EU AI Act for Annex III deployers
The deployer carries the obligations; we ship the evidence. The EU AI Act (Verordnung (EU) 2024/1689) places its high-risk requirements on the deployer — the entity operating the AI system — not on the audit-layer vendor. Adjudon's role is to make Article 13 transparency verifiable, Article 14 human oversight reviewable, Article 27 FRIA chain-anchored, and Article 73 incident timelines defensible. We document this honestly so procurement does not arrive expecting a one-click EU AI Act compliance pack that does not exist.
Scope
This page applies to deployers and providers subject to the EU AI Act, with particular relevance to:
- High-risk AI systems listed in Annex III (credit scoring, recruitment, education, law enforcement, migration, and administration of justice and democratic processes)
- Public-body deployers and certain private-sector deployers required to conduct a Fundamental Rights Impact Assessment under Art. 27
- Providers and deployers required to report serious incidents under Art. 73
Adjudon is not itself a provider of an AI system in the Annex III sense. The audit-and-policy layer is infrastructure used by the deployer to operate its own AI systems compliantly.
The EU AI Act entered into force on 1 August 2024. Application is phased: prohibitions (Art. 5) since 2 February 2025; GPAI obligations, governance, and penalties since 2 August 2025; most high-risk obligations from 2 August 2026; high-risk systems already on the market covered from 2 August 2027.
Roles
| Role | Party | EU AI Act basis |
|---|---|---|
| Deployer | Your organization operating the AI system | Art. 3(4) |
| Provider | The entity placing the AI system on the market | Art. 3(3) |
| Audit / policy infrastructure | Adjudon | Out of scope as a regulated entity |
| FRIA executor | The deployer (where Art. 27 applies) | Art. 27(1) |
| Serious-incident reporter | Provider + deployer | Art. 73(1)–(3) |
Adjudon is a Data Processor under GDPR Art. 28 in addition; see Data Residency & GDPR for the GDPR-side role split.
Article-by-article mapping
| Article | Requirement | Status | What Adjudon ships | What you do |
|---|---|---|---|---|
| Art. 12 | Record-keeping (logs) | 🗓 Roadmap Q3 2026 | Trace storage + SHA-256 chain in place today | File the records once Art. 12 export pack ships |
| Art. 13 | Transparency for deployers | ✅ Live | confidenceScore + tags + rationale per DecisionTrace; chain-anchored | Surface the trace fields to operators |
| Art. 14 | Human oversight | ✅ Live | Review Queue: low-confidence + policy-flagged decisions land on ReviewItem | Assign reviewers; act on the queue |
| Art. 26 | Deployer obligations | 🗓 Roadmap Q3 2026 | Analytics + alerting available today | Operate the deployer-side framework per Art. 26 |
| Art. 27 | FRIA for Annex III deployers | ✅ Live | FRIA model with its own chainHash; submit + approve endpoints | Run the FRIA before putting the system in use |
| Art. 50 | Transparency to natural persons | Out of scope | — | Disclose at the AI-product UX layer |
| Art. 72 | Post-market monitoring | Partial | Trace storage + analytics | Run the post-market monitoring plan |
| Art. 73 | Serious-incident reporting | ✅ Live | IncidentClock with regulator: 'aiact' and 2d/10d/15d checkpoints | File the serious-incident reports with the market-surveillance authority |
| Art. 99 | Administrative fines | — | Records on demand via the chain export | Operate within the supervisory framework |
The Article 12 (record-keeping) and Article 26 (deployer obligations) roadmap targets are scheduled for Q3 2026 as dedicated export packs. The underlying mechanisms — trace storage with the SHA-256 chain, analytics, alerting — are live today; what Q3 2026 adds is the regulator-ready bundle format.
Evidence
The Article 13 transparency claim is the central one. A regulator asking "how was this decision produced?" needs three things on demand: the input context, the engine's reasoning trace, and a tamper-evident proof that neither has been altered since the decision was made.
Every DecisionTrace carries:
inputContext— the data the AI agent saw (PII-scrubbed before storage)outputDecision— the agent's resulting actionconfidenceScore—0.0–1.0, three-pillar triangulated, not the model's self-reporttags—LOW_CONFIDENCE,HIGH_AMBIGUITY, and others raised by the Confidence Enginestatus— the policy gate verdict (approved,flagged,blocked)matchedPolicy.nameandpolicyResult.reasonfor blocked traces- A back-reference to the
HashChainEntrythat anchors the row
The bundle export gives the regulator the entire chain in one self-contained JSON document:
curl https://api.adjudon.com/api/v1/hash-chain/export \
-H "Authorization: Bearer $ADJUDON_API_KEY"
The auditor recomputes each row's chainHash against the published
algorithm at Audit Log & Security:
chainHash = sha256(prevHash || payloadDigest || sequence || createdAt)
No Adjudon login, no Adjudon endpoint, no Adjudon network is required
for the verification step. The chain is tamper-evident, not
tamper-proof: any modification to a stored entry breaks the next entry's
prevHash link, and verification returns brokenAt: <sequence>.
Tampering is loud.
The FRIA chain is separate. Each FRIA document carries its own
chainHash field, signed by the reviewer at submission. Submit and
approve transitions are recorded on the operations audit log; the FRIA
shell is append-only by construction (Cardinal Rule 5).
Multi-Clock for AI Act Art. 73 (2 d / 10 d / 15 d)
When a serious AI-related incident is opened, the Multi-Clock Incident
Hub creates an IncidentClock with regulator: 'aiact' and
articleRef: 'Art. 73':
| Checkpoint | Deadline | Trigger |
|---|---|---|
| Widespread infringement of fundamental rights, or critical-infrastructure incident | 2 days | Art. 73(2) |
| Death of a person | 10 days | Art. 73(2) |
| Any other serious incident | 15 days | Art. 73(1) |
Four other regulator clocks fire in parallel off the same Incident
document (GDPR Art. 33, DORA Art. 19, NIS2 Art. 23, CRA Art. 11) —
five clocks, one detection event, one log. See
Multi-Clock Incidents for the
five-regulator concurrent model.
A breached checkpoint is not deleted. The clock's status flips to
breached and nextCheckpointAt stays in the past so the post-incident
audit can replay exactly which deadline was missed and when.
Fines (Art. 99)
| Violation | Maximum fine | Basis |
|---|---|---|
| Prohibited-AI placement (Art. 5) | €35 million or 7% of worldwide annual turnover, whichever is higher | Art. 99(3) |
| High-risk-AI obligations (Art. 16, 22-29 incl.) | €15 million or 3% | Art. 99(4) |
| Misleading information to authorities | €7.5 million or 1.5% | Art. 99(5) |
Public bodies face administrative measures defined by the Member State rather than the corporate-fine ceilings. Operate the supervisory framework accordingly.
Honest disclosures
- Art. 12 (record-keeping) and Art. 26 (deployer obligations) are scheduled for Q3 2026 as dedicated regulator-ready export packs. The underlying trace, chain, and analytics infrastructure is live today.
- Art. 27 FRIA is live as a backend model with its own chain anchor; the FRIA Wizard front-end and the regulator-ready PDF export are part of the same Q3 2026 deployer-compliance pack.
- Art. 50 transparency to natural persons (chatbot disclosure, deepfake labelling) is out of scope for the audit layer — surface those disclosures at your AI-product UX layer.
- The 99.99% SLA target for Enterprise / Custom plans is on the roadmap; the live SLO is 99.9% on Scale and Governance plans.
- The OpenAI sub-processor (USA, GDPR Chapter V SCCs) is the one documented residency exception; see Data Residency & GDPR.
- There is no Adjudon-shipped "EU AI Act compliance pack" feature. The deployer assembles the evidence from the chain export, the Multi-Clock Hub, and the FRIA chain. We document this honestly so procurement does not arrive expecting a one-click compliance pack that does not exist.
What this page does NOT cover
- DORA Art. 17/19/28/30 mapping — see DORA Compliance.
- MDR Class IIa/IIb pseudonymisation — see Medtech Compliance.
- GDPR residency, sub-processors, and Art. 17 erasure mechanics — see Data Residency & GDPR.
- The full chain export endpoint surface — see Hash Chain API.
- The FRIA endpoint contract — see FRIA API.
- Penetration testing status — see Penetration Testing.
See also
- Architecture Overview — the production stack and the HTTPS boundary
- Audit Log & Security — the chain formula and the four-step verify algorithm
- Multi-Clock Incidents — GDPR / EU AI Act / DORA / NIS2 / CRA in parallel
- FRIA Wizard — the Article 27 chain
- Hash Chain API — export, verify, and bundle endpoints
- Incidents API — opening incidents and managing checkpoints