Tag: eu-ai-act

EU AI Act Compliance Is a Pipeline, Not a PDF

Turning the EU AI Act and ISO 42001 into automated CI/CD gates, risk classification, and cryptographic provenance — not a last-minute audit binder.

Kovcheg's credit module drafts decisions on customer applications. Under the EU AI Act, this is not an "assistant" — it is a high-risk AI system. Creditworthiness assessment of individuals is explicitly named in Annex III, which moves the system into a different legal class: a mandatory risk management system, technical documentation, logs, human oversight, registration. In parallel, the text assistant generating replies to customers falls under Art. 50 — transparency for AI-generated content. One system, two different sets of obligations.

Continue reading “EU AI Act Compliance Is a Pipeline, Not a PDF”

Auditability & Reproducibility: How to Prove to a Regulator What Your AI Actually Did

Six months after launch, a regulator asks why your AI denied a loan. Without an immutable trace of every call, you have no answer — and a high-risk system that is non-compliant.

Six months after your loan-approval system goes live, a regulator submits a formal request. A customer is appealing a denial dated May 12. The question is simple and lethal: why did the AI recommend denial?

If your answer is "the model decided so," you are already non-compliant. A high-risk system under the EU AI Act requires a reconstructible chain of evidence: the exact system prompt, the customer data pulled in, the model version, the guardrails that fired. Without an immutable trace of every call, the decision is unprovable, and the system cannot legally operate.

Continue reading “Auditability & Reproducibility: How to Prove to a Regulator What Your AI Actually Did”

Manifesto: AI Governance as a control plane, not a PDF policy

Governance that can’t be bypassed technically is not a document — it’s a control plane. Every model call physically passes through PII masking, access control, guardrails, and audit.

There are two ways to do AI governance. The first is to write a policy. A forty-page document: responsible AI principles, a committee, a role matrix, a requirement to "use AI ethically." It gets signed, filed in SharePoint, and revisited at the next audit. The second way is to build governance into the request path: every model call is physically unable to bypass PII masking, access control, guardrails, limits, and audit, because they stand in the way of the packet, not in the developer's head.

This is about the second way. The thesis is simple and blunt: governance that can't be bypassed technically is not a document — it's a control plane.

Continue reading “Manifesto: AI Governance as a control plane, not a PDF policy”