Detection under the EU AI Act is crowd-initiated: a complaint, a whistleblower report,
or a downstream-provider claim can start a case. The question is no longer whether a
regulator finds you, it is what you produce when someone opens one. The three channels,
correctly scoped, and what a hollow log looks like next to a complete, exportable
decision record.
From 2 August 2026, Article 50 binds. When an AI agent interacts with a person, the
system must disclose what it is and on whose behalf it acts. Here is the obligation,
the Commission's guidance on agents, and the Cited Decision Standard for the
runtime enforcement audit trail: hash and timestamp on every decision, tamper-evident export on Enterprise;
legal citation when a rule fires; regulator-readable export.
We sell runtime checks for the EU AI Act and we build with AI. The two-minute inspection a technical buyer
can run from the public repo: reproducible benchmark, tamper-evident audit chain, and how
we govern our own AI-assisted development, without taking our word for anything.
Google and Meta lead at 83.3%; xAI trails at 16.7%. Industry average 53.0% on public documentation
across six GPAI obligation categories: open leaderboard, reproducible from provider evidence files.
Most AI guardrails use an LLM-as-judge pattern. That works as a content filter: it does not work as compliance.
We put OPA/Rego on the hot path and the LLM on the long tail. Here is why the order matters.