EU AI Act evidence for a high-risk ADK agent
Carry Article 9 risk-management and logging evidence for a Vertex AI agent through the GPAI Code of Practice deadline.
For: AI governance leads shipping into the EU
The regulated problem
A Vertex AI agent classified high-risk under the EU AI Act needs a risk-management system (Article 9) and automatic event logging (Article 12) — with evidence an auditor can reconcile before the GPAI Code of Practice becomes enforceable on 2 August 2026. Most teams have a Notion page mirroring the Act, not executable controls.
How Regulus handles it
Executable risk-management, not a policy PDF
The EU AI Act regulation profile composes into the resolved runtime policy. The policy plugin evaluates every tool call against it at the ADK BeforeToolCallback boundary, so the risk-management system is code that runs — not a document that describes intent.
Article 12 logging as a hash-chained envelope
Every state-changing tool call emits an append-only, hash-chained audit envelope carrying the verbatim clause (EU AI Act Art. 9), the resolved jurisdiction, and the framework citation — verifiable offline with `regulus audit verify`.
Framework-mapped evidence for the auditor
The governance-evidence plugin routes signed envelopes to your GRC tool (ServiceNow IRM, OneTrust, MetricStream), each mapped to the NIST AI RMF and ISO/IEC 42001 controls the Act's conformity assessment expects.
Regulus is the open-source EU + UK compliance plane for Google ADK, a project by Neul Labs.