---
title: "EU AI Act — Regulation (EU) 2024/1689 — KYE Protocol™ coverage"
description: "EU AI Act — Regulation (EU) 2024/1689 coverage by KYE Protocol™ — every requirement bijection-mapped to the KYE™ artefact that enforces it."
url: https://kyeprotocol.com/compliance/eu-ai-act/
lang: en
source: "KYE Protocol"
---

> EU AI Act — Regulation (EU) 2024/1689 coverage by KYE Protocol™ — every requirement bijection-mapped to the KYE™ artefact that enforces it.

EU AI Act — Regulation (EU) 2024/1689

# EU AI Act — Regulation (EU) 2024/1689 — 84% of in-scope requirements covered.

139 requirements · 131 in scope (97 enforced · 19 designed · 15 advisory) · 8 out-of-scope (outside KYE™’s authority layer). The 84% is weighted over the in-scope base.

**Source:** https://eur-lex.europa.eu/eli/reg/2024/1689/oj · **License:** EU Open Data — public domain

## By category

| Category | Reqs | Enforced | Designed | Advisory | Deferred | Coverage |
| --- | --- | --- | --- | --- | --- | --- |
| Annex III — High-risk use-case classes | 1 | 1 | 0 | 0 | 0 | **100%** |
| Art 10 — Data and data governance | 6 | 5 | 0 | 1 | 0 | **88%** |
| Art 11-12 — Technical documentation & record-keeping | 4 | 4 | 0 | 0 | 0 | **100%** |
| Art 13 — Transparency to deployers | 9 | 7 | 2 | 0 | 0 | **89%** |
| Art 14 — Human oversight | 10 | 9 | 1 | 0 | 0 | **95%** |
| Art 15 — Accuracy, robustness & cybersecurity | 5 | 5 | 0 | 0 | 0 | **100%** |
| Art 16-29 — Provider/deployer obligations | 3 | 3 | 0 | 0 | 0 | **100%** |
| Art 50-52 — Transparency to natural persons | 2 | 1 | 0 | 1 | 0 | **63%** |
| Art 6 — High-risk classification | 4 | 4 | 0 | 0 | 0 | **100%** |
| Art 72 — Post-market monitoring & incidents | 1 | 1 | 0 | 0 | 0 | **100%** |
| Art 9 — Risk management system | 9 | 9 | 0 | 0 | 0 | **100%** |
| Art 86 — Right to explanation | 2 | 2 | 0 | 0 | 0 | **100%** |
| Title I — General provisions | 6 | 3 | 1 | 2 | 0 | **67%** |
| Art 5 — Prohibited practices | 8 | 8 | 0 | 0 | 0 | **100%** |
| Art 12 — Record-keeping | 1 | 1 | 0 | 0 | 0 | **100%** |
| Art 16 — Provider obligations | 9 | 5 | 3 | 1 | 0 | **75%** |
| Art 17 — Quality management system | 1 | 0 | 1 | 0 | 0 | **50%** |
| Art 18 — Documentation keeping | 1 | 1 | 0 | 0 | 0 | **100%** |
| Art 19 — Automatically generated logs | 1 | 1 | 0 | 0 | 0 | **100%** |
| Art 20 — Corrective actions | 1 | 1 | 0 | 0 | 0 | **100%** |
| Art 21 — Cooperation with competent authorities | 1 | 1 | 0 | 0 | 0 | **100%** |
| Art 22 — Authorised representatives | 1 | 0 | 0 | 1 | 0 | **25%** |
| Art 23 — Importer obligations | 1 | 0 | 0 | 1 | 0 | **25%** |
| Art 24 — Distributor obligations | 1 | 0 | 0 | 1 | 0 | **25%** |
| Art 25 — Provider responsibility along value chain | 1 | 0 | 0 | 1 | 0 | **25%** |
| Art 26 — Deployer obligations | 7 | 4 | 2 | 1 | 0 | **75%** |
| Art 27 — Fundamental-rights impact assessment | 2 | 0 | 1 | 1 | 0 | **38%** |
| Art 28 — Notifying authorities | 1 | 0 | 0 | 0 | 0 | **0%** |
| Art 29 — Application for notification | 1 | 0 | 0 | 0 | 0 | **0%** |
| Art 43 — Conformity assessment | 1 | 1 | 0 | 0 | 0 | **100%** |
| Art 44 — Certificates | 1 | 0 | 0 | 0 | 0 | **0%** |
| Art 47 — EU declaration of conformity | 1 | 0 | 1 | 0 | 0 | **50%** |
| Art 48 — CE marking | 1 | 0 | 0 | 1 | 0 | **25%** |
| Art 49 — Registration in EU database | 1 | 0 | 1 | 0 | 0 | **50%** |
| Art 50 — Transparency obligations | 2 | 1 | 1 | 0 | 0 | **75%** |
| Art 51 — GPAI with systemic risk | 1 | 1 | 0 | 0 | 0 | **100%** |
| Art 52 — GPAI notification | 1 | 0 | 1 | 0 | 0 | **50%** |
| Art 53 — GPAI provider obligations | 4 | 3 | 1 | 0 | 0 | **88%** |
| Art 55 — GPAI systemic-risk obligations | 4 | 4 | 0 | 0 | 0 | **100%** |
| Art 56 — Codes of practice | 1 | 0 | 0 | 0 | 0 | **0%** |
| Art 60 — Real-world testing | 1 | 1 | 0 | 0 | 0 | **100%** |
| Art 72 — Post-market monitoring | 1 | 1 | 0 | 0 | 0 | **100%** |
| Art 73 — Serious incident reporting | 3 | 3 | 0 | 0 | 0 | **100%** |
| Art 74 — Market surveillance | 1 | 1 | 0 | 0 | 0 | **100%** |
| Art 85 — Right to lodge complaint | 1 | 0 | 0 | 0 | 0 | **0%** |
| Art 99 — Penalties | 1 | 0 | 0 | 0 | 0 | **0%** |
| Art 113 — Entry into force | 1 | 0 | 0 | 1 | 0 | **25%** |
| Annex I — Union harmonisation legislation | 1 | 0 | 0 | 1 | 0 | **25%** |
| Annex II — Law-enforcement offences list | 1 | 0 | 0 | 0 | 0 | **0%** |
| Annex IV — Technical documentation | 1 | 1 | 0 | 0 | 0 | **100%** |
| Annex V — EU declaration of conformity | 1 | 0 | 1 | 0 | 0 | **50%** |
| Annex VI — Internal-control conformity assessment | 1 | 1 | 0 | 0 | 0 | **100%** |
| Annex VII — Notified-body conformity assessment | 1 | 0 | 0 | 1 | 0 | **25%** |
| Annex VIII — EU database registration | 1 | 0 | 1 | 0 | 0 | **50%** |
| Annex IX — Annex III registration | 1 | 0 | 1 | 0 | 0 | **50%** |
| Annex X — JHA large-scale IT systems | 1 | 0 | 0 | 0 | 0 | **0%** |
| Annex XI — GPAI technical documentation | 1 | 1 | 0 | 0 | 0 | **100%** |
| Annex XII — Downstream-integrator information | 1 | 1 | 0 | 0 | 0 | **100%** |
| Annex XIII — GPAI systemic-risk criteria | 1 | 1 | 0 | 0 | 0 | **100%** |

## Every requirement → the KYE™ artefact that enforces it

| ID | Title | Status | KYE™ enforcement |
| --- | --- | --- | --- |
| `eu-ai-act.Annex3` | High-risk AI systems enumerated in Annex III (biometrics, critical infrastructure, education, employment, essential services, law enforcement, migration, justice, democratic processes) | enforced | **audit\_events**: `kye.model.capability_profile.v1`, `kye.purpose.permission.v1`, `kye.purpose.admissibility.v1` **engines**: `internal`, `internal` **constitution\_refs**: `constitution/12-PURPOSE-PERMISSION.md` |
| `eu-ai-act.A10.2` | Training, validation and testing data sets shall be subject to data-governance practices | enforced | **audit\_events**: `kye.evidence.model_params.v1`, `kye.model.influence_envelope.v1` **engines**: `internal` **constitution\_refs**: `constitution/14-AGENTS-AND-ENGINES.md` |
| `eu-ai-act.A10.3` | Data sets shall be relevant, sufficiently representative, free of errors and complete | advisory | **constitution\_refs**: `constitution/14-AGENTS-AND-ENGINES.md` |
| `eu-ai-act.A10.5` | Processing of special-category personal data for bias detection and correction (lawful-basis exception) | enforced | **audit\_events**: `kye.purpose.grant.v1`, `kye.purpose.admissibility.v1`, `kye.evidence.decision_map.v1` **engines**: `internal` **constitution\_refs**: `constitution/12-PURPOSE-PERMISSION.md` |
| `eu-ai-act.A11.1` | Draw up technical documentation of the high-risk AI system before placing on market (Annex IV) | enforced | **audit\_events**: `kye.model.capability_profile.v1`, `kye.model.influence_envelope.v1`, `kye.evidence.pack.v1` **engines**: `internal` **constitution\_refs**: `constitution/21-DELEGATED-AUDITABILITY.md` |
| `eu-ai-act.A11.2` | Keep technical documentation up to date throughout the AI system lifecycle | enforced | **audit\_events**: `kye.signal.drift.detected.v1`, `kye.resilience.improvement_record.v1`, `kye.compliance.attestation.v1` **engines**: `internal` **constitution\_refs**: `constitution/13-RESILIENCE-LOOP.md` |
| `eu-ai-act.A12.1` | Automatic recording of events (logs) over the lifetime of the high-risk AI system | enforced | **audit\_events**: `kye.evidence.decision_map.v1`, `kye.evidence.observed_action.v1`, `kye.audit.event.v1` **engines**: `internal`, `internal` **constitution\_refs**: `constitution/21-DELEGATED-AUDITABILITY.md`, `constitution/35-STREAMING-LOGS.md` |
| `eu-ai-act.A12.3` | Logging shall enable monitoring of operation with respect to risks identified under Art 9 | enforced | **audit\_events**: `kye.evidence.decision_map.v1`, `kye.risk.score.v1`, `kye.signal.evidence.sealed.v1` **engines**: `internal`, `internal` **worm\_tables**: `decisions`, `evidence_pack` **constitution\_refs**: `constitution/30-AUDIT-WORM-RETENTION.md` |
| `eu-ai-act.A13.1` | Design and develop high-risk AI systems to ensure sufficient transparency to deployers | enforced | **audit\_events**: `kye.model.capability_profile.v1`, `kye.model.influence_envelope.v1`, `kye.assurance.adoption_stage.v1` **engines**: `internal` **constitution\_refs**: `constitution/14-AGENTS-AND-ENGINES.md`, `constitution/36-GOVERNEDUI.md` |
| `eu-ai-act.A13.3.a` | Instructions for use shall identify provider, intended purpose, performance, known limitations | enforced | **audit\_events**: `kye.model.capability_profile.v1`, `kye.purpose.permission.v1` **engines**: `internal` **constitution\_refs**: `constitution/12-PURPOSE-PERMISSION.md` |
| `eu-ai-act.A13.3.d` | Instructions for use shall include human-oversight measures, including the technical measures put in place | enforced | **audit\_events**: `kye.assurance.adoption_stage.v1`, `kye.governedui.evidence_timeline.v1` **engines**: `internal` **governedui\_modules**: `kye.governedui.module.authority_scope.v1`, `kye.governedui.module.evidence_timeline.v1` **constitution\_refs**: `constitution/36-GOVERNEDUI.md` |
| `eu-ai-act.A14.1` | High-risk AI systems shall be designed to be effectively overseen by natural persons | enforced | **audit\_events**: `kye.assurance.adoption_stage.v1`, `kye.purpose.grant.v1` **engines**: `internal`, `internal` **governedui\_modules**: `kye.governedui.module.action_approval.v1`, `kye.governedui.module.approval_queue.v1` **constitution\_refs**: `constitution/36-GOVERNEDUI.md` |
| `eu-ai-act.A14.4.a` | Oversight persons can properly understand the relevant capacities and limitations of the system | designed | **audit\_events**: `kye.model.capability_profile.v1`, `kye.governedui.evidence_timeline.v1` **governedui\_modules**: `kye.governedui.module.entity_passport.v1`, `kye.governedui.module.evidence_timeline.v1` **constitution\_refs**: `constitution/36-GOVERNEDUI.md` |
| `eu-ai-act.A14.4.d` | Oversight persons can intervene on the operation or interrupt the system through a stop button | enforced 1 unverified citation | **audit\_events**: `kye.purpose.grant.revoked.v1` unverified citation, `kye.assurance.adoption_stage.v1` **engines**: `internal`, `internal` **constitution\_refs**: `constitution/12-PURPOSE-PERMISSION.md` |
| `eu-ai-act.A14.5` | For Annex III §1(a) biometric-identification systems, no action shall be taken on the basis of identification unless verified and confirmed by at least two natural persons | enforced | **audit\_events**: `kye.purpose.admissibility.v1`, `kye.evidence.decision_map.v1` **engines**: `internal`, `internal` **constitution\_refs**: `constitution/36-GOVERNEDUI.md` |
| `eu-ai-act.A14.2` | Human oversight shall aim to prevent or minimise risks to health, safety or fundamental rights for the period the system is in use | enforced 3 unverified citations | **audit\_events**: `kye.oversight.envelope_set.v1` unverified citation, `kye.oversight.envelope_breach.v1` unverified citation, `kye.oversight.drift_alert.v1` unverified citation, `kye.purpose.admissibility.v1` **engines**: `internal`, `internal` **governedui\_modules**: `kye.governedui.module.oversight_envelope.v1`, `kye.governedui.module.authority_drift.v1` **constitution\_refs**: `constitution/36-GOVERNEDUI.md`, `constitution/13-RESILIENCE-LOOP.md` |
| `eu-ai-act.A14.4.b` | Oversight persons remain aware of the possible tendency of automatically relying or over-relying on the output (automation bias) | enforced 2 unverified citations | **audit\_events**: `kye.oversight.drift_alert.v1` unverified citation, `kye.resilience.drift.detected.v1` unverified citation **governedui\_modules**: `kye.governedui.module.oversight_envelope.v1`, `kye.governedui.module.authority_drift.v1` **constitution\_refs**: `constitution/13-RESILIENCE-LOOP.md`, `constitution/36-GOVERNEDUI.md`, `constitution/39-LEARN-RAIL.md` |
| `eu-ai-act.A15.1` | Achieve an appropriate level of accuracy, robustness, and cybersecurity throughout the lifecycle | enforced | **audit\_events**: `kye.evidence.trace_replay_spec.v1`, `kye.compliance.attestation.v1`, `kye.signal.stress_test.high_risk_detected.v1` **engines**: `internal` **constitution\_refs**: `constitution/13-RESILIENCE-LOOP.md` |
| `eu-ai-act.A15.3` | Levels of accuracy and relevant accuracy metrics declared in the instructions for use | enforced | **audit\_events**: `kye.model.capability_profile.v1` **engines**: `internal` **constitution\_refs**: `constitution/14-AGENTS-AND-ENGINES.md` |
| `eu-ai-act.A15.4` | Resilience against errors, faults or inconsistencies and against feedback loops (concept drift) | enforced | **audit\_events**: `kye.resilience.drift_event.v1`, `kye.signal.drift.detected.v1`, `kye.signal.stable_drift.detected.v1` **engines**: `internal` **constitution\_refs**: `constitution/13-RESILIENCE-LOOP.md` |
| `eu-ai-act.A15.5` | Cybersecurity measures against attempts by unauthorised third parties to alter use, behaviour or performance | enforced | **audit\_events**: `kye.purpose.admissibility.v1`, `kye.agent.refusal.v1`, `kye.evidence.tool_call_pin.v1` **engines**: `internal`, `internal` **constitution\_refs**: `constitution/52-DELEGATED-AGENT-BINDING.md` |
| `eu-ai-act.A17` | Provider shall put in place a quality management system documented in written policies, procedures and instructions | enforced | **audit\_events**: `kye.compliance.attestation.v1`, `kye.risk.authority_register.v1` **engines**: `internal` **constitution\_refs**: `constitution/13-RESILIENCE-LOOP.md`, `constitution/40-IMPLEMENTATION-CANONICAL.md` |
| `eu-ai-act.A26.1` | Deployer shall use the high-risk AI system in accordance with instructions for use | enforced | **audit\_events**: `kye.purpose.admissibility.v1`, `kye.purpose.grant.v1`, `kye.agent.refusal.v1` **engines**: `internal` **constitution\_refs**: `constitution/12-PURPOSE-PERMISSION.md` |
| `eu-ai-act.A27` | Deployers that are bodies governed by public law shall perform a fundamental-rights impact assessment | enforced | **audit\_events**: `kye.assurance.audit_pilot.v1`, `kye.risk.score.v1` **engines**: `internal` **constitution\_refs**: `constitution/13-RESILIENCE-LOOP.md` |
| `eu-ai-act.A50.1` | Providers shall ensure AI systems intended to interact directly with natural persons are designed so persons are informed they are interacting with an AI | enforced | **audit\_events**: `kye.model.capability_profile.v1`, `kye.evidence.observed_action.v1` **engines**: `internal` **constitution\_refs**: `constitution/14-AGENTS-AND-ENGINES.md` |
| `eu-ai-act.A50.2` | Providers of generative AI shall mark outputs as artificially generated or manipulated in a machine-readable format | advisory | **audit\_events**: `kye.evidence.observed_action.v1`, `kye.evidence.tool_call_pin.v1` **engines**: `internal` **constitution\_refs**: `constitution/14-AGENTS-AND-ENGINES.md` |
| `eu-ai-act.A6.1` | Classification of AI systems as high-risk per Annex I safety-component criteria | enforced | **audit\_events**: `kye.model.capability_profile.v1`, `kye.evidence.decision_map.v1`, `kye.compliance.attestation.v1` **engines**: `internal`, `internal` **constitution\_refs**: `constitution/13-RESILIENCE-LOOP.md`, `constitution/14-AGENTS-AND-ENGINES.md` |
| `eu-ai-act.A6.2` | Classification of AI systems as high-risk per Annex III enumerated use-cases | enforced | **audit\_events**: `kye.model.capability_profile.v1`, `kye.purpose.admissibility.v1` **engines**: `internal`, `internal` **constitution\_refs**: `constitution/12-PURPOSE-PERMISSION.md` |
| `eu-ai-act.A72.1` | Providers shall establish a post-market monitoring system and report serious incidents to national authorities | enforced | **audit\_events**: `kye.signal.stress_test.high_risk_detected.v1`, `kye.resilience.drift_event.v1`, `kye.evidence.pack.v1`, `kye.compliance.attestation.v1` **engines**: `internal`, `internal` **constitution\_refs**: `constitution/13-RESILIENCE-LOOP.md`, `constitution/21-DELEGATED-AUDITABILITY.md` |
| `eu-ai-act.A9.1` | Establish, implement, document and maintain a risk-management system across the AI lifecycle | enforced | **audit\_events**: `kye.risk.score.v1`, `kye.risk.authority_register.v1`, `kye.compliance.attestation.v1` **engines**: `internal` **constitution\_refs**: `constitution/13-RESILIENCE-LOOP.md` |
| `eu-ai-act.A9.2` | Identify and analyse known and reasonably foreseeable risks to health, safety and fundamental rights | enforced | **audit\_events**: `kye.risk.score.v1`, `kye.model.capability_profile.v1`, `kye.evidence.decision_map.v1` **engines**: `internal`, `internal` **constitution\_refs**: `constitution/13-RESILIENCE-LOOP.md` |
| `eu-ai-act.A9.5` | Adopt appropriate and targeted risk-management measures to eliminate or reduce identified risks | enforced | **audit\_events**: `kye.purpose.admissibility.v1`, `kye.purpose.grant.v1`, `kye.evidence.decision_map.v1` **engines**: `internal`, `internal` **constitution\_refs**: `constitution/12-PURPOSE-PERMISSION.md` |
| `eu-ai-act.A9.8` | Test the AI system for purposes of identifying the most appropriate risk-management measures | enforced | **audit\_events**: `kye.evidence.trace_replay_spec.v1`, `kye.assurance.audit_replay_report.v1` **engines**: `internal`, `internal` **constitution\_refs**: `constitution/21-DELEGATED-AUDITABILITY.md` |
| `eu-ai-act.A13.RATIONALE` | Transparency to deployers — the governance decision is rendered in a structured, human-readable rationale a deployer can inspect and pass on | enforced | **audit\_events**: `kye.decision_rationale.v1`, `kye.evidence.pack.v1`, `kye.evidence.decision_map.v1` **engines**: `internal`, `internal` **constitution\_refs**: `constitution/21-DELEGATED-AUDITABILITY.md`, `constitution/12-PURPOSE-PERMISSION.md` |
| `eu-ai-act.A14.RATIONALE` | Human oversight — the rationale records the natural-person intervention (approve / reject / modify / interrupt) and the oversight mode in force | enforced | **audit\_events**: `kye.decision_rationale.v1`, `kye.evidence.pack.v1` **engines**: `internal`, `internal` **governedui\_modules**: `kye.governedui.module.action_approval.v1`, `kye.governedui.module.evidence_timeline.v1` **constitution\_refs**: `constitution/21-DELEGATED-AUDITABILITY.md`, `constitution/36-GOVERNEDUI.md` |
| `eu-ai-act.A86.RATIONALE` | Right to explanation — an affected person receives a clear, meaningful, contestable account of why the decision was reached and how to contest it | enforced | **audit\_events**: `kye.decision_rationale.v1`, `kye.dispute.v1`, `kye.evidence.decision_map.v1` **engines**: `internal` **constitution\_refs**: `constitution/21-DELEGATED-AUDITABILITY.md` |
| `eu-ai-act.A1` | Subject matter — harmonised rules for placing on market, putting into service and use of AI systems in the Union | advisory | **constitution\_refs**: `constitution/25-EDGE-GOVERNANCE.md` |
| `eu-ai-act.A2.1` | Scope — applies to providers, deployers, importers, distributors, product manufacturers and affected persons in the Union | enforced | **audit\_events**: `kye.jurisdiction.attestation.v1` **engines**: `internal` **constitution\_refs**: `constitution/25-EDGE-GOVERNANCE.md` |
| `eu-ai-act.A2.3` | Exclusions — military, defence, national security, scientific research and personal non-professional activity | advisory | **constitution\_refs**: `constitution/26-COMMERCIAL.md` |
| `eu-ai-act.A3.1` | Definition — 'AI system' means a machine-based system designed to operate with varying levels of autonomy, that may exhibit adaptiveness after deployment, and that infers from input how to generate outputs | enforced | **audit\_events**: `kye.entity.model.v1`, `kye.model.capability_profile.v1` **engines**: `internal` **constitution\_refs**: `constitution/14-AGENTS-AND-ENGINES.md` |
| `eu-ai-act.A3.63` | Definition — 'general-purpose AI model' means an AI model trained on a large amount of data using self-supervision at scale, displaying significant generality | enforced | **audit\_events**: `kye.model.capability_profile.v1`, `kye.model.influence_envelope.v1` **engines**: `internal` **constitution\_refs**: `constitution/14-AGENTS-AND-ENGINES.md` |
| `eu-ai-act.A4` | AI literacy — providers and deployers must take measures to ensure a sufficient level of AI literacy of their staff and other persons dealing with the system on their behalf | designed | **constitution\_refs**: `constitution/39-LEARN-RAIL.md`, `constitution/10-PARTNER.md` |
| `eu-ai-act.A5.1.a` | Prohibited practice — subliminal techniques beyond a person's consciousness or purposefully manipulative techniques materially distorting behaviour | enforced | **audit\_events**: `kye.purpose.admissibility.v1`, `kye.evidence.decision_map.v1` **engines**: `internal`, `internal` **rule\_packs**: `kye:rule-pack:eu-ai-act` **constitution\_refs**: `constitution/12-PURPOSE-PERMISSION.md` |
| `eu-ai-act.A5.1.b` | Prohibited practice — exploitation of vulnerabilities due to age, disability or social/economic situation | enforced | **audit\_events**: `kye.purpose.admissibility.v1` **engines**: `internal` **constitution\_refs**: `constitution/12-PURPOSE-PERMISSION.md` |
| `eu-ai-act.A5.1.c` | Prohibited practice — social scoring leading to detrimental treatment outside the original collection context | enforced | **audit\_events**: `kye.purpose.admissibility.v1`, `kye.data_use_manifest.v1` **engines**: `internal`, `internal` **constitution\_refs**: `constitution/31-DATA-GOVERNANCE-PACK.md` |
| `eu-ai-act.A5.1.d` | Prohibited practice — risk assessment of natural persons solely on profiling or personality-trait assessment for predicting criminal offences | enforced | **audit\_events**: `kye.purpose.admissibility.v1` **engines**: `internal` **constitution\_refs**: `constitution/12-PURPOSE-PERMISSION.md` |
| `eu-ai-act.A5.1.e` | Prohibited practice — untargeted scraping of facial images for facial-recognition databases | enforced | **audit\_events**: `kye.data_use_manifest.v1`, `kye.purpose.admissibility.v1` **engines**: `internal`, `internal` **constitution\_refs**: `constitution/31-DATA-GOVERNANCE-PACK.md` |
| `eu-ai-act.A5.1.f` | Prohibited practice — emotion recognition in workplace and educational institutions (except for medical or safety reasons) | enforced | **audit\_events**: `kye.purpose.admissibility.v1` **engines**: `internal` **constitution\_refs**: `constitution/12-PURPOSE-PERMISSION.md` |
| `eu-ai-act.A5.1.g` | Prohibited practice — biometric categorisation systems that infer race, political opinions, trade-union membership, religious or philosophical beliefs, sex life or sexual orientation | enforced | **audit\_events**: `kye.purpose.admissibility.v1` **engines**: `internal` **constitution\_refs**: `constitution/12-PURPOSE-PERMISSION.md` |
| `eu-ai-act.A5.1.h` | Prohibited practice — real-time remote biometric identification in publicly accessible spaces for law enforcement (with narrow exceptions) | enforced | **audit\_events**: `kye.purpose.admissibility.v1` **engines**: `internal` **constitution\_refs**: `constitution/12-PURPOSE-PERMISSION.md` |
| `eu-ai-act.A6.3` | Derogation — Annex III system not considered high-risk if it does not pose a significant risk and meets one of the conditions in 6(3)(a)-(d) | enforced | **audit\_events**: `kye.risk.score.v1`, `kye.compliance.attestation.v1` **engines**: `internal` **constitution\_refs**: `constitution/13-RESILIENCE-LOOP.md` |
| `eu-ai-act.A6.4` | Provider documenting Art 6(3) derogation assessment and registering in the EU database | enforced | **audit\_events**: `kye.evidence.pack.v1`, `kye.compliance.attestation.v1` **engines**: `internal` **constitution\_refs**: `constitution/21-DELEGATED-AUDITABILITY.md` |
| `eu-ai-act.A9.3` | Risk-management measures shall give due consideration to the effects on persons under 18 and other vulnerable groups | enforced | **audit\_events**: `kye.risk.score.v1`, `kye.consequence_map.v1` **engines**: `internal`, `internal` **constitution\_refs**: `constitution/13-RESILIENCE-LOOP.md` |
| `eu-ai-act.A9.4` | Risk-management measures shall be such that the relevant residual risk is judged acceptable | enforced | **audit\_events**: `kye.risk.score.v1`, `kye.compliance.attestation.v1` **engines**: `internal` **constitution\_refs**: `constitution/13-RESILIENCE-LOOP.md` |
| `eu-ai-act.A9.6` | High-risk AI systems shall be tested for the purpose of identifying the most appropriate and targeted risk management measures | enforced | **audit\_events**: `kye.evidence.trace_replay_spec.v1`, `kye.scenario_run.v1` **engines**: `internal`, `internal` **constitution\_refs**: `constitution/21-DELEGATED-AUDITABILITY.md` |
| `eu-ai-act.A9.7` | Testing of high-risk AI systems shall be performed against prior defined metrics and probabilistic thresholds appropriate to intended purpose | enforced | **audit\_events**: `kye.scenario.v1`, `kye.assurance.audit_replay_report.v1` **engines**: `internal` **constitution\_refs**: `constitution/21-DELEGATED-AUDITABILITY.md` |
| `eu-ai-act.A9.9` | Risk-management process for high-risk systems intended for credit institutions covered by Union financial-services law shall be integrated with the institution's existing risk management | enforced | **audit\_events**: `kye.connector.evidence_import.v1`, `kye.compliance.attestation.v1` **engines**: `internal` **constitution\_refs**: `constitution/13-RESILIENCE-LOOP.md` |
| `eu-ai-act.A10.1` | High-risk AI systems using techniques involving training of models with data shall be developed on the basis of training, validation and testing data sets that meet quality criteria | enforced | **audit\_events**: `kye.data_use_manifest.v1`, `kye.evidence.model_params.v1` **engines**: `internal` **constitution\_refs**: `constitution/31-DATA-GOVERNANCE-PACK.md` |
| `eu-ai-act.A10.4` | Data sets shall, to the extent required by the intended purpose, take into account the characteristics or elements particular to the specific geographical, contextual, behavioural or functional setting | enforced | **audit\_events**: `kye.data_use_manifest.v1`, `kye.jurisdiction.attestation.v1` **engines**: `internal`, `internal` **constitution\_refs**: `constitution/31-DATA-GOVERNANCE-PACK.md` |
| `eu-ai-act.A10.6` | Special categories of personal data may be processed for bias detection where strictly necessary, with safeguards | enforced | **audit\_events**: `kye.purpose.admissibility.v1`, `kye.data_use_manifest.v1` **engines**: `internal`, `internal` **constitution\_refs**: `constitution/12-PURPOSE-PERMISSION.md`, `constitution/31-DATA-GOVERNANCE-PACK.md` |
| `eu-ai-act.A12.2` | Logs shall enable monitoring of the operation of the high-risk AI system with regard to the occurrence of situations that may result in the system presenting a risk | enforced | **audit\_events**: `kye.signal.drift.detected.v1`, `kye.evidence.pack.v1` **engines**: `internal`, `internal` **constitution\_refs**: `constitution/35-STREAMING-LOGS.md`, `constitution/30-AUDIT-WORM-RETENTION.md` |
| `eu-ai-act.A13.2` | High-risk AI systems shall be accompanied by instructions for use in an appropriate digital or other format | designed | **audit\_events**: `kye.compliance.attestation.v1` **constitution\_refs**: `constitution/39-LEARN-RAIL.md`, `constitution/11-CONTENT.md` |
| `eu-ai-act.A13.3.b` | Instructions for use shall include performance, robustness and cybersecurity characteristics including degradation conditions | enforced | **audit\_events**: `kye.model.capability_profile.v1`, `kye.compliance.attestation.v1` **constitution\_refs**: `constitution/39-LEARN-RAIL.md` |
| `eu-ai-act.A13.3.c` | Instructions for use shall include any known or foreseeable circumstance leading to risks to health, safety or fundamental rights | enforced | **audit\_events**: `kye.consequence_map.v1`, `kye.risk.score.v1` **engines**: `internal` **constitution\_refs**: `constitution/13-RESILIENCE-LOOP.md` |
| `eu-ai-act.A13.3.e` | Instructions for use shall include human-oversight measures including technical measures to facilitate interpretation of the outputs | enforced | **governedui\_modules**: `kye.governedui.module.action_approval.v1`, `kye.governedui.module.evidence_timeline.v1` **constitution\_refs**: `constitution/36-GOVERNEDUI.md` |
| `eu-ai-act.A13.3.f` | Instructions for use shall include the expected lifetime of the system and any necessary maintenance/care measures | designed | **audit\_events**: `kye.audit_retention_policy.v1`, `kye.compliance.attestation.v1` **constitution\_refs**: `constitution/30-AUDIT-WORM-RETENTION.md` |
| `eu-ai-act.A14.3` | Oversight measures shall be commensurate with risks, level of autonomy and context of use | enforced | **audit\_events**: `kye.purpose.permission.v1`, `kye.risk.score.v1` **engines**: `internal`, `internal` **constitution\_refs**: `constitution/12-PURPOSE-PERMISSION.md` |
| `eu-ai-act.A14.4.c` | Oversight persons shall be able to correctly interpret the high-risk AI system's output considering tools and methods available | enforced | **audit\_events**: `kye.evidence.decision_map.v1` **governedui\_modules**: `kye.governedui.module.evidence_timeline.v1` **constitution\_refs**: `constitution/36-GOVERNEDUI.md` |
| `eu-ai-act.A14.4.e` | Oversight persons shall be able to decide, in any particular situation, not to use the high-risk system or to disregard, override or reverse the output | enforced 1 unverified citation | **audit\_events**: `kye.approval_decision.v1`, `kye.purpose.grant.revoked.v1` unverified citation **engines**: `internal` **governedui\_modules**: `kye.governedui.module.action_approval.v1` **constitution\_refs**: `constitution/36-GOVERNEDUI.md` |
| `eu-ai-act.A15.2` | Levels of accuracy and the relevant accuracy metrics shall be declared in the accompanying instructions of use | enforced | **audit\_events**: `kye.model.capability_profile.v1` **constitution\_refs**: `constitution/14-AGENTS-AND-ENGINES.md` |
| `eu-ai-act.A16.a` | Providers shall ensure high-risk AI systems comply with Section 2 requirements | enforced | **audit\_events**: `kye.compliance.attestation.v1` **constitution\_refs**: `constitution/40-IMPLEMENTATION-CANONICAL.md` |
| `eu-ai-act.A16.b` | Providers shall indicate name, registered trade name and contact address on the system or its packaging/accompanying documentation | enforced | **constitution\_refs**: `constitution/26-COMMERCIAL.md` |
| `eu-ai-act.A16.c` | Providers shall have a quality-management system in place per Article 17 | designed | **constitution\_refs**: `constitution/40-IMPLEMENTATION-CANONICAL.md` |
| `eu-ai-act.A16.d` | Providers shall keep the technical documentation per Article 11 for 10 years after placing the system on the market | enforced | **audit\_events**: `kye.audit_retention_policy.v1` **constitution\_refs**: `constitution/30-AUDIT-WORM-RETENTION.md` |
| `eu-ai-act.A16.e` | Providers shall keep the logs automatically generated by their high-risk AI system per Article 19 | enforced | **audit\_events**: `kye.audit_chain_entry.v1`, `kye.audit_retention_policy.v1` **engines**: `internal`, `internal` **constitution\_refs**: `constitution/30-AUDIT-WORM-RETENTION.md`, `constitution/35-STREAMING-LOGS.md` |
| `eu-ai-act.A16.f` | Providers shall ensure that the high-risk AI system undergoes the relevant conformity-assessment procedure per Article 43 | enforced | **audit\_events**: `kye.assurance.tier1_readiness.v1`, `kye.compliance.attestation.v1` **constitution\_refs**: `constitution/21-DELEGATED-AUDITABILITY.md` |
| `eu-ai-act.A16.g` | Providers shall draw up an EU declaration of conformity per Article 47 | designed | **audit\_events**: `kye.compliance.attestation.v1`, `kye.evidence.pack.v1` **constitution\_refs**: `constitution/21-DELEGATED-AUDITABILITY.md` |
| `eu-ai-act.A16.h` | Providers shall affix the CE marking on the high-risk AI system per Article 48 | advisory | **constitution\_refs**: `constitution/26-COMMERCIAL.md` |
| `eu-ai-act.A16.i` | Providers shall register the system in the EU database per Article 49 | designed | **audit\_events**: `kye.evidence.pack.v1` **constitution\_refs**: `constitution/21-DELEGATED-AUDITABILITY.md` |
| `eu-ai-act.A17.1` | Providers shall put in place a quality management system that ensures compliance with this Regulation | designed | **audit\_events**: `kye.compliance.attestation.v1` **constitution\_refs**: `constitution/40-IMPLEMENTATION-CANONICAL.md` |
| `eu-ai-act.A18` | Provider shall keep the documentation referred to in Articles 11, 17, 20, 21 and 49 at disposal of the national competent authorities for 10 years | enforced | **audit\_events**: `kye.audit_retention_policy.v1` **constitution\_refs**: `constitution/30-AUDIT-WORM-RETENTION.md` |
| `eu-ai-act.A19` | Providers shall keep automatically-generated logs for at least 6 months unless a longer period is required by sectoral Union law | enforced | **audit\_events**: `kye.audit_retention_policy.v1`, `kye.audit_chain_entry.v1` **engines**: `internal` **constitution\_refs**: `constitution/30-AUDIT-WORM-RETENTION.md` |
| `eu-ai-act.A20` | Providers that consider or have reason to consider that a placed system is not in conformity shall take corrective actions | enforced 1 unverified citation | **audit\_events**: `kye.signal.incident.opened.v1`, `kye.purpose.grant.revoked.v1` unverified citation **engines**: `internal`, `internal` **constitution\_refs**: `constitution/13-RESILIENCE-LOOP.md` |
| `eu-ai-act.A21` | Providers shall, upon reasoned request of a national competent authority, provide all information and documentation necessary to demonstrate conformity | enforced | **audit\_events**: `kye.assurance.audit_pilot.v1`, `kye.evidence.pack.v1` **agents**: `internal` **constitution\_refs**: `constitution/21-DELEGATED-AUDITABILITY.md` |
| `eu-ai-act.A22` | Providers established in third countries shall, before making available on the Union market, appoint an authorised representative in the Union | advisory | **constitution\_refs**: `constitution/26-COMMERCIAL.md` |
| `eu-ai-act.A23` | Importers shall verify provider's conformity-assessment procedure, technical documentation and CE marking before placing the system on the market | advisory | **audit\_events**: `kye.assurance.audit_pilot.v1` **constitution\_refs**: `constitution/21-DELEGATED-AUDITABILITY.md` |
| `eu-ai-act.A24` | Distributors shall, before making a high-risk AI system available, verify that it bears CE marking, has the EU DoC and instructions for use, and that the provider/importer have complied with Articles 16(b)(c)(d) and 23(3) | advisory | **audit\_events**: `kye.compliance.attestation.v1` **constitution\_refs**: `constitution/26-COMMERCIAL.md` |
| `eu-ai-act.A25` | Any distributor, importer, deployer or third party that puts a high-risk AI system on market under its own name shall be considered a provider and shall assume provider obligations | advisory | **constitution\_refs**: `constitution/26-COMMERCIAL.md` |
| `eu-ai-act.A26.2` | Deployers shall assign human oversight to natural persons who have the necessary competence, training, authority and support | enforced | **audit\_events**: `kye.purpose.permission.v1` **engines**: `internal` **governedui\_modules**: `kye.governedui.module.approval_queue.v1` **constitution\_refs**: `constitution/36-GOVERNEDUI.md` |
| `eu-ai-act.A26.3` | Deployers shall ensure that input data is relevant and sufficiently representative | enforced | **audit\_events**: `kye.data_use_manifest.v1` **engines**: `internal` **constitution\_refs**: `constitution/31-DATA-GOVERNANCE-PACK.md` |
| `eu-ai-act.A26.5` | Deployers shall monitor the operation of the high-risk AI system on the basis of instructions for use and inform the provider of incidents per Article 72 | enforced | **audit\_events**: `kye.signal.incident.opened.v1`, `kye.signal.drift.detected.v1` **engines**: `internal`, `internal` **constitution\_refs**: `constitution/13-RESILIENCE-LOOP.md` |
| `eu-ai-act.A26.6` | Deployers shall keep the logs automatically generated for at least 6 months | enforced | **audit\_events**: `kye.audit_retention_policy.v1` **constitution\_refs**: `constitution/30-AUDIT-WORM-RETENTION.md` |
| `eu-ai-act.A26.7` | Deployers that are employers shall inform workers' representatives and affected workers before putting into service a high-risk AI system in the workplace | designed | **audit\_events**: `kye.comms.dispatched.v1` **constitution\_refs**: `constitution/38-COMMS-RAIL.md` |
| `eu-ai-act.A26.8` | Deployers shall register themselves in the EU database before using a high-risk AI system listed in Annex III | advisory | **constitution\_refs**: `constitution/26-COMMERCIAL.md` |
| `eu-ai-act.A26.11` | Deployers shall use the information provided per Article 13 to comply with their data-protection impact assessment obligation under GDPR Article 35 | designed | **audit\_events**: `kye.compliance.attestation.v1`, `kye.evidence.pack.v1` **constitution\_refs**: `constitution/31-DATA-GOVERNANCE-PACK.md` |
| `eu-ai-act.A27.1` | Deployers that are bodies governed by public law, private operators providing public services, or operators deploying Annex III §5(b)/(c) systems shall perform a fundamental-rights impact assessment (FRIA) | advisory | **audit\_events**: `kye.compliance.attestation.v1` **constitution\_refs**: `constitution/40-IMPLEMENTATION-CANONICAL.md` |
| `eu-ai-act.A27.3` | Once the FRIA is performed, the deployer shall notify the market surveillance authority of its results | designed | **audit\_events**: `kye.comms.dispatched.v1` **constitution\_refs**: `constitution/38-COMMS-RAIL.md` |
| `eu-ai-act.A28` | Each Member State shall designate or establish at least one notifying authority | out-of-scope | _(no enforcement cited)_ |
| `eu-ai-act.A29` | Conformity-assessment bodies shall submit an application for notification to the notifying authority | out-of-scope | _(no enforcement cited)_ |
| `eu-ai-act.A43` | For Annex III high-risk systems other than §1, providers shall follow the conformity-assessment procedure based on internal control (Annex VI) | enforced | **audit\_events**: `kye.assurance.tier1_readiness.v1`, `kye.compliance.attestation.v1` **constitution\_refs**: `constitution/21-DELEGATED-AUDITABILITY.md` |
| `eu-ai-act.A44` | Certificates issued by notified bodies shall be in a Union official language and shall be valid for the period they indicate, not exceeding 5 years | out-of-scope | _(no enforcement cited)_ |
| `eu-ai-act.A47` | Provider shall draw up a written, machine-readable EU declaration of conformity for each high-risk AI system | designed | **audit\_events**: `kye.compliance.attestation.v1`, `kye.evidence.pack.v1` **constitution\_refs**: `constitution/43-MACHINE-READABLE-BY-DEFAULT.md` |
| `eu-ai-act.A48` | CE marking shall be affixed visibly, legibly and indelibly on the high-risk AI system, or where not possible, on its packaging or documentation | advisory | **constitution\_refs**: `constitution/26-COMMERCIAL.md` |
| `eu-ai-act.A49.1` | Provider shall register itself and each Annex III high-risk system in the EU database before placing on market or putting into service | designed | **audit\_events**: `kye.evidence.pack.v1` **constitution\_refs**: `constitution/21-DELEGATED-AUDITABILITY.md` |
| `eu-ai-act.A50.3` | Deployers of emotion-recognition or biometric-categorisation systems shall inform natural persons exposed | enforced | **audit\_events**: `kye.consent.acceptance.v1`, `kye.comms.dispatched.v1` **constitution\_refs**: `constitution/38-COMMS-RAIL.md` |
| `eu-ai-act.A50.4` | Deployers of AI generating or manipulating image, audio or video content (deep fakes) shall disclose that the content has been artificially generated or manipulated | designed | **audit\_events**: `kye.evidence.pack.v1` **constitution\_refs**: `constitution/14-AGENTS-AND-ENGINES.md` |
| `eu-ai-act.A51` | General-purpose AI model with systemic risk shall be designated based on high-impact capabilities or by Commission decision | enforced | **audit\_events**: `kye.model.capability_profile.v1`, `kye.model.influence_envelope.v1` **constitution\_refs**: `constitution/14-AGENTS-AND-ENGINES.md` |
| `eu-ai-act.A52` | Provider of a GPAI model meeting the Art 51 condition shall notify the Commission within 2 weeks | designed | **audit\_events**: `kye.comms.dispatched.v1` **constitution\_refs**: `constitution/38-COMMS-RAIL.md` |
| `eu-ai-act.A53.1.a` | Providers of GPAI models shall draw up and keep up-to-date the technical documentation | enforced | **audit\_events**: `kye.evidence.pack.v1`, `kye.model.capability_profile.v1` **engines**: `internal` **constitution\_refs**: `constitution/43-MACHINE-READABLE-BY-DEFAULT.md` |
| `eu-ai-act.A53.1.b` | Providers of GPAI models shall make information available to providers of AI systems that intend to integrate the GPAI | enforced | **audit\_events**: `kye.model.capability_profile.v1` **constitution\_refs**: `constitution/15-MCP-AND-SDK.md` |
| `eu-ai-act.A53.1.c` | Providers of GPAI models shall put in place a policy to comply with Union law on copyright and related rights | enforced | **audit\_events**: `kye.data_use_manifest.v1` **engines**: `internal` **constitution\_refs**: `constitution/31-DATA-GOVERNANCE-PACK.md` |
| `eu-ai-act.A53.1.d` | Providers of GPAI models shall draw up and make publicly available a sufficiently detailed summary about the content used for training | designed | **audit\_events**: `kye.data_use_manifest.v1` **constitution\_refs**: `constitution/31-DATA-GOVERNANCE-PACK.md` |
| `eu-ai-act.A55.1.a` | Providers of GPAI models with systemic risk shall perform model evaluation including adversarial testing | enforced | **audit\_events**: `kye.scenario_run.v1`, `kye.assurance.audit_replay_report.v1` **engines**: `internal` **constitution\_refs**: `constitution/21-DELEGATED-AUDITABILITY.md` |
| `eu-ai-act.A55.1.b` | Providers of GPAI models with systemic risk shall assess and mitigate possible systemic risks | enforced | **audit\_events**: `kye.risk.score.v1`, `kye.consequence_map.v1` **engines**: `internal`, `internal` **constitution\_refs**: `constitution/13-RESILIENCE-LOOP.md` |
| `eu-ai-act.A55.1.c` | Providers of GPAI models with systemic risk shall keep track of, document and report serious incidents to the AI Office and national authorities | enforced | **audit\_events**: `kye.signal.incident.opened.v1`, `kye.comms.dispatched.v1` **engines**: `internal` **constitution\_refs**: `constitution/38-COMMS-RAIL.md` |
| `eu-ai-act.A55.1.d` | Providers of GPAI models with systemic risk shall ensure an adequate level of cybersecurity protection | enforced | **constitution\_refs**: `constitution/51-NO-SPOF.md`, `constitution/35-STREAMING-LOGS.md` |
| `eu-ai-act.A56` | AI Office and AI Board shall develop codes of practice for GPAI providers | out-of-scope | _(no enforcement cited)_ |
| `eu-ai-act.A60` | Real-world testing of high-risk AI systems outside AI regulatory sandboxes shall meet additional conditions | enforced | **audit\_events**: `kye.scenario_run.v1`, `kye.evidence.pack.v1` **engines**: `internal` **constitution\_refs**: `constitution/21-DELEGATED-AUDITABILITY.md` |
| `eu-ai-act.A72.2` | Post-market monitoring system shall actively and systematically collect, document and analyse relevant data on the performance of high-risk AI systems | enforced | **audit\_events**: `kye.signal.drift.detected.v1`, `kye.audit_chain_entry.v1` **engines**: `internal`, `internal` **constitution\_refs**: `constitution/13-RESILIENCE-LOOP.md`, `constitution/35-STREAMING-LOGS.md` |
| `eu-ai-act.A73.1` | Providers shall report serious incidents to the market surveillance authorities of the Member States within 15 days | enforced | **audit\_events**: `kye.signal.incident.opened.v1`, `kye.comms.dispatched.v1` **engines**: `internal` **constitution\_refs**: `constitution/38-COMMS-RAIL.md` |
| `eu-ai-act.A73.2` | Reports of serious incidents resulting in death or serious damage to health shall be made within 10 days | enforced | **audit\_events**: `kye.signal.incident.opened.v1`, `kye.comms.dispatched.v1` **engines**: `internal` **constitution\_refs**: `constitution/38-COMMS-RAIL.md` |
| `eu-ai-act.A73.3` | Reports of widespread infringement, breach of fundamental rights, or critical infrastructure disruption shall be made within 2 days | enforced | **audit\_events**: `kye.signal.incident.opened.v1`, `kye.comms.dispatched.v1` **engines**: `internal` **constitution\_refs**: `constitution/38-COMMS-RAIL.md` |
| `eu-ai-act.A74` | Market-surveillance authorities shall be given full access to documentation, training/validation/testing data sets and source code where necessary | enforced | **audit\_events**: `kye.assurance.audit_pilot.v1` **agents**: `internal` **constitution\_refs**: `constitution/21-DELEGATED-AUDITABILITY.md` |
| `eu-ai-act.A85` | Any natural or legal person having grounds to consider that there has been an infringement may submit complaints to the relevant market-surveillance authority | out-of-scope | _(no enforcement cited)_ |
| `eu-ai-act.A86` | Affected persons subject to a decision taken on the basis of output from a high-risk AI system that produces legal effects shall have the right to obtain clear and meaningful explanations from the deployer | enforced | **audit\_events**: `kye.evidence.decision_map.v1` **engines**: `internal` **constitution\_refs**: `constitution/36-GOVERNEDUI.md` |
| `eu-ai-act.A99` | Penalties — Member States shall lay down rules on penalties for infringement, up to EUR 35M or 7% of global annual turnover for Art 5 breaches | out-of-scope | _(no enforcement cited)_ |
| `eu-ai-act.A113` | Entry into force and application — staggered: prohibitions Art 5 from 2025-02-02; GPAI Art 53/55 from 2025-08-02; remainder from 2026-08-02; Annex I high-risk products from 2027-08-02 | advisory | **constitution\_refs**: `constitution/25-EDGE-GOVERNANCE.md` |
| `eu-ai-act.AnnexI` | Annex I — List of Union harmonisation legislation under which high-risk AI systems are covered if they are safety components | advisory | **constitution\_refs**: `constitution/26-COMMERCIAL.md` |
| `eu-ai-act.AnnexII` | Annex II — List of criminal offences for biometric-identification carve-out | out-of-scope | _(no enforcement cited)_ |
| `eu-ai-act.AnnexIV` | Annex IV — Technical documentation content for high-risk AI systems (9 sections) | enforced | **audit\_events**: `kye.evidence.pack.v1`, `kye.evidence.model_params.v1` **engines**: `internal` **constitution\_refs**: `constitution/43-MACHINE-READABLE-BY-DEFAULT.md` |
| `eu-ai-act.AnnexV` | Annex V — EU declaration of conformity content (9 fields) | designed | **audit\_events**: `kye.compliance.attestation.v1` **constitution\_refs**: `constitution/43-MACHINE-READABLE-BY-DEFAULT.md` |
| `eu-ai-act.AnnexVI` | Annex VI — Conformity-assessment procedure based on internal control (3-step) | enforced | **audit\_events**: `kye.assurance.tier1_readiness.v1`, `kye.assurance.audit_pilot.v1` **constitution\_refs**: `constitution/21-DELEGATED-AUDITABILITY.md` |
| `eu-ai-act.AnnexVII` | Annex VII — Conformity-assessment procedure based on assessment of QMS and technical documentation by notified body | advisory | **audit\_events**: `kye.evidence.pack.v1` **constitution\_refs**: `constitution/21-DELEGATED-AUDITABILITY.md` |
| `eu-ai-act.AnnexVIII` | Annex VIII — Information for registration in EU database (provider section + system section) | designed | **audit\_events**: `kye.evidence.pack.v1` **constitution\_refs**: `constitution/43-MACHINE-READABLE-BY-DEFAULT.md` |
| `eu-ai-act.AnnexIX` | Annex IX — Information to be submitted upon registration of high-risk AI systems referenced in Annex III §1-7 (specific use cases) | designed | **audit\_events**: `kye.evidence.pack.v1` **constitution\_refs**: `constitution/43-MACHINE-READABLE-BY-DEFAULT.md` |
| `eu-ai-act.AnnexX` | Annex X — Union legislative acts on large-scale IT systems in the area of freedom, security and justice | out-of-scope | _(no enforcement cited)_ |
| `eu-ai-act.AnnexXI` | Annex XI — Technical documentation for GPAI providers (training + model attributes) | enforced | **audit\_events**: `kye.evidence.pack.v1`, `kye.evidence.model_params.v1`, `kye.model.capability_profile.v1` **engines**: `internal` **constitution\_refs**: `constitution/43-MACHINE-READABLE-BY-DEFAULT.md` |
| `eu-ai-act.AnnexXII` | Annex XII — Information for downstream providers integrating a GPAI model | enforced | **audit\_events**: `kye.model.capability_profile.v1`, `kye.model.influence_envelope.v1` **constitution\_refs**: `constitution/15-MCP-AND-SDK.md` |
| `eu-ai-act.AnnexXIII` | Annex XIII — Criteria for designation of GPAI models with systemic risk | enforced | **audit\_events**: `kye.model.capability_profile.v1`, `kye.model.influence_envelope.v1` **constitution\_refs**: `constitution/14-AGENTS-AND-ENGINES.md` |

Canonical KYE™ surfaces referenced on this page: [Decision Rationale](https://kyeprotocol.com/agentic-governance-lifecycle/) · [KYE Protocol™](https://kyeprotocol.com/).