83 days to EU AI Act full enforcement: here's what "auditability" actually requires
august 2, 2026. that's the date EU AI Act full enforcement kicks in for high-risk AI systems. the regulation has been on the books since 2024. the implementation period ends in 83 days.
the four requirements the Act specifies for high-risk systems — risk management, human oversight, transparency, and auditability — sound straightforward until you try to operationalize auditability in an agentic stack where the system is making decisions and initiating transactions across sessions that the human never directly observed.
that's the gap most teams are underestimating.
what "auditability" means in practice for autonomous agents
the EU AI Act doesn't define auditability as "we have logs." it requires that a competent authority can reconstruct the basis for a system's decision from the available records. for an agent that executed 200 tool calls in a 4-hour session, that means:
- which tool was called, when, and with what parameters
- what the agent's authorization state was at each decision point (what was it allowed to spend, access, or modify)
- whether the agent's behavior was within the defined operating envelope at each step
- where a human was in the loop — and where they weren't
most teams have the first item. few have the second. almost none have the third and fourth in a form a regulator can actually read.
the transaction-authorization gap
agentic systems that touch payments are in the highest-exposure category. when an agent initiates a financial transaction, the audit artifact that matters isn't the payment receipt — it's the authorization chain. what authorized this agent to spend? at what limit? was the spend within that limit? was the limit set by a human, and when?
if you can't answer those four questions from your logs today, you have an auditability gap that the EU AI Act will require you to close by august 2.
what the 48-hour audit finds
BizSuite's AI audit is scoped specifically to agentic systems. in 48 hours, the output is:
- a decision attribution map: which agent decisions can be traced to human authorization, and which can't
- a spend authorization chain: per-agent spending limits, who set them, and whether observed behavior stayed within bounds
- a cross-session behavioral consistency check: did the agent behave materially differently across sessions in ways that aren't explained by input differences
- a gap list: numbered, specific, ordered by remediation difficulty
the deliverable is a gap list + remediation plan, not a compliance certificate. if your legal team needs to show a regulator what you found and what you're fixing, this is the artifact.
$997 flat. 48-hour turnaround. the audit is scoped to what the EU AI Act's auditability requirement actually asks for — not a generic security review.
83 days is enough time to fix the gaps if you find them now. it's not enough time if you find them in july.
Top comments (0)