EU AI Act readiness.
Proven with evidence.
Prepare your AI systems for the obligations that matter. HAIEC brings together scoped assessments, deterministic technical evaluation, human-oversight evidence and verifiable records so risk, engineering and compliance teams can move forward with confidence.
The software assessment uses your HAIEC account and available plan. Our team can also scope a technical readiness review for your AI systems.
From an obligation to a decision-ready record.
Understand the AI action, establish what the evidence supports and assign the next action.
Can a consequential action proceed without an accountable approval?
Qualify approval record and test boundary
Know which questions matter for your role and AI use case.
EU AI Act duties depend on your role, system category and legal context. Explore a practical evidence pathway before committing to a more detailed assessment.
Start with your role
Select the position closest to yours to preview a tailored technical-readiness conversation.
This educational selector identifies evidence questions to explore. Final statutory classification depends on your facts and applicable law.
Provider · AI agents and tools
A readiness dossier that connects the question to its evidence.
More than a checklist: examine qualified evidence, technical capability, oversight and change-related proof within an agreed boundary. Your decision owner receives a clear next action.
From obligations to accountable evidence.
Understand the system. Trace consequential actions. Separate approved authority from technical capability and observed effects. Keep the result explainable to technical and oversight teams.
Articles 9–15. Understand the obligation. Inspect the evidence.
Select an article to see the technical proof HAIEC can contribute, what remains for the responsible organization and where that proof fits into a readiness review.
Human Oversight
Design the system so capable people can understand, monitor, interpret and, where appropriate, intervene in consequential AI operations.
Explore deterministic assurance ↗Agent tool-action reachability, approval checkpoints, policy and delegated authority, and qualified evidence of human review where connected.
An evidence frontier, authority/capability divergence and an owned verification backlog for oversight gaps.
Confirm the organizational procedures, competent human oversight arrangements and operational implementation beyond the technical sample.
Read all seven technical evidence mappings without using the selector
Article 9 · Risk Management System
Scoped source-code findings and authorized runtime tests contribute risk-management evidence, including a finding owner and remediation backlog. These are technical inputs to the provider's risk management system.
Article 10 · Data and Data Governance
Data handling, minimization and relevant code-visible ingestion paths provide data-governance signals. Complete dataset provenance, representativeness and governance need the customer’s wider records.
Article 11 · Technical Documentation
Inventory, system and version identity, evaluation receipts and evidence provenance supply traceable Annex IV documentation inputs. The provider maintains the full statutory technical document.
Article 12 · Record-Keeping and Logging
Code logging capability and connected event evidence can identify gaps in tool or inference traces, with source/observation limits. Actual operational logs and retention controls require verification.
Article 13 · Transparency and Provision of Information
Relevant AI-interaction disclosures, information patterns and documented use/limitation facts can be examined where visible in source. Complete provider instructions and user information are separate responsibilities.
Article 14 · Human Oversight
Agent action paths, human review checkpoints, delegation and policy evidence can support evaluation of technical oversight arrangements. Organizational human oversight remains an accountable operating process.
Article 15 · Accuracy, Robustness and Cybersecurity
AI AppSec, MCP tenant isolation, approved runtime testing and control findings provide scoped cybersecurity/robustness evidence, without replacing full accuracy validation or lifecycle requirements.
Risk Management System
Data and Data Governance
Technical Documentation
Record-Keeping and Logging
Transparency and Provision of Information
Human Oversight
Accuracy, Robustness and Cybersecurity
Deterministic assurance turns scattered findings into a defensible review.
AI can help discover evidence and interpret records. The scoped assurance result depends on accepted technical sources, fixed versioned rules and a declared proof boundary.
Discover
Identify the system, connected tools, source paths, identities and intended effects.
Qualify
Record the provenance, scope, version and freshness of accepted evidence.
Evaluate
Compare capability, approved authority, technical controls and observed evidence.
Decide
Provide reviewed findings and an accountable owner's next action.
Reassess
Re-evaluate qualified changes as the enterprise system evolves.
Analyze implementation paths. Capability is not execution.
Observe approved tests and boundaries.
Trace tools and possible consequential effects.
Review delegation and human decision checkpoints.
Map tests to actual control questions.
Qualify connected operational observations.
Record scoped results and provenance when produced.
Provide versioned source records for dossier assembly.
Readiness should evolve with the system, not expire with the presentation.
Combine connected monitoring evidence and change review to understand when a new deployment, tool permission or delegated action changes the assurance question.
Watch material changes, then reassess.
Illustrative, not live production telemetry. Monitoring and reassessment depend on customer-connected sources and agreed control coverage.
Changes that matter
Source modifications, tool access, policy updates, agent delegation and fresh runtime observations can change the proof boundary.
Readiness that stays explainable
Track qualified evidence, stale records, technical control exceptions and review owners instead of an undifferentiated compliance percentage.
Evidence for future reviews
Support internal governance, vendor due diligence and external assurance conversations with dated records and a defined assessment scope.
A phased timetable. A readiness plan built for your role.
Regulation (EU) 2026/1744 amended the EU AI Act application dates. The correct milestone depends on the system, duty, actor and transitional rules.
Entered into force
The regulation became EU law.
Prohibited practices & literacy
Initial restrictions and literacy requirements apply.
GPAI and governance
General-purpose model duties began applying.
General application & transition
Art. 50 transparency starts in August; specified transition duties and additional prohibitions in December.
Annex III high-risk
High-risk obligations apply under the amended timetable.
Annex I regulated-product AI
Applicable product-related high-risk obligations.
Legal sources reviewed 2026-10-20. European Commission enforcement guidance · Regulation (EU) 2026/1744. Distinct transitional exceptions apply.
Which EU AI Act obligation family is relevant?
The law combines prohibitions, transparency, general-purpose model requirements, and category-specific high-risk duties. HAIEC connects these questions to relevant technical evidence where it can.
Prohibited AI practices
Includes specified manipulative/exploitative AI practices, certain biometric applications and prohibited data-collection practices under detailed legal conditions and exceptions.
Transparency
AI interaction disclosure and labeling of certain AI-generated or manipulated content, with obligations and timing depending on the application and actor.
GPAI responsibilities
Documentation, policy and transparency-related duties for general-purpose AI model providers, plus extra duties for systemic-risk models.
High-risk standalone use cases
Includes listed applications such as employment, education, essential services, biometric and public-sector categories, with applicability distinctions.
Regulated-product AI
AI tied to certain product safety regimes follows the later product-linked high-risk application schedule.
Provider, deployer, importer and distributor
One organization may have more than one role. Legal classification and contractual facts determine which tasks belong to whom.
Start in software or scope a deeper technical readiness engagement.
Choose the level of support that matches the stage of your AI program. HAIEC connects readiness questions to the evidence that can actually be examined.
EU AI Act Readiness Assessment
Use HAIEC's existing guided assessment for system identity, actor context, responses and a structured readiness record, subject to account and plan access.
- Structured AI system / actor questions
- Assessment scoring and gap identification
- Technical next questions to qualify
Technical Readiness Consultation
Review the system, consequential actions, technical-control gaps and evidence needed to support a defensible EU AI Act readiness program.
- System, role and technical evidence scope
- Article-linked findings and owned gaps
- Readiness dossier and decision readout
Ongoing Enterprise Assurance
For enterprises operating AI systems over time, qualify relevant technical changes and monitoring evidence as conditions evolve.
- Evidence freshness and scope maintenance
- Permissions, tool and policy changes
- Repeat evaluation and accountable actions
Share the evidence status, not a claim of automatic certification.
HAIEC supports scoped artifact identity, provenance, record-integrity verification and embeddable evidence badges for issued artifacts. Technical evidence can support formal reviews without replacing them.
Assessment record available
Artifact status and verification depend on the actual issued, authorized record and its current validation state.
Real trust badges are artifact-specific. A valid record or hash does not declare full legal conformity. Link to an actual issued report only when a real verification page is available.
Reports, receipts and verifiable artifact badges
HAIEC has badge and artifact workflows in its software. In a scoped engagement, use the real report identity and supported verifier, rather than a generic "EU AI Act Certified" seal.
- Evidence provenance and report identity
- Verification/revocation state where issued
- Embeddable badge for a genuine artifact
- Recipient can inspect the proof boundary
Follow developments. Keep the risk story current.
HAIEC already operates a public AI enforcement case tracker and a regulatory-alerts feed pathway. Those are valuable contextual inputs, separate from the evidence-based technical readiness assessment.
Enforcement cases and statutory exposure
Browse sourced cases, pending litigation and regulatory penalty regimes with the status of each item made explicit.
Explore AI Penalty Tracker ↗Regulatory news and alerts
Review curated changes and news relevant to AI governance. Feed availability and freshness are distinct from a customer-specific regulatory alert guarantee.
Explore AI Regulations ↗Technical findings and owner actions
Translate an applicable obligation into the exact technical questions, test evidence and accountable review tasks for your AI system.
Explore Evidence ↗Tracker entries distinguish actual enforcement, lawsuits and statutory exposure. A statutory maximum is not an issued fine or an event. External cases do not imply HAIEC prevented an incident.
Technical assurance complements your formal EU AI Act processes.
Make the handoff explicit: qualified technical evidence helps organizations execute their own regulatory duties and work with independent assessors.
Related legal and procedural responsibilities
- System legal risk classification and applicable organization role
- Conformity assessment and any notified-body involvement
- EU database registration, where applicable, and declarations of conformity
- CE marking and product-linked procedural duties
- Post-market monitoring and serious-incident reporting processes
- GPAI model documentation and systemic-risk requirements
Use HAIEC evidence as technical input for these responsibilities. Formal compliance decisions, required filings and independent conformity assessment follow their own applicable processes.
Plan the next step with clarity.
Practical answers on readiness, EU AI Act scope, technical proof, software and consultation.
How is the HAIEC software assessment different from technical assurance?
The guided EU AI Act assessment collects structured system and role answers and produces scored gaps according to HAIEC's method. Technical assurance independently qualifies actual connected source, policy, permission, capability and observed evidence within a reviewed scope. Questionnaire scores are not official EU compliance percentages.
Can a US company need EU AI Act readiness?
Yes, EU-market and use-related reach can apply outside the EU depending on the company's activity and the Act's terms. Confirm legal classification and relevant roles using the specific product and deployment facts.
Are all high-risk AI obligations due in August 2026?
No. Regulation (EU) 2026/1744 shifted the relevant Annex III Chapter III high-risk milestones to December 2, 2027 and Annex I product-linked dates to August 2, 2028, subject to transitional and other rules.
What is the difference between provider and deployer obligations?
Providers develop or place systems/models on the market and may carry technical documentation and conformity duties. Deployers use systems under their authority and have use-in-context responsibilities. Some organizations occupy multiple roles.
What can HAIEC establish for Article 14 human oversight?
In a scoped assessment it can evaluate agent action paths, source-visible review checkpoints, delegation and policy evidence and approved operational observations. Organizational oversight competence and deployment procedures remain separate facts to document.
Does a HAIEC evidence badge mean an AI system is certified?
No. A genuine issued HAIEC badge represents a particular artifact's status and proof scope. It is not a governmental EU AI Act certificate, CE mark or independent notified-body conformity judgment.
Can HAIEC monitor readiness as systems change?
Yes, for scoped approved integrations and evidence sources. Source, policy, permission, identity and runtime evidence can support reassessment and owner review. The observation and target-enforcement capabilities depend on the actual connection and deployment.
How do we start without providing production credentials?
Start with guided software assessment or a scoped consultation using existing technical documentation and approved source material. A more extensive technical review can qualify additional access and approved tests separately.
Turn the next EU AI Act requirement into an evidence-backed decision.
Start with a guided software assessment or discuss a scoped assurance review. HAIEC connects technical findings to the people and controls responsible for the next step.