EU AI Act Compliance for AI Agents

The EU AI Act is enforced. Article 50 transparency obligations took effect on 2 August 2026. Article 12 logging requirements apply to all high-risk AI systems, including banking, insurance, healthcare, and critical infrastructure.

What regulators require

Article 12: Logging and traceability

High-risk AI systems must maintain automatic logging of events throughout their lifetime. Logs must capture inputs, outputs, timestamps, model versions, and human interventions. They must be sufficient to reconstruct why the AI made a specific decision. Retention: at least 6 months, up to 10 years for high-risk systems. Standard database logs fail compliance because records can be silently altered.

Article 50: Transparency

AI-generated content must be clearly marked and detectable. People interacting with AI systems must be informed. Deployers of AI systems must disclose when AI is making decisions.

The biggest compliance gap

The most common compliance gap in enterprise AI: AI accesses regulated data under a service account or API key with no log records of which individual agent directed the access. GDPR, HIPAA, SOX, and the EU AI Act all require individual attribution that service account logging cannot provide.

How AgentPass delivers compliance

• Individual attribution: Every AI agent has its own X.509 certificate with a unique serial number. No shared API keys. No service accounts. Every action traceable to a specific agent instance.
• Tamper-evident logging: SHA-256 hash-chained evidence ledger. Every entry links to the previous entry via its hash. Change any entry and every subsequent hash breaks. Standard databases fail this requirement. AgentPass passes it by design.
• Decision reconstruction: Every inference signed with input hash, output hash, timestamp, model version, and agent identity. Regulators can reconstruct exactly what the AI saw and decided.
• Cryptographic proof: Every action ECDSA P-256 signed by the agent's private key. Verifiable against the certificate issued by the AgentPass CA. Non-repudiable.
• Retention: Evidence ledger exportable, hash-chained, signed. Suitable for 10-year retention. Backed by PostgreSQL with automated backups.
• Revocation: CRL (Certificate Revocation List) per RFC 5280. Revoke an agent instantly. Publicly verifiable at /api/ca/crl.der.

Standards alignment

• EU AI Act Articles 12, 13, 50
• eIDAS 2.0 digital identity framework
• RFC 5280 X.509 certificate standard
• FIPS 186-5 ECDSA digital signatures
• FIPS 140-2 Level 3 HSM key protection
• SPIFFE v1.0 workload identity
• OWASP AISVS 1.0 (co-authored by CyberSecAI)
• IETF Internet-Drafts: MCPS, X.509 Agent Identity Profile, Agent PKI

Start today

Article 12 and Article 50 are already enforced. Free agent certificates via API. One integration. Full compliance.

See it in action