EU AI Act high-risk obligations begin August 2, 2026. Penalties for high-risk non-compliance reach €15M or 3% of global revenue (Art. 99). EpochCore ships you Article 12 record-keeping in days, not quarters.
From Regulation (EU) 2024/1689. The high-risk obligations are not optional — they are conditions for placing a high-risk system on the EU market.
Continuous, iterative risk identification, analysis, and mitigation across the system lifecycle. Documented.
Automatic logging of events while in operation, capable of identifying when the system poses a risk or undergoes substantial modification. Logs must be tamper-evident.
Operating instructions, characteristics, capabilities, limitations — clear, complete, and verifiable.
System designed to be effectively overseen by natural persons during use. Override mechanisms documented.
Resilience against errors, faults, inconsistencies. Cybersecurity measures resilient to attempts to alter use or performance.
Documented, including post-market monitoring, incident reporting, and (for providers) conformity assessment evidence.
Article 12 says "tamper-evident logs." Article 15 says "cybersecurity resilient to alteration." Article 17 says "documented evidence." EpochCore produces evidence supporting all three with one D-KaP envelope per agent decision.
| Article | Requirement | How EpochCore satisfies it (as a technical control) |
|---|---|---|
| Art. 12 | Automatic, tamper-evident logging while in operation | D-KaP envelope per agent output: hybrid Ed25519 + ML-DSA-65 signature, chain-anchored to a public RAS root, third-party verifier. Tamper = chain break. |
| Art. 13 | Operating instructions verifiable by deployer | Produces evidence supporting deployer-facing documentation: each envelope carries operating-context metadata (model version, policy state, agent identity). Conformity-assessment route and deployer instructions remain the provider's responsibility. |
| Art. 14 | Human oversight mechanisms documented | Produces audit evidence of human-oversight events: per-envelope policy state field records whether decision was auto-issued or human-confirmed. The oversight mechanism itself is your product responsibility; we evidence it. |
| Art. 15 | Cybersecurity resilient to alteration | Post-quantum cryptography (NIST FIPS 204 / ML-DSA-65) on every envelope. Resilient against today's threat model and forward-secure against future quantum adversaries. |
| Art. 17 | Quality management documented evidence | Audit-trail-keeper agent emits chain-anchored daily compliance digests. Conformity assessment evidence pack on demand. |
Each envelope is a JSON object containing the SHA-256 hash of the canonical decision plus a hybrid signature: Ed25519 (classical) and ML-DSA-65 (NIST FIPS 204 post-quantum, security level 3). The envelope is chained to the previous envelope on your tenant's chain and to the public RAS root 40668c787c463ca5. Verification is open at https://chain.epochcoreqcs.com/v1/verify — no SDK required, no proprietary tooling, no vendor lock.
Annual, prepaid. White-glove onboarding. Cancellation pro-rated to the end of the term where required by applicable law.
Tell us what your AI product does. We'll tell you which Articles apply and whether $39k or $99k is the right fit. No commitment.