EU Artificial Intelligence Act
EU regulation establishing harmonized rules for AI systems. Requires immutable "Black Box" logging for high-risk AI with complete traceability of inputs, outputs, and agentic actions.
What EU AI Act draws on
This framework pulls on all three pillars — which is why running them as three separate tools means reconciling three sets of evidence at audit time.
Compliance
- Sensitive Data DiscoveryFinds and classifies the regulated data, so everything downstream knows what is in scope.
- Policy & ComplianceTurns the captured activity into the report shape the framework asks for.
- Compliance Advisory ServicesOrganises the gap register, the remediation roadmap, and the auditor-ready pack.
Security
What your auditor cites,
and what produces the evidence
The regulator's text is quoted below in italic, exactly as written. What follows each one is what the platform records, detects, or proves — not a claim about your compliance status, which no tool can confer.
Record-Keeping
High-risk AI systems MUST automatically log inputs, outputs, and agentic actions with immutable audit trails.
A requirement like this is about the record surviving the person who would rather it did not, which means the audit trail has to be protected as carefully as the data. File activity monitoring hashes the datafiles, the transaction logs, the backups, and the audit trail itself with XXH3, then baselines them — so an alteration or a deletion is evident rather than inferred, and it is attributed to the session and OS user behind it. Because the same platform holds the query trail, a destructive statement and the file-level change it produced are two views of one event rather than two investigations.
Model inputs, outputs, and agentic actions are captured on the same immutable trail as the database activity they touch, so an AI decision and the data it read are one record.
Transparency
REQUIRES traceability enabling human understanding of AI system decision-making.
A record of processing is only as good as the layer producing it. Real-time SQL auditing captures every statement against the data — the identity, the session, the client, the objects touched, the outcome — with no nightly batch window where activity goes unrecorded. Classification is what makes that a record of *regulated* data rather than a log of everything: it tells you which tables are in scope, so the register describes the processing you actually have to declare. Policy templates then produce it in the shape the framework asks for, instead of leaving you to assemble it from raw logs the week before an inspection.
Human Oversight
Systems MUST enable human monitoring and intervention with complete audit trails.
Governance requirements ask who is accountable and how they know. Role-based access lets auditors and risk owners see the evidence without touching the data, and scheduled reporting puts the same posture view in front of the people who have to sign. What the platform supplies is the substantiation behind the sign-off; naming the accountable owner remains yours.
Quality Management
Providers MUST implement quality management with documented procedures and logging.
Governance requirements ask who is accountable and how they know. Role-based access lets auditors and risk owners see the evidence without touching the data, and scheduled reporting puts the same posture view in front of the people who have to sign. What the platform supplies is the substantiation behind the sign-off; naming the accountable owner remains yours.
What EU AI Act covers
Art. 3(29)-(33) — training, validation and testing data; special-category derogation at Art. 10(5)
The data sets used to build a high-risk AI system, plus the input data it consumes in operation.
In scope
- Training data used to fit the learnable parameters
- Validation data used to evaluate and tune
- Testing data used for independent verification
- Input data provided to or acquired by the system in use
Special categories processed under the Art. 10(5) derogation
The instrument's own term, kept as it writes it — these labels differ between frameworks on purpose.
- Art. 9 GDPR special categories, permitted strictly for bias detection and correction, subject to safeguards
Art. 10(5) is a rare express permission to process special-category data for a purpose the GDPR would otherwise make hard — and it is conditional, not a general licence.
Regulation (EU) 2024/1689, Art. 10 · as at 2026-08
How EU AI Act is enforced
Every figure below is the ceiling the instrument publishes about itself, not a prediction of what anything would cost. Enforced by National market surveillance authorities, and the AI Office for general-purpose models.
| Published maximum | Charged | As at |
|---|---|---|
| EUR 35 million or 7% of total worldwide annual turnover | for the prohibited practices in Art. 5 | 2026-08 |
| EUR 15 million or 3% of total worldwide annual turnover | for provider, deployer and other operator obligations | 2026-08 |
| EUR 7.5 million or 1% of total worldwide annual turnover | for supplying incorrect or misleading information to an authority | 2026-08 |
Article 99 sets three tiers. The top tier applies to the prohibited practices in Article 5. Breaching the provider, deployer, and other operator obligations attracts EUR 15 million or 3%; supplying incorrect or misleading information to a notified body or an authority attracts EUR 7.5 million or 1%.
For SMEs and start-ups the rule inverts: the fine is the lower of the fixed sum and the percentage, not the higher.
Uncapped exposure that sits outside this instrument
These come from company law rather than from EU AI Act, and they are not penalties — they are liability for a loss, which is why nothing caps them at a published maximum.
Duty of oversight
Delaware, and followed in most US corporate jurisdictions. It is a rule of company law, not of any privacy or security statute.
Triggered by. A sustained or systematic failure by the board to establish a reporting system for a mission-critical risk — or, having one, consciously disregarding what it reported. The second limb is what a documented, unremediated finding goes to.
Who. Directors, in their personal capacity, in a derivative action brought on behalf of the company.
This is liability for the loss the company suffered, not a statutory penalty, so nothing caps it at a published maximum. A bad-faith finding also takes the conduct outside the exculpation and indemnification the charter would otherwise provide.
In re Caremark Int’l Deriv. Litig. (Del. Ch. 1996); Marchand v. Barnhill (Del. 2019); In re Boeing Co. Deriv. Litig. (Del. Ch. 2021).
Enforcement data reviewed August 2026. Several figures are indexed annually and move.
Built for EU AI Act,
not configured for it afterwards
AI Black Box Logging
Immutable logging of all AI inputs, outputs, and agentic actions
EU AI Act Compliance Report
Complete traceability documentation for high-risk AI
AI Training Data
Identify model inputs, training data, and inference logs
AI Drift Detection
Alert on anomalous AI behavior requiring investigation
Other AI & Technology frameworks
Walk into the EU AI Act audit knowing the answer
228 cited requirements across 57 frameworks are mapped to the controls that evidence them. A fixed-fee gap assessment tells you which of them you can already prove today.