EU AI Act compliance checklist for AI engineering teams

#ai #security #tutorial #beginners

The EU AI Act deadline for high-risk AI systems is August 2, 2026. If you are building AI agents, here is what your engineering team needs to do.

I put together a practical checklist based on Articles 9-15. Full version with checkboxes on GitHub: eu-ai-act-checklist

The Articles That Matter for Engineers

Article 9 - Risk Management
You need a documented risk management system. Not a PDF that sits in a drawer - an active process that identifies risks, tests mitigations, and updates as the system evolves.

Article 10 - Data Governance
Training data needs documentation: sources, preparation methods, bias analysis. If your agent accesses external data at runtime, you need to document that too.

Article 11 - Technical Documentation
Annex IV lists everything you need to document. Architecture, algorithms, data pipelines, performance metrics, known limitations. Start writing this now, not the week before the deadline.

Article 12 - Logging (the one most teams miss)
This is where it gets technical. The law says \"tamper-evident automatic recording of events.\" That word tamper-evident means your logs need cryptographic integrity - a regular database or log file is not enough.

In practice: every agent action needs a signed record that chains to the previous one. If someone deletes a log entry, the chain breaks and you know.

Tools that help: asqav (ML-DSA-65 signed chains), AgentMint (Ed25519 receipts), Aira (hosted receipts).

Article 13 - Transparency
Users need to know they are interacting with an AI system. Document what the system can and cannot do.

Article 14 - Human Oversight
High-risk operations need human approval gates. For AI agents, this means multi-party signing or approval workflows before destructive actions.

Article 15 - Accuracy, Robustness, Cybersecurity
Test adversarial inputs. Document accuracy benchmarks. Use post-quantum crypto if your retention period exceeds 7 years.