EU AI Act

What it requires

The EU AI Act establishes a risk-based framework for AI systems placed on the EU market or affecting EU residents. High-risk systems (Annex III) must satisfy obligations covering risk management, data governance, technical documentation, transparency, human oversight, accuracy, robustness, and cybersecurity before they can be deployed.

Key obligations for high-risk AI

• Article 9: Risk management system maintained throughout the AI system lifecycle
• Article 10: Data governance and management practices for training, validation, and testing data
• Article 11: Technical documentation drawn up before the system is placed on the market
• Article 12: Record-keeping enabling automatic logging of events
• Article 13: Transparency and provision of information to deployers
• Article 14: Human oversight measures designed into the system
• Article 15: Accuracy, robustness, and cybersecurity requirements
• Article 17: Quality management system covering all of the above
• Article 26: Obligations on deployers of high-risk AI systems
• Article 27: Fundamental rights impact assessment for certain deployers

Annex IV: Technical documentation

High-risk systems must maintain comprehensive technical documentation that demonstrates conformity with the requirements. This includes a general description of the AI system, detailed development process information, monitoring and functioning details, and a description of the risk management system.

How Vigilens automates it

Vigilens encodes the EU AI Act as executable rules, not checklist items. Every article and annex obligation becomes a control with an acceptance specification that defines exactly what evidence is needed and how it is evaluated.

• Automatic risk classification via the free EU AI Act Classifier (Annex III mapping)
• Controls auto-assigned based on classification result (high-risk, limited-risk, GPAI)
• Evidence pulled continuously from GitHub, GitLab, Jira, Confluence, Datadog, MLflow
• Deterministic verdicts computed from acceptance specs (no LLM decides pass/fail)
• Governance pack generated with full article-level traceability

Key compliance dates

The EU AI Act phases in gradually under the Digital Omnibus on AI timeline:

Related frameworks

EU AI Act compliance is strongest when combined with ISO 42001 (AI management system), ISO 27001 (information security), and GDPR (data protection). Vigilens maps controls across all four, de-duplicating shared obligations.