EU AI Act — execution-evidence crosswalk

Source version: Regulation (EU) 2024/1689 (OJ L, 12 July 2024)
Crosswalk version: eu-ai-act@1.0.0
Source authority: European Union — Official Journal / EUR-Lex
Last reviewed: 2026-08-13

What EU AI Act is

A horizontal EU regulation establishing risk-based obligations for providers and deployers of AI systems placed on the Union market.

What AIEF is

AIEF is an independent, implementation-agnostic framework for AI execution integrity. It defines the evidence properties an AI or agent execution must have to be reconstructed, attributed and independently verified after the fact — execution artifacts, integrity protection, version pinning, retention and independent validation.

Where they overlap

Several provisions concern automatically generated logs, record-keeping, traceability over the system lifetime, documentation, and the ability to make records available to authorities. Execution evidence is directly relevant to that class of obligation.

Where they do not

The Regulation also imposes obligations AIEF does not assess at all: risk management systems, data and data governance quality, human oversight design, accuracy and robustness, conformity assessment, CE marking, registration, fundamental rights impact assessment, and prohibited-practice rules.

Control mapping — 8 AIEF controls, 12 mapped references

Relationship strength is stated explicitly and deliberately conservative. Where a relationship is uncertain it is downgraded rather than overstated. Provisions with no credible execution-evidence relationship are left unmapped.

AIEF control to EU AI Act execution-evidence crosswalk
AIEF control	External reference	Relationship	Rationale	Limitation
AIEF-01Execution Artifact Completeness	Article 12Record-keeping — automatic recording of events (logs) over the system lifetime	Strong supporting relevance	The provision concerns high-risk AI systems technically allowing automatic recording of events throughout their lifetime. AIEF-01 requires that every material execution automatically emits a structured record identifying the execution, the system, its inputs and outputs and the parameters needed to interpret it — precisely the class of capability such recording depends on.	AIEF-01 does not determine whether a system is high-risk, whether the specific logging capabilities required by the Regulation are present, or whether recorded content is adequate for any regulatory purpose.
AIEF-02Tamper-Evidence	Article 15Accuracy, robustness and cybersecurity — resilience against unauthorised alteration	Supporting relevance	The provision addresses resilience against attempts by unauthorised third parties to alter use, outputs or performance. AIEF-02 requires a defined protected set whose post-issuance modification is detectable.	Tamper-evidence over evidence records is narrower than the cybersecurity and robustness properties of the system itself, which AIEF does not assess.
AIEF-04Version Preservation and Context Pinning	Article 12Record-keeping — traceability appropriate to the intended purpose	Supporting relevance	Traceability over a system's lifetime requires that historical records remain interpretable as systems change. AIEF-04 pins runtime, model, configuration and evidence-schema versions into the artifact.	Version pinning is one input to traceability. It does not establish that the level of traceability is appropriate to the intended purpose, which is a regulatory judgement.
AIEF-05Independent Validation Capability	Article 21Cooperation with competent authorities — providing information and documentation	Supporting relevance	Demonstrating conformity on request is materially easier when evidence can be verified by a party outside the originating system. AIEF-05 requires exactly that: verification without privileged production access and without relying on a dashboard that merely asserts validity.	AIEF-05 does not define what must be provided to an authority, in what language or format, and produces no legal effect.
AIEF-08Retention, Portability and Offline Verification	Article 19Automatically generated logs — provider retention obligations	Supporting relevance	Providers must keep automatically generated logs under their control for a defined period. AIEF-08 requires evidence to be exportable, retained and verifiable independently of the operational system that produced it.	AIEF-08 says nothing about the retention period, legal basis or scope of logs required, and does not establish that any retention obligation has been met.
AIEF-08Retention, Portability and Offline Verification	Article 26(6)Deployer obligations — keeping logs generated by the high-risk AI system	Supporting relevance	Deployers keep logs automatically generated by a high-risk AI system where those logs are under their control. Portable, self-contained execution evidence is what makes such retention meaningful outside the vendor's platform.	This mapping concerns the technical ability to retain and later read evidence. It does not address which logs are under a deployer's control or for how long they must be kept.
AIEF-01Execution Artifact Completeness	Article 26(6)Deployer obligations — logs generated by the high-risk AI system	Related consideration	A deployer can only retain meaningful logs if the system emits structured execution records in the first place.	AIEF is assessed from the perspective of the system producing evidence, not the deployer's separate legal obligations.
AIEF-01Execution Artifact Completeness	Article 72Post-market monitoring by providers	Related consideration	Post-market monitoring depends on collecting and analysing data about real-world system performance; structured execution records are one source of such data.	AIEF does not define a post-market monitoring system, its plan, or the analysis and reporting expected of one.
AIEF-04Version Preservation and Context Pinning	Article 11 and Annex IVTechnical documentation	Related consideration	Technical documentation describes the system, its versions and its operating context. Version and context pinning in execution evidence keeps documented claims connected to what actually ran.	AIEF does not produce technical documentation and covers only a small subset of the elements the Annex enumerates.
AIEF-06External Dependency Evidence / Tool Calls	Article 25Responsibilities along the AI value chain	Related consideration	Where third-party tools, models or data sources materially shape an outcome, evidence that identifies those dependencies helps allocate responsibility along the value chain.	AIEF makes no determination about the legal roles of providers, deployers, importers, distributors or third parties.
AIEF-09Privacy, Minimization and Redaction Controls	Article 10Data and data governance	Contextual only	Evidence records can contain personal or sensitive data. AIEF-09 requires minimisation and redaction to be handled without silently destroying integrity guarantees.	AIEF-09 is about evidence handling only. It does not assess training-data governance, quality, representativeness or bias examination, and it is not a data protection assessment.
AIEF-10Provenance and Attribution	Article 50Transparency obligations — marking and machine-readable detectability	Contextual only	Provisions concerning machine-readable marking of AI-generated content sit in the same conceptual space as provenance and attribution of artifacts.	AIEF-10 concerns who or what issued an execution artifact. It is not a content-marking or watermarking scheme and does not address the transparency obligations themselves.

Strong supporting relevance: The AIEF capability produces evidence of the kind the external provision is concerned with. It does not satisfy the provision.
Supporting relevance: The AIEF capability may help provide relevant evidence, but does not itself satisfy the external requirement.
Related consideration: A material conceptual relationship. Satisfying one does not imply satisfying the other.
Contextual only: Useful context only. No evidentiary claim is made.

Limitations and source

Mappings are limited to execution-evidence-relevant provisions. Unmapped articles are intentionally left unmapped.

Authored against European Union — Official Journal / EUR-Lex — https://eur-lex.europa.eu/eli/reg/2024/1689/oj (Regulation (EU) 2024/1689 (OJ L, 12 July 2024)). Crosswalk eu-ai-act@1.0.0, reviewed 2026-08-13.

Run an AIEF assessment