ACF
acfstandard.io
Developer docs
FR
REASON

acf.map-to-standards

Reverse index between the ACF® toolkit cards and the articles of the external standards (AI Act, GDPR, DORA, NIS2, ISO/IEC 42001): for one card, the articles it operationalises; without a card, the full inventory of the cards the mapping cites.

iNote
The tool reads the same mapping as acf.regulation.article, the other way round: acf.regulation.article starts from an article, this one starts from a card. Both therefore always return consistent answers.

When to use

Use this tool when a DDAO, an auditor or a compliance officer has to show which regulatory articles a completed card relates to, for instance to argue that a decision register (ACF-09) covers AI Act record-keeping and the GDPR Article 30 record. Without fiche_id, it helps prepare a cross-mapping audit or a coverage review.

Input parameters

Three fields, all optional.

fiche_id"ACF-01" .. "ACF-20" | "ACF-O1" .. "ACF-O10" | "ACF-P1" .. "ACF-P15"
Code of one of the 45 cards. When absent, the tool returns every card the mapping cites.
regulations("ai-act" | "gdpr" | "dora" | "nis2" | "iso-42001")[]
Restricts the answer to some standards. By default, all five.
locale"en" | "fr"default: "en"
Language of the headings and operational notes.

Output schema

fiches{ fiche_id, total_articles, mappings: { regulation, regulation_label, articles: { article, title, operational_note, source, applicable_date? }[] }[] }[]
For each card, the related articles, grouped by standard, with the operational note and the official reference.
total_fichesnumber
Number of cards returned.
total_articles_referencednumber
Total number of card-article links.
regulations_coveredstring[]
Standards queried.
requires_human_reviewtrue
Always true: the mapping supports an argument, it is not legal advice.

Example call

The articles the Agentic Decisions Register (ACF-09) relates to:

map-to-standards.tstypescript
import { Client } from "@modelcontextprotocol/sdk/client/index.js";
import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";

const transport = new StdioClientTransport({
  command: "npx",
  args: ["-y", "acf-mcp"],
});
const client = new Client({ name: "demo", version: "1.0" }, {});
await client.connect(transport);

const result = await client.callTool({
  name: "acf.map-to-standards",
  arguments: {
    fiche_id: "ACF-09",
    locale: "en",
  },
});

console.log(JSON.stringify(result.content, null, 2));

Response

response.jsonjson
{
  "fiches": [
    {
      "fiche_id": "ACF-09",
      "total_articles": 6,
      "mappings": [
        {
          "regulation": "ai-act",
          "regulation_label": "AI Act: Regulation (EU) 2024/1689",
          "articles": [
            {
              "article": "10",
              "title": "Data and data governance (high-risk AI)",
              "operational_note": "ACF operationalises Art. 10 via ACF-09 (decision register) + ACF-P14 (retention policy).",
              "source": "Regulation (EU) 2024/1689, Article 10",
              "applicable_date": "2027-12-02"
            },
            {
              "article": "12",
              "title": "Record-keeping (logging)",
              "operational_note": "ACF operationalises Art. 12 via ACF-09 (time-stamped decision register) + ACF-09 (reconstructible audit trail), a direct expression of P4.",
              "source": "Regulation (EU) 2024/1689, Article 12",
              "applicable_date": "2027-12-02"
            }
          ]
        },
        {
          "regulation": "gdpr",
          "regulation_label": "GDPR: Regulation (EU) 2016/679",
          "articles": [
            {
              "article": "30",
              "title": "Records of processing activities",
              "operational_note": "The ACF-09 decision register feeds and cross-checks the GDPR Art. 30 record for agentic processing.",
              "source": "Regulation (EU) 2016/679, Article 30"
            }
          ]
        },
        {
          "regulation": "dora",
          "regulation_label": "DORA: Regulation (EU) 2022/2554 (applicable since 2025-01-17)",
          "articles": [
            {
              "article": "17",
              "title": "ICT-related incident management process",
              "operational_note": "The decision register (ACF-09) and audit trail (ACF-09) provide the agentic-incident detection and notification evidence.",
              "source": "Regulation (EU) 2022/2554, Article 17",
              "applicable_date": "2025-01-17"
            }
          ]
        },
        {
          "regulation": "nis2",
          "regulation_label": "NIS2: Directive (EU) 2022/2555 (national transposition; deadline 2024-10-17)",
          "articles": [
            {
              "article": "23",
              "title": "Incident reporting obligations",
              "operational_note": "The reconstructible audit trail (P4, ACF-09/ACF-09) supplies the factual basis for timely incident notifications.",
              "source": "Directive (EU) 2022/2555, Article 23"
            }
          ]
        },
        {
          "regulation": "iso-42001",
          "regulation_label": "ISO/IEC 42001:2023: AI management system (AIMS)",
          "articles": [
            {
              "article": "9",
              "title": "Performance evaluation",
              "operational_note": "The clause 9 internal audit and review draw on the audit trail (ACF-09) and the improvement loop (ACF-10).",
              "source": "ISO/IEC 42001:2023, clause 9"
            }
          ]
        }
      ]
    }
  ],
  "total_fiches": 1,
  "total_articles_referenced": 6,
  "regulations_covered": [
    "ai-act",
    "gdpr",
    "dora",
    "nis2",
    "iso-42001"
  ],
  "doctrine_version": "1.0",
  "doctrine_hash": "sha256:119819463363cde0649504ab8ed5a96982fdb8506441f2c5e76e7e3c3feb77f1",
  "permanent_archive_url": "https://acfstandard.io/archive/doctrine/v1.0/doctrine-v1.0.json",
  "regulatory_snapshot": "AI Act (Reg. (EU) 2024/1689) incl. Digital Omnibus deferrals · GDPR (Reg. (EU) 2016/679) · DORA (Reg. (EU) 2022/2554) · NIS2 (Dir. (EU) 2022/2555) · ISO/IEC 42001:2023: as interpreted on 2026-06-07",
  "served_locale": "en",
  "requires_human_review": true,
  "disclaimer": "Preliminary qualification produced by the ACF® deterministic engine. Not legal advice. Human review required. Do not use for autonomous regulatory decision-making. See doctrine_archive_url for the version of the doctrine used.",
  "source_note": "Mappings reflect ACF v1.0 doctrine. The reverse-index is derived from content/guides/regulation-articles.json (the same source consumed by acf.regulation.article). For verbatim regulatory text, consult the cited source instrument."
}

Common errors

  • Invalid parameters: fiche_id outside the 45 codes (including the former ACF-00) or unknown standard. The call fails with a JSON-RPC error whose message lists the offending fields.
  • total_articles at 0: the card exists but the mapping cites it for no article of the requested standards.