The EU AI Act's high-risk and transparency obligations have been applying since 2 August 2026. If you sell an AI system into the EU, the buyer conversation has changed from "is it accurate?" to "show me the evidence".
What is actually being asked for
For a high-risk system, the evidence maps to:
- record-keeping — logs that show the system's operation over its lifetime;
- human oversight — who can intervene, how, and what the record looks like;
- technical documentation — the model/system description, intended purpose, limitations, and risk controls.
For transparency-scope products the set is narrower. The classification drives the scope; a blanket "we are AI Act compliant" claim is not evidence.
The artifact most teams forget
A log of successful calls is not enough. The reviewer wants to know what was refused and why: which policy fired, which payee was blocked, which task budget was exhausted. That is the deny log.
A useful pack contains:
- system description and intended purpose;
- model card with known limitations;
- audit-log schema and a sample;
- human-oversight procedure;
- risk-classification memo;
- deny/refusal evidence with a verifiable record;
- data-flow and subprocessor map.
What we deliver
The EU AI Act Evidence Pack in 5 days for $1,500; express 72 hours for $3,000. It is an evidence package, not a legal opinion and not a certification. The output is designed for a security/legal reviewer to inspect, not for a marketing page.
If your team is still debating whether the product is in scope, start with the classification memo. That is usually the cheapest decision to get right.
The portfolio
- Deny Evidence — signed refusal log, $29/month: https://attest.rta.lat/deny-evidence
- MCP Security Pass — $500 review before you expose a server: https://rta.lat/audit/
- EU AI Act Evidence Pack — $1,500 / 5 days; $3,000 / 72 hours: https://attest.rta.lat/eu-ai-act-evidence
Top comments (0)