Statutory Rules & Governance Catalog

Intercepts and blocks neuro-symbolic execution loops designed to deploy subliminal techniques or exploit human vulnerabilities.

Blocks unauthorized compilation of facial recognition databases via un-targeted web scraping or CCTV footage extraction.

Bans systematic evaluation or classification of natural persons based on social behavior leading to detrimental or unfavorable treatment.

Classifies AI systems intended for critical infrastructure, biometric identification, employment, or credit scoring as high-risk subject to strict ex-ante compliance.

Intercepts AI modules serving as safety components in products subject to third-party conformity assessment under Union harmonisation legislation.

Mandates that high-risk AI systems shall comply with all Section 2 requirements (Articles 9 through 15) taking into account intended purpose and state-of-the-art.

Establishes a continuous, iterative risk management system running through the entire lifecycle of high-risk AI systems to eliminate or mitigate known risks.

Mandates strict data governance practices for high-risk AI training, validation, and testing datasets, ensuring data completeness and bias prevention.

Requires technical documentation to be drawn up before a high-risk AI system is placed on the market and kept up-to-date.

Mandates high-risk AI systems to include logging capabilities ensuring traceability of system operation throughout its lifecycle.

Forces 2-person verification metadata arrays and automatic start/end timestamp logging on remote biometric identification calls.

Requires high-risk AI systems to be designed in such a way as to ensure that their operation is sufficiently transparent to enable deployers to interpret output.

Enforces continuous human oversight interfaces allowing human operators to override, interrupt, or halt high-risk AI system execution at any microsecond.

Requires high-risk AI systems to be resilient against prompt injection, data poisoning, and model evasion attacks throughout their lifecycle.

Prevents un-vetted agent outputs or synthetic generation streams from routing directly back into training or weight-update arrays without intermediate validation.

Mandates providers to establish quality management systems, draw up technical documentation, and ensure conformity before CE marking.

Requires providers to maintain a documented quality management system covering design controls, testing, and post-market surveillance.

Requires providers to retain automatically generated logs for at least 6 months under sovereign tamper-evident storage.

Requires deployers to operate systems strictly per instructions, assign human oversight, and monitor input data relevance.

Verifies input payload metadata matrix matches Annex IV declared distribution before allowing execution to proceed.

Verifies worker representative notification flag is legally cleared before firing employee evaluation or HR tracking agent scripts.

Mandates deployers of high-risk AI in public or financial services to conduct a Fundamental Rights Impact Assessment prior to deployment.

Mandates machine-readable digital watermarking and provenance headers on all AI-generated text, audio, and image outputs.

Blocks network egress of generated image or audio assets unless a machine-readable C2PA metadata watermark signature is attached.

Monitors streaming text outputs; requires an ai_disclosure_tag or human_reviewer_token before allowing public distribution egress.

Establishes technical documentation, copyright policy compliance, and training data summaries for General-Purpose AI models.

Imposes model evaluation, adversarial testing, systemic risk assessment, and incident tracking on high-impact GPAI models.

Requires providers to establish a proactive post-market monitoring system to evaluate real-world system performance and safety.

Enforces zero-compliance-leakage runtime bounds to eliminate exposure to Article 99 turnover fines up to €35,000,000 or 7% of global turnover.