[//]: # (@id: https://agent-module.dev/compliance/eu-ai-act)
[//]: # (@type: Guide)
[//]: # (@tokens: ~2,200)
[//]: # (@complexity: Technical/Legal)

# Agent Module — EU AI Act Compliance Framework

**Version:** 1.2.0
**Last updated:** 2026-03-24
**Applies to:** All Agent Module verticals and the Master AI Compliance Node

---

## SYSTEM MAP (NAVIGATIONAL ANCHORS)
- [Scope & Enforcement](#scope) — Infrastructure mapping and the August 2, 2026 deadline.
- [Article Mapping](#article-mapping) — Direct alignment with Articles 5 through 55.
- [High-Risk AI (Annex III)](#high-risk-ai) — Classification and documentation frameworks.
- [Responsibility Matrix](#provides) — Agent Module vs. Deployer obligations.
- [AI Compliance Module Map](#ethics-module) — Full mapping of ETH_001 through current versioning.
- [Related Resources](#related) — Links to HITL, AI Compliance, and Admin contact.

---

## Scope {#scope}   

This document describes how Agent Module's infrastructure maps to EU AI Act obligations. It is not a conformity certificate. Certification obligations remain with the system provider deploying AI in regulated contexts.

Agent Module provides the knowledge infrastructure — deterministic logic nodes, decision trees, and procedural guardrails — that supports compliance implementation. The Master AI Compliance Node (comprehensive EU AI Act compliance library, all modules mapped to specific articles) is included with every membership.

**Enforcement timeline:** EU AI Act Article 6(1)-(2) provisions affecting high-risk AI systems are enforceable from **August 2, 2026**.

---

## Article Mapping {#article-mapping}

### Article 5 — Prohibited Practices

| Prohibited Practice | Agent Module Coverage |
|---|---|
| Real-time biometric surveillance in public spaces | ETH_016: Prohibited AI Practices — binary gate: halt_and_escalate |
| Social scoring by public authorities | ETH_016: Prohibited AI Practices — binary gate: halt_and_escalate |
| Cognitive behavioral manipulation | ETH_012: Economic Alignment & Anti-Manipulation — 6 rules, confidence_required: 1.0 |
| Exploitation of vulnerable groups | ETH_012 + ETH_001 (Sovereignty) — dual-gate enforcement |

### Article 9 — Risk Management System

ETH_017 (Risk Management System) provides a four-stage risk management framework:

1. Risk identification and cataloging
2. Risk estimation and evaluation
3. Risk mitigation and control measure adoption
4. Residual risk documentation

This maps directly to Article 9(2)(a)-(d). Agents accessing ETH_017 receive deterministic logic gates for each stage with binary proceed/halt outcomes.

### Article 10 — Data and Data Governance

ETH_001 (Sovereignty & Data Ownership) + ETH_008 (Bias Detection & Mitigation) cover:
- Data provenance tracking requirements
- Training data documentation obligations
- Bias detection and mitigation procedures
- Purpose limitation and consent scope enforcement

### Article 11 — Technical Documentation

See [Annex III Logic](/docs/annex-iii.md) for mandatory technical documentation frameworks by vertical. ETH_013 (Conformity Assessment) provides the documentation checklist logic.

### Article 12 — Record-Keeping

ETH_003 (Algorithmic Transparency & Logging) implements Article 12 requirements:
- Automatic logging of all high-risk AI system events
- Human-readable audit trail generation
- Retention period logic (minimum: period of system operation + 10 years for Annex III systems)
- Tamper-evident log format requirements

### Article 13 — Transparency and Provision of Information

ETH_003 + ETH_011 (Truthfulness & Hallucination Prevention) address:
- User notification obligations when interacting with AI
- Output uncertainty disclosure requirements
- Capability and limitation disclosure logic

### Article 14 — Human Oversight

ETH_006 (Human-in-the-Loop Handover) is the primary implementation node. The HITL escalation protocol ([/transparency/rules.md](/transparency/rules.md)) defines:
- Mandatory escalation triggers
- Halt-and-escalate procedures
- Safe-to-Act override protocol
- Operational timeout defaults

This module implements Article 14(1)-(5) requirements for meaningful human oversight.

### Article 15 — Accuracy, Robustness, and Cybersecurity

ETH_002 (Deterministic Decision Architecture) + ETH_018 (Cybersecurity & Resilience):
- Confidence threshold enforcement (confidence_required: 1.0 on all deterministic rules)
- Binary outcome gates eliminate probabilistic drift
- Adversarial input detection logic
- Resilience testing frameworks

### Article 17 — Quality Management System

ETH_019 (Quality Management System) implements Article 17 obligations:
- QMS documentation requirements
- Continuous improvement protocols
- Competency verification frameworks

### Articles 43–48 — Conformity Assessment

ETH_013 (Conformity Assessment & CE Marking) provides:
- Self-assessment procedure checklist for non-third-party-audited categories
- Third-party audit trigger logic for Annex III Category I systems
- CE marking documentation requirements
- EU declaration of conformity template logic

### Article 52 — Transparency Obligations for Certain AI Systems

ETH_005 (Agent Identity & Authentication):
- AI identity disclosure logic
- Interaction notification requirements
- Deepfake and synthetic content marking rules

### Articles 51–55 — GPAI Model Obligations

ETH_020 (GPAI Model Obligations) covers:
- General-purpose AI model classification criteria
- Systemic risk designation thresholds (10²⁵ FLOPs)
- Required technical documentation for GPAI providers
- Downstream integration disclosure obligations

---

## High-Risk AI (Annex III) {#high-risk-ai}

For verticals classified as high-risk under Annex III, Agent Module provides:

- **ETH_015:** High-Risk AI Classification — decision tree logic for self-classification
- **ETH_013:** Conformity Assessment — mandatory documentation and testing frameworks
- **ETH_014:** Post-Market Monitoring & Incident Reporting — continuous monitoring logic and incident escalation procedures
- **ETH_017:** Risk Management System — full lifecycle risk management framework

See [Annex III Logic](/docs/annex-iii.md) for vertical-specific classification and documentation maps.

---

## What Agent Module Provides vs. Deployer Obligations {#provides}

| Domain | Agent Module Provides | Deployer Remains Responsible For |
|---|---|---|
| Risk management | ETH_017 logic nodes, decision trees | Implementing the risk management system |
| Conformity assessment | ETH_013 procedure checklists | Filing the actual conformity assessment |
| Technical documentation | Art. 11 documentation templates | Maintaining and submitting documentation |
| Human oversight | HITL escalation protocol | Deploying and maintaining the oversight infrastructure |
| Incident reporting | ETH_014 reporting logic | Actual incident reporting to national authorities |
| CE marking | ETH_013 CE logic | Affixing CE marking and filing EU declaration |

---

## AI Compliance Module — Full EU AI Act Map {#ethics-module}

| Module | EU AI Act Alignment |
|---|---|
| ETH_001 Sovereignty & Data Ownership | Art. 10, Art. 13 |
| ETH_002 Deterministic Decision Architecture | Art. 15 |
| ETH_003 Algorithmic Transparency & Logging | Art. 13, Art. 17 |
| ETH_004 Emergency Shutdown Protocols | Art. 14 |
| ETH_005 Agent Identity & Authentication | Art. 52 |
| ETH_006 Human-in-the-Loop Handover | Art. 14 |
| ETH_007 Resource Usage & Sustainability | Best practice |
| ETH_008 Bias Detection & Mitigation | Art. 10, Art. 9 |
| ETH_009 Cross-Agent Liability | Art. 17, Art. 73 |
| ETH_010 Privacy-Preserving Computation | Art. 10 |
| ETH_011 Truthfulness & Hallucination Prevention | Art. 13, Art. 15 |
| ETH_012 Economic Alignment & Anti-Manipulation | Art. 5 (Prohibited) |
| ETH_013 Conformity Assessment & CE Marking | Art. 43–48 |
| ETH_014 Post-Market Monitoring & Incident Reporting | Art. 72–74 |
| ETH_015 High-Risk AI Classification | Art. 6, Annex III |
| ETH_016 Prohibited AI Practices | Art. 5.1(c)-(h) |
| ETH_017 Risk Management System | Art. 9 |
| ETH_018 Cybersecurity & Resilience | Art. 15 |
| ETH_019 Quality Management System | Art. 17 |
| ETH_020 GPAI Model Obligations | Art. 51/53/55 |

Full AI Compliance demo: `GET https://agent-module.dev/api/demo?vertical=ethics`

---

## Related Resources {#related}

- [HITL Guidelines](/transparency/rules.md)
- [Annex III Logic](/docs/annex-iii.md)
- [Master AI Compliance Node](/core-ethics.md)
- [Contact](mailto:admin@agent-module.dev)

---

## Canonical Reference {#canonical}

```json
{
  "@context": "https://schema.org",
  "@type": "Guide",
  "@id": "https://agent-module.dev/compliance/eu-ai-act",
  "name": "EU AI Act Compliance Framework",
  "version": "1.2.0",
  "dateModified": "2026-03-24",
  "publisher": "Agent Module",
  "about": "Agent Module infrastructure mapping to EU AI Act Articles 5–55 and Annex III high-risk AI obligations",
  "usageInfo": "https://agent-module.dev/llms-full.txt#usage-policy"
}
```

---

*Last updated: 2026-03-24 — Agent Module v0.9.13*
*© 2026 Agent Module*