EU AI Act
The EU AI Act module is included on the Enterprise plan.
Scope
The EU AI Act classifies AI systems by risk tier and imposes obligations on deployers and providers of high-risk systems. Behavry's EU AI Act module maps the technical obligations that a high-risk system's providers and deployers can discharge by running their agents through Behavry.
The module is not legal advice. It provides the evidence layer; your legal / compliance team decides which systems fall under which category.
Source: backend/behavry/compliance/eu_ai_act.py. UI: Compliance → EU AI Act.
Covered obligations
| Article | Obligation | Behavry answer |
|---|---|---|
| Art. 12 | Record-keeping (logging) | Decision Trace, append-only audit log |
| Art. 13 | Transparency to users | Human AI Governance banners, audit log exports on request |
| Art. 14 | Human oversight | HITL Escalation, Restricted Mode, Global Kill Switch |
| Art. 15 | Accuracy, robustness, cybersecurity | Behavioral Monitor, ARS continuous testing, security hardening |
| Art. 17 | Quality management system | Policy Writer version history, Change Requests |
| Art. 19 | Automatically generated logs | Audit log retention + integrity |
| Art. 20 | Corrective action | Incident timeline, redaction model, breach preparedness |
| Art. 26 | Deployer obligations | Tenant-specific policies, per-agent baselines |
Record-keeping specifics (Art. 12)
Art. 12 requires that high-risk AI systems keep logs sufficient to:
- Identify situations that may result in risk (MEDIUM-severity+ events)
- Facilitate post-market monitoring (trendable, exportable)
- Monitor the operation of the system (per-action decision traces)
Behavry's audit schema satisfies these explicitly — every tool call, policy decision, DLP hit, and behavioral alert is captured with timestamps, identifiers, and integrity chaining.
Human oversight specifics (Art. 14)
Art. 14 requires effective oversight by natural persons. Behavry provides:
- HITL Escalation queue — humans can halt, modify, or approve high-risk actions
- Restricted Mode — operators can put an agent into reduced-capability mode for investigation without full shutdown
- Global Kill Switch — immediate, fleet-wide halt for emergency response
- Behavioral Monitor — alerts that draw human attention to anomalous behavior before it becomes an incident
Export
GET /api/v1/compliance/eu-ai-act/export?format=pdf|csv|json