Atomic requirement catalogue

Gamut decomposes broad legal topics into 72 atomic assessment items. This prevents a favourable answer to one part of an article from masking a gap in another.

How to read the catalogue

• A parent with no children is itself atomic.
• A parent with children is a navigation and advisory container; each child receives its own answer, assurance depth and evidence position.
• Sibling checks cannot satisfy one another.
• Applicability is still determined by the named system’s route, role and legal status.

Scope, role and timing

ID	Requirement	Legal basis
EU-AI-00	Scope, role and EU nexus	Articles 2, 3, 113
EU-AI-01	AI-system definition and intended purpose	Article 3
EU-AI-06	AI literacy	Article 4

Prohibited practices

EU-AI-02 is the Article 5 parent and hard-stop screen.

Atomic ID	Prohibited-practice check	Legal basis
EU-AI-02.a	Subliminal, manipulative or deceptive techniques	Article 5(1)(a)
EU-AI-02.b	Exploitation of vulnerabilities	Article 5(1)(b)
EU-AI-02.c	Social scoring	Article 5(1)(c)
EU-AI-02.d	Criminal-offence risk assessment based solely on profiling	Article 5(1)(d)
EU-AI-02.e	Untargeted facial-image scraping	Article 5(1)(e)
EU-AI-02.f	Emotion inference in workplace or education	Article 5(1)(f)
EU-AI-02.g	Sensitive biometric categorisation	Article 5(1)(g)
EU-AI-02.h	Real-time remote biometric identification for law enforcement	Article 5(1)(h)

High-risk classification

ID	Requirement	Legal basis
EU-AI-03	Annex I product-safety route	Article 6(1), Annex I
EU-AI-05	Article 6 exception and profiling override	Article 6(3), 6(4), 49(2)

EU-AI-04 expands Annex III:

Atomic ID	Area	Legal basis
EU-AI-04.1	Biometrics	Annex III point 1
EU-AI-04.2	Critical infrastructure	Annex III point 2
EU-AI-04.3	Education and vocational training	Annex III point 3
EU-AI-04.4	Employment and worker management	Annex III point 4
EU-AI-04.5	Essential private and public services	Annex III point 5
EU-AI-04.6	Law enforcement	Annex III point 6
EU-AI-04.7	Migration, asylum and border control	Annex III point 7
EU-AI-04.8	Justice and democratic processes	Annex III point 8

High-risk system requirements

ID	Requirement	Legal basis
EU-AI-07	Risk-management system	Articles 8, 9
EU-AI-08	Data governance and quality	Article 10
EU-AI-09	Technical documentation	Article 11, Annex IV
EU-AI-10	Record-keeping and logging	Article 12; Articles 19, 26
EU-AI-11	Transparency and instructions for use	Article 13
EU-AI-12	Human oversight	Article 14; Article 26(2)
EU-AI-13	Accuracy, robustness and cybersecurity	Article 15

Assess these across the lifecycle, including foreseeable misuse, data fitness, change control, logging integrity, oversight authority, adversarial resilience, failure handling and current technical documentation.

Operators, conformity and value chain

ID	Requirement	Legal basis
EU-AI-14	Provider obligations and quality management	Articles 16–20
EU-AI-15	Conformity, declaration, CE marking and registration	Articles 43, 47–49
EU-AI-25	Cooperation with competent authorities	Article 21
EU-AI-26	High-risk provider authorised representative	Article 22
EU-AI-27	Importer duties	Article 23
EU-AI-28	Distributor duties	Article 24
EU-AI-29	Value-chain role transfer and substantial modification	Article 25
EU-AI-30	Right to explanation of individual decision-making	Article 86

EU-AI-16 expands deployer duties:

Atomic ID	Deployer check	Legal basis
EU-AI-16.1	Use follows provider instructions	Article 26(1)
EU-AI-16.2	Competent human oversight	Article 26(2)
EU-AI-16.3	Input-data relevance	Article 26(4)
EU-AI-16.4	Monitoring based on instructions	Article 26(5)
EU-AI-16.5	Risk and incident escalation	Article 26(5)
EU-AI-16.6	Log retention under deployer control	Article 26(6)
EU-AI-16.7	Workplace notification	Article 26(7)
EU-AI-16.8	Public-authority registration check	Article 26
EU-AI-16.9	DPIA and FRIA linkage	Articles 26, 27
EU-AI-16.10	Minimum six-month deployer log retention	Article 26(6)
EU-AI-16.11	Notice to persons subject to high-risk decisions	Article 26(11)
EU-AI-16.12	Post-remote-biometric-identification safeguards	Article 26(10)

Fundamental-rights impact assessment

ID	Requirement	Legal basis
EU-AI-17	FRIA applicability and completion	Article 27

The advisory covers scope, process, affected groups, impacts, oversight, mitigation, complaint and redress, residual risk, notification and review. See Evidence, testing and findings.

Article 50 transparency

EU-AI-18 expands into trigger-specific checks:

Atomic ID	Transparency check	Legal basis
EU-AI-18.1	Direct AI-interaction notice	Article 50(1)
EU-AI-18.2	Synthetic-content marking	Article 50(2)
EU-AI-18.3	Emotion-recognition notice	Article 50(3)
EU-AI-18.4	Biometric-categorisation notice	Article 50(3)
EU-AI-18.5	Deepfake disclosure	Article 50(4)
EU-AI-18.6	Public-interest text disclosure	Article 50(4)
EU-AI-18.7	First-interaction or exposure timing	Article 50
EU-AI-18.8	Clarity, distinguishability and accessibility	Article 50
EU-AI-18.9	Transparency exceptions	Article 50

High-risk monitoring and incidents

ID	Requirement	Legal basis
EU-AI-19	High-risk post-market monitoring	Article 72
EU-AI-20	High-risk serious-incident reporting	Article 73; Article 3(49); Article 26(5)

GPAI systemic-risk monitoring

ID	Requirement	Legal basis
EU-AI-23	Systemic-risk evaluation and mitigation	Article 55
EU-AI-24	Systemic-risk incident and cybersecurity controls	Article 55

GPAI and model supply chain

EU-AI-21 captures the organisation’s position in the model value chain:

Atomic ID	GPAI role check	Legal basis
EU-AI-21.1	Direct GPAI model provider	Articles 53, 54
EU-AI-21.2	GPAI model with systemic risk	Article 55
EU-AI-21.3	Authorised representative	Article 54
EU-AI-21.4	Downstream provider integrating GPAI	Articles 53, 56
EU-AI-21.5	Deployer/API consumer supplier evidence	Chapter V
EU-AI-21.6	Copyright policy and training summary	Article 53

Additional atomic requirements:

ID	Requirement	Legal basis
EU-AI-31	GPAI classification and systemic-risk designation	Articles 51, 52
EU-AI-32	Technical documentation and downstream information	Article 53, Annexes XI and XII
EU-AI-33	GPAI provider authorised representative	Article 54

Non-applicability

ID	Requirement	Legal basis
EU-AI-22	N/A rationale and residual evidence trail	Articles 2, 6, 27, 50 and Chapter V

N/A is a governed legal conclusion. It requires a trigger-specific rationale, legal basis, factual evidence, decision owner, independent approver, approval date and reassessment trigger.

Totals

Measure	Count
Routed categories	11
Parent requirements	34
Atomic items actually assessed	72
Article 5 atomic checks	8
Annex III atomic checks	8
Article 26 atomic checks	12
Article 50 atomic checks	9
GPAI role atomic checks under EU-AI-21	6

These totals describe the methodology version above. Future legal or product changes should update the methodology identifier, legal snapshot and catalogue together.