EU AI Act Compliance

Strongly's governance framework gives you the building blocks to operationalize EU AI Act obligations: policies with staged requirements, reviewer approvals, evidence collection, deploy blocking, AI guardrails, and an immutable audit trail.

Recommended Setup

1. Group your AI workloads into a solution. Create a solution per AI system (or per risk classification) containing its apps, workflows, and models. AI Gateway models are added as "All AI Gateway Model resources". See Compliance.
2. Create a policy per risk tier. Use category Compliance, an appropriate severity, and a tag such as eu-ai-act so the policies are easy to find and report on.
3. Model each obligation as a stage requirement, then gate the aiGatewayModel, app, and workflow resource types on the stages that must complete before anything ships. See Policies.

Mapping Obligations to Gates

Obligation	How to model it
Transparency notice (users must know they are interacting with AI)	Acknowledgment gate whose description is the exact transparency statement, plus a url field pointing to the user-facing notice
Bias audit	Evidence gate requiring the audit report upload, with labels describing the expected documents
Human oversight	Approval gate with the accountable reviewers (all or majority logic)
Conformity assessment	An evidence gate for the assessment documents, then a final stage with an approval gate
Performance documentation	Threshold gate on the documented metric (e.g., accuracy >= target) and fields for test details
Prohibited-use screening	A first stage with a required dropdown classifying the use case and an approval gate, gating every applicable resource type so nothing ships until the classification is approved

Because gating carries forward to later stages, a high-risk policy can gate aiGatewayModel from its first stage: requests to the solution's AI Gateway models are then refused until every stage's requirements are satisfied or an administrator records a waiver with a written reason. Gate mlModel the same way to stop self-hosted models from being deployed.

Guardrails for AI Safety Obligations

Add a guardrail gate listing the guardrails your policy mandates (for example pii-detection, toxicity, prompt-injection). The person completing the requirement confirms those guardrails are configured on the model with Verify guardrails; the confirmation is recorded with who made it and when. See Guardrails.

Evidence for Regulators

The governance system retains the artifacts an EU AI Act review asks for:

• Policy definitions with automatic version history
• Gate submissions showing what was declared, by whom, and when
• Approval records with reviewer identity, decision, and comments
• Uploaded evidence documents, retrievable by URL
• Waive records documenting every exception and its justification
• The full audit log of governance actions

See Compliance for the audit trail and evidence details.