Automate the evidence that machines can produce and that changes often: system logs, inventories of models and dependencies, test and evaluation results, change records and monitoring data. Keep people responsible for classification, risk judgment and approvals. Automation collects and dates evidence; it does not decide compliance. This is not legal advice.
Which obligations produce evidence you can automate?
For high risk AI systems, the Act's obligations apply from 2 December 2027 for Annex III systems and from 2 August 2028 for Annex I systems, according to the EU AI Act information site. That gives time to build collection that runs continuously rather than a scramble before an audit.
Article 12, record keeping. Systems must technically allow automatic recording of events over their lifetime. Logs must support identifying risk situations or substantial modifications, post market monitoring and monitoring of operation. Automate this at the source, ship logs to storage the application cannot edit, and record the retention you chose.
Article 72, post market monitoring. Providers must actively and systematically gather, record and analyse performance data over the system's lifetime, under a monitoring plan that forms part of the technical documentation. Automate metric collection and scheduled reports, and review them on a calendar.
Article 11 and Annex IV, technical documentation. Documentation must be kept up to date. Generate the parts that are facts, such as dependency lists, model versions, data source references and test results, from your build and registry on every release. Write the parts that are reasoning, such as intended purpose, by hand.
Article 17, quality management. The system covers areas such as design and development procedures, testing, data management, risk management and record keeping. Automate the records: pull request approvals, test run archives, change tickets. Keep the policies human written.
Article 9, risk management. A continuous, iterative process that includes identifying risks, evaluating them, using post market data and adopting measures, with testing against predefined metrics. Automate metric runs and alerts on thresholds; the risk judgment and residual risk acceptance stay with people.
Article 15, accuracy, resilience and cybersecurity. Systems must achieve appropriate levels and resist attempts to alter their use or outputs by exploiting vulnerabilities. Automate vulnerability scanning of the code and dependencies, and keep results with dates.
What should stay manual?
Classification of the system, the intended purpose, acceptance of residual risk, decisions on what is a substantial modification, and responses to incidents. An auditor will want to see who decided and why, not a log that something ran.
How do you design the pipeline?
Build one evidence store with a simple record: control or article, what was collected, source system, timestamp, owner. Collect on events (a release, a model change) and on schedules (weekly metrics). Hash or sign exports if your policy needs integrity. Make a quarterly human review a standing meeting that signs off a snapshot.
Watch for two failure modes. First, collecting everything without mapping it to a requirement, which creates noise. Second, trusting automation that silently stops; add alerts when an expected feed goes quiet.
Where does Safeguard fit?
Safeguard's compliance automation can help collect and organize evidence from your scans and inventories, and the framework mapping demo shows the idea. Safeguard does not certify anyone, and the EU AI Act has no certificate from us or any tool; your own program and, where required, a conformity assessment decide.
See it on its own page: Framework mapping demo.
What to do
- Decide first whether your system is high risk, and record the reasoning.
- Make a table of Articles 9, 11, 12, 15, 17 and 72 with the evidence each needs.
- Mark each evidence item as automatic, semi automatic or manual.
- Turn on event logging and send it to storage the app cannot modify.
- Generate documentation facts from the build on every release.
- Alert when an evidence feed stops.
- Hold a quarterly sign off on a dated snapshot.
Quick check
Can software prove compliance with the Act?
No. It can collect and organize evidence. Compliance is a judgment about your system and processes.
When do the high risk obligations apply?
The information site lists 2 December 2027 for Annex III systems and 2 August 2028 for Annex I systems. Check the official text.
Sources
- EU AI Act: Article 9
- EU AI Act: Article 11
- EU AI Act: Article 12
- EU AI Act: Article 15
- EU AI Act: Article 17
- EU AI Act: Article 72
- EU AI Act implementation timeline
Last reviewed: 18 October 2026.
