Skip to main content
Sign in →

EU AI Act Compliance

Generate Annex IV technical documentation evidence from ShieldAgent's audit trail, risk scoring, and evidence records.

Annex III high-risk obligations deadline: December 2027

The EU AI Act (Regulation (EU) 2024/1689, as amended by (EU) 2026/1744) moved high-risk Annex III obligations to December 2027. Fines for high-risk obligations reach €15M or 3% of global turnover (Art. 99(4)); €35M or 7% applies to prohibited practices (Art. 99(3)). ShieldAgent generates technical documentation evidence for part of Annex IV from your live proxy data.

Enterprise & high-risk AI teams

Annex IV documentation and conformity assessment are required before December 2027 for Annex III high-risk systems; a registered notified body may be mandatory. The separate Art. 27 fundamental-rights impact assessment applies only to public-sector deployers and private providers of public services using Annex III high-risk systems (other than critical infrastructure, point 2), and to deployers of Annex III point 5(b)/(c) use cases (e.g. credit scoring, life and health insurance risk assessment and pricing) — not to every high-risk system or provider. Start your gap analysis now.

Smaller teams & limited-risk systems

Art. 50 imposes specific transparency and notification duties on particular systems and uses — for example, disclosing that a chatbot is AI, labeling AI-generated or manipulated content, and informing people subject to emotion-recognition or biometric-categorization systems. There is no general inventory duty for every limited-risk system, and this is not shifted to the December 2027 Annex III deadline. Start instrumenting now so your audit trail is ready for whichever obligations apply to you.

Annex IV Coverage

ShieldAgent maps its runtime data to report sections covering, in part, five of the nine Annex IV documentation points (1, 2, 3, 4 and 6). Points 5, 7, 8 and 9 are not covered — points 7 and 8 are provider declarations no telemetry can generate, and points 5 and 9 are not produced by this engine.

✓

S1 — General description (Annex IV, point 1)

Agent registry, MCP server inventory, system purpose fields

✓

S2 — Design & development process (Annex IV, point 2)

Policy change audit log, version history, developer annotations

✓

S3 — Monitoring & oversight (Annex IV, point 3)

Risk score timelines, alert history, human review records

✓

S4 — Appropriateness of performance metrics (Annex IV, point 4)

Operational risk scoring methodology; collected policy-decision metrics

✓

S5 — Changes through the AI system lifecycle (Annex IV, point 6)

Policy-decision records; AI system version history

✓

S6 — Assessment of human oversight measures (sub-item of Annex IV points 2 and 3)

Human-review escalations and actioned reviews (approved or denied)

✓

S7 — Accuracy, robustness & cybersecurity (sub-item of Annex IV points 2 and 3)

Injection detection scores, tool drift events, security scan results, CVE reports

✓

S8 — Data governance & data management (sub-item of Annex IV point 2)

Tool-call audit trail, DLP redaction evidence, data-governance documentation

Generate an Annex IV PDF Report

ShieldAgent can export a PDF covering the 5 of 9 base-act points described above from your live data — it is a starting point for your technical documentation, not a submission-ready filing:

bash
curl -X GET "https://api.shieldagent.io/tenants/{tenantId}/compliance/annex-iv/export?format=pdf&windowDays=30" \
  -H "Authorization: Bearer <your-api-key>" \
  -o annex-iv-report.pdf

Each section includes its evidence data and key metrics — there is no per-section timestamp. If you request an evidence sample, the PDF adds a dated evidence appendix only when there is evidence to show, and by default that appendix is not row-capped. It does not include an audit-trail integrity proof; to verify the underlying audit trail has not been tampered with, use the separate Merkle hash-chain verification API.

Compliance Status API

Query your current Annex IV posture at any time — this reflects ShieldAgent's own 20 machine-evidenced requirements across the 8 generated sections, not full legal compliance:

bash
curl "https://api.shieldagent.io/tenants/{tenantId}/compliance/annex-iv/status" \
  -H "Authorization: Bearer <your-api-key>"
Response
{
  "framework": "EU_AI_ACT_ANNEX_IV",
  "complianceScore": 70,
  "totalRequirements": 20,
  "metRequirements": 14,
  "totalGaps": 6,
  "criticalGaps": 1,
  "majorGaps": 3,
  "minorGaps": 2,
  "generatedAt": "2026-10-01T00:00:00Z",
  "windowStart": "2026-09-01T00:00:00Z",
  "windowEnd": "2026-10-01T00:00:00Z"
}

Risk Tier Is Not a Legal Classification

The EU AI Act classifies AI systems by intended use under Art. 6 and Annex III — a legal determination you make, not something ShieldAgent computes. ShieldAgent's per-agent risk tier (low/medium/high/critical) is an operational signal derived from runtime behavior (policy violations, injection detections, anomalies); it does not map to the Act's risk categories (minimal, limited, high-risk, prohibited) and does not determine which Annex IV points apply or whether a conformity assessment is required.

Audit & Documentation Retention

Article 18 requires providers to keep technical documentation for at least 10 years after the system is placed on the market. As a deployer, your own duty is narrower: Art. 26(6) requires you to keep the high-risk system's own automatically-generated logs, to the extent under your control, for at least 6 months, unless other applicable law requires a different period. ShieldAgent's own hash-chain integrity check plus a ≥6-month retention window produce supplementary evidence for this self-assessment — they are not established as the high-risk system's own automatically-generated logs Art. 26(6) covers, and whether they qualify as or substitute for those logs is a determination you make, not something ShieldAgent establishes.

SHIELDAGENT_AUDIT_RETENTION_DAYS=365 is a parsed value for the self-hosted proxy’s own ephemeral debug log — it configures no delete or prune path. ShieldAgent SaaS plans resolve retention per billing tier, from 182 days (Solo/Team) up to 1,825 days / 5 years (Enterprise Cloud); the self-hosted Enterprise On-Prem deployment sets its own window separately, up to 3,650 days / 10 years. None of these figures describe a window that is purged by default; there is no managed S3/GCS cold-storage export, and hash-chain verification has no on/off toggle.

EU AI Act Compliance