EU AI Act compliance: the audit trails regulators will ask for on August 2, 2026
Penalties up to EUR 35 million or 7% of global turnover. For high-risk systems — recruitment, credit scoring, education, critical infrastructure — regulators will demand complete audit trails, documented human oversight and a conformity assessment. Compliance is won by engineering, not by checkboxes.
30-min call. No commitment. Reply within 24h.
Your AI has no audit trail the regulator will accept
The deadline is real
Regulation (EU) 2024/1689 entered into force in stages, and August 2, 2026 is the date the substantive obligations bite for high-risk systems. Penalties reach EUR 35 million or 7% of global annual turnover, whichever is higher. In scope: AI used in recruitment and employment, credit scoring, education and training, access to essential services, biometric identification, critical infrastructure and law enforcement. If your AI takes or shapes those decisions, you are in scope, with no opt-out.
Your AI logs nothing useful
When a regulator, a lawyer, or a customer asks how a given decision was actually made, most AI implementations have no answer. No prompt log, no model version stamp, no approver chain, no record of the human who signed off. An AI without an audit trail is legally indefensible, and the editorial intelligence platforms that hold up already understood that traceability is not a module you bolt on; it is an architectural discipline.
Vendor AI does not protect you
OpenAI, Anthropic and Google will not hand you compliance evidence. Their API is a black box: you get a response, not an evaluation file. You have to build the compliance layer around their model yourself: source attribution, human gates, audit logging, the technical documentation pack. Governed AI workflows and traceable data research are no longer optional; they are the minimum bricks of a system that survives an audit.
From we'll deal with it in August to a defensible system
Classify your AI systems
I review every AI system in production or in pilot and classify each one against the AI Act tiers: prohibited, high-risk, limited-risk, minimal-risk. The distinction matters: an internal chatbot and a CV-scoring system carry very different obligations. We document the rationale for each classification, because that is what the regulator will examine first.
Identify the evidence gaps
For each high-risk system, we map the regulatory requirements (Articles 9, 12, 13, 14, 15) against what your infrastructure can produce today. Missing logs, untracked sources, undocumented human oversight, no incident register: the audit lists exactly which evidence is missing and which is already defensible as built.
Build the audit + oversight layer
I design and wire the layer that produces the evidence: per-request logging (prompt, response, model, version, cost, latency), per-fact source attribution, human review gates on high-impact outputs, oversight dashboards, incident and drift registers. This is not a bolt-on module; it is the base architecture your workflows then run on top of.
Document & maintain
We produce the technical documentation (Article 11), the risk management system (Article 9), the instructions for use (Article 13), the human oversight documentation (Article 14), and the data quality evidence (Article 10). These are not frozen artefacts: they are regenerated from production at every system change, so they stay up to date for a surprise audit.
What an auditable AI system looks like
Every fact in every article traces back to its origin: URL, date, source version, reliability score. No unsourced claim reaches publication. End-to-end traceability is what the AI Act demands and what no AI vendor delivers by default. See how it was wired.
Three documented human checkpoints before publication (angle, voice, sensitive claims), each with a review interface that shows the prompt, response, sources, model and version. Every reviewer decision is logged: approve, reject, request rewrite, with reason. Article 14 satisfied by design, not by screenshot.
For every output produced: prompt, response, model (Claude Opus, GPT-5.1), version, cost, latency, validations passed, reviewer decisions. Article 12 satisfied. Everything queryable, replayable, exportable. When the auditor asks how a given decision was made, you have the answer in under a minute.
An editorial platform auditable by design
- Every fact source-tracked back to its origin: versioned, queryable, defensible in audit
- 3 human review gates with full reviewer decision logs: angle, voice, sensitive claims
- Per-output audit trail (prompts, responses, costs, validations, approvers), Article 12 satisfied by design
Two services, one discipline of evidence
AI workflow automation
AI pipelines built with audit trails and human gates from the start: control plane, per-agent budgets, end-to-end traceability, AI Act requirements wired in by design.
Data research systems
Source attribution and coverage scoring as core architecture, not afterthoughts: every fact traceable to a URL, a date and a reliability score.
Common questions
Is my AI system 'high-risk' under the AI Act?
Probably yes if your AI takes or shapes decisions in any of the domains listed in Annex III of the AI Act: recruitment and employment management (CV screening, performance evaluation), credit or insurance scoring, education and training (grading, access), access to essential services (healthcare, energy, social benefits), law enforcement, migration management, critical infrastructure, biometric identification. Customer chatbots and product recommendation systems are generally out of high-risk scope, but the devil is in the detail. The first deliverable of any compliance engagement is precisely the documented classification, because misclassifying exposes you as much as not complying. This classification also dialogues with your production AI discipline: an AI system that does not hold up in production will not hold up in audit either.
What if my AI is a vendor product (OpenAI, Anthropic), am I still on the hook?
Yes, and this is the most misunderstood point in the AI Act. The text distinguishes the foundation model provider (OpenAI, Anthropic, Google) from the deployer (you) who integrates it into a high-risk system. The deployer carries the bulk of Articles 12 to 14 obligations: audit trail, transparency to downstream users, human oversight. OpenAI does not give you a defensible log of every request from your application with its business context; you have to log it yourself. Anthropic does not document your human gates; you have to wire them. Multi-agent AI governance is precisely the layer that turns an API call into a compliant, auditable system.
How do you build audit trails into existing AI implementations?
Three passes. Pass 1, per-request instrumentation: intercept every model call to capture prompt, response, model, version, cost and latency (Langfuse, OpenTelemetry, or a custom wrapper). Pass 2, source attribution: for outputs that depend on external data, wire traceability all the way to URL, date and source version. Pass 3, documented human gates: identify high-impact outputs and insert a review point whose every decision is logged. Traceable data research is almost always the heaviest workstream, and the one that pays back the most in reliability beyond compliance alone.
What is the relationship between AI Act compliance and GDPR?
The two regulations overlap and reinforce each other. GDPR governs the processing of personal data; the AI Act governs high-risk AI systems. When your AI processes personal data, both apply. Concretely, Article 10 of the AI Act on data quality and governance picks up and extends the GDPR principles of minimisation, accuracy and purpose limitation. Impact assessments (DPIA under GDPR, FRIA under the AI Act) can and should be coordinated. If your DPO is in place, they become the natural pivot: the AI Act adds technical obligations GDPR does not cover (human oversight, technical documentation, AI system register). The custom business tools I build integrate both layers from the start.
What happens if I miss the August 2 deadline?
At best, a formal notice from the competent authority with a remediation window. At worst, financial penalties up to EUR 35 million or 7% of global annual turnover (whichever is higher), plus a market or operational ban on non-compliant systems. National authorities (CNIL in France, BfDI in Germany) will enforce, and citizen or NGO complaints accelerate inspections. Reputational risk piles on top: being publicly named for AI non-compliance in 2026 will hurt more than any fine. The right reading is not to wait until August: the patterns the AI Act demands are the same patterns that make AI reliable in production. You pay their cost in reliability before you ever pay it in compliance; see AI that works in production for the engineering detail and internal tools for ops teams for how the same discipline applies to your back-office stack.
August 2, 2026 is not moving. Get the audit trails right before the regulator asks.
Bring an inventory of your AI systems. We classify each one against the AI Act, quantify the evidence gaps, and chart the minimum path — the one that ends in an infrastructure defensible under audit.
30-min call. No commitment. Reply within 24h.