EU AI Act Compliance Technical Documentation Guide

Overview

The EU AI Act (Regulation 2024/1689) requires AI system providers and deployers to maintain comprehensive metadata documentation across multiple dimensions: technical specifications, risk management, training data provenance, performance monitoring, and regulatory compliance.

AgentFacts was designed with regulatory compliance as a core requirement. The 10-category universal metadata framework provides 100% coverage of EU AI Act documentation obligations without requiring additional systems or schemas.

Regulatory Framework

The EU AI Act employs a risk-based classification system determining applicable requirements:

Documentation Requirements

The EU AI Act mandates 11 distinct categories of documentation and transparency metadata. The following table demonstrates complete mapping to AgentFacts categories:

Implementation Timeline

The EU AI Act follows a phased implementation schedule:

Complete Mapping

AgentFacts provides comprehensive coverage of all EU AI Act documentation requirements through its 10-category universal framework. No additional metadata systems or schemas are required.

High-Risk Systems

High-risk AI systems require the most comprehensive documentation. AgentFacts Category 6 (Compliance & Regulatory) provides the primary structure for high-risk metadata:

{
  "category_6_compliance_regulatory": {
    "eu_ai_act": {
      "version": "2024/1689",
      "risk_classification": {
        "tier": "high-risk",
        "annex_reference": "Annex III, Section 5(b)",
        "classification_rationale": "Employment decision system",
        "classification_authority": "National Competent Authority"
      },
      "conformity_assessment": {
        "assessment_type": "third_party",
        "notified_body": {
          "name": "Certification Authority Name",
          "id": "NB-XXXX",
          "certificate_number": "EU-CERT-YYYY-ZZZZ"
        }
      },
      "risk_management_system": {
        "framework_version": "2.1",
        "identified_risks": [...],
        "mitigation_measures": [...],
        "residual_risk": "low"
      },
      "technical_documentation": {
        "document_version": "3.2",
        "sections": {
          "system_description": "URL",
          "architecture": "URL",
          "performance_metrics": "URL"
        }
      }
    }
  }
}

Required Documentation Elements

GPAI Providers

General-Purpose AI providers face additional transparency obligations effective August 2, 2025. AgentFacts addresses these requirements through Category 2 (Baseline Model) and Category 8 (Supply Chain):

Training Data Transparency

Article 53 requires GPAI providers to publish detailed information about training data, including copyright status. AgentFacts Category 8 provides comprehensive structure:

{
  "category_8_supply_chain": {
    "training_data_metadata": [
      {
        "source_id": "dataset_001",
        "data_type": "text_corpus",
        "collection_method": "web_crawling",
        "data_sources": ["public_web", "licensed_content"],
        "license_info": "CC-BY-4.0, proprietary_licenses",
        "is_copyrighted": true,
        "copyright_disclosure": "Includes copyrighted material",
        "preprocessing_steps": "deduplication, filtering",
        "bias_mitigation": "demographic_balancing"
      }
    ],
    "training_data_summary": {
      "total_volume": "10TB",
      "primary_languages": ["en", "es", "fr", "de"],
      "temporal_coverage": "2015-2024",
      "quality_assessment": "automated_filtering"
    }
  },
  "category_2_baseline_model": {
    "benchmark_results": {
      "mmlu": 0.89,
      "hellaswag": 0.92,
      "truthfulqa": 0.87
    },
    "safety_evaluations": {
      "red_teaming": "completed",
      "adversarial_testing": "completed",
      "evaluation_date": "2024-11-15"
    }
  }
}

Systemic Risk Models

GPAI models with systemic risk (defined by computational threshold or significant impact) face heightened requirements:

Limited-Risk Systems

Limited-risk systems primarily require transparency obligations—informing users they are interacting with AI and labeling AI-generated content. AgentFacts Category 6 addresses these requirements:

{
  "category_6_compliance_regulatory": {
    "eu_ai_act": {
      "risk_classification": {
        "tier": "limited-risk"
      },
      "transparency_obligations": {
        "user_disclosure": true,
        "disclosure_mechanism": "in_application_notice",
        "content_labeling": true,
        "labeling_format": "watermark_and_metadata"
      }
    }
  }
}

Schema Extensions

Organizations can extend the base AgentFacts schema with EU AI Act-specific fields while maintaining full compatibility with the universal standard. The recommended approach uses Category 6 extensions:

Compliance Validation

AgentFacts provides validation tools to verify EU AI Act compliance status. The validation framework checks for required fields, appropriate documentation, and conformity with risk tier obligations.

Validation Workflow

Tools & Resources

Additional Resources