EU AI Act — Regulation (EU) 2024/1689

EU AI Act — Regulation (EU) 2024/1689 — 84% of in-scope requirements covered.

139 requirements · 131 in scope (97 enforced · 19 designed · 15 advisory) · 8 out-of-scope (outside KYE™’s authority layer). The 84% is weighted over the in-scope base.

EU AI Act: requirement → the KYE™ artefact that enforces it

Demo data

You learn: Which requirements KYE™ enforces at runtime and with which artefact. You can: Walk the requirements.

Annex3 · enforced

High-risk AI systems enumerated in Annex III (biometrics, critical infrastructure, education, employment…
Audit events: kye.model.capability_profile.v1, kye.purpose.permission.v1, kye.purpose.admissibility.v1 · Constitution: 12 purpose permission
2 · enforced

Training, validation and testing data sets shall be subject to data-governance practices
Audit events: kye.evidence.model_params.v1, kye.model.influence_envelope.v1 · Constitution: 14 agents and engines
5 · enforced

Processing of special-category personal data for bias detection and correction (lawful-basis exception)
Audit events: kye.purpose.grant.v1, kye.purpose.admissibility.v1, kye.evidence.decision_map.v1 · Constitution: 12 purpose permission
1 · enforced

Draw up technical documentation of the high-risk AI system before placing on market (Annex IV)
Audit events: kye.model.capability_profile.v1, kye.model.influence_envelope.v1, kye.evidence.pack.v1 · Constitution: 21 delegated auditability
2 · enforced

Keep technical documentation up to date throughout the AI system lifecycle
Audit events: kye.signal.drift.detected.v1, kye.resilience.improvement_record.v1, kye.compliance.attestation.v1 · Constitution: 13 resilience loop
1 · enforced

Automatic recording of events (logs) over the lifetime of the high-risk AI system
Audit events: kye.evidence.decision_map.v1, kye.evidence.observed_action.v1, kye.audit.event.v1 · Constitution: 21 delegated auditability, 35 streaming logs

How this widget is built

Demonstrates

KYE™ Compliance Mapping Rail™

Components

Framework requirement (clause)
Coverage status
KYE™ enforcement artefact (event, decision-record field, Evidence Pack™ entry)

Flow

Clause → status → the KYE™ artefact that enforces it, enforced requirements first. Architecture diagram

Used on

/compliance/eu-ai-act/: On every framework page, after its opening.

Source: https://eur-lex.europa.eu/eli/reg/2024/1689/oj · License: EU Open Data — public domain

By category

Category	Reqs	Enforced	Designed	Advisory	Coverage
Annex III — High-risk use-case classes	1	1	0	0	100%
Art 10 — Data and data governance	6	5	0	1	88%
Art 11-12 — Technical documentation & record-keeping	4	4	0	0	100%
Art 13 — Transparency to deployers	9	7	2	0	89%
Art 14 — Human oversight	10	9	1	0	95%
Art 15 — Accuracy, robustness & cybersecurity	5	5	0	0	100%
Art 16-29 — Provider/deployer obligations	3	3	0	0	100%
Art 50-52 — Transparency to natural persons	2	1	0	1	63%
Art 6 — High-risk classification	4	4	0	0	100%
Art 72 — Post-market monitoring & incidents	1	1	0	0	100%
Art 9 — Risk management system	9	9	0	0	100%
Art 86 — Right to explanation	2	2	0	0	100%
Title I — General provisions	6	3	1	2	67%
Art 5 — Prohibited practices	8	8	0	0	100%
Art 12 — Record-keeping	1	1	0	0	100%
Art 16 — Provider obligations	9	5	3	1	75%
Art 17 — Quality management system	1	0	1	0	50%
Art 18 — Documentation keeping	1	1	0	0	100%
Art 19 — Automatically generated logs	1	1	0	0	100%
Art 20 — Corrective actions	1	1	0	0	100%
Art 21 — Cooperation with competent authorities	1	1	0	0	100%
Art 22 — Authorised representatives	1	0	0	1	25%
Art 23 — Importer obligations	1	0	0	1	25%
Art 24 — Distributor obligations	1	0	0	1	25%
Art 25 — Provider responsibility along value chain	1	0	0	1	25%
Art 26 — Deployer obligations	7	4	2	1	75%
Art 27 — Fundamental-rights impact assessment	2	0	1	1	38%
Art 28 — Notifying authorities	1	0	0	0	0%
Art 29 — Application for notification	1	0	0	0	0%
Art 43 — Conformity assessment	1	1	0	0	100%
Art 44 — Certificates	1	0	0	0	0%
Art 47 — EU declaration of conformity	1	0	1	0	50%
Art 48 — CE marking	1	0	0	1	25%
Art 49 — Registration in EU database	1	0	1	0	50%
Art 50 — Transparency obligations	2	1	1	0	75%
Art 51 — GPAI with systemic risk	1	1	0	0	100%
Art 52 — GPAI notification	1	0	1	0	50%
Art 53 — GPAI provider obligations	4	3	1	0	88%
Art 55 — GPAI systemic-risk obligations	4	4	0	0	100%
Art 56 — Codes of practice	1	0	0	0	0%
Art 60 — Real-world testing	1	1	0	0	100%
Art 72 — Post-market monitoring	1	1	0	0	100%
Art 73 — Serious incident reporting	3	3	0	0	100%
Art 74 — Market surveillance	1	1	0	0	100%
Art 85 — Right to lodge complaint	1	0	0	0	0%
Art 99 — Penalties	1	0	0	0	0%
Art 113 — Entry into force	1	0	0	1	25%
Annex I — Union harmonisation legislation	1	0	0	1	25%
Annex II — Law-enforcement offences list	1	0	0	0	0%
Annex IV — Technical documentation	1	1	0	0	100%
Annex V — EU declaration of conformity	1	0	1	0	50%
Annex VI — Internal-control conformity assessment	1	1	0	0	100%
Annex VII — Notified-body conformity assessment	1	0	0	1	25%
Annex VIII — EU database registration	1	0	1	0	50%
Annex IX — Annex III registration	1	0	1	0	50%
Annex X — JHA large-scale IT systems	1	0	0	0	0%
Annex XI — GPAI technical documentation	1	1	0	0	100%
Annex XII — Downstream-integrator information	1	1	0	0	100%
Annex XIII — GPAI systemic-risk criteria	1	1	0	0	100%

Every requirement → the KYE™ artefact that enforces it

ID	Title	Status	KYE™ enforcement
`eu-ai-act.Annex3`	High-risk AI systems enumerated in Annex III (biometrics, critical infrastructure, education, employment, essential services, law enforcement, migration, justice, democratic processes)	enforced	audit_events: `kye.model.capability_profile.v1`, `kye.purpose.permission.v1`, `kye.purpose.admissibility.v1` engines: `internal`, `internal` constitution_refs: `constitution/12-PURPOSE-PERMISSION.md`
`eu-ai-act.A10.2`	Training, validation and testing data sets shall be subject to data-governance practices	enforced	audit_events: `kye.evidence.model_params.v1`, `kye.model.influence_envelope.v1` engines: `internal` constitution_refs: `constitution/14-AGENTS-AND-ENGINES.md`
`eu-ai-act.A10.3`	Data sets shall be relevant, sufficiently representative, free of errors and complete	advisory	constitution_refs: `constitution/14-AGENTS-AND-ENGINES.md`
`eu-ai-act.A10.5`	Processing of special-category personal data for bias detection and correction (lawful-basis exception)	enforced	audit_events: `kye.purpose.grant.v1`, `kye.purpose.admissibility.v1`, `kye.evidence.decision_map.v1` engines: `internal` constitution_refs: `constitution/12-PURPOSE-PERMISSION.md`
`eu-ai-act.A11.1`	Draw up technical documentation of the high-risk AI system before placing on market (Annex IV)	enforced	audit_events: `kye.model.capability_profile.v1`, `kye.model.influence_envelope.v1`, `kye.evidence.pack.v1` engines: `internal` constitution_refs: `constitution/21-DELEGATED-AUDITABILITY.md`
`eu-ai-act.A11.2`	Keep technical documentation up to date throughout the AI system lifecycle	enforced	audit_events: `kye.signal.drift.detected.v1`, `kye.resilience.improvement_record.v1`, `kye.compliance.attestation.v1` engines: `internal` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`eu-ai-act.A12.1`	Automatic recording of events (logs) over the lifetime of the high-risk AI system	enforced	audit_events: `kye.evidence.decision_map.v1`, `kye.evidence.observed_action.v1`, `kye.audit.event.v1` engines: `internal`, `internal` constitution_refs: `constitution/21-DELEGATED-AUDITABILITY.md`, `constitution/35-STREAMING-LOGS.md`
`eu-ai-act.A12.3`	Logging shall enable monitoring of operation with respect to risks identified under Art 9	enforced	audit_events: `kye.evidence.decision_map.v1`, `kye.risk.score.v1`, `kye.signal.evidence.sealed.v1` engines: `internal`, `internal` worm_tables: `decisions`, `evidence_pack` constitution_refs: `constitution/30-AUDIT-WORM-RETENTION.md`
`eu-ai-act.A13.1`	Design and develop high-risk AI systems to ensure sufficient transparency to deployers	enforced	audit_events: `kye.model.capability_profile.v1`, `kye.model.influence_envelope.v1`, `kye.assurance.adoption_stage.v1` engines: `internal` constitution_refs: `constitution/14-AGENTS-AND-ENGINES.md`, `constitution/36-GOVERNEDUI.md`
`eu-ai-act.A13.3.a`	Instructions for use shall identify provider, intended purpose, performance, known limitations	enforced	audit_events: `kye.model.capability_profile.v1`, `kye.purpose.permission.v1` engines: `internal` constitution_refs: `constitution/12-PURPOSE-PERMISSION.md`
`eu-ai-act.A13.3.d`	Instructions for use shall include human-oversight measures, including the technical measures put in place	enforced	audit_events: `kye.assurance.adoption_stage.v1`, `kye.governedui.evidence_timeline.v1` engines: `internal` governedui_modules: `kye.governedui.module.authority_scope.v1`, `kye.governedui.module.evidence_timeline.v1` constitution_refs: `constitution/36-GOVERNEDUI.md`
`eu-ai-act.A14.1`	High-risk AI systems shall be designed to be effectively overseen by natural persons	enforced	audit_events: `kye.assurance.adoption_stage.v1`, `kye.purpose.grant.v1` engines: `internal`, `internal` governedui_modules: `kye.governedui.module.action_approval.v1`, `kye.governedui.module.approval_queue.v1` constitution_refs: `constitution/36-GOVERNEDUI.md`
`eu-ai-act.A14.4.a`	Oversight persons can properly understand the relevant capacities and limitations of the system	designed	audit_events: `kye.model.capability_profile.v1`, `kye.governedui.evidence_timeline.v1` governedui_modules: `kye.governedui.module.entity_passport.v1`, `kye.governedui.module.evidence_timeline.v1` constitution_refs: `constitution/36-GOVERNEDUI.md`
`eu-ai-act.A14.4.d`	Oversight persons can intervene on the operation or interrupt the system through a stop button	enforced 1 unverified citation	audit_events: `kye.purpose.grant.revoked.v1` unverified citation, `kye.assurance.adoption_stage.v1` engines: `internal`, `internal` constitution_refs: `constitution/12-PURPOSE-PERMISSION.md`
`eu-ai-act.A14.5`	For Annex III §1(a) biometric-identification systems, no action shall be taken on the basis of identification unless verified and confirmed by at least two natural persons	enforced	audit_events: `kye.purpose.admissibility.v1`, `kye.evidence.decision_map.v1` engines: `internal`, `internal` constitution_refs: `constitution/36-GOVERNEDUI.md`
`eu-ai-act.A14.2`	Human oversight shall aim to prevent or minimise risks to health, safety or fundamental rights for the period the system is in use	enforced 3 unverified citations	audit_events: `kye.oversight.envelope_set.v1` unverified citation, `kye.oversight.envelope_breach.v1` unverified citation, `kye.oversight.drift_alert.v1` unverified citation, `kye.purpose.admissibility.v1` engines: `internal`, `internal` governedui_modules: `kye.governedui.module.oversight_envelope.v1`, `kye.governedui.module.authority_drift.v1` constitution_refs: `constitution/36-GOVERNEDUI.md`, `constitution/13-RESILIENCE-LOOP.md`
`eu-ai-act.A14.4.b`	Oversight persons remain aware of the possible tendency of automatically relying or over-relying on the output (automation bias)	enforced 2 unverified citations	audit_events: `kye.oversight.drift_alert.v1` unverified citation, `kye.resilience.drift.detected.v1` unverified citation governedui_modules: `kye.governedui.module.oversight_envelope.v1`, `kye.governedui.module.authority_drift.v1` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`, `constitution/36-GOVERNEDUI.md`, `constitution/39-LEARN-RAIL.md`
`eu-ai-act.A15.1`	Achieve an appropriate level of accuracy, robustness, and cybersecurity throughout the lifecycle	enforced	audit_events: `kye.evidence.trace_replay_spec.v1`, `kye.compliance.attestation.v1`, `kye.signal.stress_test.high_risk_detected.v1` engines: `internal` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`eu-ai-act.A15.3`	Levels of accuracy and relevant accuracy metrics declared in the instructions for use	enforced	audit_events: `kye.model.capability_profile.v1` engines: `internal` constitution_refs: `constitution/14-AGENTS-AND-ENGINES.md`
`eu-ai-act.A15.4`	Resilience against errors, faults or inconsistencies and against feedback loops (concept drift)	enforced	audit_events: `kye.resilience.drift_event.v1`, `kye.signal.drift.detected.v1`, `kye.signal.stable_drift.detected.v1` engines: `internal` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`eu-ai-act.A15.5`	Cybersecurity measures against attempts by unauthorised third parties to alter use, behaviour or performance	enforced	audit_events: `kye.purpose.admissibility.v1`, `kye.agent.refusal.v1`, `kye.evidence.tool_call_pin.v1` engines: `internal`, `internal` constitution_refs: `constitution/52-DELEGATED-AGENT-BINDING.md`
`eu-ai-act.A17`	Provider shall put in place a quality management system documented in written policies, procedures and instructions	enforced	audit_events: `kye.compliance.attestation.v1`, `kye.risk.authority_register.v1` engines: `internal` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`, `constitution/40-IMPLEMENTATION-CANONICAL.md`
`eu-ai-act.A26.1`	Deployer shall use the high-risk AI system in accordance with instructions for use	enforced	audit_events: `kye.purpose.admissibility.v1`, `kye.purpose.grant.v1`, `kye.agent.refusal.v1` engines: `internal` constitution_refs: `constitution/12-PURPOSE-PERMISSION.md`
`eu-ai-act.A27`	Deployers that are bodies governed by public law shall perform a fundamental-rights impact assessment	enforced	audit_events: `kye.assurance.audit_pilot.v1`, `kye.risk.score.v1` engines: `internal` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`eu-ai-act.A50.1`	Providers shall ensure AI systems intended to interact directly with natural persons are designed so persons are informed they are interacting with an AI	enforced	audit_events: `kye.model.capability_profile.v1`, `kye.evidence.observed_action.v1` engines: `internal` constitution_refs: `constitution/14-AGENTS-AND-ENGINES.md`
`eu-ai-act.A50.2`	Providers of generative AI shall mark outputs as artificially generated or manipulated in a machine-readable format	advisory	audit_events: `kye.evidence.observed_action.v1`, `kye.evidence.tool_call_pin.v1` engines: `internal` constitution_refs: `constitution/14-AGENTS-AND-ENGINES.md`
`eu-ai-act.A6.1`	Classification of AI systems as high-risk per Annex I safety-component criteria	enforced	audit_events: `kye.model.capability_profile.v1`, `kye.evidence.decision_map.v1`, `kye.compliance.attestation.v1` engines: `internal`, `internal` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`, `constitution/14-AGENTS-AND-ENGINES.md`
`eu-ai-act.A6.2`	Classification of AI systems as high-risk per Annex III enumerated use-cases	enforced	audit_events: `kye.model.capability_profile.v1`, `kye.purpose.admissibility.v1` engines: `internal`, `internal` constitution_refs: `constitution/12-PURPOSE-PERMISSION.md`
`eu-ai-act.A72.1`	Providers shall establish a post-market monitoring system and report serious incidents to national authorities	enforced	audit_events: `kye.signal.stress_test.high_risk_detected.v1`, `kye.resilience.drift_event.v1`, `kye.evidence.pack.v1`, `kye.compliance.attestation.v1` engines: `internal`, `internal` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`, `constitution/21-DELEGATED-AUDITABILITY.md`
`eu-ai-act.A9.1`	Establish, implement, document and maintain a risk-management system across the AI lifecycle	enforced	audit_events: `kye.risk.score.v1`, `kye.risk.authority_register.v1`, `kye.compliance.attestation.v1` engines: `internal` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`eu-ai-act.A9.2`	Identify and analyse known and reasonably foreseeable risks to health, safety and fundamental rights	enforced	audit_events: `kye.risk.score.v1`, `kye.model.capability_profile.v1`, `kye.evidence.decision_map.v1` engines: `internal`, `internal` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`eu-ai-act.A9.5`	Adopt appropriate and targeted risk-management measures to eliminate or reduce identified risks	enforced	audit_events: `kye.purpose.admissibility.v1`, `kye.purpose.grant.v1`, `kye.evidence.decision_map.v1` engines: `internal`, `internal` constitution_refs: `constitution/12-PURPOSE-PERMISSION.md`
`eu-ai-act.A9.8`	Test the AI system for purposes of identifying the most appropriate risk-management measures	enforced	audit_events: `kye.evidence.trace_replay_spec.v1`, `kye.assurance.audit_replay_report.v1` engines: `internal`, `internal` constitution_refs: `constitution/21-DELEGATED-AUDITABILITY.md`
`eu-ai-act.A13.RATIONALE`	Transparency to deployers — the governance decision is rendered in a structured, human-readable rationale a deployer can inspect and pass on	enforced	audit_events: `kye.decision_rationale.v1`, `kye.evidence.pack.v1`, `kye.evidence.decision_map.v1` engines: `internal`, `internal` constitution_refs: `constitution/21-DELEGATED-AUDITABILITY.md`, `constitution/12-PURPOSE-PERMISSION.md`
`eu-ai-act.A14.RATIONALE`	Human oversight — the rationale records the natural-person intervention (approve / reject / modify / interrupt) and the oversight mode in force	enforced	audit_events: `kye.decision_rationale.v1`, `kye.evidence.pack.v1` engines: `internal`, `internal` governedui_modules: `kye.governedui.module.action_approval.v1`, `kye.governedui.module.evidence_timeline.v1` constitution_refs: `constitution/21-DELEGATED-AUDITABILITY.md`, `constitution/36-GOVERNEDUI.md`
`eu-ai-act.A86.RATIONALE`	Right to explanation — an affected person receives a clear, meaningful, contestable account of why the decision was reached and how to contest it	enforced	audit_events: `kye.decision_rationale.v1`, `kye.dispute.v1`, `kye.evidence.decision_map.v1` engines: `internal` constitution_refs: `constitution/21-DELEGATED-AUDITABILITY.md`
`eu-ai-act.A1`	Subject matter — harmonised rules for placing on market, putting into service and use of AI systems in the Union	advisory	constitution_refs: `constitution/25-EDGE-GOVERNANCE.md`
`eu-ai-act.A2.1`	Scope — applies to providers, deployers, importers, distributors, product manufacturers and affected persons in the Union	enforced	audit_events: `kye.jurisdiction.attestation.v1` engines: `internal` constitution_refs: `constitution/25-EDGE-GOVERNANCE.md`
`eu-ai-act.A2.3`	Exclusions — military, defence, national security, scientific research and personal non-professional activity	advisory	constitution_refs: `constitution/26-COMMERCIAL.md`
`eu-ai-act.A3.1`	Definition — 'AI system' means a machine-based system designed to operate with varying levels of autonomy, that may exhibit adaptiveness after deployment, and that infers from input how to generate outputs	enforced	audit_events: `kye.entity.model.v1`, `kye.model.capability_profile.v1` engines: `internal` constitution_refs: `constitution/14-AGENTS-AND-ENGINES.md`
`eu-ai-act.A3.63`	Definition — 'general-purpose AI model' means an AI model trained on a large amount of data using self-supervision at scale, displaying significant generality	enforced	audit_events: `kye.model.capability_profile.v1`, `kye.model.influence_envelope.v1` engines: `internal` constitution_refs: `constitution/14-AGENTS-AND-ENGINES.md`
`eu-ai-act.A4`	AI literacy — providers and deployers must take measures to ensure a sufficient level of AI literacy of their staff and other persons dealing with the system on their behalf	designed	constitution_refs: `constitution/39-LEARN-RAIL.md`, `constitution/10-PARTNER.md`
`eu-ai-act.A5.1.a`	Prohibited practice — subliminal techniques beyond a person's consciousness or purposefully manipulative techniques materially distorting behaviour	enforced	audit_events: `kye.purpose.admissibility.v1`, `kye.evidence.decision_map.v1` engines: `internal`, `internal` rule_packs: `kye:rule-pack:eu-ai-act` constitution_refs: `constitution/12-PURPOSE-PERMISSION.md`
`eu-ai-act.A5.1.b`	Prohibited practice — exploitation of vulnerabilities due to age, disability or social/economic situation	enforced	audit_events: `kye.purpose.admissibility.v1` engines: `internal` constitution_refs: `constitution/12-PURPOSE-PERMISSION.md`
`eu-ai-act.A5.1.c`	Prohibited practice — social scoring leading to detrimental treatment outside the original collection context	enforced	audit_events: `kye.purpose.admissibility.v1`, `kye.data_use_manifest.v1` engines: `internal`, `internal` constitution_refs: `constitution/31-DATA-GOVERNANCE-PACK.md`
`eu-ai-act.A5.1.d`	Prohibited practice — risk assessment of natural persons solely on profiling or personality-trait assessment for predicting criminal offences	enforced	audit_events: `kye.purpose.admissibility.v1` engines: `internal` constitution_refs: `constitution/12-PURPOSE-PERMISSION.md`
`eu-ai-act.A5.1.e`	Prohibited practice — untargeted scraping of facial images for facial-recognition databases	enforced	audit_events: `kye.data_use_manifest.v1`, `kye.purpose.admissibility.v1` engines: `internal`, `internal` constitution_refs: `constitution/31-DATA-GOVERNANCE-PACK.md`
`eu-ai-act.A5.1.f`	Prohibited practice — emotion recognition in workplace and educational institutions (except for medical or safety reasons)	enforced	audit_events: `kye.purpose.admissibility.v1` engines: `internal` constitution_refs: `constitution/12-PURPOSE-PERMISSION.md`
`eu-ai-act.A5.1.g`	Prohibited practice — biometric categorisation systems that infer race, political opinions, trade-union membership, religious or philosophical beliefs, sex life or sexual orientation	enforced	audit_events: `kye.purpose.admissibility.v1` engines: `internal` constitution_refs: `constitution/12-PURPOSE-PERMISSION.md`
`eu-ai-act.A5.1.h`	Prohibited practice — real-time remote biometric identification in publicly accessible spaces for law enforcement (with narrow exceptions)	enforced	audit_events: `kye.purpose.admissibility.v1` engines: `internal` constitution_refs: `constitution/12-PURPOSE-PERMISSION.md`
`eu-ai-act.A6.3`	Derogation — Annex III system not considered high-risk if it does not pose a significant risk and meets one of the conditions in 6(3)(a)-(d)	enforced	audit_events: `kye.risk.score.v1`, `kye.compliance.attestation.v1` engines: `internal` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`eu-ai-act.A6.4`	Provider documenting Art 6(3) derogation assessment and registering in the EU database	enforced	audit_events: `kye.evidence.pack.v1`, `kye.compliance.attestation.v1` engines: `internal` constitution_refs: `constitution/21-DELEGATED-AUDITABILITY.md`
`eu-ai-act.A9.3`	Risk-management measures shall give due consideration to the effects on persons under 18 and other vulnerable groups	enforced	audit_events: `kye.risk.score.v1`, `kye.consequence_map.v1` engines: `internal`, `internal` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`eu-ai-act.A9.4`	Risk-management measures shall be such that the relevant residual risk is judged acceptable	enforced	audit_events: `kye.risk.score.v1`, `kye.compliance.attestation.v1` engines: `internal` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`eu-ai-act.A9.6`	High-risk AI systems shall be tested for the purpose of identifying the most appropriate and targeted risk management measures	enforced	audit_events: `kye.evidence.trace_replay_spec.v1`, `kye.scenario_run.v1` engines: `internal`, `internal` constitution_refs: `constitution/21-DELEGATED-AUDITABILITY.md`
`eu-ai-act.A9.7`	Testing of high-risk AI systems shall be performed against prior defined metrics and probabilistic thresholds appropriate to intended purpose	enforced	audit_events: `kye.scenario.v1`, `kye.assurance.audit_replay_report.v1` engines: `internal` constitution_refs: `constitution/21-DELEGATED-AUDITABILITY.md`
`eu-ai-act.A9.9`	Risk-management process for high-risk systems intended for credit institutions covered by Union financial-services law shall be integrated with the institution's existing risk management	enforced	audit_events: `kye.connector.evidence_import.v1`, `kye.compliance.attestation.v1` engines: `internal` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`eu-ai-act.A10.1`	High-risk AI systems using techniques involving training of models with data shall be developed on the basis of training, validation and testing data sets that meet quality criteria	enforced	audit_events: `kye.data_use_manifest.v1`, `kye.evidence.model_params.v1` engines: `internal` constitution_refs: `constitution/31-DATA-GOVERNANCE-PACK.md`
`eu-ai-act.A10.4`	Data sets shall, to the extent required by the intended purpose, take into account the characteristics or elements particular to the specific geographical, contextual, behavioural or functional setting	enforced	audit_events: `kye.data_use_manifest.v1`, `kye.jurisdiction.attestation.v1` engines: `internal`, `internal` constitution_refs: `constitution/31-DATA-GOVERNANCE-PACK.md`
`eu-ai-act.A10.6`	Special categories of personal data may be processed for bias detection where strictly necessary, with safeguards	enforced	audit_events: `kye.purpose.admissibility.v1`, `kye.data_use_manifest.v1` engines: `internal`, `internal` constitution_refs: `constitution/12-PURPOSE-PERMISSION.md`, `constitution/31-DATA-GOVERNANCE-PACK.md`
`eu-ai-act.A12.2`	Logs shall enable monitoring of the operation of the high-risk AI system with regard to the occurrence of situations that may result in the system presenting a risk	enforced	audit_events: `kye.signal.drift.detected.v1`, `kye.evidence.pack.v1` engines: `internal`, `internal` constitution_refs: `constitution/35-STREAMING-LOGS.md`, `constitution/30-AUDIT-WORM-RETENTION.md`
`eu-ai-act.A13.2`	High-risk AI systems shall be accompanied by instructions for use in an appropriate digital or other format	designed	audit_events: `kye.compliance.attestation.v1` constitution_refs: `constitution/39-LEARN-RAIL.md`, `constitution/11-CONTENT.md`
`eu-ai-act.A13.3.b`	Instructions for use shall include performance, robustness and cybersecurity characteristics including degradation conditions	enforced	audit_events: `kye.model.capability_profile.v1`, `kye.compliance.attestation.v1` constitution_refs: `constitution/39-LEARN-RAIL.md`
`eu-ai-act.A13.3.c`	Instructions for use shall include any known or foreseeable circumstance leading to risks to health, safety or fundamental rights	enforced	audit_events: `kye.consequence_map.v1`, `kye.risk.score.v1` engines: `internal` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`eu-ai-act.A13.3.e`	Instructions for use shall include human-oversight measures including technical measures to facilitate interpretation of the outputs	enforced	governedui_modules: `kye.governedui.module.action_approval.v1`, `kye.governedui.module.evidence_timeline.v1` constitution_refs: `constitution/36-GOVERNEDUI.md`
`eu-ai-act.A13.3.f`	Instructions for use shall include the expected lifetime of the system and any necessary maintenance/care measures	designed	audit_events: `kye.audit_retention_policy.v1`, `kye.compliance.attestation.v1` constitution_refs: `constitution/30-AUDIT-WORM-RETENTION.md`
`eu-ai-act.A14.3`	Oversight measures shall be commensurate with risks, level of autonomy and context of use	enforced	audit_events: `kye.purpose.permission.v1`, `kye.risk.score.v1` engines: `internal`, `internal` constitution_refs: `constitution/12-PURPOSE-PERMISSION.md`
`eu-ai-act.A14.4.c`	Oversight persons shall be able to correctly interpret the high-risk AI system's output considering tools and methods available	enforced	audit_events: `kye.evidence.decision_map.v1` governedui_modules: `kye.governedui.module.evidence_timeline.v1` constitution_refs: `constitution/36-GOVERNEDUI.md`
`eu-ai-act.A14.4.e`	Oversight persons shall be able to decide, in any particular situation, not to use the high-risk system or to disregard, override or reverse the output	enforced 1 unverified citation	audit_events: `kye.approval_decision.v1`, `kye.purpose.grant.revoked.v1` unverified citation engines: `internal` governedui_modules: `kye.governedui.module.action_approval.v1` constitution_refs: `constitution/36-GOVERNEDUI.md`
`eu-ai-act.A15.2`	Levels of accuracy and the relevant accuracy metrics shall be declared in the accompanying instructions of use	enforced	audit_events: `kye.model.capability_profile.v1` constitution_refs: `constitution/14-AGENTS-AND-ENGINES.md`
`eu-ai-act.A16.a`	Providers shall ensure high-risk AI systems comply with Section 2 requirements	enforced	audit_events: `kye.compliance.attestation.v1` constitution_refs: `constitution/40-IMPLEMENTATION-CANONICAL.md`
`eu-ai-act.A16.b`	Providers shall indicate name, registered trade name and contact address on the system or its packaging/accompanying documentation	enforced	constitution_refs: `constitution/26-COMMERCIAL.md`
`eu-ai-act.A16.c`	Providers shall have a quality-management system in place per Article 17	designed	constitution_refs: `constitution/40-IMPLEMENTATION-CANONICAL.md`
`eu-ai-act.A16.d`	Providers shall keep the technical documentation per Article 11 for 10 years after placing the system on the market	enforced	audit_events: `kye.audit_retention_policy.v1` constitution_refs: `constitution/30-AUDIT-WORM-RETENTION.md`
`eu-ai-act.A16.e`	Providers shall keep the logs automatically generated by their high-risk AI system per Article 19	enforced	audit_events: `kye.audit_chain_entry.v1`, `kye.audit_retention_policy.v1` engines: `internal`, `internal` constitution_refs: `constitution/30-AUDIT-WORM-RETENTION.md`, `constitution/35-STREAMING-LOGS.md`
`eu-ai-act.A16.f`	Providers shall ensure that the high-risk AI system undergoes the relevant conformity-assessment procedure per Article 43	enforced	audit_events: `kye.assurance.tier1_readiness.v1`, `kye.compliance.attestation.v1` constitution_refs: `constitution/21-DELEGATED-AUDITABILITY.md`
`eu-ai-act.A16.g`	Providers shall draw up an EU declaration of conformity per Article 47	designed	audit_events: `kye.compliance.attestation.v1`, `kye.evidence.pack.v1` constitution_refs: `constitution/21-DELEGATED-AUDITABILITY.md`
`eu-ai-act.A16.h`	Providers shall affix the CE marking on the high-risk AI system per Article 48	advisory	constitution_refs: `constitution/26-COMMERCIAL.md`
`eu-ai-act.A16.i`	Providers shall register the system in the EU database per Article 49	designed	audit_events: `kye.evidence.pack.v1` constitution_refs: `constitution/21-DELEGATED-AUDITABILITY.md`
`eu-ai-act.A17.1`	Providers shall put in place a quality management system that ensures compliance with this Regulation	designed	audit_events: `kye.compliance.attestation.v1` constitution_refs: `constitution/40-IMPLEMENTATION-CANONICAL.md`
`eu-ai-act.A18`	Provider shall keep the documentation referred to in Articles 11, 17, 20, 21 and 49 at disposal of the national competent authorities for 10 years	enforced	audit_events: `kye.audit_retention_policy.v1` constitution_refs: `constitution/30-AUDIT-WORM-RETENTION.md`
`eu-ai-act.A19`	Providers shall keep automatically-generated logs for at least 6 months unless a longer period is required by sectoral Union law	enforced	audit_events: `kye.audit_retention_policy.v1`, `kye.audit_chain_entry.v1` engines: `internal` constitution_refs: `constitution/30-AUDIT-WORM-RETENTION.md`
`eu-ai-act.A20`	Providers that consider or have reason to consider that a placed system is not in conformity shall take corrective actions	enforced 1 unverified citation	audit_events: `kye.signal.incident.opened.v1`, `kye.purpose.grant.revoked.v1` unverified citation engines: `internal`, `internal` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`eu-ai-act.A21`	Providers shall, upon reasoned request of a national competent authority, provide all information and documentation necessary to demonstrate conformity	enforced	audit_events: `kye.assurance.audit_pilot.v1`, `kye.evidence.pack.v1` agents: `internal` constitution_refs: `constitution/21-DELEGATED-AUDITABILITY.md`
`eu-ai-act.A22`	Providers established in third countries shall, before making available on the Union market, appoint an authorised representative in the Union	advisory	constitution_refs: `constitution/26-COMMERCIAL.md`
`eu-ai-act.A23`	Importers shall verify provider's conformity-assessment procedure, technical documentation and CE marking before placing the system on the market	advisory	audit_events: `kye.assurance.audit_pilot.v1` constitution_refs: `constitution/21-DELEGATED-AUDITABILITY.md`
`eu-ai-act.A24`	Distributors shall, before making a high-risk AI system available, verify that it bears CE marking, has the EU DoC and instructions for use, and that the provider/importer have complied with Articles 16(b)(c)(d) and 23(3)	advisory	audit_events: `kye.compliance.attestation.v1` constitution_refs: `constitution/26-COMMERCIAL.md`
`eu-ai-act.A25`	Any distributor, importer, deployer or third party that puts a high-risk AI system on market under its own name shall be considered a provider and shall assume provider obligations	advisory	constitution_refs: `constitution/26-COMMERCIAL.md`
`eu-ai-act.A26.2`	Deployers shall assign human oversight to natural persons who have the necessary competence, training, authority and support	enforced	audit_events: `kye.purpose.permission.v1` engines: `internal` governedui_modules: `kye.governedui.module.approval_queue.v1` constitution_refs: `constitution/36-GOVERNEDUI.md`
`eu-ai-act.A26.3`	Deployers shall ensure that input data is relevant and sufficiently representative	enforced	audit_events: `kye.data_use_manifest.v1` engines: `internal` constitution_refs: `constitution/31-DATA-GOVERNANCE-PACK.md`
`eu-ai-act.A26.5`	Deployers shall monitor the operation of the high-risk AI system on the basis of instructions for use and inform the provider of incidents per Article 72	enforced	audit_events: `kye.signal.incident.opened.v1`, `kye.signal.drift.detected.v1` engines: `internal`, `internal` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`eu-ai-act.A26.6`	Deployers shall keep the logs automatically generated for at least 6 months	enforced	audit_events: `kye.audit_retention_policy.v1` constitution_refs: `constitution/30-AUDIT-WORM-RETENTION.md`
`eu-ai-act.A26.7`	Deployers that are employers shall inform workers' representatives and affected workers before putting into service a high-risk AI system in the workplace	designed	audit_events: `kye.comms.dispatched.v1` constitution_refs: `constitution/38-COMMS-RAIL.md`
`eu-ai-act.A26.8`	Deployers shall register themselves in the EU database before using a high-risk AI system listed in Annex III	advisory	constitution_refs: `constitution/26-COMMERCIAL.md`
`eu-ai-act.A26.11`	Deployers shall use the information provided per Article 13 to comply with their data-protection impact assessment obligation under GDPR Article 35	designed	audit_events: `kye.compliance.attestation.v1`, `kye.evidence.pack.v1` constitution_refs: `constitution/31-DATA-GOVERNANCE-PACK.md`
`eu-ai-act.A27.1`	Deployers that are bodies governed by public law, private operators providing public services, or operators deploying Annex III §5(b)/(c) systems shall perform a fundamental-rights impact assessment (FRIA)	advisory	audit_events: `kye.compliance.attestation.v1` constitution_refs: `constitution/40-IMPLEMENTATION-CANONICAL.md`
`eu-ai-act.A27.3`	Once the FRIA is performed, the deployer shall notify the market surveillance authority of its results	designed	audit_events: `kye.comms.dispatched.v1` constitution_refs: `constitution/38-COMMS-RAIL.md`
`eu-ai-act.A28`	Each Member State shall designate or establish at least one notifying authority	out-of-scope	(no enforcement cited)
`eu-ai-act.A29`	Conformity-assessment bodies shall submit an application for notification to the notifying authority	out-of-scope	(no enforcement cited)
`eu-ai-act.A43`	For Annex III high-risk systems other than §1, providers shall follow the conformity-assessment procedure based on internal control (Annex VI)	enforced	audit_events: `kye.assurance.tier1_readiness.v1`, `kye.compliance.attestation.v1` constitution_refs: `constitution/21-DELEGATED-AUDITABILITY.md`
`eu-ai-act.A44`	Certificates issued by notified bodies shall be in a Union official language and shall be valid for the period they indicate, not exceeding 5 years	out-of-scope	(no enforcement cited)
`eu-ai-act.A47`	Provider shall draw up a written, machine-readable EU declaration of conformity for each high-risk AI system	designed	audit_events: `kye.compliance.attestation.v1`, `kye.evidence.pack.v1` constitution_refs: `constitution/43-MACHINE-READABLE-BY-DEFAULT.md`
`eu-ai-act.A48`	CE marking shall be affixed visibly, legibly and indelibly on the high-risk AI system, or where not possible, on its packaging or documentation	advisory	constitution_refs: `constitution/26-COMMERCIAL.md`
`eu-ai-act.A49.1`	Provider shall register itself and each Annex III high-risk system in the EU database before placing on market or putting into service	designed	audit_events: `kye.evidence.pack.v1` constitution_refs: `constitution/21-DELEGATED-AUDITABILITY.md`
`eu-ai-act.A50.3`	Deployers of emotion-recognition or biometric-categorisation systems shall inform natural persons exposed	enforced	audit_events: `kye.consent.acceptance.v1`, `kye.comms.dispatched.v1` constitution_refs: `constitution/38-COMMS-RAIL.md`
`eu-ai-act.A50.4`	Deployers of AI generating or manipulating image, audio or video content (deep fakes) shall disclose that the content has been artificially generated or manipulated	designed	audit_events: `kye.evidence.pack.v1` constitution_refs: `constitution/14-AGENTS-AND-ENGINES.md`
`eu-ai-act.A51`	General-purpose AI model with systemic risk shall be designated based on high-impact capabilities or by Commission decision	enforced	audit_events: `kye.model.capability_profile.v1`, `kye.model.influence_envelope.v1` constitution_refs: `constitution/14-AGENTS-AND-ENGINES.md`
`eu-ai-act.A52`	Provider of a GPAI model meeting the Art 51 condition shall notify the Commission within 2 weeks	designed	audit_events: `kye.comms.dispatched.v1` constitution_refs: `constitution/38-COMMS-RAIL.md`
`eu-ai-act.A53.1.a`	Providers of GPAI models shall draw up and keep up-to-date the technical documentation	enforced	audit_events: `kye.evidence.pack.v1`, `kye.model.capability_profile.v1` engines: `internal` constitution_refs: `constitution/43-MACHINE-READABLE-BY-DEFAULT.md`
`eu-ai-act.A53.1.b`	Providers of GPAI models shall make information available to providers of AI systems that intend to integrate the GPAI	enforced	audit_events: `kye.model.capability_profile.v1` constitution_refs: `constitution/15-MCP-AND-SDK.md`
`eu-ai-act.A53.1.c`	Providers of GPAI models shall put in place a policy to comply with Union law on copyright and related rights	enforced	audit_events: `kye.data_use_manifest.v1` engines: `internal` constitution_refs: `constitution/31-DATA-GOVERNANCE-PACK.md`
`eu-ai-act.A53.1.d`	Providers of GPAI models shall draw up and make publicly available a sufficiently detailed summary about the content used for training	designed	audit_events: `kye.data_use_manifest.v1` constitution_refs: `constitution/31-DATA-GOVERNANCE-PACK.md`
`eu-ai-act.A55.1.a`	Providers of GPAI models with systemic risk shall perform model evaluation including adversarial testing	enforced	audit_events: `kye.scenario_run.v1`, `kye.assurance.audit_replay_report.v1` engines: `internal` constitution_refs: `constitution/21-DELEGATED-AUDITABILITY.md`
`eu-ai-act.A55.1.b`	Providers of GPAI models with systemic risk shall assess and mitigate possible systemic risks	enforced	audit_events: `kye.risk.score.v1`, `kye.consequence_map.v1` engines: `internal`, `internal` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`
`eu-ai-act.A55.1.c`	Providers of GPAI models with systemic risk shall keep track of, document and report serious incidents to the AI Office and national authorities	enforced	audit_events: `kye.signal.incident.opened.v1`, `kye.comms.dispatched.v1` engines: `internal` constitution_refs: `constitution/38-COMMS-RAIL.md`
`eu-ai-act.A55.1.d`	Providers of GPAI models with systemic risk shall ensure an adequate level of cybersecurity protection	enforced	constitution_refs: `constitution/51-NO-SPOF.md`, `constitution/35-STREAMING-LOGS.md`
`eu-ai-act.A56`	AI Office and AI Board shall develop codes of practice for GPAI providers	out-of-scope	(no enforcement cited)
`eu-ai-act.A60`	Real-world testing of high-risk AI systems outside AI regulatory sandboxes shall meet additional conditions	enforced	audit_events: `kye.scenario_run.v1`, `kye.evidence.pack.v1` engines: `internal` constitution_refs: `constitution/21-DELEGATED-AUDITABILITY.md`
`eu-ai-act.A72.2`	Post-market monitoring system shall actively and systematically collect, document and analyse relevant data on the performance of high-risk AI systems	enforced	audit_events: `kye.signal.drift.detected.v1`, `kye.audit_chain_entry.v1` engines: `internal`, `internal` constitution_refs: `constitution/13-RESILIENCE-LOOP.md`, `constitution/35-STREAMING-LOGS.md`
`eu-ai-act.A73.1`	Providers shall report serious incidents to the market surveillance authorities of the Member States within 15 days	enforced	audit_events: `kye.signal.incident.opened.v1`, `kye.comms.dispatched.v1` engines: `internal` constitution_refs: `constitution/38-COMMS-RAIL.md`
`eu-ai-act.A73.2`	Reports of serious incidents resulting in death or serious damage to health shall be made within 10 days	enforced	audit_events: `kye.signal.incident.opened.v1`, `kye.comms.dispatched.v1` engines: `internal` constitution_refs: `constitution/38-COMMS-RAIL.md`
`eu-ai-act.A73.3`	Reports of widespread infringement, breach of fundamental rights, or critical infrastructure disruption shall be made within 2 days	enforced	audit_events: `kye.signal.incident.opened.v1`, `kye.comms.dispatched.v1` engines: `internal` constitution_refs: `constitution/38-COMMS-RAIL.md`
`eu-ai-act.A74`	Market-surveillance authorities shall be given full access to documentation, training/validation/testing data sets and source code where necessary	enforced	audit_events: `kye.assurance.audit_pilot.v1` agents: `internal` constitution_refs: `constitution/21-DELEGATED-AUDITABILITY.md`
`eu-ai-act.A85`	Any natural or legal person having grounds to consider that there has been an infringement may submit complaints to the relevant market-surveillance authority	out-of-scope	(no enforcement cited)
`eu-ai-act.A86`	Affected persons subject to a decision taken on the basis of output from a high-risk AI system that produces legal effects shall have the right to obtain clear and meaningful explanations from the deployer	enforced	audit_events: `kye.evidence.decision_map.v1` engines: `internal` constitution_refs: `constitution/36-GOVERNEDUI.md`
`eu-ai-act.A99`	Penalties — Member States shall lay down rules on penalties for infringement, up to EUR 35M or 7% of global annual turnover for Art 5 breaches	out-of-scope	(no enforcement cited)
`eu-ai-act.A113`	Entry into force and application — staggered: prohibitions Art 5 from 2025-02-02; GPAI Art 53/55 from 2025-08-02; remainder from 2026-08-02; Annex I high-risk products from 2027-08-02	advisory	constitution_refs: `constitution/25-EDGE-GOVERNANCE.md`
`eu-ai-act.AnnexI`	Annex I — List of Union harmonisation legislation under which high-risk AI systems are covered if they are safety components	advisory	constitution_refs: `constitution/26-COMMERCIAL.md`
`eu-ai-act.AnnexII`	Annex II — List of criminal offences for biometric-identification carve-out	out-of-scope	(no enforcement cited)
`eu-ai-act.AnnexIV`	Annex IV — Technical documentation content for high-risk AI systems (9 sections)	enforced	audit_events: `kye.evidence.pack.v1`, `kye.evidence.model_params.v1` engines: `internal` constitution_refs: `constitution/43-MACHINE-READABLE-BY-DEFAULT.md`
`eu-ai-act.AnnexV`	Annex V — EU declaration of conformity content (9 fields)	designed	audit_events: `kye.compliance.attestation.v1` constitution_refs: `constitution/43-MACHINE-READABLE-BY-DEFAULT.md`
`eu-ai-act.AnnexVI`	Annex VI — Conformity-assessment procedure based on internal control (3-step)	enforced	audit_events: `kye.assurance.tier1_readiness.v1`, `kye.assurance.audit_pilot.v1` constitution_refs: `constitution/21-DELEGATED-AUDITABILITY.md`
`eu-ai-act.AnnexVII`	Annex VII — Conformity-assessment procedure based on assessment of QMS and technical documentation by notified body	advisory	audit_events: `kye.evidence.pack.v1` constitution_refs: `constitution/21-DELEGATED-AUDITABILITY.md`
`eu-ai-act.AnnexVIII`	Annex VIII — Information for registration in EU database (provider section + system section)	designed	audit_events: `kye.evidence.pack.v1` constitution_refs: `constitution/43-MACHINE-READABLE-BY-DEFAULT.md`
`eu-ai-act.AnnexIX`	Annex IX — Information to be submitted upon registration of high-risk AI systems referenced in Annex III §1-7 (specific use cases)	designed	audit_events: `kye.evidence.pack.v1` constitution_refs: `constitution/43-MACHINE-READABLE-BY-DEFAULT.md`
`eu-ai-act.AnnexX`	Annex X — Union legislative acts on large-scale IT systems in the area of freedom, security and justice	out-of-scope	(no enforcement cited)
`eu-ai-act.AnnexXI`	Annex XI — Technical documentation for GPAI providers (training + model attributes)	enforced	audit_events: `kye.evidence.pack.v1`, `kye.evidence.model_params.v1`, `kye.model.capability_profile.v1` engines: `internal` constitution_refs: `constitution/43-MACHINE-READABLE-BY-DEFAULT.md`
`eu-ai-act.AnnexXII`	Annex XII — Information for downstream providers integrating a GPAI model	enforced	audit_events: `kye.model.capability_profile.v1`, `kye.model.influence_envelope.v1` constitution_refs: `constitution/15-MCP-AND-SDK.md`
`eu-ai-act.AnnexXIII`	Annex XIII — Criteria for designation of GPAI models with systemic risk	enforced	audit_events: `kye.model.capability_profile.v1`, `kye.model.influence_envelope.v1` constitution_refs: `constitution/14-AGENTS-AND-ENGINES.md`

Canonical KYE™ surfaces referenced on this page: Decision Rationale · KYE Protocol™.

Related

EU AI Act — Article 50 chatbot transparency (Regulation (EU) 2024/1689)EU AI Act — Article 50 chatbot transparency (Regulation (EU) 2024/1689) coverage by KYE Protocol™ — every requirement bijection-mapped to…
EU AI Act (AI governance frameworks)EU AI Act — Annex III High-Risk Insurance coverage by KYE Protocol™ — every requirement bijection-mapped to the KYE™ artefact that enforces…
Framework Coverage (machine-readable)Live machine-readable coverage of every regulatory framework KYE Protocol™ maps to: HAARF, MHRA, FDA TPLC, EU AI Act, NHS DSPT, NIST AI…
Compliance frameworksPer-framework reference: which KYE Protocol™ controls map to which obligation, with framework scope, official source, and the canonical…
NIST 800-53 Rev 5 hub (universal control taxonomy)NIST 800-53 Rev 5 is the universal control taxonomy KYE Protocol™ uses as the hub for every regulatory crosswalk. 20 control families, 25…