EU AI Act readiness

Technical controls and exportable evidence for AI governance workflows — scoped to supported runtime paths.

Readiness, not legal compliance

Quantlix provides runtime policy enforcement and exportable evidence on supported production paths to help teams build EU AI Act readiness and broader AI governance workflows. It is not legal advice, a conformity assessment, CE marking, or a guarantee of regulatory compliance. Risk classification, DPIAs, and legal interpretation remain your responsibility.

Supported runtime paths

Path	Policy before model	Enforcement events	run_id link
POST /run	Yes	Yes	Yes
Playground (via /run)	Yes	Yes	Yes
Gateway /v1/chat/completions	Yes	Yes	Yes
Gateway /v1/messages	Yes	Yes	Yes
Gateway /v1/embeddings	Yes	Yes	Yes
Workflow model/agent nodes	Yes	Yes	When workflow run exists
Workflow external_model node	Yes (input + egress)	Input + output	When workflow run exists
Action gateway POST /v1/mcp/{deployment_id}	Yes (before upstream)	Yes (event_type=action)	Deployment-scoped
POST /rag/run	Yes	Yes	Yes
K8s async worker	Yes (pre-inference)	Yes	When job has run_id
POST /demo	No	No	—

The external_model workflow node adds input and egress enforcement around a model you host elsewhere. See Runtime Layer Extraction (BYO model).

Customer readiness checklist

Map typical Act themes to product capabilities and responsibilities your team still owns.

Risk management (Art. 9)

Quantlix: Policy manifest export; optional risk_tier / intended_purpose; enforcement events with policy version; obligations map (runtime-evidenced vs attestation zones)

You own: Risk register, classification, mitigation sign-off

Data governance (Art. 10)

Quantlix: Contextual packs; block/redact on supported paths; optional SHA-256 content hashes (no raw text)

You own: Lawful basis, minimization, training data governance

Record-keeping (Art. 12)

Quantlix: Enforcement events, runs, traces; JSONL + signed export; investigation API; composed audit bundles (PDF/CSV/JSON with manifest and verification guide)

You own: Retention policy, access control, audit archival

Transparency (Art. 13)

Quantlix: Structured policy decisions in API; masked contextual audit payloads; trace summaries with policy version pinned per request

You own: End-user disclosures and deployer instructions

Human oversight (Art. 14)

Quantlix: Workflow approval nodes; MCP action approval gates; audited deployment stop/resume (POST …/stop, …/resume); block/warn outcomes

You own: Oversight procedures and escalation playbooks

Accuracy & robustness (Art. 15)

Quantlix: Eval hooks; observability metrics; provider failover events (event_type=provider_failover) on gateway paths with primary/fallback attribution

You own: Validation methodology and production monitoring

Cybersecurity

Quantlix: MFA, SSO/OIDC, API key scopes and expiry, region residency gates, external reviewer scoped access

You own: SOC program, pen tests, vendor reviews

Agentic action coverage

Where agents take actions (tool and MCP calls), each obligation is tagged by how the evidence is produced: captured automatically at runtime, or still requiring your own attestation.

Runtime-evidencedRequires attestation

Risk management (Art. 9)

Runtime-evidenced

Per-action runtime decisions (allow / block / require-approval) recorded with policy version for each agent tool and MCP call.

Record-keeping (Art. 12)

Runtime-evidenced

Agent action events sit alongside model calls in the Decision Audit and signed audit bundles, preserving model call → action → result trace continuity with hash-chained verification.

Human oversight (Art. 14)

Runtime-evidenced

High-impact MCP tool calls held for human approval; approval state (pending / granted / denied) captured as evidence next to the action. Authorized users can stop or resume a deployment; lifecycle events appear in audit bundles.

Risk classification & sign-off (Art. 9)

Requires attestation

Tool/action risk tiering, residual-risk acceptance, and mitigation sign-off.

Oversight procedures (Art. 14)

Requires attestation

Who approves which actions, escalation paths, and reviewer training records.

Runtime-evidenced items produce captured evidence — not a determination of compliance. Conformity assessment remains your responsibility.

Evidence APIs

GET /enforcement-events — list/filter by deployment, org, event_kind (e.g. human.approval.*), or event_type (e.g. action, provider_failover)
GET /enforcement-events/export — JSONL (optional signed=true)
GET /governance/investigations — bundle by request_id or run_id, including agent action evidence and approvals with model call → action → result continuity
GET /governance/deployments/{id}/policy-manifest — effective policy snapshot
POST /orgs/{org_id}/audit-bundles — composed export (PDF/CSV/JSON) with enforcement records, action evidence, provider activity (including failover rows), change history, and coverage statement
POST /deployments/{id}/stop and …/resume — audited lifecycle control (blocks new runs until resumed)

Dashboard: generate bundles at Audit bundles. Independent verification: verify an audit bundle.

Retention & stronger evidence

Org retention_config keys: audit_days (unified enforcement + runs), enforcement_events_days, runs_days. Plan defaults apply when org keys are unset.

Optional: enable store_content_hashes on deployment or org settings for SHA-256 input/output fingerprints without storing raw prompt text. Investigation API and run detail surfaces hashes when present.

Approved wording for sales

Supports teams building EU AI Act readiness evidence through runtime controls, logging, and signed enforcement exports where enabled — not a conformity assessment or legal compliance guarantee.