Where Automatos stands against the Act's obligations, article by article. We mark each one as in the product today, partly there, or on the roadmap, and we only say “in the product” where the code backs it. Automatos is not certified: no notified body certifies most AI Act categories yet.
The pieces a deployer can use now to meet their own obligations.
Actions that spend money, publish or change things outside the workspace wait for a person. Approvals are granted, denied or revoked from one inbox, a mission's plan is approved before it runs, and missions and agents can be paused.
Each gated tool action is classified as read, internal write, publish, external side effect or destructive, and mapped to an oversight tier: monitored, human on the loop, or human approval required. Every approval card shows the tier and why. This is our oversight scheme, not the Annex III classification.
Audit and orchestration events are append-only, and a hard floor keeps them for at least 180 days. They are not yet cryptographically tamper-evident.
A mission's task outputs are verified automatically against the task's success criteria before the work moves on.
Export a workspace's data as one bundle, or erase the whole workspace. Erasing a data subject removes their memories and reports exactly what could not be removed, rather than hiding the gaps.
Document and vector storage runs on AWS in Ireland (eu-west-1) today. Models run with the provider you choose; bring your own key to control where inference happens.
The Act's core obligations and where Automatos is on each. Reviewed as the product and the European AI Office's guidance change.
| Article | Obligation | Where Automatos is | Status |
|---|---|---|---|
| Art. 5 | Prohibited practices | A platform-wide filter for prohibited practices (social scoring, manipulation, biometric categorisation) is planned. Today deployers must not configure prohibited uses. | Roadmap |
| Art. 6 + Annex III | High-risk classification | Risk classes and oversight tiers on every gated action. An Annex III tier per agent and mission is planned. | Partly |
| Art. 9 | Risk management | Automatic verification of task outputs. An auditor-facing posture view is planned. | Partly |
| Art. 10 | Data governance | Provenance tracking for retrieval corpora is planned. | Roadmap |
| Art. 12 | Record-keeping | Append-only audit logs with a 180-day floor. Tamper evidence and longer retention for high-risk use are planned. | Partly |
| Art. 13 | Transparency to deployers | Generated agent cards (capabilities, limits, oversight needs) are planned. | Roadmap |
| Art. 14 | Human oversight | Grant, deny and revoke approvals, mission approval and pause. The policy plane that enforces the tiers ships switched off and says so; a workspace turns it on. | In product |
| Art. 15 | Accuracy and robustness | Output verification. Adversarial robustness testing is planned. | Partly |
| Art. 43 | Conformity assessment support | A platform-level Annex IV technical-documentation draft. Per-agent documentation and export are planned. | Partly |
| Art. 50 | Transparency to end users | A built-in AI-interaction notice for chat, voice and widgets is planned. Until then, add the disclosure in your own copy. | Roadmap |
| Art. 53–55 | General-purpose AI models | These obligations sit with the model providers. Showing their disclosures in the model catalogue is planned. | Roadmap |
| Art. 73 | Serious incident reporting | An incident-reporting workflow is planned. | Roadmap |
The Act splits responsibilities between the provider of an AI system and the deployer who uses it. Automatos provides the platform; the business running agents on it is usually the deployer.
| From | What applies | Note | |
|---|---|---|---|
| 1 Aug 2024 | The Act enters into force | Obligations then phase in. | |
| 2 Feb 2025 | Prohibited practices banned; AI literacy | Articles 4 and 5. | |
| 2 Aug 2025 | General-purpose AI model rules | Articles 53–55, for model providers. | |
| 2 Aug 2026 | Most high-risk obligations | The EU has proposed moving some high-risk deadlines: check current guidance. | |
| 2 Aug 2027 | High-risk AI in regulated products | Annex I systems. |
No, and nobody is yet for most categories: no notified certification body exists for them. This page shows what the platform does today and what's planned, so you can judge for yourself.
Not on its own. Compliance depends on your use case and how you configure it. Automatos gives you human-oversight tooling and audit logs today; several obligations above are still on our roadmap, so plan for them with your counsel.
Automatos provides the platform. The business that builds and runs agents on it is usually the deployer of the resulting AI system, and carries the deployer obligations for its use case.
High-risk uses (HR screening, credit scoring, critical infrastructure, education, law enforcement and others) carry the full Chapter III obligations. Several of the platform pieces they need are on our roadmap today. Talk to us and to your own legal counsel before deploying.
The AI Act and GDPR are separate. For GDPR, Automatos has workspace export, workspace erasure and data-subject erasure for memories, and our Privacy Policy applies.
Document and vector storage runs on AWS in Ireland (eu-west-1) today. That's our current deployment, not a contractual residency guarantee. Inference runs with the model provider you choose.
Five questions give you an indicative risk tier, the articles to review and an obligations checklist. It runs in your browser; nothing is sent.
Last reviewed 8 October 2026. This page describes what the Automatos platform does and plans to do. It is not legal advice; deployers remain responsible for their own compliance with the EU AI Act and national law. Questions: contact us.