Mapping Data Governance Requirements Between the European Union’s AI Act and ISO/IEC 5259: A Semantic Analysis

Authors: kuruvilla george aiyankovil
julio  hernandez
dave  lewis
Venue: SEMANTiCS_cc_2024_Workshop_NXDG
Published: 2024-07-06 08:35:17

Abstract: The rapidly evolving landscape of artificial intelligence (AI) has made regulatory frameworks essential to guide the development, deployment, and usage of AI technologies responsibly. Recently, the European Union (EU) has approved the AI Act to address these needs, laying out comprehensive requirements for AI systems. Similarly, the EU published a request for harmonized standards that would support implementation of the AI Act across a number of topics related to trustworthy AI and AI quality and management. One source for such European Harmonised Standards are International Standards, and ISO/IEC JTC1 SC42 has a number of standards published and in development that may be appropriate, but official analysis shows some gaps that require additional features for existing standards. It is not clear that near term modifications to existing standards will satisfy all the requirement of the AI Act given the complexity and lack of state of the art in many areas, especially in novel area such as protection of fundamental rights.We propose therefore the use of semantic web vocabularies to track the mappings of AI Act requirements that will enable the progressive tracking to third party guidelines, standards and specification. In particular, we demonstrate this approach by producing an requirement analysis of Article 10 of the AI Act on Data Governance and map it to the relevant provisions of the SC42 standards 5259 on Data Quality for Machine Learning. This study conducts a semantic analysis of the EU’s AI Act and ISO/IEC 5259 requirements, utilizing the Simple Knowledge Organization System (SKOS) ontology to map concepts between these two frameworks. We identify areas of alignment, partial alignment, and disparities between these regulatory requirements. Our analysis covers various dimensions, including completeness of satisfaction, partial satisfaction, normative language differences, definition disparities, and associated costs for compliance. Our findings reveal instances of direct alignment, partial alignments, variations in normative language and disparities in concept definitions, highlighting nuanced differences in terminology and scope.

Main paper: 
 introduction: 
 Artificial intelligence (AI) is transforming industries and societies worldwide, offering immense potential to revolutionize how we work, live, and interact. However, alongside its promises come significant ethical and societal challenges, prompting governments and international bodies to establish regulations and guidelines to ensure its responsible development and deployment.Central to this regulatory landscape is the European Union (EU), which recently introduced the AI Act-a comprehensive legislative framework designed to govern the use of AI technologies within its member states [1] . A key part of the AI Act is the governance of the data that is used to train, validate and test AI systems (Article 10) [1] [3] . In this paper we explore the extend to which the data governance requirements of the AI are satisfied by international standards. Specifically, the Subcommittee 42 (SC42) of the ICT Joint Technical Committee of the International Organization for Standardization (ISO) and International Electro-technical Commission (IEC) is developing ISO/IEC 5259, [2] a set of standards on the quality of data used in AI systems, which is a potential candidate for satisfying the harmonised standard requirements [11] that may accompany the AI Act. As with other EU product safety standards, the AI Act allows for a presumption of conformity for high risk AI system that can demonstrate conformance to harmonised standards (Article 40). The EC has already published a draft harmonised standards request for the AI Act [12] which contained a specific requirement for a European Standard on governance and quality of datasets used to build AI systems. As has already been identified in a review of AI standards [13] , the ISO/IEC 5259 standards set represents a possible candidate for adoption as harmonised standard to address the AI Act's data governance requirement. This candidacy may be strengthened by the reference to ISO/IEC 
background: 
 In recent years, the proliferation of artificial intelligence (AI) technologies has prompted significant interest and concern regarding the ethical, legal, and regulatory implications of their development and deployment. As organizations increasingly leverage AI systems to automate decision-making processes and enhance operational efficiency, there is a pressing need for robust governance frameworks to ensure accountability, transparency, and ethical use. A review of the literature, including studies by Smith et al. (2020) , Jones and Lee (2019), and Chen et al. (2018) , reveals a growing body of research focused on AI governance, with particular emphasis on regulatory frameworks, standards, and best practices [14] [15] [16] . Scholars and policymakers alike have underscored the importance of establishing clear guidelines and standards to govern the development, deployment, and operation of AI systems, thereby mitigating risks and promoting trust and accountability. One key aspect of AI governance pertains to the management and quality assurance of data used to train and operate AI models. As AI systems rely heavily on data for learning and decision-making, ensuring the quality, integrity, and interoperability of data inputs is paramount. In this context, the International Organization for Standardization (ISO) has developed ISO/IEC 5259, a series of five standards which provides terminology, requirements, measures, processes and framework for managing data quality in AI systems. ISO/IEC 5259 outlines a set of requirements and recommendations for assessing, monitoring, and improving data quality throughout the data lifecycle.Concurrently, the European Union (EU) has introduced the AI Act, a landmark regulatory initiative aimed at governing the development and use of AI technologies within the EU. The AI Act details a complex set of requirements and obligations for AI system providers and deployers, covering aspects such as transparency, accountability, and risk management. The AI Act, through Article 10, defines a set of requirements and guidelines related to data governance and management practices. The main concern of these requirements is for those high-risk AI systems involved in training AI models, which are developed based on training, validation, and testing data sets. In particular, the AI Act integrates some quality criteria that these data sets should meet r. The processing of personal data is also part of this article, as are conditions to detect and correct bias, considering high-quality training, validation, and testing data sets.While both ISO/IEC 5259 and the AI Act represent sets of requirements related to AI data governance, the AI Act makes explicit reference to the use of harmonised standards, compliance with which offers a presumption of conformance to certain technical requirements of the Act. This role for standards in the Act leads to the EC issuing a harmonised standards request [18] for such technical standards to be established by European Standards Organisation. This includes satisfying the data governance requirements of Article 10. If ISO/IEC 5259 is to be considered for adoption as a European standard for this purpose, there is a need for a clear analysis of the degree to which the requirement needed to demonstrate compliance with ISO/IEC 5259 satisfies the requirement of Article 10. To undertake such a comparison of requirements in an extensible and open manner we adopt a systematic approach to convert requirements into ontology concepts and analyse requirement relationships as an ontology mapping, leveraging the Simple Knowledge Organization System (SKOS) to represent and link concepts sets and standards [6][7] . SKOS provides a standardized framework for organizing and representing knowledge, enabling the creation of concept schemes and the systematic categorization of concepts [6] [7] . By employing the SKOS ontology to capture concepts from both documents, we enable mappings between requirements in both documents to be identified, published and extended (as subsequent legal understandings of standards revisions emerge). This provides a basis for us, and future researchers and practioners, to identify areas of convergence and divergence between the AI Act requirements for data governance and ISO/IEC 5259, thereby facilitating the resilient harmonization of regulatory requirements and the development of interoperable governance frameworks. Furthermore, the integration of ontology-based approaches offers a structured method for representing and formalizing the relationships between concepts and requirements between the AI Act and other sources of requirement, e.g. one that AI providers might have satisfied under other non-EU frameworks or juristictionss. Ontologies provide a semantic foundation for capturing domain knowledge, enabling the specification of precise definitions, properties, and relationships between entities. By formalizing the semantics of regulatory documents such as the AI Act and ISO/IEC 5259 using ontological representations, researchers can facilitate automated reasoning, semantic querying, and interoperability across regulatory domains. In summary, the literature underscores the importance of AI governance in ensuring the responsible and ethical development and use of AI technologies. By leveraging standards such as ISO/IEC 5259 and regulatory initiatives such as the AI Act, organizations can mitigate risks, enhance trust, and foster innovation in the AI domain. Moreover, the integration of SKOS-based ontology mapping techniques [8] offers a systematic approach to harmonizing regulatory frameworks and promoting semantic interoperability, thereby advancing the field of AI governance. 
methodology: 
 The development of the AI Data Governance Ontology (AIDGO) for capturing data governance requirements from the EU AI Act and ISO/IEC 5259 follows a systematic methodology tailored to the domain-specific needs [9] [10] . The process involves several structured steps to ensure the ontology effectively represents and aligns with the regulatory frameworks:This step undertake to identify and extract data governance requirements separately from both the EU AI Act and ISO/IEC 5259, focusing on aspects relevant to managing data assets in AI applications. Requirements were grouped into collections, each named and identified for specific articles or annexes, using the Trustworthy AI Requirements vocabulary [19] that is being developed for a broader requirements analysis and mapping of the AI Act. Within each collection, each individual requirement statement is recorded as a requirements objects, with a property linking to the source article. Where an Article in the Act contains multiple requirements, a separate requirements object is defined for each to facilitate fine-grained mapping. The main subject of each requirement was identified, and the normative level was classified based categories for ISO standards laid out in on ISO Directive Guidelines 2 [20] , i.e. Requirement, Recommendation, Permission, or Possibility. Concepts mentioned in the requirements were listed and referenced against existing definitions in the AI Act from Article 3 (Definitions), which had been mapped into a SKOS concept collection. If a previously unidentified concept was identified in a requirement statement was not present in this collection, a new concept was added into a separate SKOS concept collection as associated with the requirements class using a skos:RelatedMatch property. In identifying such concepts, operational items, technical components, and management processes were prioritised as these were likely to match to concepts in technical standards requirements. Terms that require clear definitions as concepts for interpreting whether the requirement was satisfied were captured. Modifiers to these terms were minimized, as the requirement statement text presented a more authoritative contextualised of such terms. These concepts were documented with camel-case IDs, lowercase space-separated skosprefLabels, and their source articles reference using DCTerm source property. Associations to existing concepts were made using SKOS related or broader properties, and where appropropriate concepts were subclassed to the TAIR subclass definitions ofEntity, Activity orAgent (themselves inherited from the W3C Provenance Ontology), or tair:Risk. Membership of a requirement object to a requirements collection, e.g. the one used here for the requirement from Ai act Article 10, was recorded using the tair:decomposes property. Where the satisfaction of a requirement statement would require consultation of requirements referenced in another part of the Act or in other legal documents, this was indicated bytair:constrainedBy properties with a link to a requirements collection expressing those requirements. These models are initially extracted in a spreadsheet in order to facilitate it checking by subject matter experts without RDF experience, and once checked it was exported to RDF for publication. The requirement collection extracted for Article 10 is part of a larger requirements extraction process aiming to cover the majority of Articles and annexes of the AI Act, each as a separate requirement collection that can be subject to analogous mapping to other technical source documents or standards.-d c t : s o u r c e : A r t i c l e 9 -9 -a i a c t x t : " [ I n i d e n t i f y i n g t h e most a p p r o p r i a t e r i s k management measures , t h e ] e l i m i n a t i o n o r r e d u c t i o n o f i d e n t i f i e d and e v a l u a t e d r i s k s p u r s u a n t t o p a r a g r a p h 2 a s f a r a s t e c h n i c a l l y f e a s i b l e t h r o u g h a d e q u a t e d e s i g n and d e v e l o p m e n t o f t h e high -r i s k AI s y s t e m [ s h a l l be e n s u r e d ] " -r d f : t y p e : A r t i c l e 9 -9-r 1 -t a i r : r e q A c t o r : t a i r : P r o v i d e r -t a i r : NormLevel : R e q u i r e m e n t --d c t : s o u r c e : ISO5259 -D a t a S p e c -a i a c t x t : " The o r g a n i z a t i o n s h a l l s p e c i f y d a t a r e q u i r e m e n t s i n a d a t a s p e c i f i c a t i o n and v a l i d a t e t h a t t h e s e r e q u i r e m e n t s a r e c o n s i s t e n t and c a p t u r e a l l r e q u i r e m e n t s f o r t h e i n t e n d e d u s e . " -r d f : t y p e : ISO5259 -DataSpec -r 1 -t a i r : r e q A c t o r : t a i r : O r g a n i z a t i o n -t a i r : NormLevel : R e q u i r e m e n t -s k o s : d e f i n i t i o n : " The o r g a n i z a t i o n s h a l l s p e c i f y d a t a r e q u i r e m e n t s i n a d a t a s p e c i f i c a t i o n and v a l i d a t e t h a t t h e s e r e q u i r e m e n t s a r e c o n s i s t e n t and c a p t u r e a l l r e q u i r e m e n t s f o r t h e i n t e n d e d u s e . " -s k o s : r e l a t e d : D a t a R e q u i r e m e n t s This structured approach ensures a rigorous and reproducible development process for AIDGO, facilitating the alignment of data governance requirements between the EU AI Act and ISO/IEC 5259, and promoting better compliance and governance in AI applications.This step defines the core concepts and relationships of AIDGO, drawing from the extracted requirements and relevant standards. First we established the top-level data governance concepts, considering terminology and definitions provided in the EU AI Act and ISO/IEC 5259.Utilize established ontology engineering principles, such as those outlined in "Ontology Development 101" by Noy and McGuinness, to structure AIDGO effectively [9] [10] . We then expanded and refined the ontology by incorporating additional concepts and relationships derived from related standards or guidelines, facilitating coverage of new emerging data governance aspects.This step, although critical for assessing the effectiveness and quality of the ontology, is not within the scope of this paper. It represents an area for future work, where AIDGO will undergo rigorous evaluation against competency questions and real-world use cases to ensure its semantic coherence and applicability in the domain of AI data governance.This step requires the generation of documentation for AIDGO using ontology documentation tools such as WIDOCO, focusing on clarity, completeness, and accessibility. It should make AIDGO publicly available online through a dedicated URI, ensuring that it is accessible to stakeholders and researchers interested in data governance in AI applications. It requires the release of AIDGO under an open license, such as Creative Commons, to encourage reuse, collaboration, and contributions from the wider community.This step aims for establish a process for ongoing human maintenance of AIDGO to accommodate changes and updates in the EU AI Act, ISO/IEC 5259, and related regulatory frameworks. It requires regular review and revision of AIDGO based on new versions of the regulatory documents, e.g. as issues in future by hte AI Office or the European AI Board, that amend or add to data governance requirements. It also involves monitoring developments in the field of AI governance and data standards, including emerging best practices and guidelines, to ensure that AIDGO remains relevant and up-to-date.This methodology provides a structured approach for developing, evaluating, publishing, and maintaining the AI Data Governance Ontology (AIDGO), tailored specifically to capture data governance requirements from the EU AI Act and ISO/IEC 5259. It aims to ensure that AIDGO accurately represents the regulatory landscape and facilitates interoperability and compliance in AI systems.The mapping between the concepts and requirements of the AI Act and ISO/IEC 5259 was created using the ontology as a basis. We leveraged the SKOS framework to represent mappings between concepts from the two regulatory frameworks.We identified corresponding concepts between the AI Act and ISO/IEC 5259, such as "Data Quality Audit and Assessment" and "Data_Quality_Audit_and_Assessment".Based on the nature of the relationship between concepts, we classified mappings into different types, such as "completelySatisfies" for direct alignments and "partiallySatisfies" for partial alignments.Table 1 provides a clear definition of each property used in the ontology mapping process, facilitating the understanding of their roles in analyzing the alignment and disparities between the regulatory frameworks.For each mapping, we assigned appropriate SKOS properties to represent the type of relationship between concepts. Additionally, we used custom properties to capture normative language differences, definition disparities, and cost functions associated with satisfying each requirement.Each mapping was annotated with metadata, including references to the specific requirements in the AI Act and ISO/IEC 5259, as well as any additional information relevant to the mapping. The semantic analysis involved a detailed examination of the mappings to identify areas of alignment, partial alignment, and disparities between the AI Act and ISO/IEC 5259.We analyzed mappings to determine if requirements in one framework completely satisfied corresponding requirements in the other, indicating direct alignment.We identified mappings where compliance with one framework partially satisfied requirements of the other, highlighting areas of partial alignment.We examined mappings to identify differences in the level of normativity between requirements sets, such as differences in the use of "shall" versus "should".We analyzed mappings to uncover disparities in the definitions of concepts used in the requirements sets, highlighting nuanced differences in terminology and scope.We assessed the effort or resources required to satisfy each requirement in one framework compared to the other, providing insights into the practical implications of compliance. Overall, the semantic analysis provided a nuanced understanding of the relationship between the AI Act and ISO/IEC 5259, laying the groundwork for harmonizing regulatory requirements and facilitating compliance for organizations operating in the EU. 
ontology mapping results: 
 The ontology mapping process revealed insightful findings regarding the alignment and disparities between the data governance requirements outlined in the EU AI Act and ISO/IEC 5259. Through the systematic comparison of concepts, relationships, and requirements encoded in the ontologies, we were able to identify areas of convergence, divergence, and potential challenges in achieving interoperability and compliance across regulatory frameworks.ISO/IEC 5259 provides guidelines for managing data quality in AI systems. Some of the data governance requirements outlined in ISO/IEC 5259 include:• Establishing data quality characteristics and criteria.• Defining data quality measures and metrics.• Implementing data documentation practices.• Monitoring and improving data quality over time.• Ensuring transparency and accountability in data handling processes.• Establishing procedures for data validation and verification.• Facilitating interoperability and data exchange among AI systems. The EU AI Act aims to regulate the development, deployment, and use of AI systems within the European Union. It includes provisions related to data governance • Ensuring transparency and explainability of AI systems.• Implementing mechanisms for data quality assurance.• Establishing accountability frameworks for AI system developers and users.• Promoting ethical and responsible AI practices.• Facilitating access to high-quality and diverse datasets.• Establishing procedures for data processing, storage, and sharing. -Enabling individuals to exercise control over their personal data.One of the key observations from the ontology mapping exercise is the significant overlap in concepts between the EU AI Act and ISO/IEC 5259. Both frameworks address fundamental aspects of data governance, such as data quality, transparency, accountability, and management processes. Concepts such as "Data Quality Characteristics," "Data Quality Measures, " "Documentation, " and "Monitoring and Improvement" are common across both ontologies, reflecting shared objectives in ensuring the reliability and integrity of data used in AI systems. The ontology mapping results offer a detailed examination of the relationships between concepts and requirements in the AI Act and ISO/IEC 5259 frameworks. This section provides an extensive analysis of the mappings, including direct alignments, partial alignments, normative language differences, definition disparities, and cost function analysis. Through meticulous classification and visualization, the mapping results illuminate areas of convergence and divergence between the two regulatory regimes, informing stakeholders about the complexities of compliance in the AI domain.Direct alignments signify mappings where requirements in one framework completely satisfy corresponding requirements in the other. These mappings demonstrate a high level of convergence between the AI Act and ISO/IEC 5259, indicating harmonization in regulatory expectations. Direct alignments underscore areas where compliance efforts can be streamlined, as organizations adhering to one framework may already meet the requirements of the other. This alignment promotes consistency and coherence in AI governance practices, enhancing transparency and accountability. Partial alignments highlight mappings where compliance with one framework partially satisfies requirements of the other. These mappings reveal intersections and disparities between the AI Act and ISO/IEC 5259, indicating areas of overlap and divergence in regulatory expectations. Partial alignments illuminate nuances in regulatory requirements, necessitating careful consideration during compliance efforts. While certain aspects may align, discrepancies in normative language and definition may require additional measures to ensure full compliance with both frameworks.Normative language differences elucidate variations in the level of prescription between the AI Act and ISO/IEC 5259 requirements. These differences may impact the interpretation and implementation of regulatory mandates, influencing organizational practices and decision-making processes. Normative language differences underscore the importance of clear and unambiguous language in regulatory frameworks, facilitating consistent interpretation and application across diverse stakeholders. Harmonizing normative language can enhance regulatory clarity and facilitate compliance efforts, promoting ethical and responsible AI development and deployment.Figure 1 mapping snippet represents mappings between concepts from the EU AI Act and requirements from ISO/IEC 5259, focusing on AI system transparency and data minimization. The concept "AI_System_Transparency" from the AI Act is mapped to the requirement "Data_Quality_Management" from ISO/IEC 5259, indicating that AI system transparency completely satisfies the requirement for data quality management.Similarly, the concept "Data_Minimization" from the AI Act is mapped to the requirement "Data_Specification" from ISO/IEC 5259, suggesting that data minimization partially satisfies the requirement for data specification. These mappings provide insights into the alignment and partial alignment of concepts and requirements between the two regulatory frameworks, contributing to the overall understanding of AI governance and data management practices.Definition disparities denote differences in the definitions of concepts used in the requirements sets. These disparities may arise due to contextual nuances, disciplinary perspectives, or terminological ambiguities, posing challenges for aligning regulatory interpretations and practices. Definition disparities underscore the need for clarity and consensus in defining key concepts, ensuring consistent interpretation and application across regulatory frameworks. Addressing these disparities can promote mutual understanding and cooperation among stakeholders, fostering effective AI governance practices.The cost function analysis evaluates the effort or resources required to satisfy each requirement in one framework compared to the other. This analysis provides insights into the practical implications of regulatory compliance, informing resource allocation and decision-making processes. Cost function analysis enables organizations to assess the economic and operational impact of regulatory compliance, guiding strategic planning and risk management efforts. By quantifying compliance costs, organizations can make informed decisions about resource allocation and prioritize actions to minimize regulatory burden while maximizing societal benefits.The table 3 provides a detailed examination of the mappings between concepts from the EU AI Act and requirements from ISO/IEC 5259, revealing both areas of alignment and discrepancies. The finding that "AI System Transparency" completely satisfies the requirement for "Data Quality Management" underscores the interconnectedness of transparency and data integrity within AI systems. This alignment suggests that efforts to enhance transparency can inherently contribute to ensuring data quality, reflecting a synergistic relationship between these aspects of AI governance. Conversely, the partial satisfaction of "Data Minimization" for "Data Specification" highlights potential challenges in translating principles from one framework to another. The normative language differences and definition disparities identified in the mappings further underscore the complexity of harmonizing regulatory requirements in the AI domain. For instance, differences in the use of terms like "shall" versus "should" and variations in the scope and implementation of concepts like "Human Oversight" and "Accountability" contribute to differing compliance costs across requirements. These findings emphasize the need for careful consideration and adaptation when aligning standards to ensure effective and coherent AI governance practices. Additionally, the moderate costs associated with several mappings indicate the resource implications of achieving compliance, suggesting the importance of balancing regulatory objectives with practical feasibility. Overall, the analysis of these mappings provides valuable insights into the challenges and opportunities inherent in harmonizing AI governance standards, informing future efforts to strengthen regulatory frameworks and promote responsible AI development and deployment. Further exploration and refinement of these mappings, as facilitated by the public ontology, will be crucial for advancing the understanding and implementation of AI governance principles in practice.Despite the alignment of concepts, differences in the granularity, scope, and specificity of requirements were apparent between the EU AI Act and ISO/IEC 5259. While both frameworks emphasize the importance of data quality management, they vary in their emphasis on specific aspects of data governance and the level of detail provided in their requirements. For example, the EU AI Act may place greater emphasis on human oversight and transparency requirements for high-risk AI systems, whereas ISO/IEC 5259 may focus more on technical standards and measurement methodologies for assessing data quality.The ontology mapping process also uncovered potential challenges in achieving interoperability and harmonization between the EU AI Act and ISO/IEC 5259. Differences in terminology, definitions, and regulatory approaches could pose obstacles to seamless compliance with both frameworks, particularly for organizations operating across multiple jurisdictions or sectors. Moreover, discrepancies in the level of prescriptiveness and enforcement mechanisms may require careful interpretation and adaptation of requirements to ensure compliance with both regulatory contexts.Despite the challenges, the ontology mapping results highlight opportunities for harmonization and convergence between the EU AI Act and ISO/IEC 5259. By identifying commonalities in concepts and objectives, stakeholders can leverage existing synergies to develop unified approaches to data governance in AI projects. Standardization efforts, collaborative initiatives, and best practice sharing can facilitate the alignment of requirements, promote consistency in implementation, and enhance interoperability across regulatory frameworks. Overall, the ontology mapping results offer valuable insights into the relationship between the AI Act and ISO/IEC 5259 requirements, facilitating informed decisionmaking and strategic planning in the context of AI governance and regulatory compliance. These findings serve as a foundation for further analysis and collaboration among stakeholders, driving towards a more coherent and unified approach to AI regulation at the international level. Moving forward, further research is needed to deepen our understanding of the implications of regulatory frameworks on AI development, deployment, and use. Future studies could explore additional dimensions of AI governance, such as privacy protection, algorithmic transparency, and stakeholder engagement, to provide a more comprehensive analysis of regulatory challenges and opportunities. Additionally, ongoing efforts to update and refine ontologies for the EU AI Act and ISO/IEC 5259 will be essential to keep pace with evolving regulatory requirements and technological advancements in AI. 
implications for policy and practice:: 
 The ontology mapping results have several significant implications for policymakers, regulators, industry stakeholders, and researchers involved in AI governance, as outlined below:The systematic analysis of data governance requirements provided by the ontology mapping exercise can serve as a valuable resource for policymakers and regulators tasked with developing AI governance frameworks. By understanding the similarities and differences between regulatory requirements, policymakers can make informed decisions about policy priorities, regulatory approaches, and compliance strategies.For organizations operating in the AI ecosystem, the ontology mapping results offer insights into the complex landscape of regulatory requirements. By identifying areas of alignment and disparity between the EU AI Act and ISO/IEC 5259, organizations can develop tailored compliance strategies that address the unique requirements of each framework while maximizing synergies and minimizing duplication of effort.The ontology mapping exercise highlights the need for harmonized technical standards and measurement methodologies to support compliance with data governance requirements. Standardization efforts in areas such as data quality assessment, transparency mechanisms, and risk management can facilitate interoperability between regulatory frameworks and promote consistency in AI development and deployment practices.By promoting transparency, accountability, and ethical use of AI technologies, the ontology mapping results contribute to fostering responsible innovation in the AI ecosystem. By aligning regulatory requirements with best practices and ethical principles, policymakers and industry stakeholders can mitigate risks associated with AI deployment while maximizing the societal benefits of AI technologies.While the ontology mapping exercise provides valuable insights into the alignment and disparities between regulatory frameworks, several areas warrant further research and exploration:Future studies could expand the scope of analysis to include additional regulatory frameworks, industry standards, and best practices in AI governance. By conducting a comprehensive comparative analysis, researchers can provide a more nuanced understanding of the global regulatory landscape and identify emerging trends and challenges in AI governance.Engaging stakeholders from diverse backgrounds, including policymakers, regulators, industry representatives, academia, and civil society, is essential to ensure the relevance, effectiveness, and legitimacy of AI governance frameworks. Future research could explore mechanisms for stakeholder engagement and participatory decision-making in the development and implementation of AI governance policies.Addressing the complex challenges of AI governance requires cross-disciplinary collaboration across fields such as law, ethics, computer science, sociology, and public policy. Future research could foster interdisciplinary collaboration and knowledge exchange to develop holistic approaches to AI governance that integrate technical, legal, ethical, and societal perspectives. In conclusion, the ontology mapping results provide valuable insights into the implications and future directions of AI governance. By informing policy development, regulatory compliance strategies, technical standards development, and responsible innovation practices, the findings from the ontology mapping exercise can contribute to shaping a more transparent, accountable, and ethically aligned AI ecosystem. 
conclusion: 
 In conclusion, the ontology mapping exercise has provided a comprehensive analysis of the data governance requirements outlined in the EU AI Act and ISO/IEC 5259 standards. Through the systematic comparison of concepts, relationships, and instances captured in the ontologies, several key findings have emerged, shedding light on the alignment and disparities between the two regulatory frameworks. The mapping exercise revealed areas of convergence, where requirements from the EU AI Act and ISO/IEC 5259 exhibit significant overlap and mutual reinforcement. These areas of alignment suggest opportunities for harmonization and interoperability, enabling organizations to develop integrated compliance strategies that address the requirements of both frameworks efficiently and effectively.However, the mapping exercise also identified areas of divergence, where differences in terminology, scope, or emphasis between the EU AI Act and ISO/IEC 5259 may present challenges for compliance and implementation. These areas of disparity highlight the need for further analysis, dialogue, and collaboration among stakeholders to reconcile conflicting requirements, clarify ambiguities, and bridge gaps in the regulatory landscape. Moving forward, policymakers, regulators, industry stakeholders, and researchers must work collaboratively to address the complex challenges of AI governance. By leveraging the insights generated from the ontology mapping exercise, stakeholders can inform policy development, shape regulatory frameworks, and advance responsible innovation practices in the AI ecosystem. Furthermore, future research efforts should focus on expanding the scope of analysis, engaging stakeholders from diverse backgrounds, fostering cross-disciplinary collaboration, and exploring adaptive governance models. By adopting a holistic and inclusive approach to AI governance, we can build a more transparent, accountable, and ethically aligned AI ecosystem that maximizes the societal benefits of AI technologies while mitigating risks and safeguarding human rights. In summary, the ontology mapping exercise serves as a valuable tool for understanding the intricacies of AI governance requirements and charting a course towards a more sustainable and equitable future for AI. Through continued dialogue, cooperation, and innovation, we can navigate the complexities of AI governance with confidence and integrity, ensuring that AI technologies serve the common good and uphold the values of democracy, justice, and human dignity. 
 
 Appendix: • Ontology and Concept mapping 



Reviews: review: title: title: Great work in progress, a lot of work still needed.
main_review: main_review: # Comments on the substance

The paper indicates its purpose clearly. It has a constrained scope, and it appears to meet the stated goal in connection with this scope. However, this paper needs a lot of work in some sections in terms of formatting, readability, spelling, and grammar. The paper's goal is there, and it is interesting, but the structure of the paper is very much a work in progress.

More detailed comments: 

* “the AI Act—a comprehensive legislative framework designed to govern the use of AI technologies within its member states[1]” (p. 2) Many (legal) authors would argue against this statement.

* [https://aidgo.eu/](https://aidgo.eu/) is currently not operational. Readers of this article will want to be able to check it out.

* “Within each collection, each individual requirement statement is recorded as a requirements objects, with a property linking to the source article. Where an Article in the Act contains multiple requirements, a separate requirements object is defined for each to facilitate fine-grained mapping. The main subject of each requirement was identified, and the normative level (Requirement, Recommendation, Permission, or Possibility) was classified based on ISO Directive Guidelines 2 [20].” (p. 4) This sentence is not fully clear for a reader who is not an expert in ontology requirements specification. The same happens with many sentences and paragraphs within Section 3.1.1.

* I really do not understand the “Examples of Requirement Extraction” [Aiyankovil et al., 2024, p. 5]. Does this need to be better explained to a broader audience?

Section “4.1.6. Cost Function Analysis: The cost function analysis evaluates” ([Aiyankovil et al., 2024, p. 12] requires more backing. How are the cost functions calculated? What sources are you using to substantiate whether compliance with one requirement or another entails a High/Moderate cost??

# Spelling issues

There are many spelling errors in this piece. The authors should go over the text in depth and get a spelling/grammar check. I have identified the following:

* “producing an requirement analysis” ([Aiyankovil et al., 2024, p. 1])

* “Through an open and extensible semantic analysis techniques,” ([Aiyankovil et al., 2024, p. 2])

* “we adopt aa systematic” ([Aiyankovil et al., 2024, p. 3)

* “as subsequent legal understanding of standards revisions emerge” ([Aiyankovil et al., 2024, p. 4])

* “one that AI provider” ([Aiyankovil et al., 2024, p. 4)

* “AI Act..” ([Aiyankovil et al., 2024, p. 4)

* “These model” ([Aiyankovil et al., 2024, p. 5])

* “Ai act” ([Aiyankovil et al., 2024, p. 5]) .

* “nological ambiguities,” ([Aiyankovil et al., 2024, p. 12]) This cannot be the beginning of the sentence.

# Readability issues

There are a couple of very convoluted sentences:

* “This candidacy may be strengthened by the reference to ISO/IEC 5259 in proposed controls for data preparation and data quality issues in ISO/IEC 42001, AI Management System, which is a candidate for a certifiable quality management system standard that is also a requirement of the AI Act.” ([Aiyankovil et al., 2024, p. 2) 

* “While both ISO/IEC 5259 and the AI Act represent set of requirements related to AI data governance, the requirement of the AI Act for harmonised standards compliance with which offer a presumption of conformance to certain technical requirements of the Act leads to the EC issuing a harmonised standards request [18] for such technical standards to be established by European Standards Organisation which includes satisfying the data governance requirements of Article 10.” ([Aiyankovil et al., 2024, p. 3])

* “Item that requiring clear definitions for interpreting the satisfaction of the requirement satisfaction were captured, and modifiers to these were minimized, as the requirement statement text presented a better contextualised version of this..” ([Aiyankovil et al., 2024, p. 5]) This sentence is really unclear.

Several sentences read as headings or subheadings, not as proper sentences. Is this a formatting error?:

* “Identify and extract data governance requirements separately from both the EU AI Act and ISO/IEC 5259, focusing on aspects relevant to managing data assets in AI applications.” ([Aiyankovil et al., 2024, p. 4]) 

* “Requirement Identification” ([Aiyankovil et al., 2024, p. 4]) Is this also a subheading?

* “Responsible Innovation:” ([Aiyankovil et al., 2024, p. 15]) Is this a heading?


The following paragraph consists of instructions; it does not read as a proper paragraph: “Define the core concepts and relationships of AIDGO, drawing from the extracted requirements and relevant standards. Establish the top-level data governance concepts, considering terminology and definitions provided in the EU AI Act and ISO/IEC 5259.Utilize established ontology engineering principles, such as those outlined in ”Ontology Development 101” by Noy and McGuinness, to structure AIDGO effectively[9][10]. Expand and refine the ontology by incorporating additional concepts and relationships derived from related standards or guidelines, ensuring comprehensive coverage of data governance aspects.” ([Aiyankovil et al., 2024, p. 6])

* The same occurs in “3.1.4. Ontology Publication” and “3.1.5. Ontology Maintenance”.
title: title: Timely work that tries to discover the alignments and disparities between the AI Act and ISO 5259. The paper needs significant imporvement in terms of writing and formating to ease the reader.
main_review: main_review: This is an interesting and timely work that tries to discover the alignments and disparities between the AI Act and ISO 5259. The authors discuss their work in detail, provide examples, derive conclusions and discuss future work. 

At times the paper is difficult to follow and understand. My comments are as follows:

The last paragraph in section 2 (is too long and mixes up different topics) - instead structure it into several paragraphs dedicated to their corresponding topics

The benefits of using semantics are clear. The authors can also provide specific references (as examples of work) when mentioning these benefits at the end of section 2.

What specific "SKOS-based ontology mapping techniques" are the authors referring to?

Sometimes references are added at the end of the sentence and it's unclear what they should reference.

The methodology (section 3.1) should clearly state the steps and then each step can be elaborated on in a dedicated subsection.

Some sentences in section 3.2 would benefit from paraphrasing and simplification.

Section 3.1.3 is missing information on methods the authors plan to use to evaluate the ontology in terms of semantics and structure (e.g. with reasoners). Currently only use case (application) evaluation has been mentioned. Further, it would be nice to see a discussion about the authors' background and their legal expertise since the mapping and the ontology will represent their views. Has a legal expert been involved and how do the authors plan to validate their analysis and work regarding this? Who derived and how the competency questions?

Tables have not been referenced in the text. The table 2's caption can also explain the difference between the match categories.

The methodology can be visualised with a simple graph to better guide the reader.

Minor comments:

Missing citation of the AI Act

Missing space between words and references and after the end of sentences

Section 2, "In particular, the AI Act integrates some quality criteria that these data sets

Should meet r." - incomplete final sentence word

Missing reference to SKOS after being mentioned in the text

Terms such as TAIR should be defined when first mentioned

Some spelling and grammar issues - "Ai act Article 10", "Item that requires clear definitions for interpreting", "These models are initially extracted"

Overall, the paper's writing style needs improvement in terms of sentence structure and language (grammar and spelling) so that the authors can better convey their ideas to the reader

There is no need for ":" in the title of the sections

Seems as if section 3.3.2 should be part of section 3.3.1

Missing reference to ISO/IEC 5259 in section 4.1 when mentioning examples of requirements/guidelines.

Reference formatting is inconsistent