Ground – Beyond the lakehouse: the ontology as the data layer AI & humans can actually useRegister →

EU AI Act

AI that is governed by architecture, not by paperwork

The EU AI Act sets risk-based obligations for AI systems across the Union. Scrydon gives you the runtime guardrails, audit trails and evidence packs to support them — so your conformity work rests on evidence, not just assertion.

Written for the security, risk and data protection teams who have to evidence this — not just describe it.

Book a briefingCommon Questions
What it is

EU AI Act (AI Act)

The EU Artificial Intelligence Act (Regulation (EU) 2024/1689) is the world's first comprehensive horizontal law for AI. It takes a risk-based approach: unacceptable-risk practices are prohibited, high-risk systems face strict requirements for risk management, data governance, technical documentation, logging, human oversight, transparency, accuracy and cybersecurity, and certain AI systems carry transparency duties. It also introduces obligations for providers of general-purpose AI models. Obligations phase in over several years, with significant penalties for non-compliance.
At a glance
Jurisdiction
European Union
Applies to
Applies to dual-use and civilian administrative AI. AI used exclusively for military, defence or national-security purposes is outside its scope (Art. 2(3)).
Talk to us
How we help

How Scrydon helps you comply

Controls are built into the runtime, so compliance is something you can demonstrate with evidence drawn from the platform itself — not assembled after the fact.

Guardrails and data-loss prevention

The DLP guardrails engine scans model inputs and outputs for personal data and hallucination, with regex and JSON gates that can block, redact or quarantine. This supports the AI Act's accuracy, robustness and risk-management expectations and gives you enforceable controls around model behaviour rather than after-the-fact review.

Audit log and technical traceability

Every actor, IP, decision and agent action is captured in an immutable, queryable audit log with redaction and retention controls. This directly supports the Act's logging and record-keeping requirements for high-risk systems and provides the traceability needed for technical documentation and post-market monitoring.

Policy-as-code and human oversight

A single policy-as-code decision point (Rego) authorises actions consistently across the application and data planes, with fail-closed defaults. You can encode human-in-the-loop checkpoints, approval gates and prohibited-use rules so that oversight is enforced by the runtime, not left to operator discipline.

Sovereignty and the AI supply chain

External AI vendors are opt-in, document clearance and classification govern what data reaches a model, and you choose where models run. This gives you control over the AI supply chain and data governance that the Act expects of high-risk deployers and providers.

Framework evidence packs

Scrydon produces framework evidence packs that map platform controls to AI Act articles alongside ISO 42001, ISO 27001 and other frameworks. These accelerate the technical documentation, conformity assessment and supervisory engagement you remain responsible for completing.

Key requirements

What AI Act asks of you

  • Classify each AI system by risk tier (prohibited, high-risk, limited or minimal risk).
  • Operate a continuous risk-management system across the AI lifecycle.
  • Apply data and data-governance practices to training, validation and testing data.
  • Maintain technical documentation and automatic event logging for high-risk systems.
  • Ensure effective human oversight and appropriate accuracy, robustness and cybersecurity.
  • Meet transparency duties, including informing people when they interact with AI.
  • Complete the relevant conformity assessment and register high-risk systems as required.
Where the line sits

What we provide, and what stays yours

No vendor can be compliant on your behalf. We build the controls into the platform and produce the evidence; the assessment of your own deployment stays with you. Here is the split, stated plainly, so it does not surface late in a security review.

Scrydon provides

  • Controls enforced in the runtime by default, rather than left to configuration.
  • An immutable, queryable record of what ran, on whose authority, and against which data.
  • Evidence packs mapped to the obligations set out on this page.
  • Documented architecture and data flows your assessors can read.
  • Deployment inside your own perimeter — up to fully disconnected.

You remain responsible for

  • Classifying your own systems and data under the framework.
  • Your risk assessment, data protection impact assessment and conformity assessment.
  • Who you grant access to, and on what basis.
  • Your incident response and reporting obligations.
  • The operational security of the environment you run it in.
Our security postureRead the documentation
FAQ

Frequently asked questions

How does Scrydon relate to the EU AI Act?+
Scrydon is built to run AI securely and under your control. The controls that do that — DLP guardrails on model inputs and outputs, an immutable audit log, policy-as-code for human oversight and prohibited uses, and document clearance for data governance — are the same ones the EU AI Act looks for, so much of what you need is already in place without a separate compliance project. Scrydon provides the controls and the evidence they produce; the conformity assessment of your AI system remains with you.
Is Scrydon certified under the EU AI Act?+
Not as a platform, and no platform can be. The Act assesses conformity per AI system and its intended purpose, so the conformity assessment of your AI system, and any declaration of conformity, stays with you. Scrydon's controls and evidence make that work substantially easier. Where Scrydon itself provides AI systems, such as Cortex, it meets the provider obligations that apply to them, including the transparency duties in Article 50.
Does the platform support high-risk AI system obligations?+
For high-risk AI systems, the Act requires risk management, data governance, record-keeping, human oversight, transparency, accuracy, robustness and cybersecurity. Scrydon's guardrails, immutable audit log, policy-as-code oversight gates, document classification and fail-closed, mTLS-secured architecture support each of these, because they are how the platform runs AI in the first place. The evidence packs then tie those capabilities back to the relevant articles for your documentation. Most high-risk obligations apply from 2 December 2027 (Annex III), and those for AI in regulated products from 2 August 2028 (Annex I).
What about general-purpose AI models and external vendors?+
Scrydon is designed so that no external model receives your data unless you allow it: external AI vendors are opt-in, and document clearance controls exactly what is shared. That gives you visibility and control over which models you use and what reaches them, which the Act's supply-chain and data-governance requirements build on. Obligations for general-purpose AI models have applied since 2 August 2025 and rest with the model providers.
When do EU AI Act obligations apply?+
The Act entered into force on 1 August 2024 and its obligations phase in over time: prohibitions and AI literacy from 2 February 2025, general-purpose AI model obligations from 2 August 2025, transparency duties from 2 August 2026, most high-risk requirements (Annex III) from 2 December 2027, and high-risk AI in regulated products (Annex I) from 2 August 2028. Scrydon is built to run AI securely and under your control, and the same guardrails, audit trail and access controls that do that also give you much of what these obligations ask for, without a separate compliance project.

Related

AI Governance→Agentic AI→Police & First Responders→National & Federal Government→Local & Municipal Government→All compliance frameworks→

Or write to us

Tell us what you are working on and who should reply. A person reads it and replies within one business day.

We only use these details to reply to you. Privacy policy

Prefer to write? Email hello [at] scrydon.com and we will get back to you.

Back to all compliance frameworks