What is the EU AI Act?

Regulation (EU) 2024/1689 — the EU framework for AI systems, including requirements for systems that may be high-risk. It creates ongoing obligations around risk management, documentation, logging, oversight, and post-market monitoring. This page describes operational evidence readiness, not legal advice.

Which AI systems may be high-risk?

Annex III lists categories that may be treated as high-risk — including employment, credit, healthcare, education, and critical infrastructure. Whether your system qualifies depends on facts and role; counsel should confirm classification.

Does Guardian make us compliant?

No. Guardian helps teams preserve operational evidence that can support EU AI Act readiness and auditability workflows. Legal compliance is a separate determination requiring qualified review.

What evidence should teams prepare?

Typically: risk measures, data governance records, technical documentation, logging, oversight procedures, post-deployment monitoring baselines, and incident trails — maintained continuously, not assembled only when review begins.

How does Guardian support EU AI Act readiness?

By linking production signals, incidents, oversight actions, and exportable records in one governed dossier above the monitoring you already run — designed for teams preparing for high-risk AI obligations.

Why start with one system?

One in-scope system is easier to approve, faster to operationalise, and the only way to build a credible evidence baseline before scaling. Most readiness gaps appear after go-live, when evidence fragments across tools and teams.

Book a pilot discussion

Regulatory readiness map · Evidence operating model

EU AI Act readiness

High-risk AI obligations create a proof burden.

Guardian helps risk, compliance, AI governance, and ML platform teams preserve the operational evidence behind high-risk AI systems, without replacing legal review or conformity assessment.

Book a readiness call View methodology

Readiness Sprint Product Post-market monitoring

Proof burden memo

Policies are not enough

The EU AI Act does not only ask for policies. It asks teams to show how systems were governed, monitored, reviewed, documented, and corrected over time. Most readiness gaps appear after deployment — when monitoring, incident handling, and evidence maintenance are not yet part of day-to-day operations.

Preserve what happened. Reconstruct what matters. Export what you can defend.

Guardian is the evidence operating model for that work — linking operational signals, human oversight, policy mapping, a traceable evidence trail, and export-ready records above the tools you already run.

Obligation → evidence map

Readiness register

Illustrative map for one in-scope system. Counsel confirms your specific obligations.

EU AI Act readiness map · MAP-001REF · GRD-EUA-MAP

Obligation area	What teams may need to show	Evidence Guardian helps preserve	Source systems	Readiness state
Risk management	Risk measures, review triggers, follow-up	Threshold events, risk reviews, escalations	Monitoring, ticketing	Linked
Data governance	Data quality, lineage, governance decisions	Quality metrics, drift signals, notes	MLOps, data platform	Active
Technical documentation	System description tied to production	Versioned docs linked to runs and changes	Model registry, change logs	Open
Logging and traceability	Who did what, when, on which output	Timestamped intake, custody trail	API intake, webhooks	Linked
Human oversight	Oversight procedures and interventions	Reviewer sign-off, escalation history	Review workflow, incidents	Active
Accuracy, robustness, and cybersecurity	Performance and resilience in operation	Metrics, robustness tests, security events	Observability, security tooling	Open
Post-market monitoring	Ongoing behaviour after deployment	Baselines, alert history, review outcomes	Monitoring, Guardian dossier	Verified
Serious incident evidence	Documentation when serious incidents occur	Incident register, remediation, notification	Ticketing, incident workflow	Active

8 obligation areas · illustrative · not a legal checklist

Evidence operating model

What Guardian preserves

Six record types that form the dossier for one in-scope system — not a dashboard screenshot.

ID	Record	What it holds	Status
EVP-01	AI System Record	In-scope system identity, owners, and operating context	Core
EVP-02	Version Record	Model, policy, and configuration versions linked to production	Core
EVP-03	Evidence Events	Captured signals with source, timestamp, and normalized payload	Active
EVP-04	Human Review	Oversight actions, sign-off, and reviewer identity	Active
EVP-05	Incident + Corrective Action	Open items, root cause, remediation, and resolution trail	Linked
EVP-06	Register-backed Export + Retention	Point-in-time evidence packet with retention boundary	Verified

Supporting objects

Policies · Owners · Source Connectors — linked across every record type above.

From obligation to dossier

Evidence workflow

ID	Step	Output
MAP-01	Identify obligation	Obligation area mapped to in-scope system
MAP-02	Map evidence source	Source systems and intake channels registered
MAP-03	Capture operational signal	Event received with timestamp and source ID
MAP-04	Link owner and policy	Custody handler and policy reference attached
MAP-05	Review and preserve custody	Review actions and transfers recorded
MAP-06	Export evidence packet	Reconstructable bundle for review

Scope boundaries

What Guardian does not do

Guardian does not provide legal advice.
Guardian does not decide whether a system is legally high-risk.
Guardian does not certify compliance.
Guardian does not replace conformity assessment.
Guardian does not replace existing MLOps, monitoring, ticketing, GRC, or legal tools.

Common questions

EU AI Act essentials

What is the EU AI Act?: Regulation (EU) 2024/1689 — the EU framework for AI systems, including requirements for systems that may be high-risk. It creates ongoing obligations around risk management, documentation, logging, oversight, and post-market monitoring. This page describes operational evidence readiness, not legal advice.
Which AI systems may be high-risk?: Annex III lists categories that may be treated as high-risk — including employment, credit, healthcare, education, and critical infrastructure. Whether your system qualifies depends on facts and role; counsel should confirm classification.
Does Guardian make us compliant?: No. Guardian helps teams preserve operational evidence that can support EU AI Act readiness and auditability workflows. Legal compliance is a separate determination requiring qualified review.
What evidence should teams prepare?: Typically: risk measures, data governance records, technical documentation, logging, oversight procedures, post-deployment monitoring baselines, and incident trails — maintained continuously, not assembled only when review begins.
How does Guardian support EU AI Act readiness?: By linking production signals, incidents, oversight actions, and exportable records in one governed dossier above the monitoring you already run — designed for teams preparing for high-risk AI obligations.
Why start with one system?: One in-scope system is easier to approve, faster to operationalise, and the only way to build a credible evidence baseline before scaling. Most readiness gaps appear after go-live, when evidence fragments across tools and teams.

Sources

Official references

Guardian supports evidence readiness and auditability workflows. It does not provide legal advice, determine legal classification, certify compliance, or replace sector-specific conformity assessment.

Start with one system

Build a first evidence baseline through the Readiness Sprint, then run the operating model in Guardian.

Book a readiness call View methodology

Readiness map FAQ