You might have read Article 2 of the EU AI Act and know the routes into scope well enough to recite them. But what you might struggle with is the question that comes after it, which isn’t whether the AI Act applies to you but what your obligations are once it does.
The AI Act often doesn’t tell you. It sets out what it requires, and then defines several of those requirements by pointing at other law. The European Commission guidance that would explain how that works hasn’t been published. Law firm alerts take one instrument at a time. Your compliance function has most of a list already, assembled for reasons that had nothing to do with AI.
At some point you start to wonder whether there’s a document you were supposed to have found by now.
There isn't. What the AI Act assumes instead is that you already know which other regulations bind your company, and what each one does once AI is involved. It was drafted to sit on top of all of that and takes it as read. No one publishes that document, because it isn't the same document for any two companies. You build it yourself.
I call it the scope map.
What a Scope Map Is
A scope map is one document listing every regulation that binds your company, with a record of what each one does once AI is involved.
Not a summary of each instrument. One line per regulation, answering a single question: when we build or buy an AI system, does this rule add an obligation, discharge one the AI Act would otherwise impose, or change which authority comes asking?
Most entries do one of the three. The ones that do none of them stay on the map anyway, because “nothing here” is an answer, and the next person to ask won’t have to work it out again.
It has two layers, because the entries arrive from two different directions.
The fixed layer comes from what the company is: its sector, its legal entities, the countries it operates in. It binds every AI use you have, whether that’s a pricing model or a chatbot on the careers page. You build it once, and it changes rarely, because a company’s identity changes rarely.
The pull-in layer is one question, asked per use case: which additional law does this specific use drag in? Recruitment pulls in employment law. Consumer lending pulls in consumer credit rules. Anything customer-facing pulls in consumer protection, and sometimes accessibility law that’s been in force since June 2025.
Central for what’s common. A question for the rest.
Three Places the AI Act Points to Other Laws
Article 26(9): “Where applicable, deployers of high-risk AI systems shall use the information provided under Article 13 of this Regulation to comply with their obligation to carry out a data protection impact assessment under Article 35 of Regulation (EU) 2016/679 or Article 27 of Directive (EU) 2016/680.” Not may. Shall, wherever a data protection impact assessment is owed at all. An AI Act duty wired into a GDPR one.
Article 17(4) and Article 26(5): for financial institutions subject to internal governance requirements under Union financial services law, the quality management system obligation, minus three of its listed elements, and the deployer monitoring obligation will each be deemed fulfilled by complying with those sectoral rules. Two AI Act duties, answered in large part by a different regime entirely.
Article 26(7): before a high-risk system is used at the workplace, employers have to inform workers’ representatives and the affected workers, and that information “shall be provided, where applicable, in accordance with the rules and procedures laid down in Union and national law and practice on information of workers and their representatives.” The duty is European. The procedure is twenty-seven different answers.
Those three sit in Chapter III and apply from December 2, 2027. Three other things bind you already: the AI literacy duty in Article 4 and the prohibitions in Article 5, both since February 2, 2025, and the transparency duties in Article 50 since August 2, 2026.
The One That Gives the Game Away
Article 86(3): “This Article shall apply only to the extent that the right referred to in paragraph 1 is not otherwise provided for under Union law.”
Article 86 is the AI Act’s right to an explanation of a decision taken on the output of a high-risk AI system. It applies only where Union law hasn’t already provided one. To know whether your customer has an Article 86 right, you have to know what else they have.
Take a consumer lender. Three instruments reach the same lending decision, and each one has a different subject.
GDPR Article 22 is about a decision based solely on automated processing, and the explanation itself sits in Article 15(1)(h), which the Court of Justice settled in Dun & Bradstreet Austria in February 2025. The Consumer Credit Directive, which applies from November 20, 2026, is about a creditworthiness assessment that involves automated processing: no “solely,” no adverse-impact condition. Article 86 is about a decision taken by a deployer on the basis of AI output, and only one that produces legal effects or similarly significantly affects the person, in a way they consider to have an adverse impact on their health, safety or fundamental rights. A borrower approved on standard terms probably has no Article 86 claim at all.
Three rights, three subjects, one loan. Read any one of them on its own and you get the wrong answer.
Below in the article: how to build each layer, an example of a fixed layer for an EU credit institution, the pull-in question applied to three categories of use, and the record format, modeled on two registers your organization may already maintain.
It comes with a workbook you can download and start filling in, with the banking example already completed.
