Problem

The EU AI Act's obligations for high-risk AI systems take full effect on August 2, 2026 — 5.5 months away. Inkog currently maps findings to Articles 12 (record-keeping), 14 (human oversight), and 15 (accuracy/robustness), but several articles relevant to AI agent developers are not yet covered. Organizations deploying AI in the EU (including US-based companies) need compliance readiness checks to prepare for enforcement, with fines up to €35M or 7% of global turnover.

Current Behavior

Proposed Solution

Extend the compliance mapping framework to cover Articles 9, 10, 11, and 13 as readiness checks. These articles have concrete indicators that static analysis can detect.

Article 9 — Risk Management System

• Verify risk assessment documentation exists
• Check for continuous monitoring patterns (audit logs, metrics collection)
• Map existing missing_rate_limits and resource_exhaustion findings

Article 10 — Data Governance

• Detect training data exposure (RAG over-fetching, context window accumulation)
• Map existing cross_tenant_data_leakage findings
• Check for data retention controls

Article 11 — Technical Documentation

• Verify AGENTS.md or equivalent governance declarations exist
• Check for model card / system prompt documentation
• Map existing governance verification findings
• This is one of the most actionable articles for static analysis: "Does documentation exist?"

Article 13 — Transparency

• Detect missing user disclosure (AI system not identifying itself in prompt templates)
• Check for output attribution / source citation patterns
• Verify human-readable explanation capabilities

Expected output

$ inког -path ./my-agent --policy eu-ai-act

EU AI Act Readiness Report:
  Art. 9  Risk Management:          ⚠️  2 gaps identified
  Art. 10 Data Governance:          ⚠️  1 gap identified  
  Art. 11 Technical Documentation:  ❌ Missing AGENTS.md
  Art. 12 Record-keeping:           ✅ Audit logging present
  Art. 13 Transparency:             ⚠️  1 gap identified
  Art. 14 Human Oversight:          ✅ Approval gates configured
  Art. 15 Accuracy & Robustness:    ✅ Input validation present

Note: These are readiness checks — indicators that help teams identify gaps before an audit. Inkog does not certify legal compliance.

References

• EU AI Act full text
• EU AI Act implementation timeline — Aug 2, 2026 for high-risk systems
• NIST AI RMF crosswalk to EU AI Act

Notes

• The compliance mapping infrastructure already exists in pkg/governance/ — this extends the ControlMetadata to cover more articles
• Some mappings (Art. 9, 10, 12) can leverage existing detection rules with new compliance annotations
• Art. 11 (Technical Documentation) is the most actionable: static analysis can check for the presence of documentation files
• Art. 13 (Transparency) can check prompt templates for AI disclosure strings
• The --policy eu-ai-act preset already exists and would automatically include these new mappings
• Consider generating a standalone readiness report (PDF/HTML) for sharing with compliance teams
• Article 5 (Prohibited Practices) is intentionally excluded — detecting "subliminal manipulation techniques" is not feasible via static analysis and claiming otherwise would undermine credibility