01 / The reframing

The regulator is asking for a graph.

Most enterprises are reading the EU AI Act as a compliance burden. A list of documents to produce. A registry to keep up to date. That reading misses what the Act actually does.

Look at Articles 11, 12, 13, 14 and 15 together. The Act is asking you to maintain a structured, machine-readable map of every AI system in your organisation: what it is, what it touches, who owns it, what it was trained on, how it behaves under stress, and how a human oversees it. That is a knowledge graph.

Build it as a graph from the start and you do not just become compliant. You become inspectable. You shorten the audit cycle. You make the next regulator visit a generated report rather than a six-week emergency.

↳ The Act as a graph
EU AI ACTProhibitedHigh-riskLimitedMinimalART. 11Tech docsART. 12LoggingART. 13TransparencyART. 14OversightEach Article maps to a node in your governance graph.THIS IS NOT A METAPHOR. THE REGULATOR WANTS A GRAPH.
02 / What we deliver

Six artefacts. One graph.

ARTICLE 11

Technical documentation

The full Annex IV documentation pack. Generated from the graph, not maintained as a separate Word file. Every model has a node, every node has its Article 11 fields populated.

ARTICLE 12

Logging & lineage

Every input, every inference, every override, every override of an override. Logged into the graph. Retained. Exportable to the regulator on request.

ARTICLE 13

Transparency ontology

User-facing transparency. Internal model cards. Both generated from the same graph nodes, never out of sync.

ARTICLE 14

Human oversight design

Where does a human have to be in the loop? Where can the AI act autonomously? Modelled as a typed relationship in the graph and enforced by the platform.

ARTICLE 15

Robustness & security

Test plans, adversarial robustness checks, fallback behaviour. Linked to the model node, dated, replayable.

REGISTRY

Model registry

A single, governed inventory of every AI system in production, its risk classification, its accountable owner, its compliance state. The graph IS the registry.

03 / The risk

Penalties up to 7% of global turnover.

The fines under the EU AI Act sit alongside GDPR-scale enforcement. Prohibited-practice violations attract penalties up to €35 million or 7% of worldwide annual turnover, whichever is higher. High-risk non-compliance attracts penalties up to €15 million or 3% of worldwide turnover.

For most enterprise clients the financial exposure is significant but not catastrophic. The reputational exposure is the real driver. Being named in the first wave of public enforcement actions is the worse outcome.

Aug 2026 is closer than it feels

Want a readiness review?

We will look at your high-risk inventory and tell you honestly how exposed you are. Book a 30 minute call to start.

Book a meeting →