EU AI Act Compliance

​

Overview

​

Timeline

​

Relevant Articles

​

Article 9 — Risk Management Systems

• Scoped grants: Every agent operates with explicitly defined permissions. The JWT scp claim lists exactly what the agent can do. Risks are bounded by the scope.
• Budget controls: budgets.allocate() and budgets.debit() set per-agent, per-grant spending limits. Agents cannot exceed their allocated budget.
• Anomaly detection: Background workers flag unusual agent behavior — scope expansion attempts, high-frequency API calls, out-of-pattern access.
• Policy-as-code: OPA and Cedar integration for fine-grained rules beyond simple scopes. Policies can encode risk thresholds, time-of-day restrictions, and geo-fencing.
• Delegation invariants: Sub-agents must have strictly fewer permissions than their parent. Depth limits prevent unbounded delegation chains.

// Risk management via budget controls
await grantex.budgets.allocate({
  grantId: 'grt_123',
  initialBudget: 100.00,
  currency: 'EUR',
  maxTransactionAmount: 10.00,
});

​

Article 13 — Transparency and Provision of Information

• Human consent flow: Before an agent gets access, the user sees a plain-language consent screen listing every scope and its description. The consent notice is stored immutably.
• Grant token claims: The JWT carries sub (human principal), agt (agent DID), dev (developer), scp (scopes), and grnt (grant ID) — full attribution chain in every token.
• Verifiable Credentials: W3C VCs provide portable, third-party-verifiable proof of authorization. Any party can verify who authorized what, without a Grantex account.
• SD-JWT selective disclosure: Show auditors only the claims they need. Reveal scopes without revealing the principal’s identity, or vice versa.
• Audit trail: Hash-chained, append-only, tamper-evident logs of every action the agent took under its grant.

​

Article 14 — Human Oversight

• Principal Sessions dashboard: Embeddable UI showing all active grants, scopes, and recent activity per user. Principals see exactly what their agents are doing.
• Real-time event streaming: SSE and WebSocket endpoints surface agent actions as they happen. Subscribe to specific event types or agents.
• One-click revocation: Revoke a grant from the dashboard or via API. Takes effect in under 1 second.
• Cascade revocation: Revoking a parent agent’s grant automatically invalidates all delegated sub-agent grants. The entire delegation tree is stopped.
• Anomaly alerts: Webhooks notify operators when anomalous behavior is detected, enabling immediate human intervention.

// Real-time human oversight via event streaming
for await (const event of grantex.events.stream({
  types: ['grant.created', 'grant.revoked', 'token.verified'],
})) {
  console.log(`[${event.type}] Agent: ${event.agentId}, Grant: ${event.grantId}`);
  if (event.type === 'anomaly.detected') {
    await grantex.grants.revoke(event.grantId); // immediate intervention
  }
}

​

Article 17 — Quality Management Systems

• Compliance evidence packs: POST /v1/compliance/evidence generates a complete documentation bundle with grants, tokens, audit entries, policies, and anomaly reports.
• Configuration-as-code: Terraform provider manages agents, grants, policies, and webhooks declaratively. Changes are versioned in git.
• Policy bundles: POST /v1/policies/sync uploads OPA/Cedar policy bundles with versioning. You can trace which policy version was active for any historical decision.
• Conformance test suite: @grantex/conformance validates your deployment against the Grantex protocol specification. Run it in CI to catch compliance regressions.

​

Article 26 — Obligations of Deployers

• Usage metering: usage.current() and usage.history() track authorization volumes, token exchanges, and verification calls. Monitor deployment scale.
• Event streaming: Continuous visibility into agent operations. Deployers can monitor without modifying the agent.
• Custom domains: domains.create() and domains.verify() let deployers run Grantex on their own domain, maintaining control over the authorization infrastructure.
• Principal sessions: Deployers can create sessions for their end-users, enabling oversight at the user level.

​

Step-by-Step: EU AI Act Compliance

​

1. Classify your AI system

​

2. Implement risk management (Art. 9)

import { GrantexClient } from '@grantex/sdk';

const grantex = new GrantexClient({ apiKey: process.env.GRANTEX_API_KEY });

// Define scoped permissions for the agent
const agent = await grantex.agents.create({
  name: 'hr-screening-agent',
  scopes: ['employee:read', 'application:review'], // bounded scope
});

// Set budget controls
await grantex.budgets.allocate({
  grantId: grant.grantId,
  initialBudget: 500.00,
  currency: 'EUR',
});

​

3. Enable transparency (Art. 13)

// Consent flow with clear descriptions
const authRequest = await grantex.authorize({
  agentId: agent.agentId,
  scopes: ['employee:read', 'application:review'],
  scopeDescriptions: {
    'employee:read': 'View employee profiles and application history',
    'application:review': 'Read and score job applications',
  },
});
// User sees these descriptions in the consent UI

​

4. Configure human oversight (Art. 14)

// Subscribe to agent events for real-time monitoring
grantex.events.subscribe((event) => {
  if (event.type === 'anomaly.detected') {
    alertOpsTeam(event);
    // Consider automatic revocation for critical anomalies
  }
});

// Enable principal sessions for end-user oversight
const session = await grantex.principalSessions.create({
  principalId: 'user_123',
  expiresIn: '24h',
});
// session.dashboardUrl → user can view and revoke grants

​

5. Generate conformance documentation (Art. 17)

// Generate EU AI Act conformance report
const report = await dpdp.exportAudit({
  framework: 'eu-ai-act',
  dateRange: { from: '2026-01-01', to: '2026-07-31' },
  format: 'json',
});

​

Deadline Warnings

​

Cross-Framework Coverage

​

Related Resources

• DPDP Act 2023 Compliance — India’s data protection mapping
• DPDP Compliance Module — feature overview and SDK reference
• OWASP Agentic Top 10 Blog — threat taxonomy mapping
• Compliance Matrix — full cross-framework compliance mapping
• Compliance Evidence Pack API — export API reference