agentgovThe AI Act
What the check looks for, and what the law will want from you
The EU AI Act sorts AI systems by risk and asks more of the riskier ones. agentgov reads your code, says which tier your system probably falls in, lists what you are missing, and writes the first drafts. A code reading, not a legal opinion: a first opinion to take to a lawyer.
The tiers, in plain words
- UnacceptablePractices the Act bans outright: manipulation that causes harm, social scoring, some uses of biometrics. If the check finds signs of these, it says so first and loudest.
- High riskSystems used in employment and recruiting, credit and insurance, education, essential services, law enforcement, migration, critical infrastructure, medical devices, or as a safety component. These carry the heavy obligations below.
- Limited riskSystems that talk to people or make content: chatbots, assistants, generated text, images or voice. Mainly transparency: people must know they are dealing with an AI, and generated content must be marked.
- Minimal riskEverything else. No specific obligations, but the general duties (and your customers' questions) still apply.
How agentgov decides: from the inventory it reads what the agents do, which data they touch and where (words and flows in the code that point at hiring, credit, health, education, public services, biometrics, children), whether they talk to people, and whether they make content. The tier is a probability, with the reasons listed; your agent is asked to confirm what the code alone cannot settle.
What a high-risk system has to show
- A risk management system: the risks named, weighed, and treated. agentgov's check run and the decision register are its first draft.
- Data governance: what data the system uses and where it came from. The data flows in the inventory.
- Technical documentation: what the system is, how it was built, how it is meant to be used. The registry and the AI Act document agentgov exports.
- Logging: records of what the system did, kept long enough to look back. One of the checks: are model calls and tool calls logged, with the person behind them?
- Transparency to the people using it: instructions, limits, what it cannot do.
- Human oversight: a person who can watch, intervene and stop it. The checks on unguarded tools, autonomy and confirmation steps are about exactly this.
- Accuracy, robustness and security: including resistance to manipulation. The prompt-injection checks and the live test's planted instruction are about this.
For a limited-risk system the list is short: tell people they are talking to an AI, mark generated content, and say what it is for.
The AI Act checks, concretely
| The check | What it reads in the code |
|---|---|
| Tier indicators | Words and flows pointing at employment, credit, education, health, essential services, law enforcement, biometrics, children; chatbots and content generation. |
| Transparency notice | Does a chat agent tell people it is an AI? Is generated content marked? |
| Human oversight | Can a person stop or confirm what an agent does? Are irreversible, money-moving or sending tools confirmed? |
| Logging | Are model calls and tool calls logged, with the actor, somewhere that lasts? |
| Robustness | Does untrusted text reach prompts without a boundary? Does a planted instruction get followed live? |
| Documentation | Is there anything in the repository that names the agents and what they are for? |
What agentgov writes for you
With GOV on, write the audit documentation produces four markdown files in your project: the registry (every agent and tool, its policy, its owner), the risk assessment (every finding by category, with its status and the decisions behind it), the AI Act document (the tier with its reasons, the obligations table with what is met, partly met or missing, the open questions, and this disclaimer) and the change log (inventory versions, gates, decisions). The paragraphs that need words come from your own coding agent, reading your code.