legalithm-map

The EU compliance obligation Map: every article of the EU AI Act and the Cyber Resilience Act that creates an obligation, with who it binds, from when, and what evidence it requires.

Offline. No API key, no network call. Cited to the Official Journal and dated.

npm install legalithm-map

import { applicable, getRequirements, frameworks } from 'legalithm-map';

frameworks;
// [{ key: 'eu-ai-act', instrument: 'Regulation (EU) 2024/1689', count: 43 },
//  { key: 'eu-cra',    instrument: 'Regulation (EU) 2024/2847', count: 31 }]

// What binds a deployer of a high-risk AI system in the EU?
applicable('eu-ai-act', { role: 'deployer', risk: 'high', deployed_in_eu: true });

// What binds a manufacturer shipping a product with digital elements?
applicable('eu-cra', {
  role: 'manufacturer',
  has_digital_elements: true,
  placed_on_eu_market: true,
});

Shape

One shape across frameworks. The AI Act classifies by (role, risk); the CRA by (role, product_class). Rather than force one vocabulary onto the other, every requirement carries a dimensions bag.

interface Requirement {
  id: string;
  framework: 'eu-ai-act' | 'eu-cra' | 'eu-eaa';
  article?: string;         // "11" — where the corpus stores it structurally
  annex?: string | null;    // "IV"
  ref: string;              // "13", or "Annex I Part II (1)"
  title: string;
  description: string;
  dimensions: Record<string, string>;
  evidence_type: string;    // document | process | record | control
  reference_url: string;
  applies_from: string | null;            // ISO date
  applies_from_milestone: string | null;  // the named milestone it resolved from
  harmonised_standard: string | null;     // null on every row — see below
  oj_citation_date: string | null;        // null on every row — see below
  applies_until: string | null;
  legal_basis_version: string;
  applies_if: AppliesIfPredicate[] | null;
}

The presumption of conformity, and why it is null everywhere

import { presumptionOfConformity } from 'legalithm-map';
presumptionOfConformity('eu-eaa');
// { available: false, standards_tracked: 3, standards_cited_in_oj: 0, checked_on: '2026-08-14', … }

harmonised_standard and oj_citation_date are null on every row of every framework. That is a dated finding, not missing data. Not one harmonised standard is cited in the Official Journal under the AI Act, the CRA or the EAA, so the presumption is available to nobody and conformity must be demonstrated against the requirement directly. A tool that certifies you against a standard with no OJ citation is certifying you against nothing.

Provenance

• CRA descriptions are verbatim Official Journal text, extracted programmatically from EUR-Lex (CELEX 32024R2847) and machine-checked against a committed source excerpt.
• EAA descriptions are verbatim Official Journal text, cut structurally from the authoritative OJ manifestation (CELEX 32019L0882, OJ L 151). The authoring script contains no OJ wording: it splits on the Journal's own numbering, and a test re-runs the cut and asserts byte equality.
• AI Act descriptions are authored summaries; every row's article citation is checked against the Official Journal article index.
• Coverage is computed against a written denominator, not asserted.

Limits, stated plainly

Not counsel-reviewed. This states obligations and their legal basis. It is not legal advice. The authentic texts are those published in the Official Journal and prevail over this representation in every case.

Licence

Code MIT. Corpus data CC BY 4.0 — see LICENSE-DATA. Attribution:

EU compliance obligation Map — Legalithm — https://www.legalithm.com/en/rules