Kovcheg's credit module drafts decisions on customer applications. Under the EU AI Act, this is not an "assistant" — it is a high-risk AI system. Creditworthiness assessment of individuals is explicitly named in Annex III, which moves the system into a different legal class: a mandatory risk management system, technical documentation, logs, human oversight, registration. In parallel, the text assistant generating replies to customers falls under Art. 50 — transparency for AI-generated content. One system, two different sets of obligations.
This chapter covers the compliance plane: turning regulatory requirements from a PDF policy into automated gates and artifacts. Compliance assembled by hand ahead of an audit date is theater. Compliance generated by a pipeline from your live engineering planes is evidence.
The regulator's timeline and the cost of delay
The stakes are explicit. Fines under Art. 99 come in three tiers: up to €35M or 7% of turnover for prohibited practices under Art. 5 (in force since 02 Aug 2025); up to €15M or 3% for high-risk violations; up to €7.5M or 1% for supplying incorrect information to a regulator. For SMEs, the lower figure applies.
The timeline has shifted, but a delay is not a cancellation. Prohibitions and GPAI rules have applied since August 2025. The AI Office's supervisory powers and Art. 50 transparency requirements hit on 02 Aug 2026. Stand-alone high-risk systems under Art. 6(2) and Annex III were pushed by the Digital/AI Omnibus to 02 Dec 2027. Embedded high-risk systems under Annex I move to 02 Aug 2028.
Pushing the deadline to 2027 or 2028 breeds complacency. A risk management system, technical documentation, and evaluation pipelines take years to build. If you start when the deadline looms, you are already late.
ISO/IEC 42001 (published Dec 2023) is a de facto requirement in EU B2B RFPs. It is not harmonized under the AI Act, meaning it does not grant presumption of conformity. It does provide certifiable evidence of governance. NIST AI RMF is voluntary, non-certifiable, and serves as a bridge to ISO 42001.
The architectural pattern: Compliance-by-Design
Use a Compliance-by-Design automated pipeline. Compliance is built into CI/CD. Risk classification, the RMS, and content labeling are pipeline steps, not a manual audit prep exercise. Governance is expressed as policy-as-code. Evidence is auto-generated artifacts.
Step 1. Auto-classifying risk in CI/CD
At registration or release, a system is tagged with an AI Act category: unacceptable, high-risk, limited, or minimal. The class determines which gates are mandatory. For Kovcheg, the credit module routes to high-risk, triggering the full gate set. The text assistant routes to limited, triggering Art. 50 transparency obligations.
Step 2. A Risk Management System for high-risk
Regular logging of risks and mitigations under Art. 9 is tied to the audit trail and evaluation reports. The RMS is a living process, not a one-off document you write and forget.
Step 3. C2PA watermarking for Art. 50
Generated content — text, image, audio — carries cryptographic Content Credentials plus provenance metadata. To defend against metadata stripping, you apply Durable Credentials: invisible watermarks and perceptual fingerprints, the SynthID approach. The Commission's draft Code of Practice on Transparency cites C2PA as an example meeting all four Art. 50 criteria.
Step 4. Technical documentation as an artifact
The system dossier — covering data, model, evaluations, risks, and controls — is assembled automatically from your engineering artifacts at release time. It is not written after the fact by someone scrambling to meet an audit deadline.
Step 5. A single compliance matrix
One table links "requirement → control (chapter) → evidence (artifact)." It maps AI Act articles to ISO 42001 controls to your implemented engineering planes. This matrix is the core of the audit.
The engineering stack
| Layer | Tool / Standard |
|---|---|
| Provenance / watermarking | C2PA Content Credentials, Durable Content Credentials, SynthID, draft ISO 22144 |
| Policy-as-code | OPA (Rego) — gates in CI/CD |
| Compliance automation | AI system registry, technical documentation templates, RMS trackers |
Where it breaks
Building this pipeline exposes four failure modes you have to account for.
Watermarks get stripped. Paraphrasing text, screenshotting, or re-encoding kills the mark. Durable Credentials reduce this but do not eliminate it, and the weakness is especially acute for text. Do not promise a client an "unremovable" mark. Build the system to survive the mark being lost.
Risk classification is not binary. Borderline cases require legal interpretation. The automation sets a draft class, and a lawyer confirms it. Auto-classification speeds things up; it does not replace judgment.
ISO 42001 does not equal presumption of conformity. Certification helps a lot in RFPs and as evidence, but it does not automatically satisfy the AI Act because the standard is not harmonized under the regulation.
Compliance theater returns. The matrix exists, but the controls do not work in production. This is the exact gap from a PDF policy. You fix it by generating evidence automatically from live planes, not by taking screenshots of a dashboard that says everything is fine.
The lab: classify, map, and test provenance
Classify both faces of Kovcheg under the AI Act and build the requirement-to-control-to-evidence matrix, referencing the artifacts from the preceding chapters. Attach C2PA credentials to generated content and test their survivability under paraphrasing and screenshotting.
The artifact you produce is a risk classification, a compliance matrix, and a provenance demo with an honest report on exactly where the mark gets stripped.
Maturity checklist
- L1: Systems are classified, a compliance owner is assigned.
- L2: An RMS and technical documentation exist as release artifacts; C2PA is applied to output content.
- L3: Policy-as-code gates run in CI/CD; an AI Act-to-ISO 42001 matrix exists with live, auto-generated evidence; Durable Credentials are deployed; AIMS certification readiness is achieved.
Sources
- EU AI Act — implementation timeline
- Article 99: Penalties
- EU AI Act and C2PA: what Article 50 requires
- ISO 42001 vs NIST AI RMF vs EU AI Act (EC-Council)
If your compliance strategy for the EU AI Act is a document someone updates by hand, you are building a binder for a fine.