EU AI Act Compliance Checklist for AI Agents
An EU AI Act checklist is only useful if each line maps to something the runtime actually enforces and records. This guide turns the high-risk obligation areas into questions you can answer with deterministic controls and verifiable evidence rather than policy language alone. It does not provide legal advice, and SovereignClaw does not replace the compliance work your organization owns.
- Treat each high-risk obligation as a control plus an evidence requirement, not a document.
- Runtime authorization, approval gates, and signed receipts give checklist items something to point at.
- SovereignClaw helps operationalize these obligations but does not determine your legal classification.
Why a checklist needs runtime backing
Most EU AI Act checklists read as a list of obligation areas: risk management, data governance, technical documentation, record-keeping, transparency, human oversight, accuracy, robustness, and cybersecurity. The hard part is not listing them. It is showing, for an autonomous agent that can take real actions, that each obligation is met at the moment an action would execute rather than only described in a policy binder.
SovereignClaw is an AI agent runtime governance platform built on a single thesis: the model is untrusted input, and execution is gated. That posture makes a checklist answerable, because every governed action passes through canonicalization into a byte-stable SovereignIR, independent fact inference, deterministic policy evaluation, risk-tier classification, authorization, and bound execution that emits a signed Authority Receipt. Each checklist line can then map to a stage that produces evidence.
- Risk management maps to risk-tier classification (T0 observe through T3 sovereign).
- Record-keeping maps to the append-only Merkle ledger of Authority Receipts.
- Human oversight maps to T2/T3 threshold approval gates.
- Cybersecurity maps to Ed25519 signing and SHA3-256 canonical hashing.
Turning obligations into answerable questions
Rewrite each obligation as a question your runtime can answer with an artifact. For data governance, the question becomes: can you show which facts drove the risk decision, and that those facts were derived from operation semantics rather than supplied by the model? In SovereignClaw, independent fact inference handles exactly this, and LLM-supplied facts are never trusted, so mismatches escalate risk instead of silently passing.
For transparency and record-keeping, the question becomes: for a given action, can you produce a portable record of the intent hash, policy version, decision and rationale, risk tier, approval state, adapter identity, tenant scope, and execution outcome? That is the field set of an Authority Receipt, which is externally verifiable without private keys because the ledger is a Merkle structure.
The checklist, line by line
Work through each item and record where the control lives and what it emits. The goal is to make every obligation point at a stage of the execution path and a concrete artifact, so an assessor can follow the chain from intent to outcome.
Where SovereignClaw provides evidence for an obligation, it still sits inside your broader programme. Classification, conformity assessment, and documentation of intended purpose remain your organization's responsibility, and this checklist supports that work rather than substituting for it.
- Risk management: is every action assigned a tier, and are escalations logged?
- Human oversight: do elevated and sovereign actions require quorum approval before execution?
- Accuracy and robustness: are identical intents canonicalized to identical hashes and replays rejected?
- Cybersecurity: are receipts signed and is the ledger append-only and externally verifiable?
Closing the gaps the checklist exposes
A good checklist surfaces gaps. The common ones for agentic systems are missing evidence after a decision, no enforced human approval for high-impact actions, and reliance on model-supplied justification for risk. Each of these is a structural gap, not a documentation gap, and SovereignClaw closes them by giving unauthorized actions no execution path at all rather than blocking them after the fact.
For the formal grounding behind these controls, the nine security properties are independently described, and the runtime is verified across twenty Rust crates with more than 829 tests. Use the architecture and security pages as the technical companions to this checklist.
Next step
This guide is meant to help with evaluation, not replace the product-specific review. If this topic matches an active project, connect it back to the relevant product page and then decide whether you need an evaluation discussion.