EU AI Act compliance software: runtime controls and audit-grade evidence

The EU AI Act sets obligations for “high-risk” AI systems that go beyond writing a policy: risk management, automatic record-keeping, transparency, human oversight, and accuracy/robustness expectations that have to hold at runtime. Software that helps with this has to do more than store documents — it has to enforce controls when a decision is made and capture evidence that survives scrutiny later.

EVE AI Core is the runtime component. It enforces policy on each high-risk decision, keeps an automatic tamper-evident record of what happened, and supports a human-in-the-loop checkpoint before consequential actions run. It does not replace your legal analysis or your management system — it provides the technical controls and the evidence they call for.

The pack version in force is bound into each decision’s signed evidence, so you can demonstrate which rules governed a specific decision at the time — central to Article 12 record-keeping and to answering a supervisory-authority question about a past decision.

The EU AI Act’s hardest expectations land at the moment a high-risk system acts. EVE CoreGuard is a pre-execution gate: each high-risk decision is risk-scored and evaluated against the versioned policy pack, and the gate returns a deterministic ALLOW, BLOCK, or MODIFY before the action runs. The path is fail-closed — if evaluation cannot complete, the action is refused, not allowed through.

That runtime posture is what turns “we have a policy” into “the policy was enforced on this decision.” It is the same mechanism described on the deterministic AI governance and AI governance runtime pages, applied to high-risk obligations.

Article 12 expects high-risk systems to keep automatic logs over their lifetime. EVE AI Core produces an Ed25519-signed, timestamped certificate for every governed decision, hash-chained into a tamper-evident trail aggregated under signed Merkle roots. Records are automatic (a by-product of enforcement), independently verifiable offline, and deterministically replayable.

For an auditor or supervisory authority, that means the record is something they can check rather than something they must trust — and because the policy version is embedded, the log shows not just what happened but which rules governed it.

Article 14 expects people to be able to oversee and intervene. EVE routes consequential high-risk actions through a propose → approve → execute workflow with role-based access control, so a designated person authorizes them before they run — and the approval (or rejection) is itself recorded in the signed evidence. The gate can also BLOCK or MODIFY an action outright when policy requires it.

Oversight becomes a control in the decision path rather than a paragraph in a manual. Combined with the Article 12 record, you can show both that a human could intervene and that, on a specific decision, the oversight step occurred.