EU AI Act compliance

AuditTrail tracks your tenant's posture against the EU AI Act and gives you a machine-readable export you can hand to a regulator or auditor. It surfaces a per-article status snapshot, a serious-incident log (Article 73), and a JSON/PDF export over a rolling period.

Per-article status

GET /api/v1/compliance/status returns a snapshot for five articles. Each article reports compliant / warning / non_compliant plus a details blob:

Serious-incident log (Article 73)

You log a serious incident with an incident_type, severity, optional description, and optional trace_id. AuditTrail computes the Article 73 reporting deadline from the incident type's reporting window and the detection time:

Valid severities are low / medium / high / critical; incident status is open / reported / resolved. The user_id is always pinned to the caller — the payload can't spoof it. Referencing a trace_id you don't own returns 404.

REST surface

routes/compliance_admin.py — prefix /api/v1/compliance, get_current_user.

Logging an incident

POST /api/v1/compliance/incidents
{
  "incident_type": "health_harm",
  "severity": "high",
  "description": "Agent recommended an unsafe dosage in 2 traces",
  "trace_id": "…"
}

The response includes the computed reporting_deadline and the incident status (open on creation).

Export

GET /api/v1/compliance/export?period_days=180 returns the per-article status, every incident detected in the window, and a violation_summary counting constitutional breaches per triggering article. GET …/export.pdf renders the identical payload as a ReportLab PDF (target: under 30 seconds for a 180-day period) with a download disposition. The default period is the Article 12 six-month retention floor; you can request anywhere from 1 to 3650 days.

Data model