Traccia is an observability and governance platform. The EU AI Act module adds registry fields, labeled exports, and documentation drafts for teams that deploy or provide AI in the EU. It helps you collect and organize evidence. It does not classify your systems for you, perform conformity assessment, or file anything with EU authorities.

Not Legal Advice

Obligations under Regulation (EU) 2024/1689 depend on your role (provider, deployer, importer, distributor), the risk category of each system, and how you use it. A chatbot used internally is not treated the same as a high-risk hiring screener. Work with qualified counsel to classify systems and confirm which articles apply. Traccia surfaces workflows and exports that many EU teams ask for. That is not the same as being “EU AI Act compliant.”

What the Module Is and Is Not

Traccia provides	Traccia does not provide
AI system registry (purpose, risk tier, linked agents, third-party vendors)	Legal classification of risk tier or Annex III category
Trace-linked human review queue with approve/reject and audit trail	Mandatory human-in-the-loop inside your application code
JSON audit bundles (standard or EU-labeled) for a date range	Complete Art. 12 log exports of every inference field regulators may request
FRIA draft wizard, provider doc outlines, EU registration pre-fill JSON	Official EU database registration or authority submission
SDK hooks for transparency evidence and optional risk-tier stamping on spans	UI banners, consent flows, or automated PII detection (regex redaction only today)

Who This Is For

Deployers: organizations that use an AI system under their authority (e.g. a bank running a credit-scoring model, a public body using high-risk AI). Most Hub workflows (registry, reviews, incidents, FRIA drafts, deployer retention evidence) target deployers.
Providers: organizations that develop or place an AI system on the market. Provider doc outlines (Art. 13 instructions for use, Annex IV technical documentation) pre-fill registry fields into structured drafts your legal or QMS team completes.
Everyone else: if you operate only in the US or globally and do not need EU labels, leave the module off. Core governance (registry, reviews, incidents, standard exports) stays available without EU-specific wording.

Enable the Module

The module is disabled by default. Traccia never turns it on based on IP or locale. An org admin must opt in.

Sign in to the app → Settings → Compliance (org admin,/settings?section=compliance).
Set Primary operating region (EU, US, UK, APAC, GLOBAL). This is a hint for the UI only. It does not change data residency. Residency is in your contract; see the Trust Center.
Turn on Show EU regulatory features. The toggle auto-saves. FRIA, EU-labeled exports, provider doc downloads, and article references appear in the Governance Hub.

SDK vs Dashboard

Enabling the module in the dashboard unlocks EU UI and export labels. Optionally pass compliance={"frameworks": ["eu_ai_act"]} in traccia.init() to stamp risk tier on spans. The two settings are independent. You can use one without the other.

Step-by-Step: Typical Deployer Workflow

Register each AI system: Governance Hub → AI systems. Record name, intended purpose, and your internal risk classification (minimal / limited / high). Link Traccia agent slugs for monitored services; add vendor/product for third-party tools Traccia does not trace (e.g. Microsoft Copilot, external APIs).
Instrument your app: use the Python SDK for traces and optional disclosure() calls when users see an AI notice (Art. 50 evidence). Human review happens in the Hub, not in SDK code.
Run human oversight: Governance Hub → Reviews. Queue items by trace ID, approve or reject with comments. Each item links to the exact trace run for auditors.
Log serious issues: Governance Hub → Incidents. Internal record with taxonomy and severity; not an EU authority filing.
Complete FRIA if applicable: Art. 27 FRIA is primarily for public-sector deployers of high-risk AI. The wizard produces a downloadable JSON draft. Traccia does not submit it anywhere.
Export evidence: Governance Hub → Evidence. Download a JSON audit bundle for 7–180 days. Choose EU-labeled export when the module is on.

AI systems vs Agents

Concept	What it is	EU module usage
Agent	Auto-discovered from SDK traces — operational identity (slug, traces, costs).	Link one or more agents to a registry row so exports connect compliance metadata to live telemetry
AI system	Compliance registry entry — purpose, risk tier, EU registration status; optional `agent_id` link.	One row per product or workflow you document for auditors, including third-party-only systems with no Traccia agent.

Governance Hub Features (EU Module On)

Tab	EU relevance
AI systems	Inventory for Art. 26 deployer duties; retention gap warning when a system is tagged high-risk and plan retention is under 180 days; provider doc downloads on each system card.
Reviews	Art. 14 human oversight evidence via trace-linked queue.
Incidents	Internal log aligned with Art. 72/73 record-keeping themes.
Evidence	EU audit bundle adds `eu_ai_act_article_mapping` labels to the same JSON structure as the standard bundle.
FRIA	Art. 27 wizard covering process, affected persons, risks, oversight, and mitigation.
Audit log	Admin activity on registry, reviews, incidents, and compliance settings.

Provider Documentation Downloads

On each registered system card (EU module on), org admins with registry write access can download:

Instructions for use (Art. 13 outline): JSON + Markdown. Pre-fills system name, purpose, risk tier, and Traccia logging integration notes. You complete limitations, contact details, and deployer obligations.
Annex IV technical documentation (Art. 11 outline): JSON + Markdown. Section headings for design, data, monitoring, and risk management. Placeholders for model cards, QMS references, and mitigations.
EU registration pre-fill: JSON only. Fields such as provider name, system name, purpose, risk tier, and registration status for manual upload to the official EU AI database. Traccia is not the registry.

Article Mapping: What the Evidence Actually Covers

The EU audit bundle attaches labels describing how each section relates to common obligations. Below is what those labels mean in practice.

Article	Typical obligation	What Traccia contributes
Art. 12	Automatic logging for high-risk AI systems	GovernanceEvent attributes on spans (event type, integrity hash, model id when set). Traces in Traccia, not a certified Art. 12 log format.
Art. 19	Log retention and deletion rules	Plan-tier retention with configurable window; high-risk systems tagged in registry trigger a warning if retention is under 180 days.
Art. 26(6)	Deployer retention and monitoring	Same retention configuration plus monitoring via traces, policy violations, and incident records in exports.
Art. 14	Human oversight for high-risk systems	Review queue: pending → approved/rejected, reviewer identity, trace ID, comments, reopen to pending with required note.
Art. 27	Fundamental Rights Impact Assessment (deployers)	Multi-step FRIA wizard; saved assessments downloadable as JSON.
Art. 50	Transparency: users informed they interact with AI	SDK `disclosure()` writes `governance.transparency.disclosed` on the active span after your UI shows a notice. Does not render the notice.
Art. 72 / 73	Post-market monitoring and serious incident reporting	Incident workflow (open → closed → reopen with comment). Internal record only; official authority notification is outside Traccia.
Annex VIII	EU database registration information	Registration pre-fill JSON from system card for manual upload.

Articles Traccia does not address today include conformity assessment (Art. 43), CE marking, notified-body workflows, full technical documentation sign-off, and mandatory authority filings. Treat exports as input to your compliance program, not as certification.

Evidence Pack Contents

Both standard and EU bundles are a single JSON file with an integrity hash. The EU variant adds article mapping metadata and a disclaimer string.

AI systems: full registry snapshot (name, purpose, risk tier, linked agents, operator role)
Policy violations: count only for the selected window (policy_violations_count). No individual violation records.
Admin audit events: total count plus up to 50 rows in audit_events_sample (action, resource type, resource id, timestamp). Query cap is 500 rows; export includes the first 50.
Review requests: total count plus up to 50 rows in review_requests_sample (status, decision, reviewer id, trace id). Query cap is 200 rows; export includes the first 50.
Incidents: total count plus up to 20 rows in incidents_sample (title, severity, status, taxonomy). Query cap is 100 rows; export includes the first 20.
EU bundle only: eu_ai_act_article_mapping with a short description per article key

The bundle does not include raw trace payloads or span-level inference logs. Requires settings:read or org admin. Time windows: 7, 30, 90, or 180 days.

SDK overlay (Python & TypeScript)

Default init() works for all users. Every span gets baseline GovernanceEvent attributes. EU-specific stamping and transparency helpers are optional:

agent.py

python

from traccia import init, observe
from traccia.governance import disclosure
from traccia.processors.redaction_processor import redact_string

init(
    compliance={"frameworks": ["eu_ai_act"], "risk_tier": "high"},
    redact_pii=True,
)

@observe()
def chat(user_msg: str) -> str:
    disclosure(channel="ui", disclosed_to_user=True)
    safe_msg = redact_string(user_msg)
    return run_llm(safe_msg)

disclosure(): Art. 50 transparency evidence on the current span. Pass synthetic_content=True for deepfake/synthetic-media notices.
compliance risk_tier: static process config; sets eu_ai_act.risk_tier on spans. Not synced from the dashboard registry. Keep both aligned manually if auditors compare them.
redact_pii: pattern-based masking before export, not ML entity detection.
Human review: not available in SDK. Use Governance Hub → Reviews.

High-Risk Log Retention

High-risk AI systems under the EU AI Act typically require logs kept for at least six months. If you tag a registry entry as high risk but your Traccia plan retains traces for fewer than 180 days, the system card shows an amber warning only. Ingestion is not blocked and retention is not extended automatically. Upgrade your plan or adjust your classification after legal review.

Access Control Summary

settings:write: register/edit AI systems, toggle compliance module
settings:read: queue and decide reviews, manage incidents, export evidence packs
Org admins typically have both permissions

Trust, Residency, and Support

Enterprise DPA, subprocessors, and residency options: Trust Center. Questions about the module: support@traccia.ai.

EU AI Act Compliance