EU AI Act 2027
Runtime evidence for the AI Act era
EU AI Act obligations phase in through 2027–28, GPAI duties already apply — and runtime evidence can't be backfilled: an audit in 2027 needs traces that started today.
The dates that matter
GPAI duties in force
Obligations for providers of general-purpose AI models already apply.
Annex III high-risk
Stand-alone high-risk systems: employment, essential services, education, law enforcement and more.
Annex I embedded AI
AI that is a safety component of a regulated product.
Source: Digital Omnibus, July 2026. Confirm the current timeline with counsel.
Three pieces for deployers
EU AI Act 2027: 8 things that change for deployers, and where to start
The high-risk dates moved to 2027 and 2028. Eight things that change for teams running AI in production with EU exposure, and the order to start in.
Article 12 logging is a runtime problem, not a document problem
A policy document cannot show what a model did on a given request; per-request evidence can. What Article 12 asks for at runtime, and what teams under-scope.
Obligation-to-artifact: mapping AI Act duties to runtime evidence
For each EU AI Act duty that touches the runtime: the auditor's question, the artifact that answers it, and whether it is evidenced or attested.
Obligation-to-artifact checklist
For each duty that touches the runtime: what an auditor asks, which of the seven evidence artifacts answers it, and whether that artifact is evidenced from traffic or attested by a person.
- Evidenced
- 10 · The trace store holds this record for traffic routed through Norcaster; it appears in the audit bundle.
- Attested
- 6 · A human statement is required, or the obligation sits upstream of runtime. Norcaster records who attested and when.
- Roadmap
- 0 · Not recorded today.
| Obligation | What an auditor asks | Runtime artifact | Status |
|---|---|---|---|
Identified risks are mitigated at runtime, and the mitigation can be shown to have operated Art. 9(2)(d), 9(5) | Show me the controls operating during the audit period, with the policy version in force for each decision. | 2 Enforcement records | Evidenced |
A risk management process exists, with owners and reviewed risk classification Art. 9(1)–(2) | Who owns the risk register, when was the classification last reviewed, and where is that decision recorded? | 7 Exportable audit bundle Process lives outside the runtime; the attestation and its date travel in the bundle. | Attested |
Personal data is minimised before inference, and the minimisation is recorded Art. 10 (with GDPR data-minimisation) | Prove personal data was redacted before the provider saw it, without showing me the personal data. | 3 Redaction / PII events Records the category detected, the action, and the latency — never the value. | Evidenced |
Training, validation and test data governance Art. 10(2)–(5) | How were the datasets assembled, examined for bias, and documented? | 7 Exportable audit bundle Upstream of runtime; the deployer or provider attests, Norcaster records the attestation. | Attested |
Events are logged automatically over the system's lifecycle Art. 12(1)–(2) | Give me the complete record of one production request from last quarter: input, policy decisions, model, output, timing. | 1 Hash-chained trace store Gateway traffic keeps decision-level records by default; full payload retention is an explicit opt-in. | Evidenced |
Logs are tamper-evident and a third party can verify them Art. 12 (integrity of records) | How do I know this log was not edited after the fact, without trusting your vendor? | 1 Hash-chained trace store Hash-chained entries, segments anchored to Sigstore Rekor; verification runs offline with no Norcaster account. | Evidenced |
Logs are retained for the period the deployer is required to keep them Art. 12, Art. 26(6) | What is your retention period for these records, who set it, and can you produce a record from the start of it? | 7 Exportable audit bundle Retention is configured per organisation; the configured period and who set it are recorded. | Attested |
Each output can be traced to the model, version and policy that produced it Art. 13(1), 13(3)(b) | Which model, from which provider, under which policy version produced this output? | 4 Provider & model attribution Provider residency is recorded as declared by the operator's tag, not verified against the endpoint. | Evidenced |
Retrieval-augmented outputs cite the sources they used Art. 13(3)(b) | Which documents did the system rely on for this answer, and in what order? | 1 Hash-chained trace store Workflow retrieval and answer-with-citations nodes only; direct gateway calls carry no citations. | Evidenced |
People are told they are interacting with an AI system Art. 13, Art. 50 | Where in the product is the user informed, and since when? | 7 Exportable audit bundle A product-design obligation in the application layer; Norcaster records the interaction, not the disclosure. | Attested |
A human can review and approve or reject a decision before it takes effect, and the decision is recorded Art. 14(4) | Show me an approval: who decided, when, on which request, and what happened next. | 5 Approval-gate & human-oversight records | Evidenced |
An authorised person can stop the system, and the stop is recorded Art. 14(4)(e) | Who can stop this deployment, how fast, and show me the last time it was done. | 5 Approval-gate & human-oversight records | Evidenced |
Oversight is assigned to competent, trained people Art. 14, Art. 26(2) | Who is responsible for oversight of this system, and what training or authority do they have? | 7 Exportable audit bundle | Attested |
Attempts to manipulate the system are detected at the boundary and recorded Art. 15(5) | How many prompt-injection or jailbreak attempts did you see last month, and what did the system do with them? | 6 Eval & adversarial-detection records High-signal controls with documented scope, never a claim to catch everything. | Evidenced |
Accuracy is monitored and a regression blocks promotion Art. 15(1)–(3) | Show me the evaluation that ran before this version went live, and one that failed. | 6 Eval & adversarial-detection records Eval runs are evidenced; the methodology and thresholds behind them are attested. | Evidenced |
The deployer knows which AI systems are in use and which are governed Art. 26 (deployer obligations) | Is this the complete list of AI systems, and how many of them route through your controls? | 7 Exportable audit bundle Gateway coverage is evidenced as a figure (governed against detected ungoverned calls); estate completeness is attested. | Attested |
Artifact numbers refer to the seven artifacts on the evidence page. Every row is about what can be shown, not whether an obligation is met.
Get the checklist as a PDF
The obligation-to-artifact table above, as a two-page PDF you can take to your risk owner and your platform team.