EU AI Act Technical Readiness

How AgentVeil capabilities support evidence, oversight, and review workflows for AI agent systems.

Last updated: May 2026. Based on EU AI Act Regulation 2024/1689 and May 2026 EU implementation updates.

AgentVeil does not make your system EU AI Act compliant. Compliance depends on your role, use case, risk classification, data processing, model provider, and deployment context. AgentVeil provides technical readiness mapping only; it does not provide legal advice, conformity assessment, or compliance certification.

Compliance Workflow

Pre-Runtime Check
Lurkr

→

Runtime Gate
approve / deny / require human

→

Signed Receipt
JCS + Ed25519

→

Audit Evidence
hash chain / anchor

→

Review / Audit

AgentVeil separates the evidence chain into three layers: pre-runtime checks show what an agent could do, runtime gates record the decision on a specific action, and receipts prove what happened after execution.

Article 9 — Risk Management

Providers must maintain a continuous, evidence-based risk management system throughout the AI system lifecycle.

Capability	Implementation
Pre-runtime capability review	LiveLurkr checks agent code and manifests for risky capability surfaces before deployment.
Runtime action gating	LiveRuntime Gate evaluates risky agent actions before execution and records approve / deny / require-human decisions.
Behavior history signals	Reputation scores summarize observed behavior history. This is separate from Lurkr's pre-runtime checks.
Risk monitoring	Webhook alerts fire on threshold crossing. Velocity tracking over 1d/7d/30d windows.

$ lurkr scan --path . — checks agent capability risk before deployment

$ curl https://agentveil.dev/v1/reputation/{did} — returns behavior-history signals such as risk_score and risk_factors

Article 12 — Record-Keeping

High-risk AI systems must automatically record events relevant to identifying risk situations and monitoring operations.

Capability	Implementation
Automatic logging	LiveControlled actions, runtime decisions, and protocol events create audit entries
Tamper evidence	SHA-256: `hash(prev_hash + event_type + did + payload + timestamp)`
Chain verification	Recomputes all hashes, detects any break or modification
Action receipts	LiveRuntime actions can produce signed receipts that can be verified independently.
Retention	LiveDatabase logs retained with sequence numbering. Public IPFS anchors are published when anchoring succeeds; audit verification remains available via `/v1/audit/verify`.

$ curl https://agentveil.dev/v1/audit/verify — verifies entire chain integrity

IPFS anchoring. Public IPFS anchors are published by the reputation and audit job when IPFS publishing succeeds. The hash is the address. No party, including AVP, can alter pinned content without changing the hash, making third-party verification possible without trusting AVP.

See the offline verification flow →

Article 13 — Transparency

High-risk AI systems must be accompanied by information enabling deployers to interpret system output and understand capabilities and limitations.

Capability	Implementation
Verifiable identity	W3C DID (did:key) with Ed25519 signatures. Public verification without server access.
Capability interpretation	Lurkr reports explain which static agent capability surfaces were found before deployment.
Decision interpretation	Runtime Gate decisions include policy reasons and action metadata for review.
Score interpretation	Reputation response includes score, confidence, tier, risk level, attestation count, algorithm version
Algorithm transparency	EigenTrust v1: 20 iterations, 0.001 convergence, 0.15 damping. Parameters documented.

$ curl https://agentveil.dev/v1/agents/verify/{name} — public identity check

Article 14 — Human Oversight

High-risk AI systems must include tools enabling natural persons to monitor operations, intervene, and override decisions.

Capability	Implementation
Runtime gate	LiveRisky agent actions can be blocked, allowed, or routed to human approval before execution.
Trust gating	4-tier system (newcomer/basic/trusted/elite) with configurable RPM limits. Humans set thresholds.
Alert notifications	Webhook on score drops or action-control events. Integrates with Discord, Teams, PagerDuty, Zapier.
Dispute mechanism	GuidedDispute review is part of the guided workflow and planned wider rollout.
Override	Agents can be suspended or revoked. Trust tiers are manually adjustable.

$ curl -H "AVP-Sig: ..." https://agentveil.dev/v1/alerts — shows configured oversight webhooks (requires Ed25519 auth)

Article 50 — Transparency Obligations

AI systems interacting with natural persons must disclose they are AI systems.

Capability	Implementation
Agent registry	Every agent registered with DID, display name, capabilities, provider
Public agent cards	Capabilities, endpoint URL, provider information
Embeddable badge	PlannedEmbeddable verification badge for agent UIs

$ curl https://agentveil.dev/v1/cards/{did} — public agent card

Note: Article 50 disclosure is the deployer’s responsibility. AVP provides the identity infrastructure to support it.

See who deploys AVP for regulated workflows →

Compliance Timeline

Date	Milestone
Feb 2, 2025	Prohibited AI practices and AI literacy obligations began applying under the original Regulation 2024/1689 schedule.
Aug 2, 2025	Governance, notified body, GPAI, and confidentiality provisions began applying under the original schedule.
May 7, 2026	The European Commission announced a political agreement to simplify AI Act implementation and set updated high-risk timelines.
Dec 2, 2027	Commission-announced application date for certain standalone high-risk systems, subject to the final legislative text.
Aug 2, 2028	Commission-announced application date for high-risk AI systems integrated into products, subject to the final legislative text.

Timeline note: the EU AI Act implementation schedule is being updated through EU legislative process. This page tracks technical readiness, not final legal deadlines for any specific deployer.

Penalty exposure depends on the violated obligation and the final enforcement context. Get legal advice before treating any technical control as sufficient for compliance.

What AVP Does Not Cover

Legal advice or compliance certification
Data protection (GDPR) controls
Bias testing or fairness audits
Full transparency documentation for deployers (AVP provides data; you write the docs)
Disclosure UI for end users (Article 50 display is your responsibility)
Risk classification of your AI system under the EU AI Act
Conformity assessment, CE marking, or notified body procedures

Get Started

pip install agentveil

from agentveil import AVPAgent

agent = AVPAgent.create("https://agentveil.dev", name="my_agent")
agent.register(capabilities=["analysis"], provider="anthropic")

# Art. 12: Audit trail exists from registration
# Art. 9: Risk score computed after first attestation
# Art. 14: Set up alerts for human oversight
agent.set_alert(webhook_url="https://hooks.slack.com/...", threshold=0.5)

Live production API: agentveil.dev — latest public IPFS anchor