Banking & Insurance
AI Mortgage Origination & Underwriting
High RiskUnverifiedDiscuss / dispute
AI scoring, underwriting and pricing systems that evaluate residential mortgage applications from natural-person consumers, including collateral valuation and rate and fee pricing.
Consensus classification rationale: Residential mortgage underwriting is governed by dedicated regimes that a general consumer-credit scoring profile does not reach. In the EU, Directive (EU) 2023/2225 (CCD2, the basis of uc-credit's EU trigger) does not apply to credit secured by a mortgage or taken to acquire or retain property rights in land or a building (Art. 2(2)(a)–(b)), so consumer mortgage lending falls under Directive 2014/17/EU, whose Art. 18 requires a thorough creditworthiness assessment on documented procedures, bars relying predominantly on the property's value or an assumed rise in it, and requires a rejected applicant to be told, where applicable, that the decision rests on automated processing. In the US, on top of ECOA/Regulation B's general adverse-action duties (shared with uc-credit), first-lien dwelling credit adds the 12 CFR 1002.14 duties to give the applicant a copy of every appraisal or other written valuation — AVM reports included — and written notice of that right, and closed-end mortgages carry the Loan Estimate timing and good-faith cost-tolerance rules of 12 CFR 1026.19(e). The Fair Housing Act (42 U.S.C. § 3605) separately prohibits discrimination in residential real estate-related lending on grounds that include handicap and familial status, which ECOA's list omits, and disparate-impact claims are cognizable under it. The pattern stays an Annex III point 5(b) creditworthiness system, high-risk under the EU AI Act like general credit scoring.
This profile is incomplete:no threats modelled. That is a gap in the graph, not a statement that nothing applies — propose the missing links →
Decision attributes in force
Autonomyhuman-in-the-loop — Drives the human-oversight duties (Art. 14, Art. 26(2)) and Art. 50 disclosure.
Profiling of natural personsyes — Feeds the Art. 6(3) second-subparagraph override directly — profiling makes the derogation categorically unavailable.
Affected subjectsnatural-person — Instruments scoped to natural persons drop out of scope when only legal entities are assessed.
Deployer typeprivate-enterprise — Selects between the recorded alternate classification readings.
Role in the value chainboth — Splits provider duties, deployer duties and upstream GPAI duties.
Consequential scoringyes — Consequential scoring of natural persons requires intrinsic interpretability, not post-hoc explanation only.
Indicative decision support, not legal advice. Risk classification depends on your concrete deployment context and can change with scope drift — validate the result with qualified counsel.
Target market(s)European UnionUnited States (federal)change
Changes which instruments below count as in scope for this profile.
Target markets: European Union, United States (federal)
Regulatory footprint
11 instruments across 4 of 7 regulatory domains, plus 31 standards references- AI law2 instruments
- Data protectionnone triggered
- Cyber & resiliencenone triggered
- Online safety & platformsnone triggered
- Product safety1 instrument
- Financial services1 instrument
- Sector & employment7 instruments
- Standards31 references
By jurisdiction
- EU4European UnionEU AI Act, EU Equal Treatment Directives (Goods, Services, Social Protection), Mortgage Credit Directive (MCD), Revised Product Liability Directive
- US4United States (federal)ECOA / CFPB Adverse-Action Regime, Fair Housing Act (US), FCRA — US Fair Credit Reporting Act, TILA-RESPA Integrated Disclosure Rule (TRID)
- US-CO2United States — ColoradoColorado ADMT Act (SB 26-189), Colorado AI Act
- DE1thinGermanyAGG (German General Equal Treatment Act)
The AI Act is one dimension of this footprint, not the whole of it — every domain above carries its own obligations and deadlines. See the instruments in the graph →
Confidence in this chain of evidenceConfidence: Check-worthy
The chain holds, but at least one hop rests on a secondary source, an ageing verification or a practice-derived step. Check the flagged hops before you rely on them.
Computed weakest-link over 58 evaluated hops across 1 target market: a chain is only as strong as its weakest step, so the band follows the worst hop rather than an average that would hide it. Five factors per hop — source tier, verification age, status certainty, community hardening, derivation kind — all read from graph data, never from a hand-set score.
Why this band12 factors lowered the band — each links to the claim behind it
- Source tier: Colorado AI Act carries no resolvable citation — the claim is uncited. open node →
- Source tier: NIST AI RMF 1.0 carries no resolvable citation — the claim is uncited. open node →
- Source tier: FAIR-AIR / FAIR-MAM carries no resolvable citation — the claim is uncited. open node →
- Source tier: NIST AI 600-1 (GenAI Profile) carries no resolvable citation — the claim is uncited. open node →
- Source tier: prEN 18228 (AI Risk Management) rests on a secondary source (tracker or summary), not on the primary text. open node → primary source →
- Source tier: JTC 21 Technical Package (prEN 18228/18229/18281–83) rests on a secondary source (tracker or summary), not on the primary text. open node → primary source →
- Source tier: prEN 18284 (Data Sets and Data Governance) rests on a secondary source (tracker or summary), not on the primary text. open node → primary source →
- Source tier: prEN 18283 (Bias Treatment) rests on a secondary source (tracker or summary), not on the primary text. open node → primary source →
- Source tier: TAGOF (Audit-as-Code) carries no resolvable citation — the claim is uncited. open node →
- Source tier: OWASP Agentic Security (AST10 / Core Risks) carries no resolvable citation — the claim is uncited. open node →
- Source tier: DIN SPEC 92001-1/-2/-3 carries no resolvable citation — the claim is uncited. open node →
- Source tier: ENISA Multilayer Framework & AI Threat Landscape carries no resolvable citation — the claim is uncited. open node →
Compliance brief
This use case is high-risk under the EU AI Act (High Risk); the provider and deployer obligations apply in full.
What is owed
- Art. 9. Continuous, iterative risk-management system across the whole lifecycle: identify, estimate, evaluate, mitigate; testing incl.
- Art. 10. Quality criteria for training/validation/test data: relevance, representativeness, error-freeness, bias detection & mitigation, data-governance procedures.
- Art. 11. Annex IV technical file before placing on market: system description, architecture, capabilities/limitations, risk measures — kept up to date.
- Art. 12. Requires logging CAPABILITY over the system's lifetime, recording events relevant to identifying situations that may present an Art.
- Art. 13. Instructions for use: capabilities, limitations, intended purpose, human-oversight measures, expected accuracy.
Dates that bind
- 2024-08-01 — AI Act enters into force. Regulation (EU) 2024/1689 in force; countdown for all staged obligations starts.
- 2025-02-02 — Prohibitions + AI literacy. Art. 5 prohibited practices ban applies (manipulation, social scoring, untargeted face scraping, workplace emotion recognition); Art. 4 AI literacy duty.
Maximum exposure
- EU AI Act: Tiered: €35m / 7% (prohibited practices); €15m / 3% (Art. 9–15 high-risk obligations incl. data governance, documentation, logging); €7.5m / 1% (Art. 99(5) — incorrect, incomplete or misleading information to notified bodies or national competent authorities)
- ECOA / CFPB Adverse-Action Regime: CFPB enforcement, civil liability
- Fair Housing Act (US): HUD administrative enforcement and civil actions (42 U.S.C. §§ 3610–3614): actual and punitive damages, civil penalties, injunctive relief; the Department of Justice may bring pattern-or-practice suits.
- Mortgage Credit Directive (MCD): Art. 38: Member States must lay down the rules on sanctions for infringements of the national provisions adopted under the Directive and ensure they are implemented; the sanctions must be 'effective, proportionate and dissuasive', and the competent authority may disclose administrative sanctions to the public unless that would seriously jeopardise the financial markets or cause disproportionate damage to the parties involved. The concrete fines and remedies are set by each Member State's transposing law.
- TILA-RESPA Integrated Disclosure Rule (TRID): Civil liability under TILA § 130 (15 U.S.C. § 1640(a)): a creditor that fails to comply with a requirement of the Act is liable for actual damages and, for closed-end credit secured by real property, statutory damages of not less than $400 or greater than $4,000, plus costs and a reasonable attorney's fee in a successful action; § 1640(a) limits statutory damages for section 1638 disclosures to the specific provisions it lists, so exposure for a given Loan Estimate or Closing Disclosure defect depends on the requirement breached. Actions are generally brought within one year of the violation (§ 1640(e)). The CFPB may also sue to impose civil penalties or seek legal and equitable relief for violations of TILA and Regulation Z, which are 'Federal consumer financial law' (12 U.S.C. §§ 5481(12)(O), 5481(14), 5564(a)).
- FCRA: Willful noncompliance exposes the violator to actual damages or statutory damages of not less than $100 and not more than $1,000 per consumer plus punitive damages and attorney's fees (§ 1681n(a)); negligent noncompliance to actual damages and fees (§ 1681o(a)); the FTC enforces under the FTC Act with civil penalties of not more than $2,500 per violation (statutory figure, inflation-adjusted) for knowing pattern-or-practice violations, the CFPB holds rulemaking authority, and state officials may sue for injunctions and damages (§ 1681s(a), (c), (e)) — but the § 1681m adverse-action duties carry no private action and are enforced exclusively by the agencies and officials named in § 1681s (§ 1681m(h)(8)).
- EU Equal Treatment Directives (Goods, Services, Social Protection): Both directives leave penalties to Member States: Art. 14 Dir. 2004/113/EC and Art. 15 Dir. 2000/43/EC require national rules on penalties/sanctions for infringements of the transposing provisions, which 'may comprise the payment of compensation to the victim' and must be 'effective, proportionate and dissuasive'; Art. 8(2) Dir. 2004/113/EC additionally requires real and effective compensation or reparation that a prior upper limit may not restrict.
- AGG (German General Equal Treatment Act): Enforcement is private-law only: employers owe damages and, for non-pecuniary harm, monetary compensation (§ 15, capped at three months' salary where the applicant would not have been hired even without discrimination), civil-law counterparties owe removal, injunction, damages and compensation (§ 21), discriminatory contract terms are void (§ 7 Abs. 2) and the burden of proof shifts under § 22; the Act provides no administrative fines or criminal penalties and claims must be asserted within two months (§ 15 Abs. 4, § 21 Abs. 5).
- Colorado AI Act: Enforcement by the Colorado Attorney General (unfair trade practice)
- Colorado ADMT Act (SB 26-189): Exclusive Colorado Attorney General enforcement under the Colorado Consumer Protection Act as a deceptive trade practice; no private right of action; up to $20,000 per violation; 60-day notice-and-cure period that sunsets 1 January 2030
First five actions
- Confirm in writing whether this organisation builds/places the system on the market (provider) or only operates it (deployer), since the role is not yet established.
- Commission and confirm the Art. 9, Art. 10, Art. 11 obligations named above as active workstreams with an accountable owner.
- Design and document a human-oversight procedure appropriate to how this system is used.
- Produce the technical documentation and evidence artefacts already mapped to this use case (Live Risk Register / Posture Management, Watchdog Supervisor & Rate Limiting, Deterministic Policy Engine (OPA / Cedar)) before they are requested.
- Put 2024-08-01 — AI Act enters into force — into the compliance calendar with an owner and lead time.
Terms used above: · · ·
This brief is based on partial coverage — no threat profile is mapped yet.
Classification precedent
Consensus reading: High Risk open in the graph →
Residential mortgage underwriting is governed by dedicated regimes that a general consumer-credit scoring profile does not reach. In the EU, Directive (EU) 2023/2225 (CCD2, the basis of uc-credit's EU trigger) does not apply to credit secured by a mortgage or taken to acquire or retain property rights in land or a building (Art. 2(2)(a)–(b)), so consumer mortgage lending falls under Directive 2014/17/EU, whose Art. 18 requires a thorough creditworthiness assessment on documented procedures, bars relying predominantly on the property's value or an assumed rise in it, and requires a rejected applicant to be told, where applicable, that the decision rests on automated processing. In the US, on top of ECOA/Regulation B's general adverse-action duties (shared with uc-credit), first-lien dwelling credit adds the 12 CFR 1002.14 duties to give the applicant a copy of every appraisal or other written valuation — AVM reports included — and written notice of that right, and closed-end mortgages carry the Loan Estimate timing and good-faith cost-tolerance rules of 12 CFR 1026.19(e). The Fair Housing Act (42 U.S.C. § 3605) separately prohibits discrimination in residential real estate-related lending on grounds that include handicap and familial status, which ECOA's list omits, and disparate-impact claims are cognizable under it. The pattern stays an Annex III point 5(b) creditworthiness system, high-risk under the EU AI Act like general credit scoring.
What the reading rests on — the provisions this classification actually pulls in:
- Art. 9 — Risk Management
- Art. 10 — Data Governance
- Art. 11 — Technical Documentation
- Art. 12 — Record-Keeping / Logging
- Art. 13 — Transparency to Deployers
- Art. 14 — Human Oversight
- Art. 15 — Accuracy, Robustness, Cybersecurity
- Art. 17 — Quality Management System
No dissenting reading is recorded for this case. That means nobody has filed one yet — not that the classification is beyond argument. file a dissent with a source →
Baseline: of 100+, 40% were not definitively classifiable (18% clearly high-risk, 42% clearly low-risk). appliedAI Institute — AI Act risk classification of AI systems from a practical perspective
Applicable Regulations (11)
EU AI Act (Regulation (EU) 2024/1689)
unverified · verified 2026-08-12 source (as amended) EUR-LexAmended by Regulation (EU) 2026/1744. Verified 16 Aug 2026: the popular mirrors have not yet been updated — artificialintelligenceact.eu still serves the unamended 13 June 2024 text with no disclaimer, and the Commission's AI Act Service Desk pages still show pre-omnibus text with a visible omnibus disclaimer. Read the OJ or consolidated text on EUR-Lex. in force EU
Horizontal, risk-based product-safety law for AI systems and GPAI models. Extraterritorial market-place principle. Staged applicability 2025–2030 (Digital Omnibus: Art. 50 → 2 Aug 2026, Annex III → 2 Dec 2027, Annex I → 2 Aug 2028). (Digital Omnibus: Regulation (EU) 2026/1744, in force 27 July 2026).
Sanctions: Tiered: €35m / 7% (prohibited practices); €15m / 3% (Art. 9–15 high-risk obligations incl. data governance, documentation, logging); €7.5m / 1% (Art. 99(5) — incorrect, incomplete or misleading information to notified bodies or national competent authorities)
ECOA / CFPB Adverse-Action Regime
in-force · verified 2026-09-05 in force US
Equal Credit Opportunity Act + CFPB guidance: credit denials require specific, accurate, legally defensible reasons — generic 'the model said no' fails. Forces architectural decoupling of scoring from decisioning and reason-code generation.
Sanctions: CFPB enforcement, civil liability
Fair Housing Act (US) (Fair Housing Act, Title VIII of the Civil Rights Act of 1968, 42 U.S.C. §§ 3601–3619)
42 U.S.C. § 3604(a) makes it unlawful to refuse to rent, to refuse to negotiate for the rental of, or otherwise to make unavailable or deny a dwelling to any person because of race, color, religion, sex, familial status or national origin; § 3604(b) covers discrimination in the terms, conditions or privileges of rental. HUD's discriminatory-effects rule (24 CFR 100.500) makes a screening or pricing practice unlawful where it has an unjustified disparate impact, so a tenant-scoring or rent-setting model is judged on effect, not intent.
Sanctions: HUD administrative enforcement and civil actions (42 U.S.C. §§ 3610–3614): actual and punitive damages, civil penalties, injunctive relief; the Department of Justice may bring pattern-or-practice suits.
Mortgage Credit Directive (MCD) (Directive 2014/17/EU of the European Parliament and of the Council of 4 February 2014 on credit agreements for consumers relating to residential immovable property and amending Directives 2008/48/EC and 2013/36/EU and Regulation (EU) No 1093/2010, as amended by Regulation (EU) 2016/1011 and Directive (EU) 2021/2167)
EU regime for credit agreements with consumers that are secured by a mortgage or comparable security on residential immovable property, or taken to acquire or retain property rights in land or a building (Art. 3(1)); the Consumer Credit Directive II does not apply to such credit (Directive (EU) 2023/2225, Art. 2(2)(a)–(b)). Art. 18 requires a thorough creditworthiness assessment before the agreement is concluded, on procedures and information that are established, documented and maintained (Art. 18(1)–(2)); the assessment must not rely predominantly on the property's value exceeding the credit or on an assumed rise in that value unless the credit finances construction or renovation (Art. 18(3)); credit may be made available only where the assessment indicates the obligations are likely to be met (Art. 18(5)(a)); and a rejected consumer must be told without delay and, where applicable, that the decision is based on automated processing of data (Art. 18(5)(c)). Art. 20(1) requires the assessment to rest on necessary, sufficient and proportionate information on income, expenses and other financial and economic circumstances, appropriately verified.
Sanctions: Art. 38: Member States must lay down the rules on sanctions for infringements of the national provisions adopted under the Directive and ensure they are implemented; the sanctions must be 'effective, proportionate and dissuasive', and the competent authority may disclose administrative sanctions to the public unless that would seriously jeopardise the financial markets or cause disproportionate damage to the parties involved. The concrete fines and remedies are set by each Member State's transposing law.
TILA-RESPA Integrated Disclosure Rule (TRID) (Integrated Mortgage Disclosures Under the Real Estate Settlement Procedures Act (Regulation X) and the Truth in Lending Act (Regulation Z), 78 FR 79730 (31 December 2013), effective 3 October 2015 (80 FR 43911) — the Loan Estimate and Closing Disclosure requirements codified in Regulation Z at 12 CFR 1026.19(e)–(f), 1026.37 and 1026.38)
CFPB rule under the Truth in Lending Act and RESPA that gives most closed-end consumer mortgages two disclosures in Regulation Z. The Loan Estimate — good-faith estimates of the § 1026.37 disclosures — must be delivered or mailed not later than the third business day after the creditor receives the application and not later than the seventh business day before consummation (12 CFR 1026.19(e)(1)(iii)); the Closing Disclosure must be received no later than three business days before consummation (1026.19(f)(1)(ii)(A)). Estimated closing costs are tested against what is charged: generally no increase over the amount disclosed, a 10% aggregate tolerance for third-party and recording fees the consumer may shop for that are not paid to the creditor or an affiliate, and a 'best information reasonably available' standard for listed charges (1026.19(e)(3)); where the interest rate was not locked, a revised Loan Estimate is due within three business days after the rate is locked (1026.19(e)(3)(iv)(D)). It applies to a closed-end consumer credit transaction secured by real property or a cooperative unit, other than a reverse mortgage subject to § 1026.33; open-end lines (HELOCs), loans secured only by a dwelling not attached to real property, business-purpose credit (1026.3(a)(1)) and lenders that are not 'creditors' under 1026.2(a)(17)(v) fall outside it. Per the CFPB's Small Entity Compliance Guide (§ 4.1), construction-only loans and loans secured by vacant land or by 25 or more acres are also covered.
Sanctions: Civil liability under TILA § 130 (15 U.S.C. § 1640(a)): a creditor that fails to comply with a requirement of the Act is liable for actual damages and, for closed-end credit secured by real property, statutory damages of not less than $400 or greater than $4,000, plus costs and a reasonable attorney's fee in a successful action; § 1640(a) limits statutory damages for section 1638 disclosures to the specific provisions it lists, so exposure for a given Loan Estimate or Closing Disclosure defect depends on the requirement breached. Actions are generally brought within one year of the violation (§ 1640(e)). The CFPB may also sue to impose civil penalties or seek legal and equitable relief for violations of TILA and Regulation Z, which are 'Federal consumer financial law' (12 U.S.C. §§ 5481(12)(O), 5481(14), 5564(a)).
FCRA — US Fair Credit Reporting Act (Fair Credit Reporting Act (Title VI of the Consumer Credit Protection Act), Pub. L. 91-508, title VI, Oct. 26, 1970, 84 Stat. 1128, codified at 15 U.S.C. §§ 1681–1681x, as amended (most recently by Pub. L. 119-36, Sept. 5, 2025))
The FCRA governs the assembly, furnishing and use of 'consumer reports' — communications by a consumer reporting agency bearing on a consumer's creditworthiness, character, personal characteristics or mode of living that are used to establish eligibility for credit, insurance, employment or another permissible purpose (15 U.S.C. § 1681a(d)(1), § 1681b(a)(3)). An AI system that consumes third-party consumer-report data (credit-bureau files, background-screening dossiers, third-party algorithmic scores) to score borrowers, price insurance or evaluate candidates inherits the user duties: a permissible purpose, stand-alone written disclosure and written authorisation before procuring a report for employment purposes (§ 1681b(b)(2)), a copy of the report before an employment adverse action (§ 1681b(b)(3)), and an adverse-action notice disclosing the numerical credit score used, the source agency and dispute rights (§ 1681m(a)). Entities that assemble or evaluate consumer information for furnishing to third parties are themselves consumer reporting agencies (§ 1681a(f)) bound by the Act's reasonable-procedures purpose regarding confidentiality, accuracy, relevancy and proper utilization (§ 1681(b)).
Sanctions: Willful noncompliance exposes the violator to actual damages or statutory damages of not less than $100 and not more than $1,000 per consumer plus punitive damages and attorney's fees (§ 1681n(a)); negligent noncompliance to actual damages and fees (§ 1681o(a)); the FTC enforces under the FTC Act with civil penalties of not more than $2,500 per violation (statutory figure, inflation-adjusted) for knowing pattern-or-practice violations, the CFPB holds rulemaking authority, and state officials may sue for injunctions and damages (§ 1681s(a), (c), (e)) — but the § 1681m adverse-action duties carry no private action and are enforced exclusively by the agencies and officials named in § 1681s (§ 1681m(h)(8)).
Revised Product Liability Directive (Directive (EU) 2024/2853)
Extends strict defect liability to standalone software and AI — including systems that continue learning post-deployment. Covers physical harm, property damage, psychological health impairment and non-professional data loss; disclosure duties and rebuttable defect presumption shift the burden of proof toward the injured party. Makes reconstructible decision evidence an economic necessity.
EU Equal Treatment Directives (Goods, Services, Social Protection) (Council Directive 2004/113/EC of 13 December 2004 implementing the principle of equal treatment between men and women in the access to and supply of goods and services (OJ L 373, 21.12.2004, pp. 37–43) — bundled with Council Directive 2000/43/EC of 29 June 2000 implementing the principle of equal treatment between persons irrespective of racial or ethnic origin (OJ L 180, 19.7.2000, pp. 22–26), Art. 3(1)(e)–(h))
in-force · verified 2026-09-11 in force EU
Directive 2004/113/EC prohibits direct and indirect discrimination based on sex, harassment and instructions to discriminate by anyone who provides goods and services available to the public (Art. 3, Art. 4), and Art. 5(1) requires that the use of sex as a factor in calculating premiums and benefits for insurance and related financial services shall not result in differences in individuals' premiums and benefits; the Member-State exemption in Art. 5(2) was declared invalid by the CJEU in C-236/09 Test-Achats with effect from 21 December 2012. Directive 2000/43/EC applies the same concept of direct and indirect discrimination on grounds of racial or ethnic origin outside employment to social protection including social security and healthcare, social advantages, education, and goods and services including housing (Art. 3(1)(e)–(h)). AI systems that price, score, rank or decide access in these fields are affected because their input features, scores and thresholds are 'apparently neutral' criteria that can put a protected group at a particular disadvantage, and both directives shift the burden of proof to the respondent once a prima facie case is established (Art. 9 / Art. 8).
Sanctions: Both directives leave penalties to Member States: Art. 14 Dir. 2004/113/EC and Art. 15 Dir. 2000/43/EC require national rules on penalties/sanctions for infringements of the transposing provisions, which 'may comprise the payment of compensation to the victim' and must be 'effective, proportionate and dissuasive'; Art. 8(2) Dir. 2004/113/EC additionally requires real and effective compensation or reparation that a prior upper limit may not restrict.
AGG (German General Equal Treatment Act) (Allgemeines Gleichbehandlungsgesetz (AGG) vom 14. August 2006 (BGBl. I S. 1897), zuletzt geändert durch Artikel 15 des Gesetzes vom 22. Dezember 2023 (BGBl. 2023 I Nr. 414))
in-force · verified 2026-09-10 in force DEthin
The AGG is Germany's general anti-discrimination statute transposing Directives 2000/43/EC, 2000/78/EC, 2004/113/EC and 2002/73/EC (recast as 2006/54/EC); it prohibits direct and indirect disadvantage on grounds of race or ethnic origin, sex, religion or belief, disability, age or sexual identity in employment (§§ 6-18, expressly including selection criteria and recruitment conditions for applicants) and in civil-law mass transactions and private insurance (§§ 19-21). An AI system used for candidate screening, performance or bonus scoring, credit decisioning or insurance pricing applies 'Kriterien oder Verfahren' within § 3 Abs. 2, so facially neutral model features that disproportionately disadvantage a protected group are unlawful unless objectively justified and proportionate, and once indicia of disadvantage are shown § 22 places the burden of proving no violation on the operator.
Sanctions: Enforcement is private-law only: employers owe damages and, for non-pecuniary harm, monetary compensation (§ 15, capped at three months' salary where the applicant would not have been hired even without discrimination), civil-law counterparties owe removal, injunction, damages and compensation (§ 21), discriminatory contract terms are void (§ 7 Abs. 2) and the burden of proof shifts under § 22; the Act provides no administrative fines or criminal penalties and claims must be asserted within two months (§ 15 Abs. 4, § 21 Abs. 5).
Colorado AI Act (Colorado SB 24-205)
repealed — reenacted by SB 26-189 (2026); never took effect · verified 2026-08-12 status source ↗ repealed — not applicable law US-CO
First comprehensive US state AI law as enacted in 2024 (duty of reasonable care for developers and deployers of high-risk AI making consequential decisions in employment, credit, housing, insurance and health; impact assessments, risk-management programme, consumer notice and appeal rights). It NEVER TOOK EFFECT: scheduled for 30 June 2026, enforcement was stayed pre-operative and the text was repealed and reenacted by SB 26-189 before its operative date. Read the duty set below as the 2024 text only — the law in force for Colorado is the ADMT Act (SB 26-189).
Sanctions: Enforcement by the Colorado Attorney General (unfair trade practice)
Colorado ADMT Act (SB 26-189) (Colorado SB 26-189)
enacted-not-yet-applicable · verified 2026-08-17 status source ↗ source leg.colorado.gov enacted — not yet applicable US-CO
Repeal-and-reenactment of SB 24-205, signed 14 May 2026 before its predecessor ever took effect. Regulates "automated decision-making technology" (ADMT); the regulated subset is "covered ADMT" — ADMT that materially influences a consequential decision. A consequential decision is "a decision that relates to an individual's access to, eligibility for, or compensation related to education, employment, housing, financial or lending services, insurance, health-care services, or essential government services and public benefits." It drops three duties SB 24-205 had carried: the duty of reasonable care to prevent algorithmic discrimination, the impact-assessment requirement and the risk-management-programme mandate. What remains is notice, adverse-outcome disclosure, consumer rights and recordkeeping.
Sanctions: Exclusive Colorado Attorney General enforcement under the Colorado Consumer Protection Act as a deceptive trade practice; no private right of action; up to $20,000 per violation; 60-day notice-and-cure period that sunsets 1 January 2030
Legal Obligations (15)
density
Art. 9 — Risk Management
Continuous, iterative risk-management system across the whole lifecycle: identify, estimate, evaluate, mitigate; testing incl. against misuse.
unverified · no verification date read the article artificialintelligenceact.eu
Art. 10 — Data Governance
Quality criteria for training/validation/test data: relevance, representativeness, error-freeness, bias detection & mitigation, data-governance procedures.
unverified · no verification date read the article artificialintelligenceact.eu
Art. 11 — Technical Documentation
Annex IV technical file before placing on market: system description, architecture, capabilities/limitations, risk measures — kept up to date.
unverified · no verification date read the article artificialintelligenceact.eu
Art. 12 — Record-Keeping / Logging
Requires logging CAPABILITY over the system's lifetime, recording events relevant to identifying situations that may present an Art. 79(1) risk or lead to a substantial modification, and to post-market monitoring (Art. 72) and deployer monitoring (Art. 26(5)). SCOPE: the itemised minimum log content of Art. 12(3) — period of each use with start and end date and time; the reference database against which input data was checked; the input data for which the search led to a match; the identification of the natural persons involved in verification of the results per Art. 14(5) — applies ONLY to Annex III point 1(a) remote biometric identification systems, not to all high-risk systems. RETENTION: providers (Art. 19) and deployers (Art. 26(6)) must keep the logs under their control for a period appropriate to the intended purpose, at least six months, unless other Union or national law — in particular data-protection law — provides otherwise. A bolted-on logging wrapper does not satisfy the requirement: logging must be core architecture.
in-force · verified 2026-08-12 read the article artificialintelligenceact.eu
Art. 13 — Transparency to Deployers
Instructions for use: capabilities, limitations, intended purpose, human-oversight measures, expected accuracy.
unverified · no verification date read the article artificialintelligenceact.eu
Art. 14 — Human Oversight
Effective human oversight by qualified, trained natural persons with real authority to intervene, override and stop; interface duties (interpretability, automation-bias countermeasures); oversight must be commensurate with autonomy level. Competence and authority of the overseers is itself a testable control objective — training records and oversight protocols are its evidence.
unverified · no verification date read the article artificialintelligenceact.eu
Art. 15 — Accuracy, Robustness, Cybersecurity
Appropriate accuracy levels, resilience against errors and adversarial attacks (data poisoning, evasion, prompt injection), declared metrics.
unverified · no verification date read the article artificialintelligenceact.eu
Art. 17 — Quality Management System
Product-focused QMS for providers: strategy, design controls, data management, post-market monitoring — target of EN 18286:2026, the first AI Act harmonised-standard candidate to be published; presumption of conformity applies only once it is cited in the OJEU, which is still pending.
unverified · no verification date read the article artificialintelligenceact.eu
Art. 43 — Conformity Assessment
Two pathways: internal control self-assessment (Annex VI) for most Annex III systems (HR, credit, education) — provider verifies QMS (Art. 17), technical file (Annex IV) and design consistency; notified-body assessment (Annex VII) mandatory for safety components in harmonised products (medical devices, aviation, rail) and remote biometric identification. Harmonised standards in the OJEU give presumption of conformity. Art. 43(4): a substantial modification of a high-risk system within Art. 3(23) requires a fresh conformity assessment — BUT changes that were pre-determined by the provider at the time of the initial conformity assessment and documented in the technical documentation under Annex IV point 2(f) do NOT constitute a substantial modification. That carve-out is the legal basis on which a continual-learning system may keep retraining after certification, and its boundary is exactly the documented corridor.
in-force · verified 2026-08-17 read the article artificialintelligenceact.eu
Art. 72/73 — Post-Market Monitoring & Incidents
Post-market monitoring plan and serious-incident reporting (15 days; 2 days for widespread infringement) to market-surveillance authorities.
in-force · verified 2026-08-11 read the article ai-act-service-desk.ec.europa.eu
Art. 26 — Deployer Obligations
Use per instructions, assign competent human oversight, input-data control, inform workers, incident duty. Art. 26(6): keep the logs generated by the high-risk system that are under the deployer's control for a period appropriate to the intended purpose, at least six months, unless other Union or national law — in particular data-protection law — provides otherwise.
in-force · verified 2026-08-12 read the article artificialintelligenceact.eu
Art. 47/48 — CE Marking & Declaration of Conformity
After passing conformity assessment: written EU Declaration of Conformity (retained 10 years) and visible, indelible CE marking — for digital systems a digital CE mark accessible via UI or machine-readable code; notified-body number displayed where one was involved.
unverified · no verification date read the article artificialintelligenceact.eu
Art. 27 — Fundamental Rights Impact Assessment
Deployers that are public bodies, or private operators providing public services, plus deployers of creditworthiness and life/health insurance pricing systems, must assess the fundamental-rights impact before first use: processes of use, period and frequency, affected persons and groups, specific risks of harm, human-oversight implementation, and the measures taken if risks materialise. Art. 27(4): where a DPIA has already been carried out, the FRIA complements it.
in-force · verified 2026-08-11 read the article artificialintelligenceact.eu
Art. 6 — Classification rules for high-risk AI systems
Decides whether an Annex III system is high-risk. Paragraph 3 opens a derogation for systems that pose no significant risk of harm, subject to four disjunctive conditions — but profiling of natural persons always keeps the system high-risk. A provider that uses the derogation still owes a documented assessment before market placement, Art. 49(2) registration in the EU database (Art. 71) and production of the documentation on request (Art. 6(4)).
in-force · verified 2026-08-16 source (as amended) EUR-Lexconvenience mirror — not updated artificialintelligenceact.euAmended by Regulation (EU) 2026/1744. Verified 16 Aug 2026: the popular mirrors have not yet been updated — artificialintelligenceact.eu still serves the unamended 13 June 2024 text with no disclaimer, and the Commission's AI Act Service Desk pages still show pre-omnibus text with a visible omnibus disclaimer. Read the OJ or consolidated text on EUR-Lex.
Art. 86 — Right to explanation of individual decision-making
An affected person subject to a decision taken by a deployer on the basis of the output of an Annex III high-risk system, where that decision produces legal effects or similarly significantly affects them, may obtain clear and meaningful explanations of the role of the AI system in the decision procedure and the main elements of the decision taken.
in-force · verified 2026-08-17 read the article artificialintelligenceact.eu
Control Objectives (15)
obligation (article) → operationalized_by → control objective → satisfied_by → component/pattern; control objective → evidenced_by → evidence artifact
Art. 9
Pre-Deployment AI Risk & Impact Assessment
ISO 42001 Clauses 6.1 / 8.2: every workflow is risk-assessed and impact-assessed before production, covering fundamental rights, availability, privacy and legal liability.
ISO/IEC 42001 clause 8.2 (indicative)
satisfied by: AI Register & Model Registry / Factsheets
evidenced by: AI Impact Assessment (AIIA)
Art. 10
Data Quality & Origin Management
ISO 42001 Annex A.7: training, fine-tuning and RAG corpora are audited for lineage, quality, representativeness and IP clearance.
ISO/IEC 42001 clause A.7 (indicative)
satisfied by: Data Lineage & Versioning
evidenced by: Dataset Documentation & Bias Reports
Art. 11
control layer: community mandate — propose objectives
Art. 12
Log Completeness & Coverage
Every lifecycle-relevant event is captured with the FprEN ISO/IEC 24970 field set (input/output traces, timestamps, acting identity, referenced sources, human overrides) across all execution paths — including tool calls, retries and degraded modes. Testable: trace-coverage sampling against the event taxonomy; gaps are findings.
satisfied by: OpenTelemetry / FCoT TracingWORM / Immutable Audit Vault
evidenced by: Event Logs & Decision Traces
Log Integrity & Non-Repudiation
Recorded events cannot be altered, reordered or deleted without detection — including by administrators of the log store. Testable: hash-chain verification, external-anchor reconciliation, red-team attempt to rewrite history. This is the control objective the WORM vault alone does not fully satisfy.
evidenced by: Event Logs & Decision Traces · Immutable Decision Ledger (WORM)
Log Access & Retention Governance
Logs are retained per regime (deployer ≥ 6 months, financial institutions per audit rules, provider lifetime scopes), access is least-privilege and itself logged, and lawful disclosure (authority request, PLD disclosure order) is executable without exposing unrelated data. Testable: retention audit, access-review, disclosure fire drill.
evidenced by: Human-Oversight Protocol & Intervention Records
Art. 13
System Traceability & Decision Transparency
ISO 42001 Annex A.8: documented mechanisms explain how a given decision was produced, enabling root-cause analysis after an incident.
ISO/IEC 42001 clause A.8 (indicative)
satisfied by: OpenTelemetry / FCoT Tracing
evidenced by: AI System Model Card
Art. 14
Oversight Competence & Authority
The natural persons overseeing the system are trained for it, have documented authority to intervene/override/stop, actually exercise it (override rates monitored against automation bias), and their competence is refreshed on system change. Testable: training records, oversight-protocol drills, override statistics.
ISO/IEC 42001 clause 7.2 (indicative)
satisfied by: HITL Escalation Queue & Review UI
evidenced by: AI Literacy Training Records · Human-Oversight Protocol & Intervention Records · Human Oversight Operating Standard (SOP)
Art. 15
Adversarial Robustness Verified
Resilience against evasion, poisoning and extraction is demonstrated against the declared threat model at a defined cadence, with metrics per ISO/IEC 4213 / 24029 and regressions gated. Testable: red-team reports with reproducible probes; a passed probe from last year is not evidence for this year's model.
satisfied by: Bias Testing & Data Quality Pipeline
evidenced by: Accuracy, Robustness & Red-Teaming Reports
Runtime Injection Defense
Direct and indirect prompt injection attempts are detected, contained or neutralized at runtime across all ingestion paths (user input, retrieved documents, tool outputs, inter-agent messages). Testable: guardrail telemetry with measured catch rates against a maintained injection corpus; command/data separation enforced structurally, not by instruction.
satisfied by: Input Rails / Prompt ShieldsGuardrail Sidecar / InterceptionTrinity Defense (TCB + Command Gates + IFC)Tool-Use Boundary Proxy
evidenced by: Guardrail Telemetry & Sanitization Records
Non-Human Identity Governance
Every agent, tool caller and service account has a distinct identity, receives credentials that are ephemeral and scoped to a single task, and loses them automatically on completion, escalation or anomaly. No agent holds a standing credential to a production system. Testable: inventory of non-human identities vs. issued credentials, median credential lifetime, revocation drill, search for long-lived secrets in agent configuration.
evidenced by: Event Logs & Decision Traces
Art. 17
Model Registry Gate & Drift Interlock
Practice-derived control objective: no model version reaches production except through a registry gate that evaluates the candidate against the corridors recorded in the Predetermined Change Control Plan. Distribution drift is measured (population stability index, distributional distance on the decisive features, performance on the held-out and subgroup slices) and the gate BLOCKS the automated rollout when a corridor is exceeded, routing the change to re-assessment instead of shipping it. Testable: a deliberately drifted candidate must be refused; every rollout must have a gate decision record; a bypassed gate must be detectable after the fact.
ISO/IEC 42001 clause 9.1 (indicative)
evidenced by: Drift-Gate Decision Log · Predetermined Change Control Plan (PCCP)
Art. 43
Model Registry Gate & Drift Interlock
Practice-derived control objective: no model version reaches production except through a registry gate that evaluates the candidate against the corridors recorded in the Predetermined Change Control Plan. Distribution drift is measured (population stability index, distributional distance on the decisive features, performance on the held-out and subgroup slices) and the gate BLOCKS the automated rollout when a corridor is exceeded, routing the change to re-assessment instead of shipping it. Testable: a deliberately drifted candidate must be refused; every rollout must have a gate decision record; a bypassed gate must be detectable after the fact.
ISO/IEC 42001 clause 9.1 (indicative)
evidenced by: Drift-Gate Decision Log · Predetermined Change Control Plan (PCCP)
Art. 72/73
Performance Monitoring & Drift Management
ISO 42001 Clauses 9 & 10: continuous accuracy, drift and incident monitoring feeding internal audit and recertification.
ISO/IEC 42001 clause 9.1 (indicative)
satisfied by: Model Drift & Accuracy Monitor
evidenced by: Post-Market Monitoring Plan & Incident Reports
Model Registry Gate & Drift Interlock
Practice-derived control objective: no model version reaches production except through a registry gate that evaluates the candidate against the corridors recorded in the Predetermined Change Control Plan. Distribution drift is measured (population stability index, distributional distance on the decisive features, performance on the held-out and subgroup slices) and the gate BLOCKS the automated rollout when a corridor is exceeded, routing the change to re-assessment instead of shipping it. Testable: a deliberately drifted candidate must be refused; every rollout must have a gate decision record; a bypassed gate must be detectable after the fact.
ISO/IEC 42001 clause 9.1 (indicative)
evidenced by: Drift-Gate Decision Log · Predetermined Change Control Plan (PCCP)
Art. 26
Embedded-AI Vendor Governance
Every third-party system with embedded AI (closed SaaS, productized services, model APIs) is inventoried, risk-tiered and governed by contract and attestation — because inline runtime inspection is architecturally impossible in a vendor's closed execution path. Required: intake-based vendor risk workflow, contractual ZDR & non-training clauses, AI-BOM/Factsheet disclosure, attestation review cadence, exit strategy. Testable: sample vendor list vs. register completeness; check contracts for AI clauses; verify attestations current.
ISO/IEC 42001 clause A.10 (indicative)
satisfied by: Vendor & Model Due-Diligence KitAI Register & Model Registry / FactsheetsShadow-AI Discovery & Asset Inventory Scanner
evidenced by: Vendor & Model Due-Diligence Records · C5 / AIC4 Cloud Attestation · AI Bill of Materials (AI-BOM) & Factsheets · AI System Inventory / Registry Entry
Art. 47/48
control layer: community mandate — propose objectives
Art. 27
control layer: community mandate — propose objectives
Art. 6
control layer: community mandate — propose objectives
Art. 86
control layer: community mandate — propose objectives
Take this into your GRC tooling
A control mapping your ISO/IEC 42001 or CSA AICM workbook can ingest, and an Annex IV skeleton to start the technical file from. Indicative mappings only — cells we are not confident about are exported empty rather than filled in.
Standards & Evidence
ISO/IEC 23894 (AI Risk Management)
AI risk-management guidance extending ISO 31000 — feeds the Art. 9 risk-management system.
unverified · no verification date publisher ISO
evidence for: Art. 9
NIST AI RMF 1.0
Govern–Map–Measure–Manage risk framework; Map/Measure functions populate the Art. 9 risk register with quantified values; the transatlantic mapping reference.
unverified · no verification date
evidence for: Art. 9
FAIR-AIR / FAIR-MAM
AI extension of Factor Analysis of Information Risk: Expected Financial Loss = Loss Event Frequency (threat frequency × vulnerability) × Loss Magnitude (primary + secondary), run as Monte Carlo distributions — the standard bridge from technical AI failure modes to board-level monetary exposure.
unverified · no verification date
evidence for: Art. 9
NIST AI 600-1 (GenAI Profile)
Companion profile to the AI RMF covering twelve GenAI-specific failure modes — confabulation, prompt injection, value-chain propagation and others — as the technical checklist behind Map/Measure for generative systems.
unverified · no verification date
evidence for: Art. 9 · Art. 15
prEN 18228 (AI Risk Management)
AI risk-management requirements deliverable of the JTC 21 core package — the harmonised-standard candidate behind Art. 9.
evidence for: Art. 9
ISO/IEC 5259 (Data Quality for ML)
Five-part data-quality framework (governance, process, management) — direct evidence path for Art. 10 representativeness and completeness.
unverified · no verification date publisher ISO
evidence for: Art. 10
JTC 21 Technical Package (prEN 18228/18229/18281–83)
CEN-CENELEC JTC 21 technical package under standardisation request M/593 (prEN 18228 trustworthiness, 18229 risk management, 18281–83 CV/NLP evaluation et al.); staged drafts, none OJEU-cited yet — Annex III applicability (Dec 2027) is Omnibus-coupled to their availability.
evidence for: Art. 10 · EU AI Act
prEN 18284 (Data Sets and Data Governance)
Data-set and data-governance deliverable of the JTC 21 core package — the concrete evidence path for Art. 10.
evidence for: Art. 10
prEN 18283 (Bias Treatment)
Bias-treatment deliverable of the JTC 21 core package — operational target for the Art. 10 data-governance duties on bias.
evidence for: Art. 10
EN ISO/IEC 22989 (AI Concepts)
Published terminology and concepts standard — the shared vocabulary layer for documentation and audits.
unverified · no verification date publisher ISO
evidence for: Art. 11
FprEN ISO/IEC 24970 (AI Logging)
Specifies event logging in AI systems — the concrete implementation target for Art. 12 record-keeping.
evidence for: Art. 12
TAGOF (Audit-as-Code)
Operationalizes governance as code in CI/CD: policy-as-code enforcement, continuous runtime telemetry and automatically generated audit evidence — the execution layer that replaces periodic audits with continuous assurance.
unverified · no verification date
evidence for: Art. 12
prEN ISO/IEC 12792 (Transparency Taxonomy)
Transparency taxonomy for AI systems: structured disclosure of system composition, data provenance, capabilities and limitations. The harmonised-norm candidate backing Art. 13 instructions-for-use and deployer-information duties — defines what a complete transparency package must contain.
evidence for: Art. 13
OWASP Agentic Security (AST10 / Core Risks)
Threat framework for autonomous agents: tool misuse, excessive agency, confused-deputy, memory poisoning — with AIVSS scoring.
unverified · no verification date
evidence for: Art. 14
IMDA Agentic AI Governance Framework (SG)
Model AI Governance Framework for Agentic AI (Jan 2026, updated Jun 2026) — first state-issued agentic-specific guidance: bounded autonomy levels, action-space and interface restrictions, human-in-command checkpoints, automation-bias controls, logging & attribution expectations. No legal force in the EU, but the most concrete public benchmark for Art. 14-style oversight design of agent systems.
published · verified 2026-08-04 status unsourced
evidence for: Art. 14
DIN SPEC 92001-1/-2/-3
AI life-cycle quality metamodel: functionality, robustness (adversarial & corruption), traceability/explainability — German operationalisation for Art. 15.
unverified · no verification date
evidence for: Art. 15
ISO/IEC 24029 (NN Robustness)
Robustness assessment of neural networks incl. formal methods (part 2) — supports Art. 15 evidence.
unverified · no verification date publisher ISO
evidence for: Art. 15
OWASP Top 10 for LLM Apps (2026)
The de-facto technical security standard for GenAI applications; maps to Art. 10/14/15 and ISO 42001 Annex A controls.
evidence for: Art. 15
ENISA Multilayer Framework & AI Threat Landscape
Three-layer good-practice model (cyber foundations → AI-specific → sectoral) and lifecycle threat landscape — the operational base for Art. 15 and CRA.
unverified · no verification date
evidence for: Art. 15
BSI C5:2026
Cloud compliance catalogue (168 requirements): post-quantum crypto, confidential computing, container security — infrastructure evidence layer for NIS2/CRA/Art. 15; binding baseline from June 2027.
unverified · no verification date
evidence for: Art. 15
ISO/IEC TS 4213 (ML Performance Measurement)
Assessment of machine-learning classification performance: standardized metrics, test-set discipline, reporting format. The metric backbone for Art. 15 'declared accuracy' — test reports that cite it are comparable across vendors and audits.
evidence for: Art. 15
BSI GenAI Criteria Catalogue
Criteria for integrating external generative models via API: named AI owner, central AI register, case-by-case risk analysis, multi-stage input/output validation, least privilege, prompt/permission separation.
unverified · no verification date
evidence for: Art. 15
IEC 61508 — Functional safety of E/E/PE safety-related systems
The base functional-safety standard: safety lifecycle, safety integrity levels (SIL) and systematic-capability requirements for electrical/electronic/programmable electronic safety-related systems. Referenced here for the safety-component reading of grid control; sector derivatives (e.g. IEC 61511, IEC 62443 for security) are not asserted as harmonised under the AI Act.
evidence for: Art. 15
EN 18286:2026 (QMS for AI Act)
Harmonised-norm candidate translating Art. 17 QMS into a product-focused governance framework; mappings to ISO 9001 and ISO/IEC 42001 Annex A (Annexes C & D); published as EN 18286:2026 in July 2026, OJEU citation (and with it the presumption of conformity) still pending.
evidence for: Art. 17
ISO/IEC 42001:2023 (AIMS)
ISO/IEC 42001:2023 — certifiable AI management system (Annex SL harmonized structure, PDCA logic, synergy discount when an ISO 27001 ISMS exists). Clauses 4–10 plus Annex A controls (control count 38 vs 39 is a live community dispute — counting method differs by edition/guide). Covers an estimated 40–50% of AI Act organizational duties; organizational certificate, no product presumption of conformity.
evidence for: Art. 17
IEC 62304:2006+AMD1:2015 (Medical device software life cycle)
Medical device software — software life-cycle processes: software safety classification (A/B/C), development planning, architecture, unit verification, integration and system testing, release, maintenance and problem resolution, and management of SOUP/off-the-shelf components. The recognised life-cycle spine for MDR software, and the process framework a notified body expects an AI-based diagnostic to be built inside.
evidence for: Art. 17
ISO/IEC 42006 (Audit Bodies)
Requirements for bodies auditing/certifying AIMS — accreditation basis (e.g. DAkkS) for ISO 42001 certificates.
unverified · no verification date publisher ISO
evidence for: Art. 43
prEN 18282 (AI Conformity Assessment)
Conformity-assessment deliverable of the JTC 21 core package — the assessment procedure behind Art. 43.
evidence for: Art. 43
ISO/IEC 42005 (AI Impact Assessment)
Guidance for AI system impact assessments — supports DPIA/FRIA-style analyses.
unverified · no verification date publisher ISO
evidence for: Art. 27
IEEE CertifAIEd™
Ethics certification (transparency, accountability, algorithmic bias, privacy) for products and professionals; interfaces with the EU ALTAI assessment list.
unverified · no verification date
evidence for: EU AI Act
prEN 18229-1 (Trustworthiness Framework, part 1)
Part 1 of the JTC 21 trustworthiness deliverable — the framework layer other prEN 18xxx documents build on.
evidence for: EU AI Act
Evidence you will need (26)
The concrete deliverables this use case's obligations ask for — grouped by what kind of artifact they are. Documentation is the largest single conformity cost block, so the list is a work plan, not a reading list. Full evidence matrix →
Documents & files (10)
Written deliverables an authority or auditor can request as a file.
Post-Market Monitoring Plan & Incident Reportstext-derivedserves 4 obligations
Art. 72 monitoring plan plus Art. 73 serious-incident reports (15 days; 2 days for widespread infringement) — reconciled in one runbook with GDPR Art. 33 (72h), NIS2 (24h/72h) and DORA timelines.
verifiability: documented artefact — verifiable on inspection
chain: Art. 72/73 — Post-Market Monitoring & Incidents · Art. 72/73 — Post-Market Monitoring & Incidents → CO: Performance Monitoring & Drift Management · DORA · NIS2 Directive · Clinical Imaging Triage & Patient Follow-Up · Cross-Border Statutory Tax & Wealth Filing · +2 more
AI Bill of Materials (AI-BOM) & Factsheetspractice-derived — dispute welcomeserves 2 obligations
Machine-readable composition manifest per AI application: base-model metadata (identifier, version, parameters, supplier tag), dataset provenance (fine-tune/RAG sources, scrubbing logs, consent records), vector-namespace bindings and access rules, active runtime-policy ruleset versions and thresholds, performance & safety verification history (bias scores, accuracy benchmarks, red-team reports). Complements the SBOM (software dependencies) with the AI-specific supply chain; auto-published into the register on every change. Feeds the Art. 11 technical file, vendor due diligence (contractually demanded from providers) and Colorado/LL144-class disclosure duties. Factsheets are its human-readable projection for auditors.
verifiability: tamper-evident
chain: Art. 11 — Technical Documentation · Art. 26 — Deployer Obligations → CO: Embedded-AI Vendor Governance · Continuous Technical Documentation Generation
AI System Model Cardpractice-derived — dispute welcomeserves 2 obligations
Model lineage, architecture, pre-training data sources, context limits, evaluation benchmarks and known failure modes.
verifiability: tamper-evident
chain: Art. 11 — Technical Documentation · Art. 13 — Transparency to Deployers → CO: System Traceability & Decision Transparency · Algorithmic Portfolio Execution & Advisory · Automated Financial Forecasting & Audit Trails · Continuous Technical Documentation Generation · Enterprise SDLC Code Automation & QA · +1 more
Dataset Documentation & Bias Reportstext-derivedserves 2 obligations
Art. 10 evidence: provenance and lineage of training/validation/test data, representativeness analysis, bias metrics and mitigation reports per ISO/IEC 5259 and BSI QUAIDAL data-quality metrics; baseline assumptions documented (Art. 10(2)(d)).
verifiability: documented artefact — verifiable on inspection
chain: Art. 10 — Data Governance · Art. 10 — Data Governance → CO: Data Quality & Origin Management · Digital Shelf Analytics & Competitive Intelligence · Generative Asset Production & Virtual Try-On · Supplier Master Data & ESG Risk Screening
EU Declaration of Conformitytext-derivedserves 2 obligations
Art. 47 written declaration that the high-risk system meets the AI Act requirements; renewed on substantial modification.
verifiability: documented artefact — verifiable on inspection
chain: Art. 43 — Conformity Assessment · Art. 47/48 — CE Marking & Declaration of Conformity · Continuous Technical Documentation Generation · Enterprise Marketing Disclosure Compliance · Regulatory Change Management & Policy Updating
Instructions for Use / Transparency Docstext-derivedserves 2 obligations
Art. 13 deployer-facing documentation: intended purpose, capabilities, limitations, expected accuracy, oversight measures — plus Art. 50 user-facing disclosures.
verifiability: documented artefact — verifiable on inspection
chain: Art. 13 — Transparency to Deployers · Art. 50 — Transparency Duties · Generative Asset Production & Virtual Try-On · Omnichannel Virtual Support & Voice Bots
Predetermined Change Control Plan (PCCP)text-derivedserves 2 obligations
Text-derived from Art. 43(4) read with Annex IV point 2(f): the documented description of the changes the provider pre-determined at the initial conformity assessment — the performance and data corridors within which automated retraining and redeployment may proceed, the methods used to make the change, and the limits beyond which the modification becomes substantial and a new conformity assessment is owed.
verifiability: self-asserted
chain: Art. 43 — Conformity Assessment · Art. 43 — Conformity Assessment → CO: Model Registry Gate & Drift Interlock
Technical Documentation (Annex IV)text-derivedserves 2 obligations
The Art. 11 technical file: system description, architecture, capabilities/limitations, risk measures, development process. Built incrementally during development — retro-reconstruction is an audit red flag. Reviewed by a notified body where the Annex VII route applies.
verifiability: self-asserted
chain: Art. 11 — Technical Documentation · Art. 43 — Conformity Assessment · Clinical Imaging Triage & Patient Follow-Up · Continuous Technical Documentation Generation
CE Marking (incl. digital)text-derived
Art. 48 visible/indelible marking; digital CE via UI or machine-readable code for digitally provided systems; notified-body number displayed where involved.
verifiability: documented artefact — verifiable on inspection
chain: Art. 47/48 — CE Marking & Declaration of Conformity
QMS Documentation (Art. 17 / EN 18286:2026)text-derived
Documented quality management system: design controls, development testing, validation, supplier management, post-market processes — the documentation set that EN 18286:2026 is expected to address once the standard is cited in the OJEU.
verifiability: documented artefact — verifiable on inspection
chain: Art. 17 — Quality Management System
Assessments (2)
A structured judgement about risk, rights or a management system.
FRIA / AI Impact Assessment (AIIA)text-derivedserves 3 obligations
Fundamental-rights impact assessment (Art. 27, deployer-side) generalized to the AI Impact Assessment: societal, legal and operational risk evaluation per ISO/IEC 42005 and ISO 42001 Clause 8.2, defining HITL intervention parameters and acceptable-use bounds. Cadence: pre-deployment, refreshed annually and on major model updates — a stale AIIA is a finding, not a document.
verifiability: documented artefact — verifiable on inspection
chain: Art. 26 — Deployer Obligations · Art. 27 — Fundamental Rights Impact Assessment · EU AI Act · Clinical Imaging Triage & Patient Follow-Up
AI Impact Assessment (AIIA)practice-derived — dispute welcomeserves 2 obligations
Societal, legal and operational risk evaluation per workflow, including the defined HITL intervention parameters and residual-risk acceptance.
verifiability: independently-attested
chain: Art. 9 — Risk Management · Art. 9 — Risk Management → CO: Pre-Deployment AI Risk & Impact Assessment · Clinical Imaging Triage & Patient Follow-Up · KYC & Client Onboarding Automation (Managed Service)
Test reports (2)
Measured results from testing, evaluation or red-teaming.
Algorithmic Bias & Fairness Audit Reportpractice-derived — dispute welcomeserves 5 obligations
Quantitative demographic-parity, disparate-impact and false-positive distribution analysis against a fixed test baseline.
verifiability: independently-attested
chain: § 3 Abs. 2 — mittelbare Benachteiligung (neutral criteria or procedures) · 42 U.S.C. § 12112(b)(6) — screen-out selection criteria · Art. 10 — Data Governance · Art. 2(2)(b) — indirect discrimination through apparently neutral criteria · Art. 2(b) — indirect discrimination through apparently neutral criteria · KYC & Client Onboarding Automation (Managed Service)
Accuracy, Robustness & Red-Teaming Reportspractice-derived — dispute welcomeserves 2 obligations
Art. 15 evidence: declared accuracy metrics, adversarial and corruption robustness results (DIN SPEC 92001-2, ISO 24029), penetration and jailbreak-resistance testing, groundedness evaluation scores.
verifiability: independently-attested
chain: Art. 15 — Accuracy, Robustness, Cybersecurity · Art. 15 — Accuracy, Robustness, Cybersecurity → CO: Adversarial Robustness Verified · Enterprise SDLC Code Automation & QA · LLM01 Prompt Injection
Log records (4)
Machine-generated records produced while the system runs.
Event Logs & Decision Tracestext-derivedserves 17 obligations
The single highest-leverage artifact: hash-chained, WORM-stored logs with structured decision traces. Required capability fields per FprEN ISO/IEC 24970: input/output traces, execution timestamps, acting user/agent identity, referenced sources, human overrides. Audit-packet spec per event: model version, system-prompt/context hash, hyper-parameters (temperature, top-p), output payload, confidence score, active policy-ruleset versions, human override record. Simultaneously serves AI Act Art. 12, GDPR accountability, DORA incident reporting, NIS2 logging, PLD disclosure duties and its rebuttable defect presumption; financial-sector regimes push retention to 7 years (SEC 17a-4-class WORM rules). Credibility bar: anchor hash-chain heads externally (qualified timestamp / eIDAS ledger) so integrity survives an insider with admin rights.
verifiability: externally-anchored
chain: Art. 12 — Record-Keeping / Logging · CRA Art. 14 — Vulnerability & Severe-Incident Reporting · DORA Art. 19 — Major ICT-Incident Reporting · GDPR Art. 33/34 — Personal-Data Breach Notification · HIPAA Breach Notification Rule · NIS2 Art. 23 — Significant-Incident Reporting · +21 more
Guardrail Telemetry & Sanitization Recordspractice-derived — dispute welcomeserves 3 obligations
Control-level evidence for the OWASP mappings: guardrail trigger records, blocked-prompt statistics (LLM01), runtime output-sanitization logs (LLM05), groundedness-check outcomes — the empirical proof that declared controls actually execute.
verifiability: tamper-evident
chain: Art. 15 — Accuracy, Robustness, Cybersecurity · Art. 50 — Transparency Duties → CO: AI Interaction & Content Disclosure · Art. 15 — Accuracy, Robustness, Cybersecurity → CO: Runtime Injection Defense · Dynamic Deal Desk & Quoting Engine · Enterprise Marketing Disclosure Compliance · LLM01 Prompt Injection · +3 more
Immutable Decision Ledger (WORM)practice-derived — dispute welcomeserves 3 obligations
Per-execution audit packet: timestamp, model version, system prompt, input-context hash, hyper-parameters, output payload, confidence score and human override record.
verifiability: externally-anchored
chain: Art. 12 — Record-Keeping / Logging · Art. 12 — Record-Keeping / Logging → CO: Log Integrity & Non-Repudiation · IFRS / US GAAP Reporting Assurance · Algorithmic Portfolio Execution & Advisory · Automated Financial Forecasting & Audit Trails · Cross-Border Statutory Tax & Wealth Filing · +3 more
Drift-Gate Decision Logpractice-derived — dispute welcome
Practice-derived artifact: one record per deployment attempt — candidate version, measured drift statistics against the PCCP corridors, gate verdict, and where a rollout was blocked, the re-assessment it was routed to. This is what shows the corridor was honoured rather than merely documented.
verifiability: tamper-evident
chain: Art. 43 — Conformity Assessment → CO: Model Registry Gate & Drift Interlock
Process records (6)
Traces that a process actually happened, and who did it.
Human-Oversight Protocol & Intervention Recordspractice-derived — dispute welcomeserves 5 obligations
Art. 14 evidence: documented oversight design (gates, thresholds, veto powers), reviewer qualification, and the record of actual approvals, overrides and escalations — also the GDPR Art. 22 meaningful-human-involvement proof.
verifiability: documented artefact — verifiable on inspection
chain: Art. 11 — automated individual decision-making · Art. 14 — Human Oversight · GDPR Art. 22 — Automated Decisions · Art. 12 — Record-Keeping / Logging → CO: Log Access & Retention Governance · Art. 14 — Human Oversight → CO: Oversight Competence & Authority · Clinical Imaging Triage & Patient Follow-Up
Individual Explanation Letters & Counterfactual Recordspractice-derived — dispute welcomeserves 5 obligations
Practice-derived artifact: the issued adverse-decision explanations together with the attribution run, model version and counterfactual scenario that each letter rested on, so an authority or a court can check that the stated reasons are the reasons the system actually used.
verifiability: self-asserted
chain: Art. 11 — automated individual decision-making · Art. 18 — Obligation to assess the creditworthiness of the consumer · Art. 21 — examination of an application · Art. 86 — Right to explanation of individual decision-making · GDPR Art. 22 — Automated Decisions
Vendor & Model Due-Diligence Recordspractice-derived — dispute welcomeserves 4 obligations
DORA Art. 30 / AI Act deployer evidence: scored vendor assessments (jurisdiction, ZDR, BYOK, C5/AIC4/42001 evidence, tenant isolation), contract register, exit strategies for critical third parties.
verifiability: documented artefact — verifiable on inspection
chain: Art. 26 — Deployer Obligations · Art. 26 — Deployer Obligations → CO: Embedded-AI Vendor Governance · DORA · HIPAA (US Health Privacy) · Procurement Variance & Vendor KPI Monitoring
AI Literacy Training Recordspractice-derived — dispute welcomeserves 2 obligations
Art. 4 evidence: role-based training curricula and completion records for staff dealing with AI systems — the one obligation that applies at every risk level.
verifiability: documented artefact — verifiable on inspection
chain: Art. 4 — AI Literacy · Art. 14 — Human Oversight → CO: Oversight Competence & Authority
Human Oversight Operating Standard (SOP)practice-derived — dispute welcome
Binding procedure defining supervisor roles, competence, review-queue handling, override authority and escalation thresholds θ per workflow.
verifiability: tamper-evident
chain: Art. 14 — Human Oversight → CO: Oversight Competence & Authority · KYC & Client Onboarding Automation (Managed Service) · Legal Contract & Regulatory Clause Extraction · Omnichannel Virtual Support & Voice Bots · Regulatory Change Management & Policy Updating
Risk Management File / Live Registertext-derived
Art. 9 continuous risk-management record: identified risks, quantified values (FAIR-AIR/NIST Map-Measure), mitigations, residual-risk acceptance, testing incl. misuse scenarios.
verifiability: documented artefact — verifiable on inspection
chain: Art. 9 — Risk Management · Algorithmic Portfolio Execution & Advisory · Supplier Master Data & ESG Risk Screening
Registry entries (2)
An entry in a register — internal inventory or public registry.
Serious-Incident Registerpractice-derived — dispute welcomeserves 5 obligations
One register carrying every reportable incident with its detection time, classification and the clocks it started, so overlapping AI Act, NIS2, DORA, CRA and sectoral reports run from the same recorded facts.
verifiability: tamper-evident
chain: Art. 72/73 — Post-Market Monitoring & Incidents · CRA Art. 14 — Vulnerability & Severe-Incident Reporting · DORA Art. 19 — Major ICT-Incident Reporting · NIS2 Art. 23 — Significant-Incident Reporting · SEC Form 8-K Item 1.05 — Material Cybersecurity Incident
AI System Inventory / Registry Entrypractice-derived — dispute welcomeserves 3 obligations
The organizational register of AI systems in use — role (provider or deployer), classification, owner, vendor and lifecycle state — from which per-system obligations are assigned.
verifiability: self-asserted
chain: Art. 17 — Quality Management System · Art. 26 — Deployer Obligations · Art. 26 — Deployer Obligations → CO: Embedded-AI Vendor Governance
Architecture Blueprint
Glass-Box EBM with Monotonic Constraints
Intrinsically interpretable scoring: an explainable boosting machine / generalised additive model whose per-feature shape functions ARE the model, exported as exact lookup tables so an adverse-action reason is read off the model rather than approximated after the fact. Monotonicity is enforced per feature at fit time — higher utilisation can never improve a score — which makes the direction of every reason contractual instead of empirical, and makes a remediation instruction ('reduce utilisation') actually true of the model. Interaction terms are capped and enumerated so the score decomposition sums exactly.
Human-in-the-Loop Core Pattern
For high-risk decision support over people (HR, credit, benefits): confidence-thresholded escalation queues, WORM audit vault, bias testing per ISO 5259 — the human decision is architecturally enforced. CORRECTED 2026-08-15: this pattern previously recommended a post-hoc explainability API (SHAP/LIME or CoT traces) as the explanation mechanism for consequential scoring of natural persons. That is the wrong default. Post-hoc local explainers are sampling-unstable, vary with perturbation choice and are susceptible to fairwashing, and an adverse-action reason that would not change the outcome if the applicant remediated it is not a defensible reason. For consequential scoring (credit, insurance pricing, tenant screening, employment scoring) use intrinsic interpretability — glass-box additive models with monotonic constraints — and keep post-hoc methods as a supplementary diagnostic only.
Transparent Multi-Metric Scorecard with Dispute Workflow
Scores are decomposed into named, separately reported metrics with their weights published to the scored person, and a dispute workflow lets that person contest an input, trigger re-computation and receive a reasoned answer within a recorded deadline. The dispute record is retained as evidence.
Required Technical Components (30)
Live Risk Register / Posture Management
Continuously updated risk register wired to runtime posture: threat-model deltas, open defects, control status, exposure per system. Includes Shadow-AI discovery — continuous scanning for unsanctioned agents, MCP servers and AI API usage outside the register; an unregistered agent is an unmanaged Art. 12/26 liability and the empirical driver of proportionate (not blanket) controls.
from: Art. 9
Watchdog Supervisor & Rate Limiting
Cost/iteration caps, loop detection, anomaly-triggered mandatory approval (CodeBuddy 'suspicious command override').
from: Art. 9 · Art. 15
Deterministic Policy Engine (OPA / Cedar)
Policy-as-code decision point (PDP) with enforcement points (PEP) in front of every tool call: versioned policies in Git, microsecond evaluation, typed action schemas — authorization decided outside the model's reasoning space, never in the prompt.
from: Art. 9
Guardian Agents (Runtime Policy Enforcement)
Autonomous supervisory agents outside the supervised agent's reasoning loop: stateful threat engines with graph-based cross-session history (catch multi-turn injection, gradual exfiltration, incremental privilege escalation), event-driven exposure visibility (permission drift, new connectors), and contextual risk correlation into unified issues — interception before execution, not post-hoc logging.
from: Art. 9 · Art. 72/73
Bias Testing & Data Quality Pipeline
Representativeness checks, bias metrics and mitigation per ISO/IEC 5259; versioned datasets with lineage.
from: Art. 10 · Glass-Box EBM with Monotonic Constraints · Human-in-the-Loop Core Pattern · Transparent Multi-Metric Scorecard with Dispute Workflow
Data Lineage & Versioning
Provenance tracking of datasets, features and embeddings; write-time attribution (source, actor, timestamp, confidence).
from: Art. 10 · Glass-Box EBM with Monotonic Constraints
PII Scrubbing / DLP-NER Layer
Automated detection, pseudonymisation and blocking of personal data in inputs, retrievals and outputs.
from: Art. 10
Retrieval Rails (ACL-aware RAG)
Relevance, freshness and per-user permission checks on every retrieved chunk; curated, versioned index.
from: Art. 10
Sovereign Context Layer
Governed runtime workspace operationalizing Art. 10: traceable lineage for every RAG chunk and training record at execution time, canonical version-controlled business glossary (documents Art. 10(2)(d) baseline assumptions), and continuous data-quality monitoring with threshold alerts and logged remediation for the Art. 10(3) 'error-free and complete' standard.
from: Art. 10
Inline PII/PHI Tokenisation
Personal and health data are detected and replaced with reversible cryptographic tokens before the payload leaves the isolation layer; re-identification happens only inside the tenant boundary.
from: Art. 10
AI Register & Model Registry / Factsheets
AI register & model registry: central inventory of every model, agent, RAG pipeline and embedded third-party SaaS AI across the estate, with factsheets per asset. v2.0 duty: every application — internal, open-source or procured — continuously publishes a machine-readable AI-BOM and Factsheet into the register; an asset without a current AI-BOM is an inventory gap, not a formality. Feeds Colorado AIA/ LL144 disclosure duties and the Art. 11 technical file; the enforcement backstop is Shadow-AI discovery on the risk register.
from: Art. 11 · Art. 13
WORM / Immutable Audit Vault
Append-only, hash-chained audit vault (WORM object-lock storage, AES-256 at rest, TLS 1.3 in transit). Guarantees tamper-evidence within the organization's trust domain — which stops your own team, but not an admin who can rebuild the vault. Pair with an external trust anchor and key ceremonies outside the operating team for evidence that holds against the insider scenario.
from: Art. 12 · Art. 26 · Revised Product Liability Directive · Glass-Box EBM with Monotonic Constraints · Human-in-the-Loop Core Pattern · Transparent Multi-Metric Scorecard with Dispute Workflow
OpenTelemetry / FCoT Tracing
Hierarchical trace spans for every sub-task, prompt, retrieved document and API call — the reconstructible decision path for Art. 12/14 and PLD disclosure.
from: Art. 12 · Revised Product Liability Directive
External Trust Anchor (Qualified Timestamp / Ledger)
Takes integrity proofs out of the operator's trust domain: periodic anchoring of log hash-chain heads via qualified electronic timestamps or a (qualified) electronic ledger per eIDAS 2, with signing keys held outside the operating team (key ceremony, HSM, separation of duties). Answers the insider test — a party who controls the vault cannot rewrite history without the anchor exposing it. Cost profile: anchoring is periodic and cheap; it upgrades every downstream log-based artifact at once.
from: Art. 12
Explainability API (SHAP/LIME/CoT)
Feature attributions for classical ML, reasoning-trace summaries for GenAI — feeds the human reviewer and the technical file.
from: Art. 13 · Art. 14 · Art. 86 · Glass-Box EBM with Monotonic Constraints · Human-in-the-Loop Core Pattern · Transparent Multi-Metric Scorecard with Dispute Workflow
Adverse-Decision Reason Generator
Practice-derived component: converts feature attributions (SHAP or an equivalent attribution method) into an individually understandable, legally defensible explanation of an adverse decision — the role the AI system played, the main elements the decision rested on, and counterfactual scenarios stating what would have had to differ for a different outcome. Reason codes are generated from the decisioning path, not from a marketing template, and every issued letter is retained with the model version and the attribution run behind it. Honesty condition: a reason is only usable if acting on it would actually change the outcome, which non-monotonic feature interactions can break (see the post-hoc instability threat).
from: Art. 13 · Art. 86 · ECOA / CFPB Adverse-Action Regime · Glass-Box EBM with Monotonic Constraints
Visual Explainability for Clinical Review
Practice-derived component: saliency, heatmap or region-proposal overlays rendered on the study itself, so the reviewing clinician can check the anatomical plausibility of the finding — whether the model looked where the pathology is — instead of accepting a score. Overlay stability across reconstructions is monitored, because an unstable overlay is a false assurance rather than an explanation.
from: Art. 13 · Art. 14
HITL Escalation Queue & Review UI
HITL escalation queue & review UI ('Human-as-a-Tool': the agent calls the human like any other tool via propose-action objects). Confidence- and risk-threshold routing, SLA timers, structured accept/modify/reject verdicts with digital reviewer signature at gate release — each verdict is itself Art. 14 evidence and feeds the active-learning loop.
from: Art. 14 · Art. 26 · Art. 86 · Human-in-the-Loop Core Pattern · Transparent Multi-Metric Scorecard with Dispute Workflow
Kill Switch / Graceful Degradation
Operator stop controls and degraded-mode fallbacks; real-time override (veto) channels for HOTL operation.
from: Art. 14 · Human-in-the-Loop Core Pattern
Trust & Risk Dual Scoring
Escalation triggers built from two independent signals, because raw model confidence is uncalibrated: calibrated trust scores (prompt relevance, similarity to historic successes, cross-model consistency) plus deterministic risk scores (sensitive categories, transaction value, protected data) — either crossing its threshold forces human review.
from: Art. 14 · Human-in-the-Loop Core Pattern
Confidence-Threshold HITL Routing
Every output carries a confidence score C_s. C_s ≥ θ commits to the immutable ledger and downstream systems; C_s < θ pauses the transaction and routes the payload to a specialist review queue, whose verdict is logged as part of the decision record.
from: Art. 14
Confidence Scoring & Threshold Gate
Computes a probabilistic confidence score for every output and holds the transaction when the score falls below the workflow's regulatory threshold.
from: Art. 14 · Human-in-the-Loop Core Pattern
Input Rails / Prompt Shields
Pre-model validation of user input: injection detection, topic blocking, encoding checks.
from: Art. 15
Output Rails / Groundedness Check
Faithfulness scoring of answers against retrieved sources; deterministic fallback instead of hallucination; schema-validated structured output.
from: Art. 15
Confidential Computing Enclaves
AMD SEV / Intel TDX: data protected from the cloud operator even in memory during inference.
from: Art. 15
Model Abstraction & Graceful Fallback
Application logic addresses capabilities, not providers; the router degrades to a secondary or local model on error-rate or latency breach instead of failing the workflow.
from: Art. 15
AI Intake Portal & Use-Case Triage
The operational front door of the translational pipeline: structured intake profile (business objective, autonomy degree, data sensitivity, deployment context, target users) → automated tier proposal (detectors + evaluator pipeline) → risk-proportionate approval workflow → register entry with AI-BOM stub. Prevents both over-engineering (blanket high-tier controls breed Shadow AI) and under-engineering (unassessed high-risk deployment). Every governance framework assumes it; almost no failed audit had one.
from: Art. 17
Unified Incident-Response Runbook
One procedure reconciling AI Act Art. 73, GDPR Art. 33 (72h), DORA and NIS2 (24h/72h) timelines and recipients.
from: Art. 72/73
Durable Checkpointing (Pause & Resume)
At oversight gates the complete operational state — working memory, conversation history, tool arguments, intermediate artifacts — is serialized into a durable checkpoint (fast KV store for sub-ms lookups, transactional backend as recovery anchor, vector store for semantic caching of past human decisions). On approval the agent deserializes and resumes at the exact step; matched precedents can shortcut re-planning entirely.
from: Human-in-the-Loop Core Pattern
Active-Learning Feedback Loop
Human corrections at oversight gates are serialized as structured data — original context, model proposal, human edit, rationale — and fed into fine-tuning pipelines and prompt registries, systematically reducing future escalation rates instead of dying in review UIs.
from: Human-in-the-Loop Core Pattern
Build or Buy — Vendor Layer (13)
The graph models vendor CATEGORIES as first-class nodes and keeps named vendors as community-maintained, disputable desc content with lastVerified dates. A category is stable; a vendor list is a currency-layer object like any standard node.
AI GRC & Governance Platforms
Second-line systems of record: model/agent inventory incl. third-party SaaS AI, automated risk tiering, policy administration, cross-framework mapping and control deduplication, audit-evidence generation, intake workflows. Named products live in marketExamples, which is the single source of truth for this layer — prose here describes the class, not the field. What the class buys you: one register a second line can defend, and evidence assembled once and reused across frameworks. Selection metrics: see meta.marketLandscape.selectionMetrics.grc. One compilation-reported item is deliberately kept as unverified: a claimed updated US banking model-risk guidance 'SR 26-2'. Two secondary compilations repeating it is corroboration of the rumour, not of the guidance; it stays flagged pending verification against Federal Reserve primary sources, and a curator verification proposal is filed. All alignments in this layer are vendor-positioned claims, never certifications.
unverified · verified 2026-08-18 community-maintained
selection metrics: multi-model/multi-cloud cataloging incl. third-party SaaS, automated risk tiering, regulatory reporting, independent-2nd-line deployability, cross-framework control deduplication
supplies: Live Risk Register / Posture Management · AI Register & Model Registry / Factsheets · Adverse-Decision Reason Generator · AI Intake Portal & Use-Case Triage · Vendor & Model Due-Diligence Kit
Filters to self-hostable, customer-VPC and open-source options when personal or confidential data cannot leave the EU.
| Example | Sub-category | What it does | Hosting | Claimed alignments |
|---|---|---|---|---|
| Credo AI | AI governance platform | Policy packs, risk tiering and evidence workflows mapped across frameworks. Typical: AI registry, policy administration. Scope overlap: Its scope overlaps this platform's own; we have a commercial interest in the comparison. | not checked | ISO 42001 alignment (claimed)EU AI Act readiness positioning |
| Holistic AI | AI governance & audit | Risk assessment, bias auditing and regulatory reporting workflows. Typical: bias audit, regulatory reporting. Scope overlap: Its scope overlaps this platform's own; we have a commercial interest in the comparison. | not checked | NYC LL144 audit support (claimed)EU AI Act readiness positioning |
| IBM watsonx.governance | AI governance platform | Governance, factsheets and monitoring integrated with the IBM stack. Typical: factsheets, model monitoring. Scope overlap: Its scope overlaps this platform's own; we have a commercial interest in the comparison. | not checked | ISO 42001 alignment (claimed)Art. 11 documentation support (claimed) |
| ModelOp | AI/model governance | Model and agent inventory with automated lifecycle controls for large estates. Typical: model inventory, control automation. Scope overlap: Its scope overlaps this platform's own; we have a commercial interest in the comparison. | not checked | model-risk positioning (SR 11-7 style, claimed)ISO 42001 alignment (claimed) |
and 3 more in the stack advisor →
Community-maintained, disputable examples — not an endorsement and not a ranking. Alignments are as claimed by vendors or the source compilation, not verified by RAIN; a certification is shown as a certification only where a certificate or registry reference is recorded.
Disclosure: RAI·N·avigator operates in this category too, so we have a commercial interest in any comparison here. That is why this layer maps product classes to control objectives and lists named products as community-maintained examples — we publish no rankings, no quadrants and no coverage assertions about any vendor, including ourselves.
Runtime Guardrails & Enforcement
Policy enforcement in the request path: input/output validation, injection and exfiltration defence, structured-output constraints and action blocking. Distinct from observability layers because these products are in-line and can refuse. Selection questions: added latency at p95, whether enforcement is fail-open or fail-closed, whether policies are versioned artefacts, and whether the layer can be self-hosted inside your data boundary.
unverified · verified 2026-08-18 community-maintained
selection metrics: Where enforcement sits (inline proxy, sidecar, SDK) and the added latency at your token volumes; whether policy is versioned and testable as code; fail-open vs. fail-closed behaviour under guardrail outage; language and modality coverage; whether every block writes an evidence record you can cite later.
supplies: Deterministic Policy Engine (OPA / Cedar) · Input Rails / Prompt Shields · Output Rails / Groundedness Check · Tool-Use Boundary Proxy
Filters to self-hostable, customer-VPC and open-source options when personal or confidential data cannot leave the EU.
| Example | Sub-category | What it does | Hosting | Claimed alignments |
|---|---|---|---|---|
| Guardrails AI | validation framework | Open-source validator framework for structured output and content policies in the request path. Typical: output validation, structured output. | open source | supports Art. 15 robustness measures (claimed) |
| NVIDIA NeMo Guardrails | dialogue policy rails | Programmable dialogue and topic rails placed around an LLM application. Typical: topic control, dialogue policy. | open source | supports Art. 50 interaction disclosure patterns (claimed) |
| Lakera AI | guardrail proxy | Inline prompt-injection and content detection at request time. Typical: injection defence, content filtering. | SaaS (vendor cloud) | SOC 2 (claimed)supports Art. 15 robustness measures (claimed) |
| Credal AI | enterprise access & policy layer | Permission-aware access layer with data-loss controls in front of enterprise assistants. Typical: access control, DLP. | SaaS (vendor cloud) | SOC 2 (claimed) |
Community-maintained, disputable examples — not an endorsement and not a ranking. Alignments are as claimed by vendors or the source compilation, not verified by RAIN; a certification is shown as a certification only where a certificate or registry reference is recorded.
Disclosure: RAI·N·avigator operates in this category too, so we have a commercial interest in any comparison here. That is why this layer maps product classes to control objectives and lists named products as community-maintained examples — we publish no rankings, no quadrants and no coverage assertions about any vendor, including ourselves.
Agent Observability & Model Risk Management
Tracing, evaluation, drift monitoring and model-validation records. This layer is where Art. 12 record-keeping becomes technically real (step-level traces, prompt/response records, retention control) and where model-risk practice in the SR 11-7 tradition — validation evidence, performance and drift monitoring, challenger comparison — is operated. Gateways and tracing tools produce the logs; the retention, integrity and access regime around them is still yours.
unverified · verified 2026-08-18 community-maintained
selection metrics: Trace completeness per agent step; log retention and immutability options; drift/quality metrics available out of the box; evaluation dataset support; export into your audit vault; self-host option.
supplies: Bias Testing & Data Quality Pipeline · AI Register & Model Registry / Factsheets · OpenTelemetry / FCoT Tracing · Explainability API (SHAP/LIME/CoT) · Adverse-Decision Reason Generator · Visual Explainability for Clinical Review · Confidence Scoring & Threshold Gate · Model Drift & Accuracy Monitor
Filters to self-hostable, customer-VPC and open-source options when personal or confidential data cannot leave the EU.
| Example | Sub-category | What it does | Hosting | Claimed alignments |
|---|---|---|---|---|
| LangSmith | agent tracing & evaluation | Trace capture and evaluation over LangChain/LangGraph runs with dataset-based scoring. Typical: step tracing, regression evaluation. | not checked | SOC 2 (claimed)supports Art. 12 record-keeping (claimed) |
| Langfuse | agent tracing & evaluation | Open-source tracing, prompt management and evaluation; self-hostable for retention control. Typical: self-hosted tracing, cost/latency analytics. | open source | GDPR-positionedsupports Art. 12 record-keeping (claimed) |
| Arize AI / Phoenix | ML & LLM observability | Production monitoring with drift and performance analysis; Phoenix is the open-source tracing side. Typical: drift monitoring, production analytics. | not checked | SOC 2 (claimed)drift-monitoring positioning (SR 11-7 style, claimed) |
| Helicone | LLM gateway & logging | Proxy-level logging of prompts, costs and latency across providers. Typical: gateway logging, cost control. | not checked | SOC 2 (claimed)supports Art. 12 record-keeping (claimed) |
and 11 more in the stack advisor →
Community-maintained, disputable examples — not an endorsement and not a ranking. Alignments are as claimed by vendors or the source compilation, not verified by RAIN; a certification is shown as a certification only where a certificate or registry reference is recorded.
Disclosure: RAI·N·avigator operates in this category too, so we have a commercial interest in any comparison here. That is why this layer maps product classes to control objectives and lists named products as community-maintained examples — we publish no rankings, no quadrants and no coverage assertions about any vendor, including ourselves.
Secure Data Infrastructure & Vector Storage
Governed retrieval substrate: vector databases, lakehouses and catalogs with tenant/namespace isolation, RBAC and client-managed keys (CMEK), lineage into RAG chunks, air-gap options, and code-level data and AI lineage. Named products live in marketExamples; prose here describes the class. What the class buys you: retrieval that can be scoped per requester and traced back to a source record. The Art. 10 runtime data-governance duties land here. Selection metrics: see meta.marketLandscape.selectionMetrics.data.
unverified · verified 2026-08-18 community-maintained
selection metrics: namespace/tenant isolation, RBAC + CMEK, lineage into RAG chunks, SOC 2 / ISO 27001 attestations, air-gap capability
supplies: Data Lineage & Versioning · Retrieval Rails (ACL-aware RAG) · Sovereign Context Layer · Agent Memory Record Store
Filters to self-hostable, customer-VPC and open-source options when personal or confidential data cannot leave the EU.
| Example | Sub-category | What it does | Hosting | Claimed alignments |
|---|---|---|---|---|
| Azure AI Search | managed retrieval | Managed hybrid search with security trimming against tenant identities. Typical: ACL-aware RAG, enterprise search. | not checked | ISO 27001 (claimed)SOC 2 (claimed) |
| Databricks Unity Catalog | governed lakehouse | Catalog and lineage spanning tables, features and RAG chunks. Typical: lineage evidence, governed RAG. | not checked | SOC 2 (claimed)lineage/Art. 10 support (claimed) |
| Relyance AI | code-level data & AI lineage | Parses source repositories to map data and inference flows at code level, with CI checks on changes to those flows. Typical: data lineage, shift-left privacy review. Scope overlap: Its AI-governance reporting scope overlaps this platform's own; we have a commercial interest in the comparison. | SaaS (vendor cloud) | GDPR programme tooling (claimed)EU AI Act readiness positioning |
| Snowflake Cortex | governed lakehouse | Model calls inside the warehouse boundary with masking and clean rooms. Typical: in-warehouse inference, governed analytics. | not checked | SOC 2 (claimed)ISO 27001 (claimed)HIPAA-eligible (claimed) |
Community-maintained, disputable examples — not an endorsement and not a ranking. Alignments are as claimed by vendors or the source compilation, not verified by RAIN; a certification is shown as a certification only where a certificate or registry reference is recorded.
Disclosure: RAI·N·avigator operates in this category too, so we have a commercial interest in any comparison here. That is why this layer maps product classes to control objectives and lists named products as community-maintained examples — we publish no rankings, no quadrants and no coverage assertions about any vendor, including ourselves.
Grounding, Retrieval & Agent Memory
The grounding layer between raw sources and the model: document parsers, embedding models, vector databases and — new in the agentic era — persistent agent memory stores. Memory is the hard part: once a personal fact is embedded, GDPR Art. 17 erasure has to reach the vector and the memory record, not just the source row, and embeddings are partially reconstructable (see IronCore in the privacy layer). Retrieval quality is also a data-governance question under Art. 10: what got parsed, chunked and indexed is what the system 'knows'.
unverified · verified 2026-08-18 community-maintained
selection metrics: Parsing fidelity on your worst document class; retrieval precision/recall on a labelled set; tenant and ACL isolation model; per-vector encryption and erasure path; memory TTL and record semantics; self-host option.
supplies: Data Lineage & Versioning · Retrieval Rails (ACL-aware RAG) · Bitemporal Memory (GDPR×Art.12) · Agent Memory Record Store
Filters to self-hostable, customer-VPC and open-source options when personal or confidential data cannot leave the EU.
| Example | Sub-category | What it does | Hosting | Claimed alignments |
|---|---|---|---|---|
| Docling | document parser | Open-source layout-aware parsing of PDFs and office formats into structured chunks. Typical: RAG ingestion, air-gapped pipelines. | self-hostable | EU sovereignty positioning |
| LlamaParse | document parser | Managed parsing service tuned for tables and complex documents feeding RAG. Typical: RAG ingestion, table extraction. | not checked | SOC 2 (claimed) |
| Amazon Textract | document parser | OCR and form/table extraction with per-page pricing inside AWS. Typical: document intake, claims processing. | not checked | SOC 2 (claimed)HIPAA-eligible (claimed)ISO 27001 (claimed) |
| Diffbot | web/knowledge extraction | Structured extraction and knowledge-graph construction from web sources. Typical: market monitoring, entity resolution. | not checked | vendor-stated security posture |
and 12 more in the stack advisor →
Community-maintained, disputable examples — not an endorsement and not a ranking. Alignments are as claimed by vendors or the source compilation, not verified by RAIN; a certification is shown as a certification only where a certificate or registry reference is recorded.
Disclosure: RAI·N·avigator operates in this category too, so we have a commercial interest in any comparison here. That is why this layer maps product classes to control objectives and lists named products as community-maintained examples — we publish no rankings, no quadrants and no coverage assertions about any vendor, including ourselves.
Sovereign Infrastructure
Compute and storage under EU jurisdictional control. Two structurally different offers, and the difference is the decision: native EU providers give full jurisdictional isolation with narrower service catalogs and thinner managed-AI tooling; hyperscaler sovereign constructions give the broad catalog with contractual and operational isolation, where the residual question is the control plane, support access and operational metadata rather than the data plane. Named offers live in marketExamples, which is the single source of truth for this layer — prose here describes the class, not the field. Claimed alignments recorded per entry: positioning for BSI C5 / C3A and ANSSI SecNumCloud attestation, NIS2 and DORA third-party requirements. Nothing here is an endorsement, and no provider in this category is 'CLOUD-Act-proof' by label alone — ask who holds the keys and who administers the plane.
unverified · verified 2026-08-18 community-maintained
selection metrics: jurisdiction of the control plane (not only the data plane), operator nationality and support-access paths, key custody, C5 / C3A / SecNumCloud attestation scope, managed-AI service depth vs. isolation trade-off, exit and repatriation terms
supplies: Sovereign Context Layer
Filters to self-hostable, customer-VPC and open-source options when personal or confidential data cannot leave the EU.
| Example | Sub-category | What it does | Hosting | Claimed alignments |
|---|---|---|---|---|
| OVHcloud | native EU | French provider with EU-only jurisdiction and a narrower managed-AI catalog than the hyperscalers. Typical: EU-resident inference, regulated workload hosting. | not checked | ISO 27001 (claimed)SecNumCloud-positionedGDPR-positioned |
| Scaleway | native EU | EU-operated cloud with GPU instances and managed inference under French corporate control. Typical: EU-resident inference, fine-tuning. | not checked | ISO 27001 (claimed)GDPR-positioned |
| STACKIT | native EU | German provider (Schwarz Group) positioned for data residency in Germany. Typical: public sector, retail data platforms. | not checked | C5-positionedGDPR-positioned |
| AWS European Sovereign Cloud | sovereign hyperscaler | Separately operated EU region set with EU-resident personnel and keys; full hyperscaler catalog. Typical: large-scale enterprise AI, regulated hosting. | not checked | ISO 27001 (claimed)SOC 2 (claimed)EU data-boundary positioning |
and 11 more in the stack advisor →
Community-maintained, disputable examples — not an endorsement and not a ranking. Alignments are as claimed by vendors or the source compilation, not verified by RAIN; a certification is shown as a certification only where a certificate or registry reference is recorded.
Disclosure: RAI·N·avigator operates in this category too, so we have a commercial interest in any comparison here. That is why this layer maps product classes to control objectives and lists named products as community-maintained examples — we publish no rankings, no quadrants and no coverage assertions about any vendor, including ourselves.
Public Transparency Registers & System Cards
Authoring and publishing the outward-facing record: public AI registers, system and model cards, conformity declarations and plain-language notices, with versioning so a published statement can be tied to the system version it described. The register content is produced elsewhere; this class is the publication and version-control surface for it. Selection metrics: see meta.marketLandscape.selectionMetrics.transparency.
unverified · verified 2026-08-17 community-maintained
selection metrics: Versioning of published statements against the system version they describe; whether a card is generated from your governance record or re-authored by hand; language coverage and accessibility of the published surface; export and self-hosting of the public register; whether unpublishing leaves an auditable trail.
supplies: AI Register & Model Registry / Factsheets
Filters to self-hostable, customer-VPC and open-source options when personal or confidential data cannot leave the EU.
| Example | Sub-category | What it does | Hosting | Claimed alignments |
|---|---|---|---|---|
| Saidot | public AI register | AI register with published system cards and regulation-mapped documentation workflows. Typical: public AI register, system cards. Scope overlap: Its documentation and register scope overlaps this platform's own; we have a commercial interest in the comparison. | SaaS (vendor cloud) | EU AI Act documentation positioningISO 42001 alignment (claimed) |
Community-maintained, disputable examples — not an endorsement and not a ranking. Alignments are as claimed by vendors or the source compilation, not verified by RAIN; a certification is shown as a certification only where a certificate or registry reference is recorded.
Disclosure: RAI·N·avigator operates in this category too, so we have a commercial interest in any comparison here. That is why this layer maps product classes to control objectives and lists named products as community-maintained examples — we publish no rankings, no quadrants and no coverage assertions about any vendor, including ourselves.
Cryptographic Evidence & Audit Ledger
Tamper-evident recording of what a system did: content-addressed decision records, hash chains and external anchoring, so a log can be shown not to have been rewritten after the fact. This is the layer that turns Art. 12 logging and Art. 19 retention from a storage question into an evidentiary one. AI Verify is carried in RAIN as a STANDARD node (sg-ai-verify), not duplicated here as a vendor.
unverified · verified 2026-08-18 community-maintained
selection metrics: Append-only guarantees and who can rotate or delete (including the vendor); anchoring mechanism (qualified timestamp, transparency log, notarisation) and whether verification works without the vendor; retention and export in a readable format at end of contract; throughput and cost at your event volume.
supplies: WORM / Immutable Audit Vault · External Trust Anchor (Qualified Timestamp / Ledger)
Filters to self-hostable, customer-VPC and open-source options when personal or confidential data cannot leave the EU.
| Example | Sub-category | What it does | Hosting | Claimed alignments |
|---|---|---|---|---|
| Fact0 | cryptographic evidence ledger | Positions itself as a tamper-evident ledger for AI decision records. Typical: decision records, audit trail. | not checked | supports Art. 12 record-keeping (claimed) |
| Traccia | audit trail & traceability | Positions itself around traceability of AI pipeline steps and artefacts. Typical: traceability, artifact lineage. | not checked | supports Art. 12 record-keeping (claimed) |
Community-maintained, disputable examples — not an endorsement and not a ranking. Alignments are as claimed by vendors or the source compilation, not verified by RAIN; a certification is shown as a certification only where a certificate or registry reference is recorded.
Disclosure: RAI·N·avigator operates in this category too, so we have a commercial interest in any comparison here. That is why this layer maps product classes to control objectives and lists named products as community-maintained examples — we publish no rankings, no quadrants and no coverage assertions about any vendor, including ourselves.
Agent Orchestration & SDLC Toolkits
Developer middleware for multi-agent networks, tool-use chains, RAG abstraction, state and memory persistence, and model routing. Named products live in marketExamples; prose here describes the class. Regulatory posture: orchestration code is where autonomy tiering, propose-action objects and fallback routing get implemented — the framework choice constrains which controls are cheap and which are retrofits. Selection metrics: see meta.marketLandscape.selectionMetrics.orchestration.
unverified · verified 2026-08-18 community-maintained
selection metrics: broad model-API abstraction, state/memory management, error recovery, fallback routing hooks
supplies: HITL Escalation Queue & Review UI
Filters to self-hostable, customer-VPC and open-source options when personal or confidential data cannot leave the EU.
| Example | Sub-category | What it does | Hosting | Claimed alignments |
|---|---|---|---|---|
| LangChain / LangGraph | agent framework | Graph-structured agent runtime; interrupt/pause nodes support implementing human approval at defined steps. Typical: multi-step agents, approval workflows. | not checked | supports implementing Art. 14 oversight (claimed)supports Art. 12 step logging (claimed) |
| LlamaIndex | RAG framework | Indexing and query abstractions over documents and structured sources. Typical: enterprise RAG, document agents. | open source | retrieval-governance positioning |
| Microsoft AutoGen | multi-agent framework | Conversational multi-agent patterns with pluggable tool executors. Typical: multi-agent research, code agents. | not checked | research/OSS, no vendor certification |
| CrewAI | multi-agent framework | Role-based agent teams with task delegation and process templates. Typical: process automation, role-based agents. | not checked | vendor-stated security posture |
and 6 more in the stack advisor →
Community-maintained, disputable examples — not an endorsement and not a ranking. Alignments are as claimed by vendors or the source compilation, not verified by RAIN; a certification is shown as a certification only where a certificate or registry reference is recorded.
Disclosure: RAI·N·avigator operates in this category too, so we have a commercial interest in any comparison here. That is why this layer maps product classes to control objectives and lists named products as community-maintained examples — we publish no rankings, no quadrants and no coverage assertions about any vendor, including ourselves.
Runtime Security & Guardrail Vendors
First-line inline enforcement: single-pass parallel input/output evaluation proxies, injection and exfiltration defense, PII masking, grounding checks, SecOps routing. Named products live in marketExamples; prose here describes the class. What the class buys you: a policy decision point in the request path that fails closed and emits telemetry an auditor can read. Selection metrics: single-pass latency (<20 ms class), catch rates, policy-version telemetry into the AI-BOM. Consolidation matters commercially: a guardrail acquired by a platform vendor tends to follow that platform's roadmap, which is a lock-in question rather than a security one — reported acquisitions are recorded per entry as reported, not asserted here.
unverified · verified 2026-08-18 community-maintained
selection metrics: single-pass parallel evaluation latency (<20 ms class), injection/hallucination catch rates, SecOps/SIEM routing, policy versioning surfaced into the AI-BOM
supplies: Input Rails / Prompt Shields · Output Rails / Groundedness Check · Guardrail Sidecar / Interception · Tool-Use Boundary Proxy
Filters to self-hostable, customer-VPC and open-source options when personal or confidential data cannot leave the EU.
| Example | Sub-category | What it does | Hosting | Claimed alignments |
|---|---|---|---|---|
| Lakera | guardrail proxy | Inline prompt-injection and content detection at request time. Typical: injection defence, content filtering. | not checked | SOC 2 (claimed)supports Art. 15 robustness measures (claimed) |
| HiddenLayer | model/agent detection & response | Model-layer detection and response with adversarial-attack telemetry. Typical: model threat detection, red-team telemetry. | not checked | SOC 2 (claimed)supports Art. 15 robustness measures (claimed) |
| Palo Alto Prisma AIRS | network-integrated AI security | AI runtime security folded into an existing enterprise network security estate. Typical: enterprise rollout, egress control. | not checked | SOC 2 (claimed)enterprise security integration (claimed) |
| Cisco AI Defense | network-integrated AI security | Discovery of AI usage plus inline enforcement across the corporate network. Typical: shadow-AI discovery, inline enforcement. | not checked | enterprise security integration (claimed) |
and 4 more in the stack advisor →
Community-maintained, disputable examples — not an endorsement and not a ranking. Alignments are as claimed by vendors or the source compilation, not verified by RAIN; a certification is shown as a certification only where a certificate or registry reference is recorded.
Disclosure: RAI·N·avigator operates in this category too, so we have a commercial interest in any comparison here. That is why this layer maps product classes to control objectives and lists named products as community-maintained examples — we publish no rankings, no quadrants and no coverage assertions about any vendor, including ourselves.
Confidential Computing & Privacy Engines
Data-in-use protection and pre-model privacy interception: enclave and runtime encryption, key management, tokenisation vaults, PII detection and redaction, application-layer and vector encryption. Named products live in marketExamples; prose here describes the class. Select on: enclave attestation support, key custody model (external HSM / BYOK), detokenisation audit trail, latency added per call, and coverage of the identifier classes your regime actually names. Selection metrics: see meta.marketLandscape.selectionMetrics.privacy.
unverified · verified 2026-08-18 community-maintained
selection metrics: enclave attestation support, key custody (external HSM / BYOK), detokenisation audit trail, added latency per call, coverage of the identifier classes your regime names, in-boundary deployment option
supplies: Confidential Computing Enclaves
Filters to self-hostable, customer-VPC and open-source options when personal or confidential data cannot leave the EU.
| Example | Sub-category | What it does | Hosting | Claimed alignments |
|---|---|---|---|---|
| Anjuna | confidential computing | Runs workloads inside hardware enclaves without application rewrites. Typical: data-in-use protection, regulated inference. | not checked | confidential-computing positioningDORA-positioned (claimed) |
| Fortanix | confidential computing & KMS | Enclave runtime plus key management and tokenisation services. Typical: key management, data-in-use protection. | not checked | FIPS 140-2 (claimed)DORA-positioned (claimed)HIPAA-positioned (claimed) |
| Skyflow | privacy vault | Polymorphic data vault de-identifying records before they reach a model. Typical: PII vaulting, pre-model redaction. | not checked | SOC 2 (claimed)HIPAA-positionedGDPR-positioned |
| Private AI | PII detection & redaction | Detection and redaction of identifiers across text, documents and audio. Typical: inline redaction, document de-identification. | not checked | GDPR-positionedHIPAA-positioned |
and 1 more in the stack advisor →
Community-maintained, disputable examples — not an endorsement and not a ranking. Alignments are as claimed by vendors or the source compilation, not verified by RAIN; a certification is shown as a certification only where a certificate or registry reference is recorded.
Disclosure: RAI·N·avigator operates in this category too, so we have a commercial interest in any comparison here. That is why this layer maps product classes to control objectives and lists named products as community-maintained examples — we publish no rankings, no quadrants and no coverage assertions about any vendor, including ourselves.
Agentic Execution Governance
The youngest tier: governance of what an agent is allowed to do at execution time — non-human identity, per-task scoping, action approval, agent inventory and agent-level red-teaming. Named products live in marketExamples; prose here describes the class. Because the category is new, capability claims outrun deployments: ask for a reference in your own regime before believing a control is covered, and treat entries with limited public verification as unconfirmed. Selection metrics: see meta.marketLandscape.selectionMetrics.agentgov.
unverified · verified 2026-08-18 community-maintained
selection metrics: non-human identity inventory completeness, credential time-to-live and revocation latency, per-action approval hooks, agent-level red-team coverage, evidence export a 2nd line can read, deployment references in your regime
supplies: Non-Human Identity Credential Broker · Agent Identity & Access (IdP)
Filters to self-hostable, customer-VPC and open-source options when personal or confidential data cannot leave the EU.
| Example | Sub-category | What it does | Hosting | Claimed alignments |
|---|---|---|---|---|
| Pillar Security | agent security & inventory | Discovery, inventory and runtime policy for agents in the estate. Typical: agent registry, policy enforcement. | not checked | agent-inventory positioning |
| Lyzr | agent governance & observability | Agent platform with governance, approval and observability features. Typical: agent approval, agent analytics. | not checked | vendor-stated security posture |
| Astrix Security | non-human identity | Lifecycle governance of machine and agent identities and their grants. Typical: credential scoping, NHI inventory. | not checked | SOC 2 (claimed)NHI governance positioning |
| Britive | just-in-time access | Ephemeral, per-task privileges instead of standing credentials. Typical: JIT credentials, privilege reduction. | not checked | SOC 2 (claimed)least-privilege positioning |
Community-maintained, disputable examples — not an endorsement and not a ranking. Alignments are as claimed by vendors or the source compilation, not verified by RAIN; a certification is shown as a certification only where a certificate or registry reference is recorded.
Disclosure: RAI·N·avigator operates in this category too, so we have a commercial interest in any comparison here. That is why this layer maps product classes to control objectives and lists named products as community-maintained examples — we publish no rankings, no quadrants and no coverage assertions about any vendor, including ourselves.
AI Asset Discovery & Shadow-AI Inventory
Automated discovery of AI in an existing estate: model and agent detection in source repositories, LLM API egress in cloud and network telemetry, AI features switched on inside employee SaaS, reconciliation against the CMDB and the AI register, ownership attribution and drift between declared and observed estate. Distinct from the GRC layer, which is the system of record for what is already known: this class finds the population that record is supposed to cover. Selection metrics: see meta.marketLandscape.selectionMetrics.discovery.
unverified · verified 2026-08-17 community-maintained
selection metrics: Coverage of the estate you actually have (repos, cloud accounts, SaaS tenants, network egress) rather than the connector count; false-positive rate on detected AI usage; whether findings reconcile into your existing register rather than a second inventory; ownership attribution quality; agent-based vs. agentless deployment; whether discovery data leaves your tenancy.
supplies: Shadow-AI Discovery & Asset Inventory Scanner
Filters to self-hostable, customer-VPC and open-source options when personal or confidential data cannot leave the EU.
| Example | Sub-category | What it does | Hosting | Claimed alignments |
|---|---|---|---|---|
| Truyo | shadow-AI discovery | Discovery of AI usage across SaaS and cloud accounts with intake and governance workflow on top. Typical: shadow-AI inventory, AI intake. Scope overlap: Its governance-workflow scope overlaps this platform's own; we have a commercial interest in the comparison. | SaaS (vendor cloud) | EU AI Act readiness positioningGDPR programme tooling (claimed) |
Community-maintained, disputable examples — not an endorsement and not a ranking. Alignments are as claimed by vendors or the source compilation, not verified by RAIN; a certification is shown as a certification only where a certificate or registry reference is recorded.
Disclosure: RAI·N·avigator operates in this category too, so we have a commercial interest in any comparison here. That is why this layer maps product classes to control objectives and lists named products as community-maintained examples — we publish no rankings, no quadrants and no coverage assertions about any vendor, including ourselves.
Procurement rule: Derived from three-lines-of-defense separation: the second-line GRC platform must be procured and deployed independently of any first-line runtime or model vendor — a governance tool that only sees its own vendor's models cannot govern a multi-model estate, and closed third-party SaaS AI can only be governed contractually (intake, attestation, AI-BOM disclosure), never by inline inspection.
Outsourced delivery BPO · SaaS · Service-as-a-Software caveats
Delivery Model — BPO · SaaS · Service-as-a-Software
Spectrum
BPO: input-priced (billable hours/FTEs), linear headcount scaling, human error & attrition as primary risk
SaaS: capability-priced (software access), client operates the workload, implementation/adoption failure as primary risk
Service-as-a-Software: outcome-priced (SLA on completed work), provider-managed AI executes 60–80% of cognitive tasks with specialist supervision, algorithmic bias & non-compliance as primary risk
Caveats in regulated markets
— Outcome SLAs move compliance risk onto the provider — but NOT the buyer's deployer duties: Art. 26 oversight, log retention and FRIA obligations stay with the enterprise even when execution is outsourced.
— Provider role analysis is the central legal question: a productized platform that fine-tunes, re-purposes or chains models can flip into the Art. 25 provider role with full high-risk obligations.
— Certified operations (ISO 42001) function as a procurement moat and shortcut third-party risk assessment — but organizational certificate ≠ product conformity (never conflate, see meta.assuranceEcosystem).
— The buyer's evidence chain must reach into the provider: contractually mandated AI-BOM disclosure, ZDR certificates, bias-audit reports and logging-ledger access are the artifacts that make an outsourced workflow auditable.
Threat Profile
No elevated threat is modelled for this use case yet.