Turn an AI use case into its EU AI Act risk class, the regulations it triggers, the obligations, the architecture and the evidence you owe — in about two minutes.
Community-curated knowledge graph, peer-reviewed by experts across law, engineering and governance. Every change traceable →
Every regulation in the graph resolves into concrete technical components — through an article obligation, a control objective, a design pattern or an evidence artefact that a component must produce. Pick a regulation to see its technical surface, how each component is derived, and in which of the triggering use cases it is actually part of the required stack. The gap counts show where the graph reaches a component that no use case yet requires — those are open contribution targets, not settled answers. Open the full graph →
Digital operational resilience for the financial sector: ICT third-party risk (CTPP oversight), change management, resilience testing — applies to AI-based trading, credit and KYC systems.
6 components0 articles / obligations9 triggering use casesopen in graph
WORM / Immutable Audit Vault
89% of use cases
Append-only, hash-chained audit vault (WORM object-lock storage, AES-256 at rest, TLS 1.3 in transit). Guarantees tamper-evidence within the organization's trust domain — which stops your own team, but not an admin who can rebuild the vault. Pair with an external trust anchor and key ceremonies outside the operating team for evidence that holds against the insider scenario.
evidence artefactDORA → Event Logs & Decision Traces → produced by WORM / Immutable Audit VaultEvent Logs & Decision Traces
Hierarchical trace spans for every sub-task, prompt, retrieved document and API call — the reconstructible decision path for Art. 12/14 and PLD disclosure.
evidence artefactDORA → Event Logs & Decision Traces → produced by OpenTelemetry / FCoT TracingEvent Logs & Decision Traces
Abstraction layer decoupling application logic from model providers: dynamic routing on capability, cost, latency SLA and regulatory constraint (sensitive-data classes pinned to ZDR private/VPC endpoints or on-prem open-weight instances); real-time health monitoring with automatic fallback to secondary endpoints or local fine-tuned models on outage/latency spikes. Discharges resilience duties (DORA-class), prevents provider lock-in, and makes model deprecations a routing-table change instead of a re-architecture. Router decisions are logged into the decision trace — model version per event is an audit-packet field.
named in regulationDORA → Multi-Model Router & Fallback Abstractionprovider-outage resilience & exit strategy