The EU AI Act classifies AI systems by the risk they pose. Before reviewing the article-by-article controls, it helps to know that classification depends on how each organization uses AI — and why that matters for labs operating in or selling to the EU.
Art. 9
Risk Management System
Requires a continuous, documented risk management process covering identification, analysis, and mitigation of known and foreseeable risks throughout the AI system's lifecycle.
AILS
The Risk Assessment module maintains a live risk register with assigned mitigations and status tracking. The AI Risk Scorer on batch release decisions logs every scoring event with the data inputs, model used, and human override record. Risk register exports are available for regulatory submission.
Art. 10
Data & Data Governance
Training, validation, and testing data must meet quality criteria. Data governance practices must be documented, and data provenance must be traceable.
AILS
All AI agents in AILS operate on your live tenant data — no external training corpus. Data inputs to every AI decision are logged with source record IDs, enabling full provenance tracing from AI output back to the originating lab record. Per-tenant database isolation means no cross-contamination of training context.
Art. 11
Technical Documentation
Detailed technical documentation must be maintained before market placement and kept current throughout the lifecycle — covering system design, capabilities, limitations, and performance metrics.
AILS
The AILS Architecture documentation, Vendor Validation Package (IQ/OQ/PQ), and System Test Agent reports collectively satisfy the Article 11 technical documentation requirement. All are generated from live system state and downloadable from your Compliance module.
Art. 12
Record Keeping & Logging
High-risk AI systems must automatically log events throughout operation to enable post-incident traceability. Logs must be retained for a period appropriate to the system's intended use.
AILS
Every AI agent invocation is logged with: user ID, timestamp, model version, prompt context, and structured output. Logs are immutable, append-only, and retained for 5 years by default. The audit trail is exportable as PDF for regulatory submissions and is searchable by event type, user, or record.
Art. 13
Transparency & Provision of Information
Deployers must be provided with clear, adequate information to understand the system's capabilities and limitations and to use it as intended.
AILS
Each AI agent in AILS has a defined scope statement visible to users, a confidence indicator where applicable, and an explicit disclaimer where AI outputs require human review before acting. The onboarding flow documents intended use, out-of-scope uses, and model limitations for each agent.
Art. 14
Human Oversight
High-risk AI systems must be designed to allow natural persons to effectively oversee functioning, intervene, and override outputs. AI decisions must not be automatically implemented without a human in the loop for consequential actions.
AILS
No AI agent in AILS takes a consequential action autonomously. COA issuance, batch release, CAPA closure, and SOP approval all require an authenticated human signature. AI outputs are recommendations — QA controls the final action. Re-authentication is required before every critical signing event, not just session login.
Art. 15
Accuracy, Robustness & Cybersecurity
High-risk AI systems must achieve appropriate levels of accuracy and must be resilient against errors, faults, and adversarial interference throughout their lifecycle.
AILS
The System Test Agent runs 1232 automated tests — including negative-path security checks, injection resistance tests, and boundary condition tests — and publishes a timestamped health report. Current score: 100/100. AES-256 encryption, account lockout, token rotation, and tamper-evident hashing are enforced at the infrastructure layer.
Art. 17
Quality Management System
Providers of high-risk AI systems must put in place a quality management system covering design, development, testing, deployment, and post-market monitoring.
AILS
AILS ships with a 10-module QMS: CAPA, Deviations, SOPs, Management Reviews, Proficiency Testing, Training Records, Risk Assessments, Audit Logs, Equipment, and Disclaimers. The platform's own operations run on this QMS — making it a live demonstration of the Article 17 requirement, not a policy on paper.