EU AI Act

AI system component documentation, supply chain transparency, version traceability.


Short name	EU AI
Region	Europe
Country or scope	European Union
Sector	AI
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers EU AI

Scan requirements: 6, all decided by a scan.
Controls: the scan requirements below, plus 14 controls from Safeguard's control catalog for EU AI.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 25: 3 written for EU AI and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`EU-AIA-11` Technical Documentation of System Elements	Providers of high-risk AI systems must draw up technical documentation describing the system's development and its elements, which for the software stack means an enumerated component inventory (AI Act Art. 11 and Annex IV)	Scan
`EU-AIA-11V` Version Traceability of the Stack	Technical documentation must cover the versions of relevant software and how they interact, so components must record versions to keep documentation faithful across releases (AI Act Annex IV documentation content)	Scan
`EU-AIA-15` Cybersecurity and Integrity	High-risk AI systems must achieve appropriate cybersecurity and resilience against attempts to alter their use or behaviour, including assurance that deployed components are unmodified (AI Act Art. 15)	Scan
`EU-AIA-25` Value Chain Responsibilities	Obligations along the AI value chain require providers to know which third parties supply tools, components and services integrated into the system (AI Act Art. 25, responsibilities along the AI value chain)	Scan
`EU-AIA-12` Record-Keeping Foundations	High-risk systems must support automatic recording of events, and documentation must be identifiable and dated for authorities across the retention period (AI Act Arts. 12 and 18)	Scan
`EU-AIA-13` Transparency to Deployers	Systems must be accompanied by instructions and information enabling deployers to understand and use them, supported by machine-readable composition data that downstream tooling can consume (AI Act Art. 13)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`EUAI-ART9`	Establish Risk Management System for High-Risk AI
`EUAI-ART10`	Implement Data and Data Governance Practices
`EUAI-ART11`	Maintain Technical Documentation
`EUAI-ART12`	Implement Automatic Logging of AI System Events
`EUAI-ART13`	Ensure Transparency and Provision of Information to Users
`EUAI-ART14`	Enable Effective Human Oversight
`EUAI-ART15`	Ensure Accuracy, Robustness, and Cybersecurity
`EUAI-ART16`	Register High-Risk AI Systems in EU Database
`EUAI-ART17`	Implement Quality Management System
`EUAI-ART50`	Label AI-Generated Content (GPAI Transparency)
`EUAI-ART53`	Comply with GPAI Model Obligations
`EUAI-ART55`	Meet Systemic Risk Obligations for High-Impact GPAI Models
`EUAI-SBOM`	Document AI Model and Component Supply Chain
`EUAI-ART4`	Ensure AI Literacy of Staff

Policy templates

Written for EU AI:

EU AI Act High-Risk AI System Risk Management Policy
EU AI Act Technical Documentation Policy
EU AI Act GPAI Model Transparency and Obligations Policy

And 22 from the standard set, adapted to EU AI.