EU AI Act — Article Mapping¶

The EU Artificial Intelligence Act (Regulation EU 2024/1689) entered into force on 1 August 2024. This page maps each relevant article to the specific Geodesia G-1 feature or API that satisfies it.

Applicability¶

If you are deploying an AI system that falls under Annex III of the EU AI Act — which includes systems used in education, employment, essential services, law enforcement, biometrics, migration, or the administration of justice — you are a deployer of a high-risk AI system and are subject to Articles 25–30 and 70–73.

If you are simply embedding a general-purpose LLM (like Mistral or Gemma) into a product, the obligations depend on whether the specific application meets Annex III criteria.

Geodesia G-1 was built assuming the most demanding scenario: Annex III high-risk deployment.

Chapter-by-Chapter Coverage¶

Chapter II — Prohibited AI Practices (Articles 5–6)¶

Article 5 prohibits certain AI applications (social scoring, real-time biometric surveillance in public spaces, subliminal manipulation). Geodesia G-1 does not facilitate these use cases. The jailbreak detection axis (jailbreak) can help prevent your system from being used to attempt such applications.

Chapter III — High-Risk AI Systems¶

Article 9 — Risk Management System¶

Deployers must establish a risk management system throughout the AI lifecycle.

Requirement	Geodesia G-1 Feature
Identify and analyze known and foreseeable risks	Detection axes — nine-axis risk monitoring
Evaluate risks from deployment context	FRIA — deployment context section
Implement risk management measures	Thresholds — configurable detection thresholds
Testing with real-world data	Human oversight decisions — ground-truth feedback loop

Article 10 — Data and Data Governance¶

Data used to train and test the AI system must meet quality criteria.

Geodesia G-1 does not train models in production. For custom fine-tuning workflows, the system logs all training-related operations. The detection engine's input data (user prompts and context) is logged in the audit chain for governance review.

Article 11 — Technical Documentation¶

Providers must maintain technical documentation before market placement.

The Deployer Manual (POST /v1/glad/deployer-manual) generates Article 13/11-compliant documentation automatically from the live system configuration.

Article 12 — Record-Keeping¶

High-risk AI systems must log automatically to enable post-market monitoring.

Requirement	Geodesia G-1 Feature
Automatic logging	Every inference call written to the database automatically
Log integrity	HMAC audit chain — tamper-evident
Log retention	Retention policy — configurable per data type
Log accessibility	`GET /v1/glad/chain/status` (ledger snapshot) + `GET /v1/glad/apps/{app_id}/export` (full per-call export)

Article 13 — Transparency and Provision of Information¶

High-risk AI systems must be transparent to deployers.

Requirement	Geodesia G-1 Feature
Clear instructions for use	`POST /v1/glad/deployer-manual`
Capabilities and limitations	Deployer manual — limitations section
AI-generated content disclosure	Watermark — latent watermark + logged manifest label
Provider identity	`GET /v1/glad/provider-identity`

Article 14 — Human Oversight¶

High-risk AI systems must have human oversight capabilities.

Requirement	Geodesia G-1 Feature
Ability to interrupt the system	Kill Switch — immediate suspension
Ability to override outputs	`POST /v1/glad/oversight/decide` with `decision: "overridden_allow"`
Monitoring for anomalies	Dashboard — real-time metrics
Human interpretation of outputs	Explainability — per-token attribution
Escalation chain	Oversight — tiered escalation

Chapter V — General-Purpose AI Models (Articles 51–56)¶

If you are using a general-purpose AI model (GPAI) such as a public LLM, you are a deployer and must comply with the GPAI provisions. Geodesia G-1 provides:

Watermarking for synthetic content (Art. 50)
Monitoring and logging (Art. 72)
Incident reporting infrastructure (Art. 73)

Chapter VI — Measures in Support of Innovation¶

No restrictions from Geodesia G-1's side. The system supports regulatory sandboxes by providing complete audit trails that can be submitted to national authorities.

Chapter VII — Governance (Articles 57–75)¶

Article 50 — Transparency Obligations for Certain AI Systems¶

AI-generated content must be disclosed.

Geodesia G-1 satisfies this with: - Latent watermark — an HMAC-SHA256 record logged for every answer the gateway returns, verifiable at POST /v1/glad/watermark/verify (by text, or by call_id + watermark_id) - Manifest label — each watermark record carries the AI-GENERATED CONTENT label and the applicable laws

The chat API response itself carries no watermark or disclosure field. Informing end users that they are interacting with AI, or that content is AI-generated, is done in the deployer's own interface.

Article 72 — Post-Market Monitoring¶

Providers and deployers must establish post-market monitoring systems.

Requirement	Geodesia G-1 Feature
Continuous monitoring	Dashboard — real-time detection statistics
Serious incident detection	Human oversight — anomaly escalation
Performance tracking	`GET /v1/glad/scorecard` — per-framework compliance tracking

Article 73 — Reporting of Serious Incidents¶

Providers must report serious incidents to national authorities within 15 days.

Geodesia G-1 does not automatically submit to authorities (no access to national authority endpoints). However: - All serious incidents are flagged in the audit chain - The compliance report can be generated on demand for incident submission - The POST /v1/glad/report endpoint generates the required technical documentation

Article 26 — Obligations of Deployers¶

Deployers must use AI systems in accordance with instructions and maintain human oversight.

Obligation	Geodesia G-1 Support
Use only for intended purpose	`purpose` field in FRIA; deployer manual
Monitor operation	Dashboard + scorecard
Maintain oversight	Oversight queue + escalation chain
Report malfunctions	Incident log via audit chain
Inform provider of serious risks	Notification configuration

Article 27 — FRIA¶

Deployers of high-risk AI systems in certain domains must conduct a FRIA before deployment.

Full FRIA lifecycle: FRIA documentation.

POST /v1/glad/fria          → create
PUT /v1/glad/fria/{id}      → edit
POST /v1/glad/fria/{id}/approve  → approve
GET /v1/glad/fria/{id}/export?fmt=pdf  → export

Quick Compliance Checklist¶

Use this checklist before going to production with a high-risk AI system: