EU AI Act — OSCAL catalog

A machine-readable OSCAL rendering of the obligations of Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744 — so a compliance toolchain can treat the AI Act the way it already treats NIST SP 800-53 or ISO 27001: import a catalog, select a profile, run an assessment, emit evidence.

This page is the resolution target for the https://w3id.org/eu-ai-act-oscal namespace. It is a showcase, not a source — every artifact below is generated from the project repository, where the canonical copy lives.

The date most compliance material still gets wrong

Regulation (EU) 2026/1744 was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026. It rewrote Article 113. Two consequences are worth stating plainly, because much published guidance predates the Omnibus:

• The high-risk deadline moved by sixteen months. Annex III stand-alone high-risk systems now apply from 2 December 2027, not 2 August 2026. A readiness programme still working to the older date is working to a superseded one.
• 2 August 2026 is not empty. Article 50 transparency lands then, and after the deferral it is the principal substantive obligation that does. The near-term obligation is transparency, not high-risk.

Permanent identifiers

• Vocabulary and artifacts

  Properties https://w3id.org/eu-ai-act-oscal/ns

  Catalog https://w3id.org/eu-ai-act-oscal/catalog

  Profiles https://w3id.org/eu-ai-act-oscal/profiles/{id}/profile.json

  Assessment https://w3id.org/eu-ai-act-oscal/assessment-plans/{id}/assessment-plan.json

  Examples https://w3id.org/eu-ai-act-oscal/examples/{file}

  Versioned https://w3id.org/eu-ai-act-oscal/v/{semver}/{path}

What is in the catalog

Fifty controls covering Chapters I–V, IX and XII, grouped as general provisions, prohibited practices, high-risk systems, transparency obligations, general-purpose AI models, post-market monitoring and market surveillance, and penalties.

• Role-scoped profiles

  Prohibited practices & AI literacy 15 controls · since 2 February 2025

  GPAI model provider 21 controls · since 2 August 2025

  Article 50 transparency 18 controls · from 2 August 2026

  High-risk deployer (Annex III) 26 controls · from 2 December 2027

  High-risk provider (Annex III) 40 controls · from 2 December 2027

Using it

The artifacts are plain OSCAL JSON and validate against OSCAL 1.1.2. Fetch the catalog by its permanent identifier and hand it to any OSCAL-aware tool:

curl -L https://w3id.org/eu-ai-act-oscal/catalog

Pin a release rather than tracking the moving artifact when you need reproducibility: the /v/{semver}/ paths are immutable.

Provenance and limits

This is an independent, community-maintained encoding of a published legal text. It is not legal advice, not an official publication of any EU institution, and carries no endorsement. The authoritative text of the Regulation is the one in the Official Journal; where this catalog and the Official Journal differ, the Official Journal governs. Corrections are welcome as issues or pull requests on the repository.

Repository, licence, citation