High-Tech & Software
Enterprise SDLC Code Automation & QA
Minimal RiskUnverifiedDiscuss / dispute
Generative code completion, test synthesis, legacy refactoring and vulnerability remediation inside CI/CD, with synthetic test data and visual regression testing.
Classification rationale: Minimal-risk under the AI Act, but the output ships into products covered by the Cyber Resilience Act: generated code inherits secure-development, SBOM and vulnerability-handling duties. NIST SSDF and ISO 27001 A.8.28 are the practical control anchors, and licence provenance must be checked before a suggestion enters the repository.
Indicative decision support, not legal advice. Risk classification depends on your concrete deployment context and can change with scope drift — validate the result with qualified counsel.
pricingPer merged change / outcome-based delivery tier
oversightHuman code review and release approval before production merge
Compliance brief
This use case is minimal-risk under the EU AI Act (Minimal Risk); no product-specific obligations beyond general AI literacy apply.
What is owed
- Art. 4. Providers and deployers must ensure sufficient AI literacy of staff dealing with AI systems.
Dates that bind
- 2026-08-02 — General applicability + Art. 50. Transparency obligations for chatbots, deepfakes and synthetic content; EU-level enforcement begins.
- 2026-12-02 — Additional prohibitions. Additional bans (deepfake CSAM et al.) and transition period for synthetic content under Art. 50(2).
Maximum exposure
- EU AI Act: Tiered: €35m / 7% (prohibited practices); €15m / 3% (Art. 9–15 high-risk obligations incl. data governance, documentation, logging); €7.5m / 1% (Art. 99(5) — incorrect, incomplete or misleading information to notified bodies or national competent authorities)
- Cyber Resilience Act: Up to €15m or 2.5% of worldwide annual turnover
- NIS2 Directive: Up to €10m or 2% of worldwide annual turnover
First five actions
- Confirm in writing whether this organisation builds/places the system on the market (provider) or only operates it (deployer), since the role is not yet established.
- Commission and confirm the Art. 4 obligations named above as active workstreams with an accountable owner.
- Stand up the named oversight design — Mode 3 — with a documented human-review procedure.
- Produce the technical documentation and evidence artefacts already mapped to this use case (SBOM & Dependency Management, Secure Boot & Hardened Runtime, Unified Incident-Response Runbook) before they are requested.
- Put 2026-08-02 — General applicability + Art. 50 — into the compliance calendar with an owner and lead time.
Terms used above: · · ·
Applicable Regulations (3)
EU AI Act (Regulation (EU) 2024/1689)
unverified · no verification date source EUR-Lex
Horizontal, risk-based product-safety law for AI systems and GPAI models. Extraterritorial market-place principle. Staged applicability 2025–2030 (Digital Omnibus: Annex III → 2 Dec 2027, Annex I → 2 Aug 2028).
Sanctions: Tiered: €35m / 7% (prohibited practices); €15m / 3% (Art. 9–15 high-risk obligations incl. data governance, documentation, logging); €7.5m / 1% (Art. 99(5) — incorrect, incomplete or misleading information to notified bodies or national competent authorities)
Cyber Resilience Act (Regulation (EU) 2024/2847)
unverified · no verification date source EUR-Lex
Security-by-design for products with digital elements over the full lifecycle: vulnerability management, patching, SBOM. Complements AI Act Art. 15 at product level.
Sanctions: Up to €15m or 2.5% of worldwide annual turnover
NIS2 Directive (Directive (EU) 2022/2555)
unverified · no verification date source EUR-Lex
Cyber-resilience duties for essential/important entities: supply-chain risk management, incident response, 24h early warning / 72h notification. AI components count as operational IT in scope.
Sanctions: Up to €10m or 2% of worldwide annual turnover
Legal Obligations (1)
Art. 4 — AI Literacy
Providers and deployers must ensure sufficient AI literacy of staff dealing with AI systems. In force since 2 Feb 2025.
unverified · no verification date read the article artificialintelligenceact.eu
Control Objectives (0)
obligation (article) → operationalized_by → control objective → satisfied_by → component/pattern; control objective → evidenced_by → evidence artifact
Art. 4
control layer: community mandate — propose objectives
Take this into your GRC tooling
A control mapping your ISO/IEC 42001 or CSA AICM workbook can ingest, and an Annex IV skeleton to start the technical file from. Indicative mappings only — cells we are not confident about are exported empty rather than filled in.
Standards & Evidence
IEEE CertifAIEd™
Ethics certification (transparency, accountability, algorithmic bias, privacy) for products and professionals; interfaces with the EU ALTAI assessment list.
unverified · no verification date
evidence for: EU AI Act
ENISA Multilayer Framework & AI Threat Landscape
Three-layer good-practice model (cyber foundations → AI-specific → sectoral) and lifecycle threat landscape — the operational base for Art. 15 and CRA.
unverified · no verification date
evidence for: Cyber Resilience Act
NIST SP 800-218 (SSDF)
Secure Software Development Framework: practices for provenance, review and vulnerability handling of generated and third-party code; SSDF-AI companion covers AI-assisted development.
unverified · no verification date
evidence for: Cyber Resilience Act
ISO/IEC 27001:2022 + A.8.28
Information-security management; control A.8.28 (secure coding) is the natural anchor for AI code-generation and QA workflows alongside ISO 42001.
unverified · no verification date publisher ISO
evidence for: Cyber Resilience Act
BSI C5:2026
Cloud compliance catalogue (168 requirements): post-quantum crypto, confidential computing, container security — infrastructure evidence layer for NIS2/CRA/Art. 15; binding baseline from June 2027.
unverified · no verification date
evidence for: NIS2 Directive
Architecture Blueprint
Guarded RAG Pattern
For limited-risk conversational/generative systems: deterministic RAG with input rails (DLP/NER, injection blocking), retrieval rails (relevance, freshness, ACL) and output rails (groundedness check with deterministic fallback), plus synthetic-content labelling.
Mode 3 — Human-on-the-Loop
Autonomous execution with aggregate oversight: dashboards, sampling audits (5–10%), real-time veto. For high-volume, low-individual-impact steps.
Required Technical Components (10)
SBOM & Dependency Management
Software bill of materials incl. model weights and datasets; automated vulnerability patching pipeline.
from: Cyber Resilience Act
Secure Boot & Hardened Runtime
Verified boot chain and hardened runtimes for edge/IoT deployments per CRA security-by-design.
from: Cyber Resilience Act
Unified Incident-Response Runbook
One procedure reconciling AI Act Art. 73, GDPR Art. 33 (72h), DORA and NIS2 (24h/72h) timelines and recipients.
from: NIS2 Directive
Vendor & Model Due-Diligence Kit
Scoring model: jurisdiction (CLOUD Act exposure), zero-data-retention, BYOK support, audit evidence (C5/AIC4/ISO 42001/EN 18286:2026), tenant isolation.
from: NIS2 Directive
Input Rails / Prompt Shields
Pre-model validation of user input: injection detection, topic blocking, encoding checks.
from: Guarded RAG Pattern
Retrieval Rails (ACL-aware RAG)
Relevance, freshness and per-user permission checks on every retrieved chunk; curated, versioned index.
from: Guarded RAG Pattern
Output Rails / Groundedness Check
Faithfulness scoring of answers against retrieved sources; deterministic fallback instead of hallucination; schema-validated structured output.
from: Guarded RAG Pattern
PII Scrubbing / DLP-NER Layer
Automated detection, pseudonymisation and blocking of personal data in inputs, retrievals and outputs.
from: Guarded RAG Pattern
Synthetic-Content Labelling / Watermarking
Synthetic-content labelling & watermarking: visible disclosure plus machine-readable provenance (C2PA Content Credentials) embedded in generated images, audio and video; metadata identifying artificial origin survives common transformations. Discharges Art. 50(2)/(4) for deepfakes and synthetic media; verification telemetry (watermark presence/validity checks at publication gates) is the corresponding evidence stream.
from: Guarded RAG Pattern
Dual-Gate Validation Pipeline
Input and output validation as two independent gates (MLCommons-hazard-class semantic filters, groundedness checks, structural validators: LLM Guard sub-ms–10 ms, Llama Guard <90 ms, NeMo <50 ms, Guardrails AI 50–200 ms). Latency economics decide the architecture: sequential gate chains add 300–800 ms per agent action; parallel evaluation collapses total added latency to the slowest single check — run independent checks concurrently, reserve sequential ordering for true dependencies.
from: Guarded RAG Pattern
Delivery Stack & Pipeline Stage (7)
Service-as-a-Software delivery: the engines, patterns and artifacts this workflow needs on top of the generic obligations. See the full pipeline
Code Automation & QA Engine
Generation, refactoring, test synthesis and vulnerability scanning inside CI/CD, with license and provenance checks on every suggestion.
SBOM & Dependency Management
Software bill of materials incl. model weights and datasets; automated vulnerability patching pipeline.
OpenTelemetry / FCoT Tracing
Hierarchical trace spans for every sub-task, prompt, retrieved document and API call — the reconstructible decision path for Art. 12/14 and PLD disclosure.
Multi-Model Router & Fallback Abstraction
Abstraction layer decoupling application logic from model providers: dynamic routing on capability, cost, latency SLA and regulatory constraint (sensitive-data classes pinned to ZDR private/VPC endpoints or on-prem open-weight instances); real-time health monitoring with automatic fallback to secondary endpoints or local fine-tuned models on outage/latency spikes. Discharges resilience duties (DORA-class), prevents provider lock-in, and makes model deprecations a routing-table change instead of a re-architecture. Router decisions are logged into the decision trace — model version per event is an audit-packet field.
pipeline stage 3 — Multi-model routing & fallback
Dual-Gate Validation Pipeline
Input and output validation as two independent gates (MLCommons-hazard-class semantic filters, groundedness checks, structural validators: LLM Guard sub-ms–10 ms, Llama Guard <90 ms, NeMo <50 ms, Guardrails AI 50–200 ms). Latency economics decide the architecture: sequential gate chains add 300–800 ms per agent action; parallel evaluation collapses total added latency to the slowest single check — run independent checks concurrently, reserve sequential ordering for true dependencies.
Ephemeral Execution Isolation
gVisor/Firecracker microVMs, read-only root, egress allowlists; container discarded after each task to prevent persistence of exploits.
Model Abstraction & Graceful Fallback
Application logic addresses capabilities, not providers; the router degrades to a secondary or local model on error-rate or latency breach instead of failing the workflow.
Build or Buy — Vendor Layer (4)
The graph models vendor CATEGORIES as first-class nodes and keeps named vendors as community-maintained, disputable desc content with lastVerified dates. A category is stable; a vendor list is a currency-layer object like any standard node.
AI GRC & Governance Platforms
Second-line systems of record: model/agent inventory incl. third-party SaaS AI, automated risk tiering, policy administration, cross-framework mapping & control deduplication, audit-evidence generation, intake workflows. Exemplary (community-maintained): ModelOp Center, Credo AI, IBM watsonx.governance, OneTrust, Holistic AI, Modulos (governance graph), Monitaur (insurance/lending), Fairly AI, Saidot, Trustible, Enzai, LatticeFlow (technical validation), Vanta (evidence automation), ServiceNow (intake/ITSM); data-catalog adjacency: Collibra, Alation, Informatica. Selection metrics: see meta.marketLandscape.selectionMetrics.grc.
unverified · verified 2026-08-06 community-maintained
selection metrics: multi-model/multi-cloud cataloging incl. third-party SaaS, automated risk tiering, regulatory reporting, independent-2nd-line deployability, cross-framework control deduplication
supplies: Vendor & Model Due-Diligence Kit
Runtime Security & Guardrail Vendors
First-line inline enforcement: single-pass parallel input/output evaluation proxies, injection & exfiltration defense, PII masking, grounding checks, SecOps routing. Exemplary (community-maintained): Prompt Security, HiddenLayer (MLSDR), Palo Alto AI Runtime Security, AWS Bedrock Guardrails, NVIDIA NeMo Guardrails, Guardrails AI, Robust Intelligence, LLM Guard / Llama Guard OSS class. Selection metrics: single-pass latency (<20 ms class), catch rates, policy-version telemetry into the AI-BOM.
unverified · verified 2026-08-06 community-maintained
selection metrics: single-pass parallel evaluation latency (<20 ms class), injection/hallucination catch rates, SecOps/SIEM routing, policy versioning surfaced into the AI-BOM
supplies: Input Rails / Prompt Shields · Output Rails / Groundedness Check · Dual-Gate Validation Pipeline
Secure Data Infrastructure & Vector Storage
Governed retrieval substrate: vector databases, lakehouses and catalogs with tenant/namespace isolation, RBAC + client-managed keys (CMEK), lineage into RAG chunks, air-gap options. Exemplary (community-maintained): Pinecone (serverless, SOC 2), Chroma/FAISS (self-hosted/air-gapped sovereignty), Snowflake Cortex (masking, clean rooms), Databricks Unity Catalog (end-to-end lineage), Azure AI Search, AWS OpenSearch. The Art. 10 runtime data-governance duties land here.
unverified · verified 2026-08-06 community-maintained
selection metrics: namespace/tenant isolation, RBAC + CMEK, lineage into RAG chunks, SOC 2 / ISO 27001 attestations, air-gap capability
supplies: Retrieval Rails (ACL-aware RAG)
Regulated Foundation-Model Platforms
Frontier commercial APIs and open-weight models under enterprise controls: zero-data-retention tiers, data isolation, fine-tuning governance, safety alignment documentation, EU-sovereign options. Exemplary (community-maintained): Anthropic Claude (ZDR enterprise tier), OpenAI GPT enterprise, Google Gemini Enterprise, Cohere (private-cloud RAG), Mistral (EU/self-hosted), Meta Llama (open-weight sovereignty). GPAI-chapter duties and vendor due diligence attach at this layer.
unverified · verified 2026-08-06 community-maintained
selection metrics: ZDR enterprise tiers, data isolation, EU-sovereign options, fine-tuning controls, safety alignment documentation
supplies: Synthetic-Content Labelling / Watermarking
Procurement rule: Derived from three-lines-of-defense separation: the second-line GRC platform must be procured and deployed independently of any first-line runtime or model vendor — a governance tool that only sees its own vendor's models cannot govern a multi-model estate, and closed third-party SaaS AI can only be governed contractually (intake, attestation, AI-BOM disclosure), never by inline inspection.
Outsourced delivery BPO · SaaS · Service-as-a-Software caveats
Delivery Model — BPO · SaaS · Service-as-a-Software
Spectrum
BPO: input-priced (billable hours/FTEs), linear headcount scaling, human error & attrition as primary risk
SaaS: capability-priced (software access), client operates the workload, implementation/adoption failure as primary risk
Service-as-a-Software: outcome-priced (SLA on completed work), provider-managed AI executes 60–80% of cognitive tasks with specialist supervision, algorithmic bias & non-compliance as primary risk
Caveats in regulated markets
— Outcome SLAs move compliance risk onto the provider — but NOT the buyer's deployer duties: Art. 26 oversight, log retention and FRIA obligations stay with the enterprise even when execution is outsourced.
— Provider role analysis is the central legal question: a productized platform that fine-tunes, re-purposes or chains models can flip into the Art. 25 provider role with full high-risk obligations.
— Certified operations (ISO 42001) function as a procurement moat and shortcut third-party risk assessment — but organizational certificate ≠ product conformity (never conflate, see meta.assuranceEcosystem).
— The buyer's evidence chain must reach into the provider: contractually mandated AI-BOM disclosure, ZDR certificates, bias-audit reports and logging-ledger access are the artifacts that make an outsourced workflow auditable.
Threat Profile
LLM03 Supply Chain
Compromised third-party models, datasets, adapters or libraries.
mitigate with: SBOM & Dependency Management, Vendor & Model Due-Diligence Kit
IP Infringement from Generated Assets & Code
Generated imagery, copy or code reproduces protected material or incompatible-licence snippets into client deliverables.
mitigate with: Data Lineage & Versioning, Vendor & Model Due-Diligence Kit
LLM05 Improper Output Handling
Unvalidated outputs cause XSS, SSRF or remote code execution downstream.
mitigate with: Output Rails / Groundedness Check, Ephemeral Execution Isolation, Dual-Gate Validation Pipeline