The trust layer

Compliance as a by-product of building — not a project you start afterwards.

Most AI governance tools describe what your system should do. This one sits in the path and records what it did. Obligations are mapped to concrete controls, enforced while the work happens, and exported as the evidence an auditor actually asks for.

Obligations to controls → The full platform

The problem

The model was never the hard part.

Industrial AI rarely fails on accuracy. It fails when someone asks who approved this decision, which model version produced it, what data it was trained on, and whether a human could have stopped it. Those answers have to exist before deployment — and they cannot be reconstructed afterwards.

Enforced at runtime

The audit trail is generated by doing the work, not assembled from memory at audit time. Logging, versioning and approvals sit in the execution path.

Model- and vendor-agnostic

Governance travels across providers and deployments, including on-premise. Which model, which version, which prompt, which human approved it — recorded regardless of who built the model.

Oversight that is real

A human can inspect, override or halt any automated decision, and the oversight action is itself part of the record — which is what Article 14 actually requires.

Evidence, exportable

The technical file, decision logs and monitoring history export on demand, in the structure a conformity assessment expects.

Obligations to controls

Every duty, mapped to a mechanism.

The high-risk chapter of the EU AI Act reads as a list of duties. This is how each one becomes something a system does, rather than something a team promises.

ObligationHow the trust layer delivers it

Risk managementArt. 9A living risk register tied to the system itself — hazards, mitigations and residual risk versioned alongside the model.

Data governanceArt. 10Lineage on every dataset: where it came from, how it was processed, which model version consumed it.

Technical documentationArt. 11 · Annex IVThe technical file is generated from the system of record rather than written from memory at audit time.

Record-keeping & loggingArt. 12An immutable decision log: model, version, inputs, outputs, timestamp — queryable, exportable, retained.

Transparency to usersArt. 13Clear disclosure of what the system does, its limits, and how its outputs should be interpreted.

Human oversightArt. 14An explicit oversight gate: a person can review, override or stop an automated decision, and that act is logged too.

Accuracy & robustnessArt. 15Continuous monitoring of performance and drift, with thresholds that trigger review rather than silent degradation.

Timing

The runway moved. The work did not get shorter.

Obligations for stand-alone high-risk systems under Annex III — including education, employment, credit and essential services — were deferred from August 2026 to December 2027, while most transparency duties stayed on the original schedule. The obligations themselves did not change.

What this means commercially. Sixteen extra months is not relief; it is the minimum time a serious organisation needs to build risk management, data lineage, oversight architecture and post-market monitoring into systems that are already running. The teams that treat the deferral as a pause will meet the deadline with a documentation problem they cannot solve retrospectively.

Regulatory timelines are subject to formal adoption and publication. We track them so our partners do not have to.

Proven by doing

We filed the technical file before we sold the tool.

Edaptic is a high-risk system under Annex III. Rather than describe compliance in the abstract, we built that system, documented it against the full obligation set, and published what the process taught us. The trust layer is the productised version of that work — and it now governs every AI system on the platform.

Explore the compliance platform ↗ See what it governs

↑ Point this button at the standalone platform site.