BY NEURABYTE
FRAMEWORKS/AI/EU AI ACT
EU AI
AI · European Union

EU AI Act

The first comprehensive AI law, with logging and oversight duties for high-risk systems.

The AI Act entered into force in August 2024 and phases in through 2027. It classifies systems by risk. High-risk systems must meet requirements for risk management, data governance, technical documentation, record-keeping, transparency, human oversight, and accuracy. General-purpose model providers have separate duties. Penalties reach 7% of global turnover.

AT A GLANCE
ISSUEREuropean Union REGIONEU, extraterritorial CATEGORYAI CROSSWALKVersioned mapping onto the 15-control registry
EVIDENCE, NOT CERTIFICATION
01. WHO IT APPLIES TO

Is this one yours?

01Providers and deployers of high-risk AI systems in the EU
02Organizations using agents in employment, credit, insurance, or essential services
03Any deployer needing an audit trail for AI-driven decisions
02. KEY REQUIREMENTS

The parts of EU AI Act that touch what agents do.

Art. 12 Record-keeping
High-risk systems automatically log events over their lifetime, sufficient to trace operation and identify risk situations.
Art. 13 Transparency
Deployers can interpret output and understand what information the system used.
Art. 14 Human oversight
Natural persons can oversee, intervene, override, or stop the system, with measures proportionate to risk.
Art. 9 Risk management
A continuous, iterative process across the lifecycle.
03. HOW LORE MAPS TO IT

Enforcement controls, read against the requirement.

These controls exist because the platform needs them to run safely. The crosswalk reads their signed evidence against EU AI Act. Where there is no evidence, the report says gap.

LORE CONTROL EU AI ACT REFERENCE
Signed, hash-chained receiptsArt. 12(1), 12(2)
Context disclosure recordArt. 13(3)(b), Art. 10
Maker–checker approvalArt. 14(4)(d), 14(4)(e)
Blocking authorization gateArt. 14(4)(e) stop mechanism
Illustrative references. The shipped crosswalk carries exact clause citations, its version, and the review date.
04. OUT OF SCOPE

What Lore will not claim.

Risk classification, conformity assessment, and CE marking are provider obligations.
Fundamental rights impact assessments are organizational.
05. QUESTIONS
Are agents high-risk?
It depends on what they do, not what they are. An agent adjusting insurance claims is high-risk; one drafting internal notes is not.
What does Art. 12 actually want?
Logs that identify the situation, the inputs used, and who verified results. A receipt with a linked context snapshot is that record.
When do obligations start?
Prohibited practices applied from February 2025; GPAI duties from August 2025; most high-risk obligations from August 2026, with some extended to 2027.
← PREVIOUSISO 27701 ALL FRAMEWORKS NEXT →NIST AI RMF
EU AI ACT · EARLY ACCESSEVIDENCE COLLECTED ONCE

Start building the record your auditor will read.

Every receipt Lore signs today is evidence for EU AI Act tomorrow. Turn the crosswalk on when you are ready; nothing needs re-collecting.

Also from Neurabyte: Cupel
Lore's core mechanisms are patent-pending. Product names are trademarks of their respective owners; listing an integration doesn't imply a partnership.
© 2026 NEURABYTE INC.