EU AI Act

​

Coverage at a glance

​

Article 9 — Risk management system

An iterative, lifecycle-long process of identifying, estimating and mitigating risk.

​

Article 10 — Data and data governance

Data-governance practices, in particular for personal data reaching the system.

​

Article 12 — Record-keeping

Automatic recording of events over the system’s lifetime. Retention is split by design. Audit events are kept 365 days. TrustGuard records carry a per-team entitlement — 365 days by default — with an absolute expiry stamped when written, so changing entitlements later neither extends nor shortens what is already stored.

​

Article 14 — Human oversight

Systems that natural persons can effectively oversee. Oversight here means observe, alert, grant and revoke. The approval workflow governs which servers a person may reach, not individual inference requests.

​

Article 15 — Accuracy, robustness and cybersecurity

Resilience against errors, faults, and attempts to exploit the system.

​

Article 26 — Deployer obligations

Use high-risk systems per instructions, assign human oversight, keep the logs you control. Deployer duties are where these products fit most directly: policies are the documented operational control, roles assign who oversees, and audit logs plus findings are the logs under your control. End-user attribution ties traffic behind a shared key to the person a client was serving — as a label the calling application asserts, not an authenticated identity.

​

Article 50 — Transparency

Neither product detects nor enforces AI-identity disclosure. Article 50 is met by how you design and label your application.

​

Where NeuralTrust stops

Design-time risk. Articles 9 and 10 also reach training choices, foreseeable-misuse analysis and dataset governance. Both products sit on the traffic path at inference time and have no visibility into how a model was trained. Cite them for the operational half. Streaming enforcement. Streamed output is evaluated, but where enforcement can act depends on the path. Through the gateway the stream is buffered and inspected once the client has drained it, so findings are recorded rather than refused; on the LiteLLM path accumulated output is scanned during the stream, where block stops later chunks. Tokens already delivered cannot be recalled either way, so enforce on the request leg when a response must be stopped. A streamed response above 8 MiB is not inspected and emits no event. Tagging. Article identifiers do not ship as tags on findings. This page is the mapping. Residency. Self-hosted and hybrid keep evaluated traffic in your own infrastructure, with configuration-only egress. On SaaS it lives in the region your workspace was provisioned in, fixed at provisioning. See Data handling.