Kovcheg's credit module drafts decisions on customer applications. Under the EU AI Act, this is not an "assistant" \u2014 it is a high-risk AI system. Creditworthiness assessment of individuals is explicitly named in Annex III, which moves the system into a different legal class: a mandatory risk management system, technical documentation, logs, human oversight, registration. In parallel, the text assistant generating replies to customers falls under Art. 50 \u2014 transparency for AI-generated content. One system, two different sets of obligations.<\/p>\n
<\/p>\n
This chapter covers the compliance plane: turning regulatory requirements from a PDF policy into automated gates and artifacts. Compliance assembled by hand ahead of an audit date is theater. Compliance generated by a pipeline from your live engineering planes is evidence.<\/p>\n
The stakes are explicit. Fines under Art. 99 come in three tiers: up to \u20ac35M or 7% of turnover for prohibited practices under Art. 5 (in force since 02 Aug 2025); up to \u20ac15M or 3% for high-risk violations; up to \u20ac7.5M or 1% for supplying incorrect information to a regulator. For SMEs, the lower figure applies.<\/p>\n
The timeline has shifted, but a delay is not a cancellation. Prohibitions and GPAI rules have applied since August 2025. The AI Office's supervisory powers and Art. 50 transparency requirements hit on 02 Aug 2026. Stand-alone high-risk systems under Art. 6(2) and Annex III were pushed by the Digital\/AI Omnibus to 02 Dec 2027. Embedded high-risk systems under Annex I move to 02 Aug 2028.<\/p>\n
Pushing the deadline to 2027 or 2028 breeds complacency. A risk management system, technical documentation, and evaluation pipelines take years to build. If you start when the deadline looms, you are already late.<\/p>\n
ISO\/IEC 42001 (published Dec 2023) is a de facto requirement in EU B2B RFPs. It is not harmonized under the AI Act, meaning it does not grant presumption of conformity. It does provide certifiable evidence of governance. NIST AI RMF is voluntary, non-certifiable, and serves as a bridge to ISO 42001.<\/p>\n
Use a Compliance-by-Design automated pipeline. Compliance is built into CI\/CD. Risk classification, the RMS, and content labeling are pipeline steps, not a manual audit prep exercise. Governance is expressed as policy-as-code. Evidence is auto-generated artifacts.<\/p>\n
At registration or release, a system is tagged with an AI Act category: unacceptable, high-risk, limited, or minimal. The class determines which gates are mandatory. For Kovcheg, the credit module routes to high-risk, triggering the full gate set. The text assistant routes to limited, triggering Art. 50 transparency obligations.<\/p>\n
Regular logging of risks and mitigations under Art. 9 is tied to the audit trail and evaluation reports. The RMS is a living process, not a one-off document you write and forget.<\/p>\n
Generated content \u2014 text, image, audio \u2014 carries cryptographic Content Credentials plus provenance metadata. To defend against metadata stripping, you apply Durable Credentials: invisible watermarks and perceptual fingerprints, the SynthID approach. The Commission's draft Code of Practice on Transparency cites C2PA as an example meeting all four Art. 50 criteria.<\/p>\n
The system dossier \u2014 covering data, model, evaluations, risks, and controls \u2014 is assembled automatically from your engineering artifacts at release time. It is not written after the fact by someone scrambling to meet an audit deadline.<\/p>\n
One table links "requirement \u2192 control (chapter) \u2192 evidence (artifact)." It maps AI Act articles to ISO 42001 controls to your implemented engineering planes. This matrix is the core of the audit.<\/p>\n