The chain from law to implementation runs through three layers: the Act (the law), the EU harmonised standard that operationalises it, and the international technical standard the harmonised standard leans on.
Act (law) → EU harmonised standard → international technical standard
(mapping happens here) (pulled in as normative reference)
A harmonised standard is a European standard (EN), developed by a European Standards Organisation such as CEN, that has been given legal effect: conforming to it earns a presumption of conformity with the matching legal requirement. For the EU AI Act these are being written by CEN-CENELEC JTC 21.
The mapping from technical specification to legal compliance lives in the standard’s Annex ZA. That annex ties a clause of the standard to a specific article of the Act, so an engineer can trace each control back to the obligation it satisfies.
An example:
- CEN side:
prEN 18229-1maps technical specifications to EU compliance. Its Annex ZA ties clauses to Article 11 (technical documentation) and the Article 12 logging duties - 12(2)(a), 12(2)(c) and 12(3)(a-d) - across Tables 1 and 2. - ISO side:
prEN 18229-1takesISO 24970, a technical standard on AI system logging, as a normative reference.
That an EN can lean on an ISO standard this way is arrangement, not accident. Under the Vienna Agreement, signed by CEN and ISO in Vienna in 1991, the two bodies plan and develop standards jointly to avoid duplicating effort and to keep the European and international texts aligned. It lets an ISO standard be adopted as an EN, or referenced by name from one, rather than re-written from scratch on each side. It is the quiet plumbing that makes the downward reference above possible.
So the international standard supplies the technical substance, the EU standard wraps it and maps it to the law, and Annex ZA is the seam between the two. That downward reference from the EU standard to the ISO one is worth understanding in its own right, because being referenced normatively is not the same as being substantive.