Solutions — instrument
EU AI Act, mapped clause by clause.
Regulation (EU) 2024/1689. Fourteen clauses mapped, scored only over the obligations that currently apply, with the ones deferred to December 2027 stated beside the number rather than folded into it.
What the platform evidences
Each of these maps to a clause and to a record the deployment actually holds. Where it cannot produce one, the pack names the gap and says what would fix it — a report that silently omits what it could not find reads as complete, which is worse than no report.
- Art. 12 — Record-keeping
- Automatic logging over the lifetime of the system. Decision records, sequenced and Merkle-sealed, with per-record inclusion proofs and external anchoring.
- Art. 14 — Human oversight
- Evidence that consequential actions reach a person and that the loop is real: the review queue, who decided, and how long it took. Art. 14(4)(e) — the ability to stop the system — is revocation reaching a whole delegation tree.
- Art. 26 — Deployer obligations
- Use in accordance with instructions, oversight by competent persons, monitoring, and retention of logs — each against the authority in force at the time rather than the configuration today.
- Art. 50(1) — Transparency
- Records that affected people were told an AI system was involved, recorded as a step rather than inferred from a template.
- Art. 73 — Serious incidents
- Classification by a named person, the deadline computed from awareness rather than occurrence, and a report chain where each revision names its predecessor. 15 days, 10 where a death may have been caused, 2 for widespread infringement.
- Art. 86 — Right to explanation
- The causal chain for one decision: what was read, what authority was in force, what each gate did, and what was refused.
Twelve of the fourteen clauses do not apply yet. The Digital Omnibus deferred the Annex III high-risk obligations to 2027-12-02 while Article 50 transparency applies from 2026-08-02. A single percentage across both is an average of two unrelated questions, so readiness scores only what currently applies and states the deferred count and its date beside it.
What is yours, not ours
Whether your system is high-risk under Annex III. Whether an event is a serious incident. Your risk management system, your data governance, your conformity assessment, your quality management system. RotaGrant holds attestations about those; it does not perform them, and grading you on them would be measuring the wrong system.