EU AI Act
Where a governed action layer meets the Act's obligations
The Act places obligations on providers and deployers of high-risk AI systems. Several of them — record keeping, human oversight, robustness — are satisfied in part by properties of the execution layer. This page states which, and which are not ours to satisfy.
Obligation to control mapping
Each row names the obligation area, the control that addresses it, and the artifact a reader or assessor can inspect.
| Obligation area | ApexClaw control | Evidence object |
|---|---|---|
| Risk management | Deterministic policy bands with a hard-deny class that no approval can release, applied before execution. | Policy version recorded in every decision record. |
| Logging & record keeping | Automatic recording of every decision, authorization, refusal, outcome and configuration change for the life of the action. | Signed, hash-linked evidence chain. |
| Transparency to the deployer | The decision record states the acting identity, the principal, the policy version and the outcome, in a documented format. | Record schema and portable verifier. |
| Human oversight | Bands that require a separately authenticated human with the required role; approvals are payload-bound and single-use. | Approval record naming the approver and the payload bound. |
| Accuracy, robustness | Exactly-once execution, recovery across documented crash windows, and undeterminable outcomes recorded as unknown. | Recovery acceptance run and its report. |
| Corrective action & withdrawal | Revocation evaluated at dispatch, so approved-but-undispatched work cannot execute after authority is withdrawn. | Revocation record and its consequences in the chain. |
Mapped means we assert the control addresses the requirement. Evidence-backed means the control emits an artifact a reader can verify. Conformity readiness means the evidence an assessor would request is assembled. Certification means an accredited third party assessed the system and issued a certificate — ApexClaw holds none, and displays none.
The mapping's own verdict
EU AI governance evidence mapping
CandidateA requirement-by-requirement map from EU AI Act obligations to the specific technical control and the specific evidence object that supports it, stating coverage and stating gaps.
Limitation · Candidate, not proven: the validator checks structure and traceability. It cannot check that a legal reading is correct, and this map has not been reviewed by anyone with legal competence. It is engineering evidence, not legal advice.
Signed, hash-linked evidence
ProvenEach decision, authorization, outcome, refusal and configuration change is written as a signed record in a hash-linked chain. The record carries the request identity, the policy version, the decision, the approver where one exists, timestamps and the execution result.
Human approval, bound and single-use
ProvenAn action held for approval produces no effect until a separately authenticated human with the required role approves that exact request. The approval is bound to the payload and the envelope, is consumed once, and cannot release a different action or the same action twice.
What this page is not
It is not legal advice, not a conformity assessment, and not a classification of your system's risk tier under the Act. Whether a system is high-risk, and which obligations attach to you as provider or deployer, is a determination for you and your counsel. Timelines and implementing acts continue to change; verify current obligations against the official text rather than this page.