arXiv:2609.13535 extracts 47 EU AI Act Section 2 requirements and maps 17 to AI-specific risk sources

The preprint systematically codes every obligation in EU AI Act Section 2. Authors derive eight consolidated AI-specific risk sources after removing duplicates and process mandates. The resulting EU AI Act Risk Source List provides the first explicit bridge between legal text and established risk taxonomies used in ISO 42001 and NIST AI RMF 1.0.

Data extraction counted 17 requirements that name technical risk sources including model opacity, training data bias, and post-deployment performance degradation. The remaining 30 requirements mandate documentation, human oversight structures, and conformity assessment procedures without specifying AI failure modes. This split matches patterns observed in earlier regulatory analyses of the Medical Device Regulation where 65 percent of clauses were procedural.

Operational impact is immediate for providers filing technical documentation under Article 11. Risk management teams must now maintain dual registers: one for the eight Act-derived sources and one for internal taxonomies. Gap analysis against ISO 42001 will require explicit traceability matrices rather than narrative statements.

Next milestone is the 2027 harmonized standards deadline. Providers that pre-map their systems to the eight sources can reuse the same evidence package for both conformity assessment and internal audit cycles.