Regulation (EU) 2024/1689
High-risk-system obligations under Articles 12–15 take effect August 2, 2026. AEGIS ships a signed, article-by-article evidence pack — one-click JSON that an auditor can verify offline against the gateway's public key.
The EU AI Act classifies an AI system as high-risk when it falls in Annex III — including systems used in employment decisions, essential services (credit, insurance, benefits), critical infrastructure, law enforcement, education admissions, and migration/border control. Agentic systems operating in those verticals inherit the classification.
If you're in scope, the compliance obligations for Articles 12–15 must be operational by August 2, 2026. Missing them isn't just a regulatory risk — the Act allows fines of up to €35 million or 7 % of worldwide annual turnover, whichever is higher.
What the Act says The high-risk system must automatically log events relevant to identifying, monitoring, and investigating risk incidents.
How AEGIS satisfies it Every tool call becomes an append-only audit row with an Ed25519 signature over the Merkle chain. Signed evidence pack lists row count, first/last timestamps, and the transparency-log root hash.
What the Act says Systems must be designed so deployers can interpret the output and use it appropriately — instructions for use, characteristics, capabilities, limitations must be disclosed.
How AEGIS satisfies it Registered-agents view + policy DSL rules-in-force + static policy count all embedded in the evidence pack. Deployers can hand the JSON to auditors as the "what runs where, under what rules" declaration.
What the Act says Natural persons must be able to oversee the system, understand its outputs, intervene, and interrupt operation via a stop button.
How AEGIS satisfies it Blocking-mode approval queue + kill-switch API + agent status transitions (active → suspended). Evidence pack counts approvals decisions + kill-switch events + suspensions in the reporting window; fires a gap if the oversight loop was never exercised.
What the Act says Systems must achieve an appropriate level of accuracy, robustness, and cybersecurity — and perform consistently in those respects throughout their lifecycle.
How AEGIS satisfies it Detector chain + integrity sweep across every agent trace-chain + policy violations tally + rollback events. Evidence pack fires a gap if any agent has a broken chain (tamper suspected).
Evidence pack, at a glance
The evidence-pack endpoint bundles all four articles into a
single Ed25519-signed JSON document. Every article carries an
evidence object with the specific numbers your
auditor asks about + a gaps list flagging what's
missing.
$ curl -H "X-AEGIS-Key: $KEY" \
"https://aegistraces.com/api/v1/evidence-pack/eu-ai-act/export?window_days=90" \
-o aegis-eu-ai-act-$(date +%F).json
$ curl -H "X-AEGIS-Key: $KEY" \
https://aegistraces.com/api/v1/evidence-pack/public-key
{"key_id":"…","public_key_pem":"-----BEGIN PUBLIC KEY-----\n…"}
# Verify offline with any Ed25519 tool
Under the hood: EuAiActEvidenceService.build(orgId)
walks four DB queries (audit-log window, transparency-log root,
agents + DSL rules, approvals + kill-switch events, integrity
sweep). Each article's compliant flag flips to
true only when the minimum-evidence floor is met.
Overall pack compliant is a strict AND across all four
— no partial-credit shortcut.
Articles 12–15 are the record-keeping and operational controls we can actually observe at the tool-call layer. They are not the entire high-risk system compliance surface:
If someone tells you a single tool "covers the entire EU AI Act," they haven't read Chapter III Section 3. AEGIS covers the four articles that live at the runtime layer — properly, with cryptographic evidence — and integrates with whatever you use for the rest.
The demo page runs the compiler + evaluator client-side; the cloud tier exports the signed pack against your own live audit log.