EU AI Act Architecture Guide

The EU AI Act entered into force in August 2024, with full enforcement beginning February 2025 for prohibited practices and August 2026 for high-risk systems. For enterprises deploying AI agents in production, especially those operating in or serving EU markets, this is not optional reading. It is the regulatory equivalent of SOX for AI.

This guide is not a legal summary. It is a technical architecture guide, the exact infrastructure patterns you need to implement so your AI systems pass conformity assessments, produce defensible audit trails, and satisfy regulator inquiries without scrambling.

1. Risk Classification: Where Your AI Agents Fall

The EU AI Act classifies AI systems into four risk tiers. Enterprise AI agents, particularly those making or influencing business decisions, almost always fall into High-Risk or require careful analysis to prove they don't.

Unacceptable Risk (Banned)

Social scoring, real-time biometric surveillance in public spaces, manipulation of vulnerable groups. If your agents do any of this, stop.

High-Risk (Annex III)

This is where most enterprise AI lives. High-risk includes AI used in:

• Employment and worker management: resume screening, performance evaluation, task allocation agents
• Access to essential services: credit scoring, insurance pricing, benefit eligibility agents
• Critical infrastructure: supply chain optimization, energy management, network routing agents
• Law enforcement and migration: fraud detection, risk assessment agents in financial services

If your agent influences a decision that affects a person's rights, safety, or livelihood, it is almost certainly high-risk under Annex III.

Limited Risk

Chatbots, content generation, emotion detection. Key obligation: transparency. Users must know they are interacting with AI.

Minimal Risk

Spam filters, AI-powered search, recommendation engines (with some exceptions). Mostly unregulated but still subject to general transparency principles.

2. The Technical Requirements for High-Risk Systems

Articles 9–15 define what high-risk AI systems must implement. Here is the architecture translation:

Article 9: Risk Management System

You need a continuous risk management process, not a one-time assessment. Architecturally, this means:

• Automated risk scoring for every agent decision (confidence thresholds, anomaly detection)
• A risk registry that tracks identified risks, mitigation measures, and residual risk acceptance
• Periodic re-evaluation triggers, model drift detection, data distribution shifts, new deployment contexts

Article 10: Data Governance

Training, validation, and testing datasets must be relevant, representative, free of errors, and complete. For RAG-based agents, this extends to your knowledge base:

• Document provenance tracking (who uploaded, when, from what source)
• Staleness detection and automated freshness governance
• Bias auditing across knowledge domains

Article 11: Technical Documentation

Complete technical documentation must exist before the system is placed on the market. This includes:

• System architecture diagrams (agent topology, data flows, integration points)
• Training methodology and data descriptions
• Performance metrics and limitations
• Intended purpose and foreseeable misuse scenarios

Article 12: Record-Keeping (Logging)

High-risk systems must automatically record events (logs) throughout their lifetime. This is the audit trail requirement:

• Every agent input, output, and intermediate reasoning step must be logged
• Logs must be immutable (append-only storage, ClickHouse, immutable S3, blockchain-anchored hashes)
• Retention period: at least the lifetime of the system plus regulatory inspection windows
• Logs must enable traceability, from a specific output back to the input, context, and model version that produced it

Article 13: Transparency and Information

Users and deployers must understand what the system does and its limitations:

• Human-readable explanation of what the agent does (not just model cards, operational documentation)
• Known limitations, failure modes, and edge cases
• Instructions for human oversight (when to override, escalation procedures)

Article 14: Human Oversight

High-risk systems must be designed for effective human oversight. Architecturally:

• Human-in-the-loop gates for high-stakes decisions (configurable confidence thresholds)
• Ability to interrupt, override, or shut down the agent at any point
• Dashboard visibility into agent reasoning, not just outputs

Article 15: Accuracy, Robustness, Cybersecurity

• Defined accuracy metrics with ongoing monitoring (not just initial benchmarks)
• Adversarial robustness testing (prompt injection, data poisoning, input manipulation)
• Cybersecurity measures appropriate to the risk level

3. The Compliance Proxy Pattern

At Dioval Group, we implement EU AI Act compliance through the Compliance Proxy Pattern, a middleware architecture that wraps every agent in a compliance envelope without modifying the agent's core logic.

The pattern works by intercepting every agent call through a compliance proxy that:

• Classifies the request: maps the agent action to its EU AI Act risk category
• Enforces policy: checks OPA (Open Policy Agent) rules before allowing execution
• Logs immutably: writes the full decision context to ClickHouse audit trails
• Generates explanations: produces human-readable reasoning summaries (Article 13)
• Routes to human oversight: triggers human-in-the-loop when confidence drops below thresholds (Article 14)

This pattern lets you retrofit compliance onto existing agent deployments without rewriting your agent logic.

4. Conformity Assessment: What to Expect

High-risk AI systems must undergo a conformity assessment before deployment. For most enterprise AI (except biometric and critical infrastructure), this is a self-assessment based on internal procedures, but the documentation burden is substantial:

• Quality Management System (QMS) documentation
• Technical documentation per Annex IV
• EU Declaration of Conformity
• CE marking (yes, for software)
• Registration in the EU AI database

5. Timeline and Enforcement

• February 2025: Prohibited practices banned
• August 2025: Governance structure + GPAI rules apply
• August 2026: Full high-risk system requirements enforced
• Penalties: Up to €35M or 7% of global annual turnover (whichever is higher)

If you are deploying high-risk AI agents in the EU, August 2026 is your compliance deadline. The architecture work needs to start now.

6. Your Action Plan

• Step 1: Classify: Map every AI agent to its EU AI Act risk tier
• Step 2: Gap Analysis: Audit existing infrastructure against Articles 9–15
• Step 3: Architecture: Implement the Compliance Proxy Pattern
• Step 4: Documentation: Build Annex IV technical documentation
• Step 5: Validate: Run internal conformity assessment

Dioval Group's AI Compliance Architecture service handles Steps 2–5. We perform a full regulatory gap assessment, implement the compliance infrastructure, and deliver examination-ready documentation. Book a diagnostic call →