Operationalizing the EU AI Act through eIDAS Trust Services Primitives: A Reference Mapping for High-Risk AI Systems

Version 1.0.1 (18 May 2026) is a minor revision of v1.0-preprint (17 May 2026, archived under the same concept DOI). v1.0.1 preserves the analytical claims, the article-by-article mapping, all numbered tables, and the architectural view of v1.0. It applies the following cleanup so that the public preprint no longer carries internal editorial scaffolding: Removes §2.6 (Reviewer-risk register) and §2.7 (Venue positioning), which were authoring-stage tables aimed at peer reviewers and venue selection rather than at readers of the paper. Introduces a new §2.6 (Claim boundaries) that consolidates the public-facing claim-scope language — preserving the precision distinctions between “supports evidence for” and “satisfies”, between “uses eIDAS vocabulary” and “is an eIDAS trust service”, and between “reduces future-verification risk” and “guarantees decade-scale validity”. No changes to §3 (architectural view), §4 (article-by-article mapping), §5 (contested decisions), §6 (worked example), §7 (open rows), or the references list. This revision affects positioning only; the substantive contribution of v1.0 stands. The competing-interest disclosure remains as in v1.0. v1.0 preprint (17 May 2026) of Operationalizing the EU AI Act through eIDAS Trust Services Primitives: A Reference Mapping for High-Risk AI Systems. This working paper maps selected high-risk obligations in Regulation (EU) 2024/1689 (the EU AI Act) to cryptographic and trust-service primitives drawn from eIDAS/eIDAS 2.0, ETSI EN 319-series standards, IETF RFC 3161 timestamping, W3C Verifiable Credentials, JSON canonicalization, and post-quantum signature practice. Its central contribution is an article-by-article and layer-by-layer reference mapping for producing independently verifiable evidence about AI system behavior. Version v1.0-preprint is derived from publication-prep rc4 and adds a structured failure-case appendix for broken evidence packages, completes a URL verification pass, and tightens claim-risk wording from compliance guarantees toward evidence-support formulations. The mapping is implementation-agnostic. The Agent Trust Framework (EATF) is used as a worked example because its artifacts are publicly observable. Tyche Institute is a research entity, not a trust service provider or qualified trust service provider, and this paper does not claim that EATF or any implementation certifies legal compliance.