EU AI Act for the CTO
Most of the AI Act that actually costs money is engineering work, not documentation. Logging over the lifetime of the system, an interruptible architecture, feedback-loop control, and a declared accuracy figure you have to keep true in production. None of it retrofits cheaply.
What lands on you, and what does not
Ownership boundaries are the most useful thing to settle early. Expert analysis: the Regulation names organisations, not job titles.
| Obligation | Yours? | Note |
|---|---|---|
| Art. 12 automatic event logging over the system lifetime | Yes | Architecture, not policy |
| Art. 14 stop button or equivalent, and oversight interfaces | Yes | Must halt in a safe state |
| Art. 15 accuracy, robustness, feedback-loop control | Yes | Including redundancy and fail-safe |
| Annex IV heading 2 development description | Yes | Architecture, third-party components, validation |
| Pre-determined change envelope | Yes, with legal | Decides re-assessment frequency |
| Art. 10 data lineage | Shared with data teams | You hold the provenance |
| Art. 43 conformity assessment | Support | Quality function runs it; you supply the file |
Where this usually goes next
Three situations account for most people reading this page. Each has a different answer.
A deal is blocked on an AI questionnaire
Legal will not sign until you can evidence how AI is governed. HumanAudit’s AI Trust Package is a fixed $3,500 over five business days: a public trust page, a pre-filled SIG Lite / CAIQ / SSPA Section K questionnaire bank, and your AI inventory and classification.
You need ISO/IEC 42001 documentation
23 clause-mapped AIMS documents with all 38 Annex A controls pre-populated, editable and yours to keep, from $199. Or score your gaps first: 18 questions, free, no signup to begin.
You are not sure what reaches you
Twenty minutes with the founder. No prep, no deck, straight to the person accountable for the work. If none of this applies to you, you get told that on the call.
This reference is published by HumanAudit Inc. Not a law firm, not an accredited certification body, not a registered auditor. We build documentation, your counsel interprets it, and an accredited body of your choosing certifies you. How this is funded →
The change envelope is an architecture decision
Article 43(4) treats a substantial modification as triggering a fresh conformity assessment. But changes pre-determined by the provider at the time of the initial conformity assessment and described in the technical documentation are not substantial modifications.
So the breadth of the change envelope you declare directly determines how often you go back through assessment. Declare narrowly and every meaningful model update is a re-assessment. Declare broadly and you must be able to justify that the declared envelope genuinely bounded the behaviour.
For a team shipping model updates continuously, this is the single highest-leverage design decision in the whole regime, and it has to be made before the first assessment, not after. Expert analysis: how broadly an envelope may be drawn has not been tested by any authority.
Three things that do not retrofit
1. Logging over the lifetime of the system. Article 12 asks for automatic recording sufficient to identify risk situations, support post-market monitoring, and let deployers monitor operation. Bolting that onto a system that logs only for debugging means re-instrumenting the inference path. Six-month minimum retention under Article 19 is a storage and access design problem too.
2. Interruptibility. Article 14 requires the ability to intervene or interrupt through a stop button or similar procedure. That means halting in a safe state, which for an asynchronous pipeline with downstream consumers is not a feature flag.
3. Feedback-loop control. Article 15 requires systems that continue to learn after deployment to be built so that possibly biased outputs do not influence input for future operations, with mitigation measures. Any system whose own decisions shape its future training data, ranking, recommendation, fraud scoring, triage, needs this designed in.
Your first 30 days
- Instrument one high-risk system to Article 12 and find out what it costs. Extrapolate.
- Draft the pre-determined change envelope with legal, before anyone commits to a conformity assessment date.
- Name your third-party components. Annex IV heading 2 needs them, and you cannot complete the file without them.
- Pick and justify your accuracy metric. Annex IV heading 4 asks why it is the right metric, not just what it is.
- Test the stop path end to end, including downstream consumers.
Questions worth asking
- Can we halt any high-risk system in a safe state today?
- Do our logs support an incident investigation, or only debugging?
- Which of our systems trains on data shaped by its own past decisions?
- Who can produce the list of every third-party model and library inside our products?
Status labels on this page
Verified fact: Article references, dates and penalty tiers cited above, checked against the consolidated Regulation and the Commission's AI Act Service Desk.
Expert analysis: The ownership allocation, the failure modes, and the 30-day sequence — all our practice rather than the text.
Unsettled: Harmonised standards remain in development, and the Commission's Annex III guidelines are in draft. Both affect how these obligations will be evidenced.
The technical file should be generated, not written
A file regenerated from source systems each release stays current. One assembled by hand for an audit is stale the week after, and Article 11 requires it to be kept up to date.
Start with the inventory
Every role guide on this site converges on the same first step: a list of the AI systems, their intended purpose, their role and their tier.
Frequently asked
What does the EU AI Act require engineering teams to build?
For high-risk AI systems: automatic event logging over the system lifetime under Article 12, human oversight capability including the ability to intervene or interrupt through a stop button or similar procedure under Article 14, accuracy robustness and cybersecurity measures including feedback-loop control under Article 15, and the development, architecture, validation and testing material that populates Annex IV heading 2.
Does every model update trigger a new conformity assessment?
No. Article 43(4) treats a substantial modification as requiring a fresh assessment, but changes pre-determined by the provider at the time of the initial conformity assessment and described in the technical documentation are not substantial modifications. The breadth of that declared change envelope therefore determines re-assessment frequency, which makes it an architecture decision taken before the first assessment.
Does CE marking apply to software?
Yes, for high-risk AI systems. Article 48 requires CE marking, and for AI systems provided digitally it may be affixed digitally where it can be accessed easily through the interface or a machine-readable code.