How FluxyChat maps to Regulation (EU) 2024/1689: risk classification, human oversight, transparency, and Annex IV documentation.

EU AI Act readiness

FluxyChat ships technical controls aligned with the EU Artificial Intelligence Act (Regulation 2024/1689). This is not legal advice. Pair with your counsel for formal conformity assessment.

Console: compliance hub

Open EU AI Act in the dashboard (also under Trust → EU AI Act):

Feature	What it does
Gap assessment	Automated checklist with severity (critical / high / medium)
Project settings	Provider identity, retention, disclosure and HITL enforcement toggles
Agent profiles	Intended purpose, EU risk category, Annex III domain, oversight level
Runtime enforcement	Blocks unacceptable/high-risk-without-conformity agents; forces HITL
Annex IV export	JSON technical documentation for your conformity file

Risk categories

Category	Typical FluxyChat use	Runtime behaviour
minimal	Internal FAQ bot, read-only tools	Standard logging
limited	Customer support with disclosure	AI disclosure in system prompt and message metadata
high	HR, credit, essential services (Annex III)	HITL on side-effect tools; conformity sign-off required
unacceptable	Social scoring, prohibited practices	Blocked at runtime when enforcement enabled

Document each agent's intended purpose before production. Most team-chat agents are minimal or limited.

Article mapping

Art. 9: Risk management

Per-agent profiles with intended purpose and Annex III category
Automated gap assessment (GET /admin/eu-ai-act/assessment)
Integration with AI Governance model/prompt/tool registry

Art. 10: Data governance

EU consent and DPA: banner and audit log
Data residency: pin project storage region
PII redaction via LLM middleware and room firmware

Art. 11: Technical documentation

Annex IV export: GET /admin/eu-ai-act/technical-documentation
Includes agents, models, controls matrix, provider identity
Download from dashboard Annex IV export button

Art. 12: Record-keeping

agent_runs table (tool traces, tokens, latency)
eu_ai_act_audit_log (settings changes, blocked runs, completions)
Configurable retention days in project settings (default 365)
Activities, SOC 2, OTel/Langfuse export

Art. 13: Transparency

Agent @mention and streaming agent_step events
AI disclosure suffix in system prompt for limited/high-risk agents
Message metadata: aiGenerated, aiDisclosure, euAiActRiskCategory

Art. 14: Human oversight

Tool approvals: HITL before destructive tools
Automatic HITL for high-risk agents (side_effect or all_tools mode)
Moderation console, agent queue, async decisions

Art. 15: Accuracy and robustness

Agent eval datasets and OTel export
Counterfactual replay
Agents → Observability for drift monitoring

Art. 43 / 50: Conformity and transparency to deployers

Conformity assessed checkbox on high-risk agent profiles (blocks run until set)
Provider legal name and contact in project settings
GPAI: register foundation models in AI Governance; use provider DPAs

API reference

All routes require admin JWT.

# Settings
GET  /admin/eu-ai-act/settings
PATCH /admin/eu-ai-act/settings

# Agent profiles
GET  /admin/eu-ai-act/agents
PUT  /admin/eu-ai-act/agents/{agentId}

# Assessment & documentation
GET  /admin/eu-ai-act/assessment
GET  /admin/eu-ai-act/technical-documentation
GET  /admin/eu-ai-act/audit-log?limit=100

Example: register a high-risk agent profile:

curl -X PUT "$WORKER/admin/eu-ai-act/agents/bot_hr" \
  -H "Authorization: Bearer $ADMIN_JWT" \
  -H "Content-Type: application/json" \
  -d '{
    "intendedPurpose": "Draft HR policy answers. Human reviews all outbound messages.",
    "euRiskCategory": "high",
    "annexIIICategory": "employment",
    "humanOversightLevel": "human_in_loop",
    "hitlMode": "all_tools",
    "requiresDisclosure": true,
    "conformityAssessed": true
  }'

Operator checklist (before go-live)

Set provider legal name and contact in EU AI Act settings.
Inventory every agent: purpose, risk category, model ID.
Register models in AI Governance registry.
Enable tool approvals / HITL for high-risk agents.
Turn on EU consent and data residency if you have EU users.
Enable moderation and audit logging for customer-facing rooms.
Run gap assessment. Resolve all critical and high items.
Export Annex IV documentation and store with your conformity file.
Mark conformity assessed only after internal/legal review.
Configure OTel/Langfuse for incident review.

What FluxyChat cannot do for you

These remain organizational and legal obligations:

Formal conformity assessment body involvement (if required for your use case)
EU database registration as provider/deployer where applicable
Written human oversight policy signed by management
Fundamental rights impact assessment (FRIA) for high-risk public-sector deployers
Training data documentation for custom fine-tuned models

EU AI Act readiness

On this page