EU AI Act and Sequence Enforcement: How to Prove Compliance for Agentic AI
EU AI Act Regulation 2024/1689 — in force from August 2024, with high-risk AI obligations applying from December 2027 (extended from August 2026) — establishes mandatory oversight, traceability, and logging requirements for agentic AI systems operating in sectors including hiring, lending, healthcare triage, law enforcement, and critical infrastructure. The Act is not a documentation exercise. It is an evidence requirement: proof that oversight mechanisms were operational during deployment, not merely described in a policy document. For agentic AI, sequence enforcement — gate-evaluating each step before it executes and issuing a cryptographic receipt on every authorised pass — is how operators produce that proof.
What the EU AI Act actually requires for agentic AI
EU AI Act Regulation 2024/1689 entered into force on 1 August 2024. Obligations for high-risk AI systems are phased, with most technical and conformity requirements applying from December 2027 (extended from August 2026 via the Digital Omnibus on AI, May 2026). Agentic AI systems that make consequential decisions — in hiring, lending, healthcare triage, law enforcement, critical infrastructure — fall squarely within the high-risk classification under Annex III.
The Act does not specify how to implement compliance. It specifies what must be demonstrable. For agentic AI, the four most operationally demanding articles are 9, 11, 12, and 14.
The Act requires a risk management system that is continuous and iterative throughout the AI system's lifecycle — not a one-time assessment. For agentic AI, the key risk is action without authorisation: a step that executes without its preconditions having been verified.
How sequence enforcement addresses it: The gate evaluation is the risk management check. Before each step executes, the gate verifies sequence position, function/step match, action type permissibility, nonce uniqueness, and timestamp freshness. Any failure produces a gate denial — the step does not run. This is a continuous, per-action risk evaluation, not a deployment-time assessment.
Article 11 and Annex IV require technical documentation covering the system's design, development, and operation — including the logic by which the system makes decisions and the controls in place to ensure it behaves as specified.
How sequence enforcement addresses it: AgenticRail's MSMD policy maps (msmd_policy_maps.js) define the complete logic: which functions are permitted, which action types are allowed per function, and the exact step order. These are version-controlled, auditable, and deployed as the enforcement source of truth. The compliance report endpoint (POST /report) generates a verifiable technical documentation artefact for any sequence ID, including a chain proof and AI-generated compliance narrative.
Article 12 requires that high-risk AI systems automatically generate logs enabling post-market monitoring. The logs must be sufficient to determine the period of each use, the reference database against which the output was verified, and the persons involved in the verification.
How sequence enforcement addresses it: Every gate decision — ALLOW or DENY — produces an HMAC-signed receipt written to immutable R2 storage. Each receipt records: sequence ID, step identifier, function, action type, gate decision, timestamp, nonce, and pack ID. Receipts are chained via prev_receipt_id, making tampering with the order detectable. This is not a log appended after the fact — it is a gate decision record created before the action runs, by the enforcement layer, not the application.
Article 12 also requires identification of "the persons involved in the verification." Each gate call accepts an optional attestation object — a JSON payload the calling system attaches per step. Operators pass verifier IDs, approver tokens, KYC result codes, or document hashes. This data is signed into the receipt at the moment the gate issues the ALLOW. The result: every step in the chain carries cryptographic proof of both the enforcement decision and the evidence that justified it.
Article 14 is the most operationally demanding requirement for agentic AI. It requires that high-risk AI systems be designed and developed with appropriate human oversight measures — including the ability for natural persons to intervene in or interrupt the system. The oversight must be effective, meaning built into the system's operation, not merely available as a policy option.
How sequence enforcement addresses it: The gate is the human oversight mechanism. Every step requires explicit gate authorisation before executing. A human operator can revoke gate access, modify the sequence policy, or terminate a sequence at any point — and no subsequent step can execute without passing through the gate. The gate's fail-closed design means that any interruption of gate access (key revocation, policy change, explicit HALT) immediately stops execution. The oversight mechanism cannot be bypassed by the model because it operates at infrastructure level, not application level.
ISO/IEC 42001:2023 alignment
ISO/IEC 42001:2023 is the international standard for AI management systems. Certification to this standard provides a structured conformity path for organisations deploying high-risk AI. The standard requires:
- →Clause 6.1 — Actions to address AI risks: documented, implemented, and evaluated
- →Clause 8.4 — AI system impact assessment documentation
- →Clause 9.1 — Monitoring, measurement, and evaluation of AI system performance
- →Annex A, Control A.6.1.6 — AI system operational logging
AgenticRail's gate decisions, receipt chain, and compliance report endpoint address Clauses 9.1 and Annex A.6.1.6 directly. The gate's policy maps address the documentation required under Clause 8.4.
The receipt chain as compliance evidence
Compliance evidence for the EU AI Act must be producible on demand — by a notified body conducting conformity assessment, by a market surveillance authority, or in civil litigation. The receipt chain AgenticRail produces is designed for this.
Each receipt in the chain is HMAC-signed using a versioned key (k1_2026-02-22_01). The signature covers a canonical JSON serialisation of the receipt — alphabetically sorted, deterministic. Tampering with any field in any receipt breaks the signature. Removing a receipt breaks the prev_receipt_id chain. Adding a receipt breaks the seal. The chain is self-evidencing: if the chain verifies, the sequence ran as recorded.
To generate a compliance report for any sequence:
POST https://report.agenticrail.nz
{"sequence_id": "your-seq-id", "format": "html"}
The report includes: sequence summary, per-step enforcement log, chain linkage proof, cryptographic verification results, and a Claude-generated compliance narrative. It is human-readable and machine-parseable, suitable for inclusion in technical documentation packages required under EU AI Act Article 11.
Attestation — per-step deliverable contracts
Receipt chains prove that the correct steps ran in the correct order. Attestation proves what was confirmed at each step.
Each gate call accepts an optional attestation: { ... } object. The object is signed into the R2 receipt alongside the enforcement decision — before the step runs. Whatever the calling system passes (a KYC result, a fraud score, a human approver ID, a document hash, a premium calculation) becomes part of the cryptographic record. Immutable. Chained. Provable to a regulator without granting system access.
For EU AI Act Article 12, attestation addresses the requirement to log the "persons involved in the verification." Pass an approver token or verifier ID in the attestation object — it is signed into the receipt at the moment of ALLOW. The audit trail is complete: who approved it, what they approved, and the enforcement decision that allowed it to proceed.
Attestation is particularly valuable for Article 9 risk management evidence. Instead of a one-time risk assessment document, each underwriting or lending step carries a signed record of the risk output that justified that specific action — credit score, AML check result, fraud score — bound to the sequence at the moment of execution.
See the attestation documentation for the field format, SDK examples, and receipt structure.
What sequence enforcement does not cover
Sequence enforcement addresses the operational and audit requirements of the EU AI Act. It does not cover:
- —Conformity assessment or CE marking (requires notified body involvement for Annex III systems)
- —Data governance obligations under Article 10 (training data quality and governance)
- —Accuracy, robustness, and cybersecurity testing under Article 15
- —User transparency obligations under Article 13 (requires additional disclosure tooling)
AgenticRail is the enforcement layer — the piece of the compliance stack that makes Articles 9, 11, 12, and 14 operationally provable. It is designed to integrate with, not replace, a complete compliance programme. Other frameworks in the EU AI Act compliance stack include: NIST AI RMF 1.0 (risk management framework), ISO/IEC 42001:2023 (AI management systems), and the EU AI Office guidance on conformity assessment. The EU AI Act's December 2027 deadline for high-risk AI conformity — including CE marking and EU database registration under Annex III — means operators building agentic AI pipelines now need the receipt chain AgenticRail produces, not a logging system to add later.