EU AI Act

Regulation (EU) 2024/1689 — the European Union's horizontal law for AI systems. Gadriel Code maps GVL findings onto the technical articles most likely to leave source-code evidence and produces a per-article report.

At a glance

Property	Value
Slug	`eu-ai-act`
Aliases	`eu`, `ai-act`
Controls	9
Manual-only	0
Machine-assessable	9
Direct mapping key	`eu_ai_act`

KEY TAKEAWAY

The EU AI Act framework is one of the two most automatable frameworks in Gadriel Code — every article the pack tracks is predicated and driven from real source evidence, with zero forced manual reviews.

Generating the report

bash
# Single framework
gadriel code report --compliance eu-ai-act

# Alongside other AI-governance frameworks
gadriel code report --compliance eu-ai-act,nist-ai-rmf,iso-42001

Outputs land in .security/compliance/eu-ai-act.{md,typ,pdf} and refresh the HTML bundle in .security/reports/.

What Gadriel evaluates

The pack tracks technical articles that leave traces in code: data-governance practices, transparency to users, human oversight surfaces, accuracy/robustness guardrails, cybersecurity controls, and logging. GVL rules carry an eu_ai_act: Article_X mapping (e.g. Article_9, Article_10, Article_15) so findings feed directly into the corresponding article's verdict.

NOTE

Placing a system in a risk category (prohibited, high-risk, limited-risk, minimal-risk) is a legal and organizational determination Gadriel cannot make from source. Treat this report as technical evidence to accompany that determination — not a substitute for it.

Reading verdicts

PASS — the article's pass_when predicate matched real GVL evidence.
PARTIAL — evidence is partial or missing; the corpus has not yet observed the required signal in your repo.
FAIL — a fail_when predicate matched (e.g. clearly missing security controls covered by Article 15).

Pair the technical report with your organizational risk classification and any external conformity-assessment obligations.