COBIT ↔ AI Act Mapping Checklist
If you already have COBIT 2019 in place, this is what you need to add — not rebuild — to show the AI Act is already covered.
What's included
- Word document mapping COBIT 2019's 5 domains to AI Act obligations
- 5-point verification checklist, one per domain
- Guide on presenting AI Act compliance to a COBIT-based audit
- Legal Notice
Why this document exists
If your organization already uses COBIT 2019 to govern IT, you have a real advantage over the AI Act: a technology governance structure already exists where AI fits. The common mistake is treating AI Act compliance as a new, isolated program instead of extending the COBIT objectives you already have.
The 5 domains, one line each
- EDM (Evaluate, Direct, Monitor): the board approves AI risk appetite — not fully delegated to IT.
- APO (Align, Plan, Organize): AI systems inventory, risk classification and roles aligned with strategy.
- BAI (Build, Acquire, Implement): technical documentation and data quality during development.
- DSS (Deliver, Service, Support): human oversight in production and incident response.
- MEA (Monitor, Evaluate, Assess): continuous monitoring and periodic audit of the risk system.
Frequently asked questions
Does this replace AI Act technical documentation?
No. It shows which COBIT domain each obligation fits into, but the documentation itself is covered by the specific products linked in each domain.
Does it apply only to COBIT 2019?
It's built on the 2019 version, the current one. The 5 domains (EDM, APO, BAI, DSS, MEA) remain stable across recent versions of the framework.
Does this replace legal advice?
No. It's a template that organizes the governance conversation, but it doesn't constitute legal advice — see the included Legal Notice.
What format is it delivered in?
A Word document with the mapping tables and verification checklist, plus the Legal Notice, delivered instantly after purchase.