ACF
acfstandard.io
Developer docs
EN
REASON

acf.map-ai-act-obligations

Énumération exhaustive des obligations AI Act applicables à un cas d’usage qualifié, ventilées par phase de cycle de vie (pre-go-live / continu / incident), avec articles, échéances (incluant les reports Digital Omnibus), actions opérationnelles et preuves attendues.

!Attention
Cet outil produit une cartographie réglementaire préliminaire, pas un avis juridique. requires_human_review vaut toujours true. Les échéances reflètent le calendrier AI Act 2024/1689 figé dans le regulatory_snapshot: un juriste doit valider l’application au cas concret avant tout dépôt ou inspection.

Quand l’utiliser

Utilisez cet outil quand un système a déjà été qualifié, typiquement haut risque Annexe III, ou Annexe I, ou hors scope, et qu’il faut maintenant la liste exhaustive des articles AI Act qui s’appliquent, en quelle phase, à quelle date d’applicabilité, et quelles preuves doivent être prêtes. C’est la sortie qui alimente un plan de mise en conformité ou la réponse à un inspecteur.

La question board que la sortie tranche : « De quoi sommes-nous redevables, devant qui, et à quelle date ? » Le critical_path donne les cinq obligations pre-go-live non reportées par Digital Omnibus, celles à clôturer avant tout autre travail.

Paramètres d’entrée

Cinq champs, dont quatre obligatoires. La qualification annex et provider_or_deployer doit déjà avoir été tranchée en amont (typiquement par acf.classify-agent ou par un juriste).

annex"iii" | "i" | "none"required
Catégorie de risque AI Act déjà qualifiée. iii = haut risque Annexe III (RH, biométrie, infrastructure critique…) ; i = Annexe I (jouets, machines, dispositifs médicaux régulés) ; none = hors scope haut risque.
use_casestring (10-500)required
Description du cas d’usage. Sert à faire matcher les règles métier internes (recrutement, scoring crédit, etc.) qui ajoutent des fiches ACF® et obligations spécifiques.
provider_or_deployer"provider" | "deployer" | "both"required
Rôle AI Act du demandeur. deployer ajoute Art. 26 et Art. 27 (FRIA) ; provider ajoute la chaîne Art. 9-15 + Art. 43.
gpai_usedboolean
Le système utilise-t-il un GPAI (LLM généraliste) en sous-couche ? Active les obligations GPAI Art. 51-55 et renforce Art. 50 (transparence).
locale"en" | "fr"default: "en"
Langue de la sortie textuelle (titres d’articles, rationales).

Schéma de sortie

La sortie est un objet structuré ventilant les obligations par phase de cycle de vie, plus métadonnées et pied-de-page signé.

obligations{ pre_go_live: Obligation[], continuous: Obligation[], on_incident: Obligation[] }
Obligations classées par phase. Chaque Obligation contient article, title, requirement, deadline, fiches ACF® liées, operational_actions, evidence_required et digital_omnibus_deferred.
total_countnumber
Nombre total d’obligations toutes phases confondues.
critical_pathstring[]
Maximum cinq obligations pre-go-live non reportées par Digital Omnibus, c’est la liste à clôturer en priorité absolue.
confidence"low" | "medium" | "high"
Niveau de confiance global. low si annex=none mais que des règles ont matché sur le use_case (contradiction).
assumptionsstring[]
Hypothèses explicites, par exemple, contradiction détectée entre l’annex déclaré et les règles qui ont matché.
gaps_to_validatestring[]
Trous identifiés que la revue humaine doit combler avant d’agir sur la cartographie.
rationale_per_ruleRationaleRecord[]
Trace par règle interne : id, version, fired (true/false), evidence textuelle. Sert l’audit trail signé.
requires_human_reviewtrue
Constant. Aucun appel ne retourne false.

Exemple d’appel

Un déployeur d’agent de présélection CV (Annexe III §4, emploi) :

map-obligations.tstypescript
import { Client } from "@modelcontextprotocol/sdk/client/index.js";
import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";

const transport = new StdioClientTransport({
  command: "npx",
  args: ["-y", "acf-mcp"],
});
const client = new Client({ name: "demo", version: "1.0" }, {});
await client.connect(transport);

const result = await client.callTool({
  name: "acf.map-ai-act-obligations",
  arguments: {
    annex: "iii",
    use_case:
      "Automated CV screening agent that ranks candidates for a software-engineering role. Outputs a shortlist that recruiters use as a starting point.",
    provider_or_deployer: "deployer",
    gpai_used: true,
    locale: "en",
  },
});

console.log(JSON.stringify(result.content, null, 2));

Réponse

response.jsonjson
{
  "obligations": {
    "pre_go_live": [
      {
        "article": "art-9",
        "title": "Risk management system",
        "requirement": "Establish, implement, document, maintain a risk management system across the lifecycle.",
        "deadline": "2027-12-02",
        "fiches": [
          "ACF-03",
          "ACF-P6",
          "ACF-12"
        ],
        "operational_actions": [
          "Stand up risk register",
          "Define risk methodology",
          "Review quarterly"
        ],
        "evidence_required": [
          "Risk register",
          "Methodology doc"
        ],
        "digital_omnibus_deferred": true
      },
      {
        "article": "art-10",
        "title": "Data and data governance",
        "requirement": "Training/validation/testing data sets governance + quality requirements.",
        "deadline": "2027-12-02",
        "fiches": [
          "ACF-03",
          "ACF-P6",
          "ACF-12"
        ],
        "operational_actions": [
          "Document data sources",
          "Run bias evaluation",
          "Document data drift monitoring"
        ],
        "evidence_required": [
          "Data inventory",
          "Bias evaluation report"
        ],
        "digital_omnibus_deferred": true
      },
      {
        "article": "art-11",
        "title": "Technical documentation",
        "requirement": "Maintain technical documentation per Annex IV.",
        "deadline": "2027-12-02",
        "fiches": [
          "ACF-03",
          "ACF-P6",
          "ACF-12"
        ],
        "operational_actions": [
          "Author Annex IV-aligned tech doc"
        ],
        "evidence_required": [
          "Technical documentation"
        ],
        "digital_omnibus_deferred": true
      },
      {
        "article": "art-13",
        "title": "Transparency to deployers",
        "requirement": "Provide instructions for use that allow the deployer to interpret outputs.",
        "deadline": "2027-12-02",
        "fiches": [
          "ACF-03",
          "ACF-P6",
          "ACF-12"
        ],
        "operational_actions": [
          "Draft instructions for use",
          "Translate to operating languages"
        ],
        "evidence_required": [
          "Instructions for use"
        ],
        "digital_omnibus_deferred": true
      },
      {
        "article": "art-50",
        "title": "Transparency on AI/GPAI",
        "requirement": "Disclose AI usage to natural persons interacting with the system.",
        "deadline": "2026-08-02",
        "fiches": [],
        "operational_actions": [
          "Add disclosure on every user surface"
        ],
        "evidence_required": [
          "Disclosure copy"
        ],
        "digital_omnibus_deferred": false
      },
      {
        "article": "art-50",
        "title": "Transparency on AI/GPAI",
        "requirement": "Transparency obligations on AI systems intended to interact with natural persons (clear notice that the user is interacting with an AI system, unless obvious from context).",
        "deadline": "2026-08-02",
        "fiches": [],
        "operational_actions": [
          "Add disclosure on every user surface"
        ],
        "evidence_required": [
          "Disclosure copy"
        ],
        "digital_omnibus_deferred": false
      }
    ],
    "continuous": [
      {
        "article": "art-12",
        "title": "Record-keeping",
        "requirement": "Automated logs over the lifecycle of the system.",
        "deadline": "2027-12-02",
        "fiches": [
          "ACF-03",
          "ACF-P6",
          "ACF-12"
        ],
        "operational_actions": [
          "Wire structured logging",
          "Define retention policy"
        ],
        "evidence_required": [
          "Logs"
        ],
        "digital_omnibus_deferred": true
      },
      {
        "article": "art-14",
        "title": "Human oversight",
        "requirement": "Effective human oversight design + operation.",
        "deadline": "2027-12-02",
        "fiches": [
          "ACF-03",
          "ACF-P6",
          "ACF-12"
        ],
        "operational_actions": [
          "Design kill switch (ACF-07)",
          "Document escalation thresholds (ACF-P6)"
        ],
        "evidence_required": [
          "Kill switch design",
          "Drill reports"
        ],
        "digital_omnibus_deferred": true
      },
      {
        "article": "art-26",
        "title": "Deployer obligations",
        "requirement": "Instructions, monitoring, fundamental rights impact assessment.",
        "deadline": "2027-12-02",
        "fiches": [],
        "operational_actions": [
          "Run fundamental rights IA",
          "Document monitoring plan"
        ],
        "evidence_required": [
          "FRIA report",
          "Monitoring plan"
        ],
        "digital_omnibus_deferred": true
      },
      {
        "article": "art-27",
        "title": "Fundamental rights impact assessment",
        "requirement": "Mandatory FRIA for high-risk deployers in some sectors.",
        "deadline": "2027-12-02",
        "fiches": [],
        "operational_actions": [
          "Author FRIA"
        ],
        "evidence_required": [
          "FRIA"
        ],
        "digital_omnibus_deferred": true
      },
      {
        "article": "art-51",
        "title": "GPAI obligation",
        "requirement": "Classification of GPAI models and identification of systemic-risk models.",
        "deadline": "2026-08-02",
        "fiches": [],
        "operational_actions": [],
        "evidence_required": [],
        "digital_omnibus_deferred": false
      },
      {
        "article": "art-53",
        "title": "GPAI obligation",
        "requirement": "Technical documentation, training data summary, copyright policy, instructions for downstream providers.",
        "deadline": "2026-08-02",
        "fiches": [],
        "operational_actions": [],
        "evidence_required": [],
        "digital_omnibus_deferred": false
      },
      {
        "article": "art-54",
        "title": "GPAI obligation",
        "requirement": "Authorised representative requirement for non-EU GPAI providers placing models on the EU market.",
        "deadline": "2026-08-02",
        "fiches": [],
        "operational_actions": [],
        "evidence_required": [],
        "digital_omnibus_deferred": false
      }
    ],
    "on_incident": [
      {
        "article": "art-15",
        "title": "Accuracy, robustness, cybersecurity",
        "requirement": "Maintain accuracy, robustness, cybersecurity levels appropriate to the use.",
        "deadline": "continuous",
        "fiches": [
          "ACF-03",
          "ACF-P6",
          "ACF-12"
        ],
        "operational_actions": [
          "Define accuracy KPIs",
          "Run robustness tests",
          "Define cybersecurity controls"
        ],
        "evidence_required": [
          "KPI dashboards",
          "Pen test reports"
        ],
        "digital_omnibus_deferred": false
      }
    ]
  },
  "total_count": 14,
  "critical_path": [
    "art-50: Transparency on AI/GPAI",
    "art-50: Transparency on AI/GPAI"
  ],
  "confidence": "medium",
  "assumptions": [],
  "gaps_to_validate": [
    "Confirm provider_or_deployer qualification: it changes the obligation set.",
    "Confirm GPAI usage: Article 50 transparency obligation depends on it."
  ],
  "requires_human_review": true,
  "rationale_per_rule": [
    {
      "rule_id": "ai-act-annex-iii.annex-iii-1a-biometric-identity",
      "rule_version": "2026-06",
      "fired": false,
      "evidence": ""
    },
    {
      "rule_id": "ai-act-annex-iii.annex-iii-2-critical-infrastructure",
      "rule_version": "2026-06",
      "fired": false,
      "evidence": ""
    },
    {
      "rule_id": "ai-act-annex-iii.annex-iii-3-educational",
      "rule_version": "2026-06",
      "fired": false,
      "evidence": ""
    },
    {
      "rule_id": "ai-act-annex-iii.annex-iii-4-employment",
      "rule_version": "2026-06",
      "fired": true,
      "evidence": "keyword:cv screening"
    },
    {
      "rule_id": "ai-act-annex-iii.annex-iii-5b-credit-scoring",
      "rule_version": "2026-06",
      "fired": false,
      "evidence": ""
    },
    {
      "rule_id": "ai-act-annex-iii.annex-iii-5c-insurance-pricing",
      "rule_version": "2026-06",
      "fired": false,
      "evidence": ""
    },
    {
      "rule_id": "ai-act-annex-iii.annex-iii-6-law-enforcement",
      "rule_version": "2026-06",
      "fired": false,
      "evidence": ""
    },
    {
      "rule_id": "ai-act-annex-iii.annex-iii-7-migration-asylum",
      "rule_version": "2026-06",
      "fired": false,
      "evidence": ""
    },
    {
      "rule_id": "ai-act-annex-iii.annex-iii-8-justice-democracy",
      "rule_version": "2026-06",
      "fired": false,
      "evidence": ""
    },
    {
      "rule_id": "ai-act-annex-i.annex-i-medical-device",
      "rule_version": "2026-06",
      "fired": false,
      "evidence": ""
    },
    {
      "rule_id": "ai-act-annex-i.annex-i-vehicle-safety",
      "rule_version": "2026-06",
      "fired": false,
      "evidence": ""
    },
    {
      "rule_id": "ai-act-annex-i.annex-i-machinery",
      "rule_version": "2026-06",
      "fired": false,
      "evidence": ""
    },
    {
      "rule_id": "gpai-triggers",
      "rule_version": "2026-06",
      "fired": true,
      "evidence": "enum:gpai_used=true"
    }
  ],
  "doctrine_version": "ACF framework v1.0 / rules 2026-06",
  "doctrine_hash": "sha256:119819463363cde0649504ab8ed5a96982fdb8506441f2c5e76e7e3c3feb77f1",
  "doctrine_signature": "ed25519:3R0oIiqL3Kgd…",
  "doctrine_archive_url": "https://acfstandard.io/archive/doctrine/v1.0/doctrine-v1.0.json",
  "regulatory_snapshot": "EU AI Act (Reg. 2024/1689, incl. Digital Omnibus deferral) + GDPR (Reg. 2016/679) + DORA (Reg. 2022/2554) + NIS2 (Dir. 2022/2555) + ISO 42001:2023: as of 2026-06-07",
  "generated_at": "2026-11-01T12:06:31.068Z",
  "disclaimer": "Preliminary qualification produced by the ACF® deterministic engine. Not legal advice. Human review required. Do not use for autonomous regulatory decision-making. See doctrine_archive_url for the version of the doctrine used."
}

Erreurs courantes

  • Paramètres invalides : annex hors de iii, i ou none (en minuscules), ou provider_or_deployer hors énumération. L’appel échoue avec une erreur JSON-RPC dont le message liste les champs en cause.
  • Confiance basse : quand peu de champs de contexte sont fournis, confidence vaut low et assumptions dit ce qui a été supposé. Complétez l’entrée avant de vous appuyer sur le résultat.
  • acf.classify-agent: obtenir la qualification annex + provider_or_deployer avant d’appeler cet outil.
  • acf.assign-ddao-controls: traduire les obligations en contrôles DDAO concrets avec budget et effort estimé.
  • acf.regulation.article: récupérer le texte vérifié d’un article AI Act spécifique cité dans la cartographie.