EU AI Act assessment
Article 26 of Regulation (EU) 2024/1689 sets duties for organizations that deploy high-risk AI systems. VeriProof saves an assessment for four of them, so you can see what an application recorded and what your organization still needs to show.
A saved assessment is not a conformity assessment. Your organization decides whether its AI system is high-risk, which role it holds, and when each obligation applies.
What the assessment covers
| Obligation | Recorded application facts | Organization evidence |
|---|---|---|
| Article 26(1): Use in line with the instructions for use | Active policy rules and declared data classifications | The provider’s instructions for use and the measures that keep use within them |
| Article 26(2): Human oversight assignment | Current access grants and attributed actors | Oversight assignments, training records, and the authority of the people assigned |
| Article 26(5): Monitoring operation and reporting risks | Verified activity records, active rules, and rule checks | Monitoring procedure, escalation and reporting records, and any decision to suspend use |
| Article 26(6): Keeping automatically generated logs | Verified activity records and archive digests | Log retention determination and its period |
The regulation asks deployers to keep logs for at least six months unless other law provides otherwise. Your retention determination records the period you apply.
Every obligation also needs an applicability decision. It records your classification of the system as high-risk, your role as deployer, and the date the obligation applies. VeriProof does not infer these from the framework you assigned, session volume, or the application’s risk tier.
Provider obligations in Articles 9 to 17, and the other paragraphs of Article 26, are not part of the assessment.
Review a saved assessment
Open the application
Open the application, then select Compliance. EU AI Act must be one of the application’s frameworks.
Select the assessment period
Choose the dates to review. The assessment uses activity that started in that period.
Open the EU AI Act assessment
Select Review EU AI Act assessment. Each obligation lists its recorded facts, what is missing, and the next step.
Add organization evidence
Select Organization evidence. An Administrator or Compliance Officer adds a PDF for an obligation and requests a review. A reviewer approves or rejects it. The applicability decision is reviewed separately.
Export the assessment
Download the assessment record or send the EU AI Act evidence summary to a connected GRC platform such as Vanta or ComplyAssistant. Verify the archive before you deliver it.
Requirement states
Each requirement shows one state, so you can see who acts next.
| State | What it means |
|---|---|
| Organization evidence needed | No evidence is approved yet. Add a PDF and request a review. |
| Evidence awaiting approval | A reviewer approves or rejects the submitted evidence, then VeriProof reassesses the requirement. |
| Accountable review needed | A recorded review is waiting for an accountable reviewer to approve or reject it. |
| Met | The organization evidence has a current approval. |
| Not assessed for these dates | The requirement has no result for the selected dates. Run an assessment for them. |
| Observations only | VeriProof summarizes recorded activity for the framework but does not assess the requirement. |
Partially met, Not met, and Contradicted by recorded activity are decided results. Open the requirement to see the evidence behind them.
Resolve rule problems
When an application has no active rule, or its rule checks fail, VeriProof opens one work item for that problem. The HIPAA, ISO/IEC 42001, EU AI Act, and SOC 2 assessments share it, so you resolve it once.
Related guides
These guides map VeriProof records to risk, data, documentation, and quality-management activities outside the saved assessment.