EU AI Act

Overview

Govern → Compliance program → EU AI Act covers the obligations the EU Artificial Intelligence Act places on an organisation that builds or uses AI: providers, deployers, importers, distributors and providers of general-purpose AI models. For each Article it shows whether it applies to you, its status in the current environment, the checks behind that status and who attested it.

Caution

This is evidence, not legal advice, a legal determination or a conformity assessment. A status says what Shield360 observed and what your people recorded in this environment. Whether an obligation is met, and whether a system is high-risk, is for you and your advisers to decide.

The Articles are those of the Regulation as published in the Official Journal: Regulation (EU) 2024/1689 of 13 June 2024, OJ L, 2024/1689, 12.7.2024 (EUR-Lex). Article numbers, titles, the Art. 73 deadlines, the Art. 5 practices and the Annex III and Annex IV lists were checked against that text. Later amending acts may change the application dates; check the consolidated text on EUR-Lex.

Prerequisites

• Govern → Compliance program → Framework controls reads your environment (see Controls).
• To record roles, classify systems, attest Articles or record literacy: the Maintain the Statement of Applicability permission (compliance.soa.manage).
• To record serious incidents: the Manage findings and corrective actions permission (compliance.findings.manage).
• Anyone with View the compliance overview (compliance.read) can read the page.

The Articles covered

Chapter	Articles	Binds
I General provisions	Art. 4 AI literacy	Providers, deployers
II Prohibited AI practices	Art. 5	Providers, deployers
III High-risk AI systems	Art. 6 classification; Art. 9–15 requirements (risk management, data governance, technical documentation, record-keeping, transparency to deployers, human oversight, accuracy, robustness and cybersecurity); Art. 16–21 provider obligations (including the quality management system, documentation keeping, logs, corrective actions, cooperation); Art. 22 authorised representatives; Art. 23 importers; Art. 24 distributors; Art. 25 value chain; Art. 26 deployers; Art. 27 fundamental rights impact assessment; Art. 43 conformity assessment; Art. 47 EU declaration of conformity; Art. 48 CE marking; Art. 49 registration	Providers, deployers, importers, distributors
IV Transparency	Art. 50	Providers, deployers
V General-purpose AI models	Art. 53, 54, 55	GPAI model providers
IX Post-market monitoring	Art. 72 post-market monitoring; Art. 73 serious incidents; Art. 86 right to explanation	Providers, deployers

That is 33 Articles. Articles addressed only to authorities, notified bodies, the Commission or the AI Office are left out: they place no obligation an organisation can evidence. Art. 60 and 61 (testing high-risk systems in real-world conditions outside a sandbox) are left out too; a provider that runs such tests evidences them with its test plan.

Each Article’s title is the Regulation’s own. The one-line hint in the attestation dialog is written for Shield360 and is not a quotation.

Statuses

Status	Meaning
Met	Met, with at least one check Shield360 observed behind it.
Attested	Met on the owner’s attestation alone: Shield360 observes nothing for this Article.
Partial	A gap or missing evidence, but some of its checks are met.
Gap	A gap, and nothing met.
No evidence	Nothing recorded or observed yet, such as an Article nobody has decided on.
Not applicable	Recorded as not applicable, or ruled out by your roles and systems (with the reason).

Covered is the share of Articles met, attested or not applicable.

Your roles

Under Your roles, record the roles your organisation holds in this environment and the facts that decide which Articles apply:

• Provider, Deployer, Importer, Distributor, General-purpose AI model provider (Art. 3(3)–(7)).
• A body governed by public law, or a private entity providing public services: brings in the fundamental rights impact assessment (Art. 27) and deployer registration (Art. 49(3)).
• Established outside the Union: brings in the authorised representative (Art. 22, 54).
• A general-purpose AI model you provide has systemic risk: brings in Art. 55.

AI systems

Under AI systems, every AI system in scope is listed: applications and agents seen in the AI inventory, and AI tools rated high risk, while in use. For each, record:

Field	What it decides
Class	Prohibited (Art. 5), high-risk (Art. 6), transparency only (Art. 50), or minimal risk.
Your role for this system	Whether you provide it, deploy it, or both.
Annex III area	Points 1 to 8 of Annex III. An Annex III system you do not treat as high-risk needs the reasoning written down (Art. 6(3), 6(4)), and registering (Art. 49(2)).
Annex I	A safety component of, or itself, a product under Annex I law (Art. 6(1)).
Credit or insurance	Annex III points 5(b) and 5(c): brings in the fundamental rights impact assessment for any deployer.
Art. 50 checklist	For each trigger (interacts with people, generates synthetic content, recognises emotions or categorises biometrically, deep fakes, public-interest text), whether its measure is in place.
EU database registration	The registration number once registered (Art. 49, 71).
Annex IV technical documentation	For a high-risk system you provide: where each Annex IV document is kept, as a link or a note.

Technical documentation pack (Art. 11, Annex IV)

For a high-risk system you provide, Annex IV pack downloads a JSON file ready to lay out as a PDF. It lists each of the 23 Annex IV items as observed, referenced or missing, and carries the records behind the observed ones:

Item	Observed from
2(d) Data requirements and datasheets	The dataset registry: at least one approved dataset is linked to the system, and every dataset linked to it is approved, with owner, provenance, license, legal basis, classes and the Art. 10 quality and bias examination recorded
2(e) Assessment of human oversight measures	A current approved impact assessment of the system that records its oversight
2(g) Validation and testing	Evaluations that ran in the period, or a recent red-team run
2(h) Cybersecurity measures	Prompt-injection detection on in some channel
5 Risk management system	A current approved impact assessment of the system, with the risk register

The pack lists the datasets linked to the system as the register summary carries them: purpose, status and approval, which governed items are recorded, classes, kinds, legal basis, version and SHA-256. Their free text is left out.

Every other item, such as the instructions for use, the design specifications or the EU declaration of conformity, is a document only you hold. Record where it is kept. The pack gathers what Shield360 holds and lists what is missing; your own technical documentation satisfies Art. 11, not the pack.

Which Articles apply

From your roles and each system’s class, Shield360 works out whether each Article applies:

• An Article for a role you do not hold is not applicable. For example, Art. 16 when you are only a deployer.
• The high-risk Articles apply when a system you provide (Art. 9–21, 43–48, 72) or deploy (Art. 26) is classified high-risk.
• Art. 27 applies to a deployed high-risk Annex III system (not point 2) when you are a public body or public-service provider, or the system is used for creditworthiness or life and health insurance pricing.
• Art. 49 applies to an Annex III system you provide, high-risk or concluded not high-risk, and to a deployed one when you are a public body.
• Art. 50 applies when any system has a transparency trigger.
• Chapter V applies to a GPAI model provider; Art. 54 only outside the Union, Art. 55 only with systemic risk.

While your roles are not recorded, or a system that would decide it is unclassified, nothing is derived. An Article nobody has decided on that is ruled out shows as Not applicable with the reason. A decision recorded in the Statement of Applicability always wins. Edit an Article from the page, or open Govern → Compliance program → Framework controls → EU AI Act → Applicability.

Prohibited-practice screening (Art. 5)

Every AI request answers eight questions, one for each practice of Art. 5(1)(a)–(h): manipulative techniques, exploiting vulnerabilities, social scoring, crime prediction by profiling, untargeted facial image scraping, emotion recognition at work or in education, biometric categorisation of sensitive traits, and real-time remote biometric identification for law enforcement. A request cannot be submitted without every answer. A yes flags the request: it can be rejected, but never approved. Microsoft 365 Copilot and the Office add-in ask the same questions and send the answers with the request. Shield360 validates them exactly as it validates the web form. A request that arrives without answers is held: it shows as not screened and cannot be approved until the requester answers the questions. This covers older add-ins and agent packages, and requests from before the screening existed. The requester gets an Answer screening action on the request, a link to it in the channel’s reply, and an email reminder. See Requests from Microsoft Copilot and the Office add-in.

AI literacy (Art. 4)

Under AI literacy, record who completed which training or acknowledgement and when. Choose a member of the organisation, or import a CSV with email, course and completed_at columns (and optionally kind, expires_at and evidence_ref). Rows whose email is not a member are skipped and listed by line number. A record without an expiry counts for a year. The page shows the share of members with a current record; the check asks for 90%.

email,course,completed_at,kind,expires_at
ana@example.com,AI acceptable use,2026-09-30,acknowledgement,
bo@example.com,Working with AI assistants,2026-10-02,training,2027-10-02

Serious incidents (Art. 73)

See Serious incident register.

Checks

Check	Article	Met when
Members have current AI literacy records	4	At least 90% of members have a current record
AI uses are screened against prohibited practices	5	No prohibited system in use, no flagged request approved, every request in the period screened
AI systems are classified under the EU AI Act	6	Every system in scope has a class
High-risk systems have their Annex IV documentation	11, 16	Every Annex IV item observed or referenced
Logs are kept at least six months	16, 19, 26	Traces and log events kept at least 183 days
Fundamental rights impact assessments are complete	27	Every required FRIA current, complete and notified
Systems are registered in the EU database	16, 49	Every system that needs it has its registration id
Art. 50 transparency measures are in place	50	Every triggered measure in place
Serious incidents are reported in time	26, 72, 73	Nothing overdue, nothing reported late in the period

Art. 10 is also backed by Datasets feeding AI systems are owned, sourced, licensed, classified, examined for quality and bias, and approved from the dataset registry: every training, validation, testing or grounding dataset of an in-scope system has its Art. 10(2) governance practices and Art. 10(3) quality examination recorded and a second person’s approval.

The existing checks back Art. 5, 6, 9, 10, 12, 13, 14, 15, 17, 26 and 72 too: the AI inventory, risk ratings, impact assessments, prompt-injection detection, sensitive-data protection, the data gateway, the audit log, retention, provenance, sequence policies, coding-agent oversight, agent authorization and ownership, evaluations, red teaming, approved models, transports and alerts. The rest are attested only: Art. 18, 20–25, 43, 47, 48, 53–55 and 86. Shield360 observes nothing for them; their status is your owner’s attestation.

Note

By default the trace and log tables keep rows for 730 hours (about 30 days), the minimal period that keeps the product useful, so Logs are kept at least six months shows a gap until you keep them longer. Art. 19(1) and 26(6) allow a different period where other Union or national law provides one.

Keep logs for six months

The EU AI Act logs — keep at least 6 months preset in Settings → Data retention → How long logs are kept keeps traces, the trace index and log events for 183 days. When you have recorded a provider or deployer role under Your roles and the check is a gap, the Articles view shows a Logs are kept less than six months callout, and the check’s reason carries an Apply the EU AI Act logs preset link. Both open the preset with its effect shown first: the tables, each environment’s period before and after, and how much more the tables will hold. Nothing changes until you confirm.

The preset changes how long logs are kept, not what they hold: prompts, responses and tool content are stored only where data retention stores them. The check reads the tables’ own TTLs, the shorter of the traces and the log events, so it turns met as soon as the preset is applied. An environment set to keep logs for less than the organisation keeps its own shorter period and stays a gap. See How long logs are kept.

Export and evidence package

Export (JSON) on the Articles view downloads the statement: every Article with its status, checks, attestation and applicability, the coverage summary, your roles, the source and the disclaimer. An evidence package for the EU AI Act adds eu-ai-act-statement.json beside the Statement of Applicability, signed with the rest.

API

Method	Path	Permission	Body or query
GET	/api/governance/eu-ai-act	compliance.read	period (7d, 30d, 90d)
GET	/api/governance/eu-ai-act/export	compliance.read	period
PUT	/api/governance/eu-ai-act/profile	compliance.soa.manage	{ roles, publicBody?, outsideEu?, gpaiSystemicRisk? }
PATCH	/api/governance/eu-ai-act/systems	compliance.soa.manage	{ assetKey, riskClass?, systemRole?, annexIiiArea?, annexI?, creditOrInsurance?, rationale?, transparency?, euDatabaseId?, docRefs?, markReviewed? }
GET	/api/governance/eu-ai-act/technical-documentation	compliance.read	asset
GET, POST	/api/governance/eu-ai-act/literacy	compliance.read, compliance.soa.manage	{ userId, course, completedAt, kind?, expiresAt?, evidenceRef? } or { csv }
DELETE	/api/governance/eu-ai-act/literacy/{id}	compliance.soa.manage

Every route acts on your current environment; a database config id in a request is ignored. Malformed JSON returns 400. Every change is written to the audit log with the fields that changed, never the free text (rationale, document references, incident text).

Limits

• Shield360 does not decide whether a system is high-risk, prohibited or within scope of the Regulation: your classification does. Derived applicability follows what you recorded.
• Observed checks show that controls are on and records exist, not that they are adequate for the Regulation.
• Registration in the EU database, conformity assessment, CE marking and notification of authorities happen outside Shield360; it records that they did.
• Literacy records count members of the organisation only, not contractors or others acting on your behalf.

Next steps

Serious incidents

Record serious incidents and report them in time

Controls

Every framework’s controls and the Statement of Applicability

Impact assessments

Including the fundamental rights impact assessment