Minimization and retention
Send only what is necessary and document how long it is kept.
Privacy
Responsible use
Safety and regulation by design.
Risk, data and external effects must be defined before adding autonomy.
Essential controls
Protection depends on the context of use.
Permissions and confirmation
Limits tools and requires approval for sensitive effects.
AgentsProportional verification
Review and evidence increase as the impact of the error grows.
RiskOperational regulatory map
The legal classification depends on the territory and the specific use.
Document the system
Provider, version, data, purpose, managers and users.
GovernanceClassify the risk
Identify affected people and foreseeable consequences.
AssessmentCheck every update
A new model or tool can alter obligations and controls.
Follow-up
ANALYSIS
Related analysis
Article 27 of the AI Act: a practical guide to fundamental rights impact assessments
A legal and operational analysis of Article 27 of Regulation (EU) 2024/1689, which requires certain deployers of high-risk AI systems to assess their impact on fundamental rights before use.
20 Oct 2026 ↗
Article 14 of the AI Act: Continuous Risk Management and Its Practical Application in High-Risk Systems
A legal-operational analysis of Article 14 of Regulation (EU) 2024/1689, focusing on the obligation to establish a continuous risk management system for high-risk AI systems, distinguishing between initial assessment and permanent monitoring, and providing a compliance checklist.
19 Oct 2026 ↗
Article 10 of the AI Act: Training Data Requirements and Practical Application
A legal-operational analysis of the quality, governance, and documentation criteria required by Regulation (EU) 2024/1689 for datasets used in high-risk AI systems.
18 Oct 2026 ↗
AI literacy under the AI Act: a guide to training staff and documenting compliance
Article 4 of the EU AI Act requires providers and deployers to take measures to ensure that their staff and other people operating or using AI systems on their behalf have a sufficient level of AI literacy. This guide explains how to turn that obligation into role-specific training and keep a record of the measures taken, without mistaking documentation for automatic proof of compliance.
14 Oct 2026 ↗
Article 16 of the AI Act: High-Risk AI Provider Obligations and How to Verify Them
Article 16 of the AI Regulation assigns specific compliance, documentation, monitoring, and communication duties to providers. This guide distinguishes these tasks from those of the deployer and proposes verifiable controls, with caution regarding dates and sanctions.
13 Oct 2026 ↗
AI agents that modify records: who is responsible under the AI Act?
An agent that uses tools and changes data does not thereby acquire its own legal category or automatically become high-risk. The analysis depends on its purpose, configuration and use, and on the role each organisation plays throughout its lifecycle.
13 Oct 2026 ↗From the model to the real system
Safety cannot be inferred from a model sheet. It depends on the data, permissions, affected people, connected tools, and ability to stop or reverse actions.
Govern
Define owners, purpose, inventory, acceptance criteria, and incident channels before deployment.
Map
Describe users, data, third parties, foreseeable impacts, and out-of-scope uses.
Measure
Test quality, bias, privacy, instruction injection, and failure recovery with recorded evidence.
Manage
Limit privileges, require confirmation for sensitive actions, monitor changes, and maintain a rollback path.
Supervision
Stop sensitive actions before producing external effects.
Source and date
Every claim must retain the official page consulted and the verification date.
Primary and technical sources
References used to expand and review this page.