Framework mapping

EU AI Act (Regulation 2024/1689)

Publisher. European Union

Control mappings. 23 controls

Statement date. 2026-08-03

AI Act for high risk AI systems. Etch addresses Article 12 record keeping, Article 14 human oversight, Article 15 accuracy and robustness, and Article 50 transparency obligations.

Download PDF for procurement All frameworks

Control mapping

Every row names a specific control from the framework and describes how Etch addresses it. The response prose commits to what Etch signs on the chain, not to runtime enforcement. Etch is an evidence layer.

Control ref	Control name	How Etch addresses it
`Art. 9(1)`	Risk management system	The extended governance schema records invalidation_conditions on every event. Risk management constraints are chain signed at write time.
`Art. 9(2)(a)`	Identification and analysis of risks	Session risk score and autonomy level fields record the upstream risk assessment at each event.
`Art. 10(1)`	Data and data governance	Evidence field on the governance record binds source hashes. Data governance evidence is chain signed at event level.
`Art. 10(2)(g)`	Bias identification and mitigation	Drift detection engine measures 8 dimensional drift including confidence and evidence dimensions. Bias shift over time is chain signed.
`Art. 11(1)`	Technical documentation	Model card attestation binds model_card_hash and system_prompt_hash per session. Technical documentation content is committed by hash.
`Art. 12(1)`	Record keeping (logs)	The chain is the Article 12 log. SQL layer append only triggers reject UPDATE and DELETE. Chain signed per epoch. Externally anchored.
`Art. 12(2)(a)`	Traceability across life cycle	Supersession edge event records DAG structure with intent enum. Life cycle traceability is chain signed.
`Art. 12(2)(b)`	Identification of situations for post market monitoring	Drift detection engine and corrigibility self audit identify post market anomalies. All flagged situations are chain signed.
`Art. 12(2)(c)`	Monitoring of operation	The chain records every event with governance record. Monitoring is continuous by construction.
`Art. 12(3)`	Retention (six months minimum for high risk)	Retention is operator configurable and configurable beyond the Article 12(3) minimum. Hot cold storage split supports long term archival.
`Art. 13(1)`	Transparency to users	Model card attestation and session risk score are chain signed. Transparency evidence is auditor retrievable.
`Art. 14(1)`	Human oversight	Bounded authority receipt records HITL approval as a signed subtype. Autonomy level field records L0 through L3 or custom per event. Signed dissent captures second line of defense disagreement.
`Art. 14(4)(a)`	Understanding capacities and limitations	Mission field, assumption field, and uncertainty field on the governance record chain sign the system's declared capacities and limitations.
`Art. 14(4)(b)`	Awareness of automation bias	Autonomy level field flags high autonomy events for scoped review. Corrigibility self audit flags suppression fragility.
`Art. 14(4)(d)`	Ability to intervene	Explicit stop condition endpoint records intervention. The verifier flags any post halt write.
`Art. 15(1)`	Accuracy, robustness, cybersecurity	Post quantum hybrid signing envelope (Ed25519 + SLH-DSA-SHA2-128f). External anchoring to Sigstore Rekor and Bitcoin OpenTimestamps. Adversarial benchmark public and reproducible.
`Art. 15(3)`	Cybersecurity measures	HSM attestation endpoint accepts tpm2, yubikey, aws-nitro, gcp-shielded, azure-attestation, sev-snp, intel-tdx. Signing keys never leave HSM boundary in BYOK deployments.
`Art. 16(a)`	Compliance with requirements	The custody export bundle produces a self authenticating slice aligned with FRE 902 and eIDAS regimes. Compliance evidence is auditor retrievable.
`Art. 17(1)`	Quality management system	Recoverability measurement, drift detection, corrigibility self audit all run on chain state. All quality measurements are chain signed.
`Art. 18(1)`	Automatically generated logs retention	Chain retention is operator configurable. Cold archival preserves logs beyond hot tier retention.
`Art. 19(1)`	Automatically generated logs kept	Chain signed and externally anchored. Log retention survives operator continuity assumption.
`Art. 50(1)`	Transparency of AI generated content	Model card attestation binds model_card_hash + system_prompt_hash + policy_hash per session. Artifact hash endpoint chain signs any generated output by SHA 256.
`Art. 72(1)`	Post market monitoring plan	The chain is the post market monitoring substrate. Drift detection runs on continuous chain state. Signed postmortem records retrospective assessment.