EU AI Act Law
Regulation (EU) 2024/1689, composed with amending Regulation (EU) 2026/1744. The flagship instrument on this site, and the only one modelled: 1,523 nodes and 1,944 edges parsed from official Formex XML, with a SHA-256 of the retrieved bytes on every node. It is also the instrument whose weaknesses this site is most exposed by, and those are on a page of their own.
- Kind
- Law — it binds directly, with penalties written into the instrument
- Issuer
- The European Parliament and the Council of the European Union
- Instrument
- Regulation (EU) 2024/1689 (the AI Act)
- Amendments composed
- Regulation (EU) 2026/1744, in force since 27 July 2026
- Consolidated text
- None official exists. This composition is unofficial — read what that means before relying on it
- Republishable
- YES — official Formex XML from CELLAR; EU legislative texts are freely reusable
- Vault
- Regulation Graph · 207 files · 14.9 MB · read key published below
- Status
- Citations derived from secondary sources. Re-derivation from operative text is required before any citation here is relied on. The status page →
So: this page does not reproduce operative text. Every provision below carries its citation, its structural address and the project's own reading, marked as a reading. The text itself lives in the vault, where it was parsed from Formex XML and hash-verified, and at EUR-Lex. When the re-derivation pass is done, the text lands here and this box comes down. Progress →
Structure
The taxonomy as modelled — the counts are from the graph, not from a description of it.
| Layer | Count | Notes |
|---|---|---|
| Articles | 113 | The operative provisions |
| Paragraphs | 500 | The hinge unit — this is what a citation and a crosswalk attach to |
| Points | 417 | Sub-paragraph lettered items. Modelled separately because the Act refers to them separately |
| Recitals | 180 | Not operative, and interpretively load-bearing — which is why they are nodes rather than preamble |
| Annexes | 13 | Including Annex III, which defines the high-risk categories |
| Definitions | 68 | One identifier, many labels. Authority anchoring → |
| 1,523 nodes · 1,944 edges | ||
Provisions
The permalink targets. Four are published as worked provisions; the rest are in the vault pending the re-derivation pass. The provision index → · resolve a citation →
A dual obligation
Suspension and notification. A checklist renders this as one box and the box can be ticked with half of it unmet — which is why this site models provisions rather than checkboxes.
Read → Art. 26(6)The arithmetic one
Log retention with a stated minimum. The finding derived from it is the most defensible on this site, and it is published with its own caveat attached.
Read → Art. 9(5)Judged to be acceptable
The obligation to make the judgement is imposed; the standard against which to judge is not supplied. And a self-correction on citation precision that produced a site-wide rule.
Read → Art. 99Penalties, and the SME inversion
For most undertakings the fine is the higher of a fixed sum or a percentage. For SMEs and start-ups it is the lower. Plus one number this site refuses to publish until it is checked.
Read →The operator question set
Fourteen questions, tiered by legal status rather than by how hard they are to answer. This is the reading layer the vault does not have, and it is the practical output of modelling the Act at all.
The worked example
A deployer running a procured agentic underwriting system for creditworthiness, taken end to end: 8 facts, 7 evidence items, 5 provisions, 3 findings, 5 risks, 4 stakeholder views, 9 questions of which 5 are unanswered, 2 projects. Read it →
V1. Log retention is below the required minimum. This is arithmetic, not judgement, which makes it the most defensible finding in the graph.
And the tension recorded against it in the same document, published alongside rather than quietly dropped: “Thirty days against six months is clean; most obligations are not that crisp, and the graph must not imply they are.”
Crosswalk
No crosswalk exists from this instrument to any other. Not to GDPR — despite the two applying concurrently and being the most obviously valuable pair on the estate. Not to NIS2, not to ISO/IEC 42001, not to NIST AI RMF.
The Act refers out constantly — to GDPR, to harmonised standards, to notified bodies, to conformity assessment procedures. Every one of those references currently terminates at nothing. The design is done and the bridges are not built →
The composition, and the labelling obligation it creates
It is also exactly the shape of the thing the project's own probe found in the wild: a text that never was the law, a negotiating draft circulating as though in force. This site must not become another instance of that. So the composition is labelled as a composition everywhere it appears, the amendment is a first-class node rather than silently applied, and what the labelling obligation formally requires is an open question — Q5.
The vault
Regulation Graph — 207 files, 14.9 MB, 2 commits. Eleven app views including the Act navigable with per-node provenance footers, a Cytoscape citation network with amendment halos, SQL over the graph via sql.js, an RDF view with Turtle export, the 68 concepts, external references, and an Article 9 Lab.
The read key, published deliberately. Read keys yes, write keys never — a read key is a capability handed out on purpose and cannot become write access:
sgit_rk1_c004daae386e8d17fa648884acc527018bd4ea1116ad673fb2f1b068011695c9:73heuprz
Open in the vault viewer → · the landing page → · how vaults reach a reader, and the key rules →
There is no zip and no SQLite download. Not for this instrument and not for any of the twelve published vaults. The distribution mechanism — eu-ai-act-v<n>.zip and eu-ai-act-v<n>.sqlite, versioned and never overwritten — is specified and net-new. Distribution →
Status
Two real weaknesses, neither of them cosmetic: citations derived from secondary sources, and two commits with no amendment-over-time history on the instrument whose whole business argument is that the amendment is the product. The status page states both, with what would fix each →