S9.01 - EU_AI_Act

S9.01 ? EU AI Act

flowchart LR
    A[EU AI Act background:
risk-based governance, transparency, oversight, documentation] --> B[RAIDT
run-level evidence framework]
    X[Practical fields:
task purpose, risk rationale, model version, prompt template, human review, logging, escalation] --> C[[EU AI Act
as operational governance driver]]
    B --> C
    C --> D[Run-level evidence pack]
    C --> E[RAIDT score profile]
    D --> F[Reviewer reconstruction
and contestability]
    E --> G[Governance readiness
audit, assurance, policy alignment]
    C --> H[Organisational learning
and post-market monitoring]

? Star S9 - Policy, Standards and Assurance

Star context: Connects RAIDT to statutory and policy instruments that shape documentation, assurance, procurement, audit, incident response, and organisational accountability for generative AI use.

Academic picture

Definition / background

The EU AI Act is a statutory regulatory framework that structures AI governance around differentiated levels of risk, documentation, transparency, accountability, and oversight. In broad terms, it aims to move AI governance beyond voluntary principles by defining legal expectations for how AI systems are developed, placed on the market, deployed, monitored, and, where necessary, restricted. For organisations using generative AI, the importance of the Act is not limited to legal interpretation; it is equally about what kinds of evidence must exist if use is to be justified, reviewed, and defended.

Within the RAIDT project, the EU AI Act matters because it provides a concrete policy environment in which claims about responsible AI must be translated into inspectable organisational practice. RAIDT does not replace the Act, and it does not itself determine legal compliance. Instead, it provides a run-level evidence logic that helps organisations connect broad duties such as documentation, human oversight, traceability, and risk management to specific uses of GenAI in work settings.

This note therefore treats the EU AI Act as more than a background law. It is a governance reference point for deciding what should be documented at run level, what should be reviewable after the fact, and what should be included in an evidence pack when an organisation wants to demonstrate responsible use. That makes it especially relevant to RAIDT's core outputs: the run-level evidence pack and the five-pillar score profile across Responsibility, Auditability, Interpretability, Dependability, and Traceability.

The concept also differs from softer governance terms such as principles, ethics statements, or internal policy aspirations. Those may express what good AI governance should look like; the EU AI Act sharpens the question into what must be operationally evidenced, governed, monitored, and defended in real organisational settings. RAIDT belongs here because it addresses the gap between regulatory expectation and practical run-level evidence.

Why this concept matters

The EU AI Act matters because organisations often know that they face governance duties, but they struggle to show how those duties connect to actual AI use in context. Policies may exist at board level, procurement teams may ask for assurances, and technical teams may maintain system logs, yet none of this necessarily explains what happened in a specific run, why a particular prompt or model was used, who reviewed the output, or what evidence exists if a decision is later challenged.

Without a structure like RAIDT, there is a risk that organisations respond to regulation with generic statements, static documentation, or one-off approvals that are too distant from real usage. That creates confusion between nominal compliance and operational accountability. It also weakens contestability, because reviewers may be unable to reconstruct whether an output was appropriately generated, checked, escalated, or corrected.

For GenAI governance, the value of the EU AI Act in RAIDT is that it provides a reason to make evidence collection systematic rather than optional. It encourages governance that is demonstrable, reviewable, and capable of improvement over time. In this sense, the Act helps push organisations from principle-led aspiration toward evidence-led operational governance.

Key idea: The EU AI Act matters in RAIDT because it turns responsible AI from a general promise into a demand for inspectable, run-level governance evidence.

What this item controls

It controls how broad regulatory duties are translated into concrete run-level evidence requirements.
It controls the expectation that AI use should be supported by documentation rather than informal trust in the tool or user.
It controls the place of human oversight by requiring organisations to specify where review, intervention, and escalation occur.
It controls the need for traceable records that allow later reconstruction of a run and its governance context.
It controls how risk classification and use-context reasoning inform what evidence should be captured.
It controls the connection between operational practice and wider assurance activities such as procurement, audit, incident response, and post-market monitoring.

Practical example / likely audience question

Audience question

Does RAIDT make an organisation compliant with the EU AI Act, or is it only an internal documentation tool?

Answer

The concern behind this question is a common one: people often assume that if an organisation has a governance framework, that framework itself guarantees legal compliance. RAIDT should not be presented that way. The direct answer is that RAIDT does not by itself make an organisation compliant with the EU AI Act. Compliance depends on the legal classification of the use case, the role of the organisation, the system characteristics, the relevant obligations, and how those obligations are actually discharged in practice.

What RAIDT does provide is a much stronger operational basis for demonstrating that governance duties have been taken seriously and translated into evidence. For example, if a team uses a GenAI system to support drafting eligibility assessments, RAIDT can require the capture of task purpose, model version, prompt template, user role, sensitivity of input data, human review checkpoint, exceptions, and escalation notes. That evidence does not replace legal analysis, but it gives auditors, managers, and reviewers something concrete to inspect.

This is where RAIDT improves on a generic AI governance approach. Generic governance often stops at policies, principles, or broad workflow diagrams. RAIDT asks what happened in this run, what evidence exists, and whether that evidence supports accountability, reviewability, and learning. In regulatory terms, that is much closer to the operational reality that the EU AI Act demands.

Practical example in RAIDT terms

A public service organisation uses a generative AI assistant to help staff draft responses in a housing-support casework process. The system does not make the final decision, but it shapes how staff interpret case notes and compose explanations to citizens. The run-level issue is that one output contains an incorrect statement about eligibility criteria because the prompt template drew on an outdated internal guidance note.

In RAIDT terms, the evidence needed includes the task definition for the run, the prompt template used, the model and version, the source materials referenced, the staff role of the operator, the human review checkpoint before the response was sent, the correction or escalation path, and a note on whether the case fell into a more sensitive category requiring stronger oversight. The relevant pillars are Responsibility, because the accountable role and review obligation must be clear; Auditability, because the run must be reconstructable; Dependability, because the output reliability problem must be examined; and Traceability, because the faulty guidance source and resulting output path must be logged. Interpretability also matters, but here it is secondary to the governance chain.

The EU AI Act improves governance readiness in this example because it frames the need for structured documentation, oversight, and post-use review not as optional best practice but as part of a regulatory accountability environment. RAIDT then operationalises that expectation by making the individual run governable.

Detailed link to RAIDT

EU AI Act links to RAIDT in four ways.

First, it connects to RAIDT's core idea that responsible GenAI governance must be demonstrated through evidence rather than declared through abstract policy statements.
Second, it connects to the run because the practical meaning of documentation, oversight, traceability, and risk control depends on a specific configured use in a specific context.
Third, it connects to the evidence pack and score profile because those outputs provide a structured way to gather, organise, and evaluate the signals that matter for governance review.
Fourth, it connects to reviewability, contestability, audit readiness, and organisational learning because regulatory expectations become more actionable when reviewers can reconstruct how a run was performed and governed.

EU AI Act -> Run-level evidence -> Evidence pack -> RAIDT score profile -> Governance readiness

In other words, the Act supplies a policy imperative, while RAIDT supplies an operational grammar for making that imperative inspectable.

Link to the five RAIDT pillars

Responsibility

The EU AI Act strengthens the need to identify who is accountable for using, supervising, approving, and correcting AI-supported work. In RAIDT, responsibility cannot remain implicit.