EU AI Act

Overview

The EU AI Act is Regulation (EU) 2024/1689. It entered into force on 1 August 2024 and applies in stages. It was amended by the AI Omnibus, Regulation (EU) 2026/1744, which entered into force on 27 July 2026 and moved the high-risk dates. The dates below are those of the amended text, as of 30 September 2026. Most of the Act’s detailed duties attach to high-risk AI systems and fall on their providers (who develop a system and place it on the market or put it into service under their name) and deployers (who use it under their authority). Grantex is an authorisation layer: it records which agent was allowed to do what, on whose authority, and what happened. Those records can help evidence some of these duties. They do not make a system compliant.

This page maps Grantex features to EU AI Act provisions. It is not legal advice, not a conformity assessment and not a certification: only the conformity assessment procedures of the Act (and CE marking where they require it) establish conformity. Whether a duty applies depends on your role and on how your AI system is classified. Consult qualified counsel.

Grantex is owned by Orchestrum Technologies LLP. Inventor and owner: Sanjeev Kumar. Ownership or IP questions may be sent to sanjeev@orchestrum.in or mishra.sanjeev@gmail.com.

Timeline

Date	What applies
1 August 2024	The Regulation enters into force
2 February 2025	Art. 4 AI literacy and the Art. 5 prohibited practices
2 August 2025	Obligations for general-purpose AI (GPAI) models (Arts. 53-55), governance, and penalties (except Art. 101)
2 August 2026	General application, including the Art. 50 transparency obligations; Commission enforcement of GPAI obligations and Art. 101 fines
2 December 2026	End of the Art. 50(2) marking grace period for generative systems placed on the market before 2 August 2026; the new Art. 5 prohibition of AI systems that generate non-consensual intimate imagery or child sexual abuse material applies
2 August 2027	GPAI models placed on the market before 2 August 2025 must comply
2 December 2027	High-risk obligations for Annex III (stand-alone) systems (previously 2 August 2026)
2 August 2028	High-risk obligations for Annex I (product-embedded) systems (previously 2 August 2027)

The separate “Digital Omnibus” on data protection (COM(2025) 837) is still a proposal; the GDPR is unchanged.

Roles and classification

A team that builds an agent on a third-party model is usually the provider of an AI system, a deployer of it, or both. It is not a GPAI model provider unless it places a general-purpose model on the market.
An authorisation layer such as Grantex is not itself a high-risk AI system. An agent is high-risk if it falls under Art. 6: a safety component of an Annex I product, or a use listed in Annex III (for example credit scoring, recruitment or access to essential services).
Art. 6(3) lets a provider conclude that an Annex III system is not high-risk when it does not pose a significant risk, but never when it profiles natural persons; the provider documents that assessment and registers the system (Art. 6(4)). The Commission’s classification guidelines were published as a draft on 19 May 2026.

Obligations and what Grantex provides

Article	Who, from when	Requirement (summary)	What Grantex provides	What remains yours
Art. 4 AI literacy	Providers and deployers, 2 Feb 2025	As amended, take measures to support the development of AI literacy of staff and others operating AI systems on their behalf	Nothing specific	Training and literacy measures
Art. 5 Prohibited practices	All operators, 2 Feb 2025; the new NCII and CSAM prohibition from 2 Dec 2026	Do not place on the market or use the listed practices	Nothing specific	Not building or using them
Art. 9 Risk management	High-risk providers	A documented, lifecycle risk management system	Controls you can cite as risk measures: scoped, time-limited, revocable grants; delegation that can only narrow authority; budgets and caps; policies	The risk management system itself
Art. 10 Data governance	High-risk providers	Training, validation and test data governance (bias-related special-category processing now in Art. 4a)	Nothing specific	Your data governance
Art. 11 + Annex IV Technical documentation	High-risk providers	Technical documentation, kept for 10 years (Art. 18)	Exports can be annexed as records	Writing and keeping the documentation
Art. 12 Record-keeping	High-risk systems (provider designs, deployer keeps)	Automatic recording of events over the system’s lifetime	The developer’s hash-chained audit log of authorisation, delegation, revocation and DPDP events; the evidence export reports its integrity and time span	Logging inside the AI system itself (inputs, outputs, model events); Grantex records authorisation events only
Art. 13 Transparency to deployers	High-risk providers	Instructions for use	Nothing specific	Writing the instructions
Art. 14 Human oversight	High-risk systems	People able to understand, not over-rely on, interpret, override, intervene in or stop the system	Human consent before a grant; decision grants for approval of individual actions; payment approvals; revocation with cascade; the operator override (`POST /v1/emergency-stop`, when enabled); the evidence export counts each	Assigning competent people and designing the oversight
Art. 15 Accuracy, robustness, cybersecurity	High-risk providers	Appropriate levels throughout the lifecycle	Token binding, audience and revocation checks contribute to cybersecurity	The system’s accuracy and robustness
Art. 17 Quality management	High-risk providers	A documented quality management system	Configuration as code (Terraform provider), versioned policies, and exports as records	The QMS
Art. 19(1) Logs kept by providers	High-risk providers	Keep automatically generated logs under their control for at least six months	Grantex never deletes or rewrites audit entries; retention is your database’s	Keeping logs at least that long (a minimum, not a maximum)
Art. 26 Deployers	High-risk deployers	Use per instructions; human oversight; monitor and inform the provider; keep logs at least six months (26(6)); inform workers; inform affected persons of Annex III decisions (26(11))	Per-agent grants and scopes in the evidence export (`art26Deployer`); event streams and webhooks for monitoring	The deployer duties themselves
Art. 27 Fundamental rights impact assessment	Only public bodies, private providers of public services, and deployers of Annex III 5(b) credit scoring and 5(c) life and health insurance	A FRIA before first use	Nothing specific	The FRIA, where it applies
Art. 50 Transparency	Providers and deployers of certain AI systems, 2 Aug 2026	Tell people they are interacting with an AI system unless obvious (50(1)); mark generated content in a machine-readable way (50(2)); disclose emotion recognition and biometric categorisation (50(3)); disclose deepfakes and AI-generated public-interest text (50(4)); at the latest at first interaction (50(5))	Not recorded. The evidence export states `art50Transparency.recorded: false`	The disclosures and their evidence, from your own systems. The Code of Practice on marking and labelling AI-generated content (10 June 2026) is voluntary
Art. 72 Post-market monitoring	High-risk providers	A post-market monitoring system and plan	Audit and event data as inputs	The system and plan
Art. 73 Serious incidents	High-risk providers (deployers inform them)	Report not later than 15 days after awareness; 2 days for a widespread infringement or critical infrastructure; 10 days in the event of a death; an incomplete initial report is allowed	The DPDP breach register lists personal data breaches; the evidence export includes them under `art73Incidents`	Deciding whether an incident is serious and reporting it; Grantex classifies and reports nothing

GPAI model obligations are in Arts. 53-55, not Art. 50.

The EU AI Act evidence export

POST /v1/dpdp/exports with "type": "eu-ai-act-evidence" returns sections mapped to Arts. 12, 14, 26, 50 and 73, each naming its data source, with an applicability block of the dates above and a disclaimer that it is evidence for the operator’s own assessment, not a conformity assessment:

curl -X POST https://api.grantex.dev/v1/dpdp/exports \
  -H "Authorization: Bearer $GRANTEX_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "type": "eu-ai-act-evidence", "dateFrom": "2026-08-01T00:00:00Z", "dateTo": "2026-08-31T23:59:59Z" }'

See EU AI Act Evidence Pack for every field. The older eu-ai-act-conformance type is kept for compatibility; despite its name, it is not a conformity assessment.

Examples

Register an agent with narrow scopes and ask a person for a grant (the grant bounds what the agent may do, and the person’s approval is recorded):

import { Grantex } from '@grantex/sdk';

const grantex = new Grantex({ apiKey: process.env.GRANTEX_API_KEY });

const agent = await grantex.agents.register({
  name: 'shopper-01',
  description: 'Places orders the user approves on merchant.example',
  scopes: ['catalog:read', 'orders:create'],
});

const request = await grantex.authorize({
  agentId: agent.id,
  userId: 'user_abc123',
  scopes: ['catalog:read', 'orders:create'],
  expiresIn: '24h',
});
// Send the person to request.consentUrl to approve or deny.

Stop an agent’s authority, including every grant delegated from it (Art. 14 intervention), and collect audit-chain evidence for a period:

await grantex.grants.revoke('grnt_01HXYZ...');

const pack = await grantex.compliance.evidencePack({
  since: '2026-08-01T00:00:00Z',
  until: '2026-08-31T23:59:59Z',
});
console.log(pack.chainIntegrity.valid);

Penalties (Art. 99)

Prohibited practices (Art. 5): up to EUR 35 million or 7% of worldwide annual turnover, whichever is higher.
Most operator obligations, including those of providers (Art. 16), deployers (Art. 26) and Art. 50: up to EUR 15 million or 3%.
Supplying incorrect or misleading information to authorities: up to EUR 7.5 million or 1%.
For SMEs, including start-ups, and small mid-caps, each cap is the lower of the two amounts.
GPAI model providers (Art. 101): up to EUR 15 million or 3%, enforceable by the Commission from 2 August 2026.

Cross-framework mapping

These are technical mappings, not a statement that any framework is met.

Grantex feature	EU AI Act	DPDP Act 2023	OWASP ASI
Scoped, time-limited grants	Art. 9 (a risk control)	s.4 (purposes recorded; scopes bound authority)	ASI-01 (goal hijacking)
Per-agent DID	Art. 12 (attribution in logs)	—	ASI-03 (identity abuse)
Delegation that can only narrow	Art. 9 (a risk control)	—	ASI-05 (privilege escalation)
Revocation with cascade	Art. 14 (intervene or stop)	s.6(6) (cease processing after withdrawal)	ASI-10 (rogue agents)
Human consent and decision grants	Art. 14 (human oversight)	s.6 (consent)	—
Hash-chained audit log	Art. 12 and Arts. 19(1), 26(6) (logs)	r.6(1)(e), r.8(3) (one-year logs)	—
Breach register	Art. 73 (input to the incident decision)	s.8(6), r.7 (breach intimation)	—

Sources

European Commission: AI Act regulatory framework
European Commission: the AI Omnibus enters into force
AI Act Service Desk: article texts (some article pages may still show the text before Regulation (EU) 2026/1744)

DPDP Act 2023 — India’s data protection mapping
DPDP Compliance Module — features and examples
EU AI Act Evidence Pack — export reference
Compliance Evidence Pack API — audit-chain evidence
Compliance Matrix — cross-framework mapping
OWASP Agentic Top 10 Blog — threat taxonomy mapping

Getting Started

Core Concepts

Trust & Identity

Offline Authorization

x402 Payment Protocol

MCP Authorization

OACP Authority

Agentic Commerce V1 (Historical)

Compliance

Guides

Case Studies

Examples

Overview

Timeline

Roles and classification

Obligations and what Grantex provides

The EU AI Act evidence export

Examples

Penalties (Art. 99)

Cross-framework mapping

Sources

​Overview

​Timeline

​Roles and classification

​Obligations and what Grantex provides

​The EU AI Act evidence export

​Examples

​Penalties (Art. 99)

​Cross-framework mapping

​Sources

​Related Resources

Overview

Timeline

Roles and classification

Obligations and what Grantex provides

The EU AI Act evidence export

Examples

Penalties (Art. 99)

Cross-framework mapping

Sources

Related Resources