EU AI Act Compliance

Strongly's governance framework gives you the building blocks to operationalize EU AI Act obligations: policies with staged requirements, reviewer approvals, evidence collection, deploy blocking, AI guardrails, and an immutable audit trail.

Recommended Setup

1. Group your AI workloads into a solution. Create a solution per AI system (or per risk classification) containing its AI Gateway models, workflows, and apps. See Compliance.
2. Create a policy per risk tier. Use category Compliance, an appropriate severity, and a tag such as eu-ai-act so the policies are easy to find and report on.
3. Model each obligation as a stage requirement, then gate the aiGatewayModel, app, and workflow resource types on the stages that must complete before anything ships. See Policies.

Mapping Obligations to Gates

Obligation	How to model it
Transparency notice (users must know they are interacting with AI)	Acknowledgment gate whose description is the exact transparency statement, plus a url field pointing to the user-facing notice
Bias audit	Evidence gate requiring the audit report upload, with labels describing the expected documents
Human oversight	Approval gate with the accountable reviewers (all or majority logic)
Conformity assessment	Evidence gate for the assessment documents plus a final approval gate
Performance documentation	Threshold gate on the documented metric (e.g., accuracy >= target) and fields for test details
Prohibited-use screening	A first stage with a required dropdown classifying the use case, reviewed via an approval gate before any resource type is un-gated

Because gating is cumulative across stages, a high-risk policy can gate aiGatewayModel from its first stage: the model then cannot be deployed until every stage's requirements are satisfied or an administrator records a waiver with a written reason.

Guardrails for AI Safety Obligations

Add a guardrail gate listing the guardrails your policy mandates (for example pii-filter, toxicity-filter, prompt-injection). The developer must verify those guardrails are configured on the model to satisfy the gate.

Independently, the AI Gateway checks models in governance solutions against their policies' required guardrails and logs a policy violation to the governance audit trail when a required guardrail is missing from a model's configuration. See Guardrails.

Evidence for Regulators

The governance system retains the artifacts an EU AI Act review asks for:

• Policy definitions with automatic version history
• Gate submissions showing what was declared, by whom, and when
• Approval records with reviewer identity, decision, and comments
• Uploaded evidence documents, retrievable by URL
• Waive records documenting every exception and its justification
• The full audit log of governance actions

See Compliance for the audit trail and evidence details.