Repository navigation
Expand EU AI Act compliance mapping to all relevant articles #9
Description
Problem
The EU AI Act's obligations for high-risk AI systems take full effect on August 2, 2026 — 5.5 months away. Inkog currently maps findings to Articles 12 (record-keeping), 14 (human oversight), and 15 (accuracy/robustness), but several articles relevant to AI agent developers are not yet covered. Organizations deploying AI in the EU (including US-based companies) need compliance readiness checks to prepare for enforcement, with fines up to €35M or 7% of global turnover.
Current Behavior
| Article | Topic | Inkog Coverage |
|---|---|---|
| Art. 5 | Prohibited practices | ❌ Not mapped (enforced since Feb 2025) |
| Art. 9 | Risk management system | ❌ Not mapped |
| Art. 10 | Data governance | ❌ Not mapped |
| Art. 11 | Technical documentation | ❌ Not mapped |
| Art. 12 | Record-keeping | ✅ Mapped |
| Art. 13 | Transparency | ❌ Not mapped |
| Art. 14 | Human oversight | ✅ Mapped |
| Art. 15 | Accuracy & robustness | ✅ Mapped |
Proposed Solution
Extend the compliance mapping framework to cover Articles 9, 10, 11, and 13 as readiness checks. These articles have concrete indicators that static analysis can detect.
Article 9 — Risk Management System
- Verify risk assessment documentation exists
- Check for continuous monitoring patterns (audit logs, metrics collection)
- Map existing
missing_rate_limitsandresource_exhaustionfindings
Article 10 — Data Governance
- Detect training data exposure (RAG over-fetching, context window accumulation)
- Map existing
cross_tenant_data_leakagefindings - Check for data retention controls
Article 11 — Technical Documentation
- Verify AGENTS.md or equivalent governance declarations exist
- Check for model card / system prompt documentation
- Map existing governance verification findings
- This is one of the most actionable articles for static analysis: "Does documentation exist?"
Article 13 — Transparency
- Detect missing user disclosure (AI system not identifying itself in prompt templates)
- Check for output attribution / source citation patterns
- Verify human-readable explanation capabilities
Expected output
$ inког -path ./my-agent --policy eu-ai-act
EU AI Act Readiness Report:
Art. 9 Risk Management: ⚠️ 2 gaps identified
Art. 10 Data Governance: ⚠️ 1 gap identified
Art. 11 Technical Documentation: ❌ Missing AGENTS.md
Art. 12 Record-keeping: ✅ Audit logging present
Art. 13 Transparency: ⚠️ 1 gap identified
Art. 14 Human Oversight: ✅ Approval gates configured
Art. 15 Accuracy & Robustness: ✅ Input validation present
Note: These are readiness checks — indicators that help teams identify gaps before an audit. Inkog does not certify legal compliance.
References
- EU AI Act full text
- EU AI Act implementation timeline — Aug 2, 2026 for high-risk systems
- NIST AI RMF crosswalk to EU AI Act
Notes
- The compliance mapping infrastructure already exists in
pkg/governance/— this extends theControlMetadatato cover more articles - Some mappings (Art. 9, 10, 12) can leverage existing detection rules with new compliance annotations
- Art. 11 (Technical Documentation) is the most actionable: static analysis can check for the presence of documentation files
- Art. 13 (Transparency) can check prompt templates for AI disclosure strings
- The
--policy eu-ai-actpreset already exists and would automatically include these new mappings - Consider generating a standalone readiness report (PDF/HTML) for sharing with compliance teams
- Article 5 (Prohibited Practices) is intentionally excluded — detecting "subliminal manipulation techniques" is not feasible via static analysis and claiming otherwise would undermine credibility
Activity
cloakmaster commentedon Apr 28, 2026
Currently we map to EU AI Act Article 14 (Human Oversight) and Article 15 (Accuracy, Robustness, Cybersecurity) which are the most directly relevant to AI agent security. The compliance report also maps to NIST AI RMF and OWASP LLM Top 10.
Expanding to Articles 9 (Risk Management System), 10 (Data Governance), 11 (Technical Documentation), and 12 (Record-Keeping) is planned. These require deeper analysis — e.g., Article 10 compliance needs understanding of training data handling, which goes beyond static code analysis.
We're exploring this for a future release, likely as an extended compliance mode. The EU AI Act enforcement deadline (August 2026) makes this increasingly urgent, so it's a priority for our roadmap.