement": "Provide instructions for use that allow the deployer to interpret outputs.",
        "deadline": "2027-12-02",
        "fiches": [
          "ACF-03",
          "ACF-P6",
          "ACF-12"
        ],
        "operational_actions": [
          "Draft instructions for use",
          "Translate to operating languages"
        ],
        "evidence_required": [
          "Instructions for use"
        ],
        "digital_omnibus_deferred": true
      },
      {
        "article": "art-50",
        "title": "Transparency on AI/GPAI",
        "requirement": "Disclose AI usage to natural persons interacting with the system.",
        "deadline": "2026-08-02",
        "fiches": [],
        "operational_actions": [
          "Add disclosure on every user surface"
        ],
        "evidence_required": [
          "Disclosure copy"
        ],
        "digital_omnibus_deferred": false
      },
      {
        "article": "art-50",
        "title": "Transparency on AI/GPAI",
        "requirement": "Transparency obligations on AI systems intended to interact with natural persons (clear notice that the user is interacting with an AI system, unless obvious from context).",
        "deadline": "2026-08-02",
        "fiches": [],
        "operational_actions": [
          "Add disclosure on every user surface"
        ],
        "evidence_required": [
          "Disclosure copy"
        ],
        "digital_omnibus_deferred": false
      }
    ],
    "continuous": [
      {
        "article": "art-12",
        "title": "Record-keeping",
        "requirement": "Automated logs over the lifecycle of the system.",
        "deadline": "2027-12-02",
        "fiches": [
          "ACF-03",
          "ACF-P6",
          "ACF-12"
        ],
        "operational_actions": [
          "Wire structured logging",
          "Define retention policy"
        ],
        "evidence_required": [
          "Logs"
        ],
        "digital_omnibus_deferred": true
      },
      {
        "article": "art-14",
        "title": "Human oversight",
        "requirement": "Effective human oversight design + operation.",
        "deadline": "2027-12-02",
        "fiches": [
          "ACF-03",
          "ACF-P6",
          "ACF-12"
        ],
        "operational_actions": [
          "Design kill switch (ACF-07)",
          "Document escalation thresholds (ACF-P6)"
        ],
        "evidence_required": [
          "Kill switch design",
          "Drill reports"
        ],
        "digital_omnibus_deferred": true
      },
      {
        "article": "art-26",
        "title": "Deployer obligations",
        "requirement": "Instructions, monitoring, fundamental rights impact assessment.",
        "deadline": "2027-12-02",
        "fiches": [],
        "operational_actions": [
          "Run fundamental rights IA",
          "Document monitoring plan"
        ],
        "evidence_required": [
          "FRIA report",
          "Monitoring plan"
        ],
        "digital_omnibus_deferred": true
      },
      {
        "article": "art-27",
        "title": "Fundamental rights impact assessment",
        "requirement": "Mandatory FRIA for high-risk deployers in some sectors.",
        "deadline": "2027-12-02",
        "fiches": [],
        "operational_actions": [
          "Author FRIA"
        ],
        "evidence_required": [
          "FRIA"
        ],
        "digital_omnibus_deferred": true
      },
      {
        "article": "art-51",
        "title": "GPAI obligation",
        "requirement": "Classification of GPAI models and identification of systemic-risk models.",
        "deadline": "2026-08-02",
        "fiches": [],
        "operational_actions": [],
        "evidence_required": [],
        "digital_omnibus_deferred": false
      },
      {
        "article": "art-53",
        "title": "GPAI obligation",
        "requirement": "Technical documentation, training data summary, copyright policy, instructions for downstream providers.",
        "deadline": "2026-08-02",
        "fiches": [],
        "operational_actions": [],
        "evidence_required": [],
        "digital_omnibus_deferred": false
      },
      {
        "article": "art-54",
        "title": "GPAI obligation",
        "requirement": "Authorised representative requirement for non-EU GPAI providers placing models on the EU market.",
        "deadline": "2026-08-02",
        "fiches": [],
        "operational_actions": [],
        "evidence_required": [],
        "digital_omnibus_deferred": false
      }
    ],
    "on_incident": [
      {
        "article": "art-15",
        "title": "Accuracy, robustness, cybersecurity",
        "requirement": "Maintain accuracy, robustness, cybersecurity levels appropriate to the use.",
        "deadline": "continuous",
        "fiches": [
          "ACF-03",
          "ACF-P6",
          "ACF-12"
        ],
        "operational_actions": [
          "Define accuracy KPIs",
          "Run robustness tests",
          "Define cybersecurity controls"
        ],
        "evidence_required": [
          "KPI dashboards",
          "Pen test reports"
        ],
        "digital_omnibus_deferred": false
      }
    ]
  },
  "total_count": 14,
  "critical_path": [
    "art-50: Transparency on AI/GPAI",
    "art-50: Transparency on AI/GPAI"
  ],
  "confidence": "medium",
  "assumptions": [],
  "gaps_to_validate": [
    "Confirm provider_or_deployer qualification: it changes the obligation set.",
    "Confirm GPAI usage: Article 50 transparency obligation depends on it."
  ],
  "requires_human_review": true,
  "rationale_per_rule": [
    {
      "rule_id": "ai-act-annex-iii.annex-iii-1a-biometric-identity",
      "rule_version": "2026-06",
      "fired": false,
      "evidence": ""
    },
    {
      "rule_id": "ai-act-annex-iii.annex-iii-2-critical-infrastructure",
      "rule_version": "2026-06",
      "fired": false,
      "evidence": ""
    },
    {
      "rule_id": "ai-act-annex-iii.annex-iii-3-educational",
      "rule_version": "2026-06",
      "fired": false,
      "evidence": ""
    },
    {
      "rule_id": "ai-act-annex-iii.annex-iii-4-employment",
      "rule_version": "2026-06",
      "fired": true,
      "evidence": "keyword:cv screening"
    },
    {
      "rule_id": "ai-act-annex-iii.annex-iii-5b-credit-scoring",
      "rule_version": "2026-06",
      "fired": false,
      "evidence": ""
    },
    {
      "rule_id": "ai-act-annex-iii.annex-iii-5c-insurance-pricing",
      "rule_version": "2026-06",
      "fired": false,
      "evidence": ""
    },
    {
      "rule_id": "ai-act-annex-iii.annex-iii-6-law-enforcement",
      "rule_version": "2026-06",
      "fired": false,
      "evidence": ""
    },
    {
      "rule_id": "ai-act-annex-iii.annex-iii-7-migration-asylum",
      "rule_version": "2026-06",
      "fired": false,
      "evidence": ""
    },
    {
      "rule_id": "ai-act-annex-iii.annex-iii-8-justice-democracy",
      "rule_version": "2026-06",
      "fired": false,
      "evidence": ""
    },
    {
      "rule_id": "ai-act-annex-i.annex-i-medical-device",
      "rule_version": "2026-06",
      "fired": false,
      "evidence": ""
    },
    {
      "rule_id": "ai-act-annex-i.annex-i-vehicle-safety",
      "rule_version": "2026-06",
      "fired": false,
      "evidence": ""
    },
    {
      "rule_id": "ai-act-annex-i.annex-i-machinery",
      "rule_version": "2026-06",
      "fired": false,
      "evidence": ""
    },
    {
      "rule_id": "gpai-triggers",
      "rule_version": "2026-06",
      "fired": true,
      "evidence": "enum:gpai_used=true"
    }
  ],
  "doctrine_version": "ACF framework v1.0 / rules 2026-06",
  "doctrine_hash": "sha256:119819463363cde0649504ab8ed5a96982fdb8506441f2c5e76e7e3c3feb77f1",
  "doctrine_signature": "ed25519:3R0oIiqL3Kgd…",
  "doctrine_archive_url": "https://acfstandard.io/archive/doctrine/v1.0/doctrine-v1.0.json",
  "regulatory_snapshot": "EU AI Act (Reg. 2024/1689, incl. Digital Omnibus deferral) + GDPR (Reg. 2016/679) + DORA (Reg. 2022/2554) + NIS2 (Dir. 2022/2555) + ISO 42001:2023: as of 2026-06-07",
  "generated_at": "2026-11-01T12:06:31.068Z",
  "disclaimer": "Preliminary qualification produced by the ACF® deterministic engine. Not legal advice. Human review required. Do not use for autonomous regulatory decision-making. See doctrine_archive_url for the version of the doctrine used."
}

Common errors

Invalid parameters: annex outside iii, i or none (lower case), or provider_or_deployer outside its enum. The call fails with a JSON-RPC error whose message lists the offending fields.
Low confidence: when few context fields are provided, confidence is low and assumptions states what was assumed. Complete the input before relying on the result.

acf.classify-agent: obtain the annex + provider_or_deployer qualification before calling this tool.
acf.assign-ddao-controls: translate obligations into concrete DDAO controls with budget and estimated effort.
acf.regulation.article: fetch the verified text of a specific AI Act article cited in the map.