EU AI Act compliance for AI agents

What the EU AI Act asks of AI agents

The EU AI Act regulates AI systems by risk tier. Agentic systems used in high-risk contexts inherit obligations that are largely about evidence: you must be able to show how the system was built, how it behaves, and that you keep records over its lifetime. Most of these obligations live in Articles 9–15.

• Article 9 — a risk-management system maintained across the lifecycle.
• Article 10 — data and data-governance practices for the data the system uses.
• Article 11 — technical documentation (its contents are listed in Annex IV).
• Article 12 — automatic record-keeping (logs) for traceability.
• Article 13 — transparency and information for the people deploying the system.
• Article 14 — effective human oversight.
• Article 15 — accuracy, robustness, and cybersecurity.

Where Agenomic fits

Agenomic encodes each agent into a signed genome and builds a reproducible bundle from it. That genome, its execution traces, and its attestations are the raw material for AI Act evidence — captured as part of your release flow rather than reconstructed by hand before an audit.

• The genome captures prompts, models and configuration, tools, permissions, policies, dependencies, memory contracts, execution traces, behavioral fingerprints, and compliance evidence.
• agenomic build produces a reproducible, signed bundle you can archive per release.
• agenomic diff shows what changed between two versions, so reviewers see behavioral drift before promotion.
• Replay re-runs an agent and compares output distributions and behavior-contract outcomes — statistical evidence, not a claim of bit-for-bit determinism.

Which articles Agenomic helps evidence

Agenomic is strongest on the documentation, record-keeping, and behavioral-evidence obligations. It supports — but does not replace — your own risk-management and oversight processes.

• Article 11 / Annex IV: the genome and bundle capture the system description, components, versions, and design choices. See the technical-documentation guide.
• Article 12: signed traces and tamper-evident attestations give you an audit trail over the agent’s lifetime. See the audit-trail guide.
• Article 9: versioned genomes, diffs, and replay give your risk-management process repeatable behavioral evidence to act on.
• Article 15: replay and behavior contracts provide repeatable accuracy and robustness checks across versions.

What Agenomic does not do

Agenomic produces evidence that maps to the AI Act; it does not certify compliance, guarantee legal conformity, or constitute legal advice. Conformity assessment, classifying your system’s risk tier, and sign-off remain your responsibility. Agenomic’s job is to make the evidence portable, signed, and easy to produce.

Where to start

Capture a genome and a trace with the quickstart, then read the two evidence guides below. When you are ready to share evidence for review, Agenomic Cloud can collect signed bundles into AI Act evidence packs with approval workflows — entirely optional, since the CLI and SDKs run offline.