V77 Trust
Start free trial

AI compliance crosswalk: EU first

One control catalogue across the EU AI Act, GDPR, DORA, ISO/IEC 42001, and the other AI laws you operate under.

Map a control once and reuse its evidence wherever the frameworks overlap. V77 Trust unifies the EU AI Act (Regulation (EU) 2024/1689), GDPR (Regulation (EU) 2016/679), DORA (Regulation (EU) 2022/2554 for European banks and insurers), EN ISO/IEC 42001:2023, EN ISO/IEC 27001:2022, and NIST AI RMF 1.0 in one shared catalogue of 182 controls, with optional packs for the UK, Colorado, New York City, Texas and South Korea. Each framework still has requirements of its own, which V77 tracks separately.

πŸ‡ͺπŸ‡Ί EU AI Act (Regulation (EU) 2024/1689)

Full Art. 5(1)(a–h) prohibited practices screening, Annex I/III high-risk classification (including Annex III pt. 5(b) Creditworthiness & pt. 5(c) Life/Health Insurance), Art. 6(3) exemptions, Art. 25 provider escalation, Annex IV technical documentation, and Art. 47/49 conformity exports.

  • β€’26-question risk classifier in the app (a 14-question quick check is free on the home page)
  • β€’AI-assisted Annex IV drafts with human review logged, Art. 47 Declaration of Conformity & Art. 49 EU database JSON
  • β€’Art. 27 FRIA, Art. 50 transparency checks & Art. 73 serious-incident clocks (2 / 10 / 15 days)

🏦 DORA (Regulation (EU) 2022/2554 β€” Banking & Insurance)

Digital Operational Resilience Act crosswalk for European credit institutions, insurers, and investment firms deploying high-risk AI and third-party foundation models.

  • β€’DORA Arts. 5–16 ICT & AI risk management integrated with EU AI Act Art. 9(9)
  • β€’DORA Art. 19 major-incident clocks (4h / 24h initial, 72h intermediate, 1-month final) & Art. 28 third-party AI vendor register
  • β€’EBA / EIOPA supervisory audit pack & model risk governance

πŸ”’ GDPR (Regulation (EU) 2016/679 β€” Arts. 5, 22, 25, 32, 35)

European data protection controls for personal-data AI training, inference, automated credit/insurance profiling (Art. 22), and data subject rights.

  • β€’Automated DPIA (Art. 35) complementary to EU AI Act Art. 27 FRIA
  • β€’Art. 22 human intervention, explanation & contestability workflows
  • β€’72-hour national Data Protection Authority (Art. 33) breach notification tracking

πŸ“œ EN ISO/IEC 42001:2023 (AIMS)

Certifiable AI Management System (AIMS) standard adopted by CEN-CENELEC across the European Union for Clause 4–10 and Annex A controls.

  • β€’Clause 4–10 governance & Annex A control implementation tracking
  • β€’Evidence sealed with RFC 3161 timestamps & 4-tier external auditor sign-off
  • β€’Readiness gap analysis to prepare for accredited certification bodies and notified bodies (V77 does not certify)

πŸ›‘οΈ EU AI Act Art. 15 cybersecurity & robustness (ISO/IEC 27001 alignment)

AI robustness and security testing for EU AI Act Art. 15 and the OWASP LLM Top 10, with control references to ISO/IEC 27001:2022 where they overlap.

  • β€’65-scenario adversarial red-team library mapped to all ten OWASP LLM Top 10 (2025) risks, including agent hijacking, unsafe output and AI Act prohibited uses
  • β€’10-case scored evaluation benchmark & subgroup fairness metrics β€” demographic parity, equal opportunity, equalised odds, predictive parity (Art. 10)
  • β€’Append-only, hash-chained audit log & role-based access control

πŸ“ NIST AI RMF 1.0 (GOVERN Β· MAP Β· MEASURE Β· MANAGE)

Technical risk management crosswalk linking NIST AI RMF 1.0 functions directly to EU AI Act Articles 9–15 and EN ISO/IEC 42001.

  • β€’182 controls, each mapped once across every framework it supports
  • β€’Gap analysis & readiness scoring (implemented Γ· applicable controls)
  • β€’CI/CD release gate API (/api/v1/compliance-gate) for GitHub Actions

🌍 Laws outside the EU

Optional packs for the other AI laws your systems touch, switched on per workspace and assessed with the same evidence.

  • β€’United Kingdom: UK GDPR automated decision-making rules (Data (Use and Access) Act 2025), DPIAs, Equality Act
  • β€’Colorado SB 26-189 (applies from 1 January 2027): notice, adverse-decision explanations, correction and human review
  • β€’New York City Local Law 144: yearly bias audits, published results, candidate notice
  • β€’Texas TRAIGA (in force since 1 January 2026) and South Korea's AI Basic Act (in force since 22 January 2026)

Regional Regulatory Coverage & High-Need Sectors

πŸ‡ͺπŸ‡Ί European Union & EEA

2 / 10 / 15 days (AI Act Art. 73) Β· 4h/24h initial (DORA Art. 19) Β· 72h (GDPR Art. 33)

Risk-tiered European Union statutory regulation prohibiting unacceptable AI practices (Art. 5), regulating Annex I/III high-risk systems including Banking Creditworthiness & Life/Health Insurance Pricing (Annex III pt. 5(b)/(c)), enforcing Art. 50 transparency, and governing GPAI models (Arts. 51–55).

EU AI Act (Regulation (EU) 2024/1689)GDPR (Regulation (EU) 2016/679 Arts. 22, 35)DORA (Regulation (EU) 2022/2554)EN ISO/IEC 42001:2023 & ISO/IEC 27001:2022
  • β€’ Art. 5(1)(a–h) prohibited practices screening & Art. 6(3) narrow-procedural derogation checks
  • β€’ Art. 9–15 technical controls, Annex IV technical documentation & Art. 47 EU Declaration of Conformity
  • β€’ Art. 27 Fundamental Rights Impact Assessment (FRIA) & GDPR Art. 35 DPIA
  • β€’ Art. 73 serious-incident reporting within 2, 10, or 15 calendar days, run in parallel with DORA Art. 19 (4h/24h initial) and GDPR Art. 33 (72h) clocks

Ready to run the crosswalk on your AI inventory? Start 14-day trial or talk to sales.