Regulatory Requirements as Engineering Constraints

All courses / AI Platform and Security / Module 1 / Chapter 3

Learning objectives

After the lesson the participant can:

• Write a regulatory obligation as a chain of legal source, platform capability, codified artefact and evidence produced.
• Apply the three keys of risk tier, role and general-purpose AI model use to decide which requirements apply to a system.
• Explain why log retention under the deployer's control is an architectural and contractual matter.
• Derive the platform requirements and evidence for a new AI system before design starts.

Key concepts

The four-link chain

Every requirement is written as legal source, platform capability, codified artefact and evidence produced. A requirement that cannot be written as all four links is not ready to be built; the missing link is usually the evidence.

Three keys

The result of risk classification reaches the platform as data in three keys: the risk tier, the role under Article 3 of the AI Act, and whether the system integrates a general-purpose AI model.

Article 25 trigger

The clause the chapter says platform teams most often miss: a deployer that makes a significant change to a high-risk AI system, or repurposes a system into a high-risk use, inherits the provider's obligations.

Platform requirements catalogue

One artefact the pipeline reads: each entry names an article, its control, the condition under which it applies and the gate that blocks a release when the evidence is missing. A full catalogue runs to some sixty entries.

Incident pipeline

The capability for Article 73 of the AI Act: it classifies each AI-related incident against every regime that may apply at once, starts the right clocks and assembles the report from logs and the evidence store.

Interactive exercises

Do them here and get feedback at once. Choose a card and then where it belongs, or drag it.

Teaching plan

Discussion

1. Which obligation in your organisation is met today by a project-built substitute instead of a shared platform capability, and what does that cost?
2. Hansa Mutual applied the Article 12 logging profile and the Article 14 oversight binding to an agent that its classification record places outside the high-risk tier. When should policy go beyond what the law requires?
3. For which of your requirements is the evidence link the one that is missing, and who would have to produce that evidence by hand today?

Written exercise

Self-test

Choose an answer to see whether it is right, or open the answer below each question.

1. When a requirement cannot be written as all four links of the chain, which link does the chapter say is usually missing?

   1. The legal source
   2. The platform capability
   3. The evidence produced
   4. The codified artefact
   Show the answer

   C. The evidence produced
   The chapter states that a requirement lacking one of the four links is not ready to be built, and that the missing link is usually the evidence.

2. Article 26 of the AI Act requires deployers of high-risk AI systems to keep the logs under their control. What architectural consequence does the chapter draw?

   1. The deployer must retrain the procured model on its own premises every quarter, so that the training logs count as its own records
   2. The contract should require the logs to land on the deployer's platform, since logs kept only by the supplier cannot be retained
   3. The deployer must build its own gateway before it may procure any high-risk AI system
   4. The provider must hand over the model weights so that the deployer can regenerate the logs whenever an authority asks
   Show the answer

   B. The contract should require the logs to land on the deployer's platform, since logs kept only by the supplier cannot be retained
   If a procured system writes logs only to the supplier's environment the deployer cannot retain them, so the phrase matters architecturally and belongs in the contract.

3. Why did Hansa Mutual add the Article 12 logging profile and the Article 14 oversight binding to its claims-triage agent?

   1. As group policy: an agent with write access to production needs action-level logs and a stop control whatever its legal tier
   2. Because its classification record places the agent in the high-risk tier under Annex III point 5(c), like the underwriting-support model
   3. Because DORA Article 28 requires both controls for every ICT third-party service provider in the register of information
   4. Because the Swiss and UK supervisors demand AI Act controls for agents in their markets
   Show the answer

   A. As group policy: an agent with write access to production needs action-level logs and a stop control whatever its legal tier
   The agent's classification record places it outside the high-risk tier; the group added the two controls as policy beyond what the law requires.