The EU AI Act deadline is live. Can you prove control of your AI data flows?

Article 15 transparency obligations are active now. For FCA/ECB-regulated firms using AI in credit decisions, KYC, fraud detection, or claims processing, the audit question isn't whether you use AI, it's whether you can show what data went in, what came out, and where it went. SAGITTERA gives you the evidence your Data Protection Officer (DPO) can open.

Book a pilot demo

Does this apply to you?

If you're in a regulated sector, the question isn't whether this applies, it's whether you can prove you're in control.

Banks, insurers, payments firms, and healthcare providers already work under a microscope. The EU AI Act adds a new obligation on top of what you carry: transparency. Article 2 contains narrow exclusions, military, defense, national security, and pure research. If AI touches your customer data, your credit decisions, or your claims processing, those exclusions almost certainly don't cover you.

And the EU AI Act isn't the only clock. Under GDPR Articles 44–49 (Schrems II), sending personal data to a non-EU AI provider is a live cross-border transfer risk. If you're already carrying DORA third-party-risk obligations, AI adds another layer. When your auditor asks where that data went, a vendor's word won't be enough. You need evidence you can open.

The obligation isn't "do you use AI?", it's "can you prove you control what data goes in and out, and detect manipulation when it happens?" If AI touches your organisation at all, you need evidence you can show.

The application timeline

The clock is already running. Each milestone adds obligations, and the first one is live today.

2 August 2026 · Active now

Transparency obligations (Article 15)

Technical documentation and record-keeping apply today. For a regulated firm, this is the obligation that matters most, and the one most organisations can't evidence. Your audit trail either exists, or it doesn't, and gaps become findings, remediation costs, and reputational risk.

2 December 2027 · Deadline

High-risk AI systems (Annex III)

Stand-alone high-risk systems in creditworthiness, employment, education, and access to essential services. Originally 2 Aug 2026, moved to 2 Dec 2027 by the Digital Omnibus. A reprieve, not a repeal: the obligations are unchanged.

2 August 2028 · Deadline

High-risk AI in regulated products (Annex I)

AI integrated into regulated products, medical devices, machinery, lifts, toys. Extended 12 months by the Omnibus. Same substantive obligations, only the clock moved.

What SAGITTERA Provides

SAGITTERA does not make you compliant, compliance is your responsibility. We give you the evidence to defend it.

Runtime Evidence

When your auditor asks "prove it," you open the log. A tamper-evident sealed audit of your AI traffic, what was sent, when, and where it went. Evidence your DPO can verify, not a claim your vendor makes.

Zero-Knowledge Sealed Audit

Audit events seal to your DPO's public key. Only your DPO can decrypt them, not SAGITTERA, not anyone else. We can't read your logs even if we tried.

Network-Level Screening

Screens for prompt-injection, tool-calls, sensitive PII, and shadow-AI at the network boundary, so you control what crosses it, and you have the record to prove it when the audit comes.

Sensitive Data Substitution

Sensitive data is substituted before it leaves your network. What egresses to an AI provider is no longer the personal data your customer handed you, and the log shows exactly that.

DORA & Schrems II Alignment

Cross-border transfer logs show exactly when personal data leaves the EU, critical for Schrems II challenges. Tamper-evident seals support DORA's third-party risk documentation requirements.

What Happens If You Can't Prove It?

When your auditor asks for evidence of AI data flow controls and you don't have it, the consequences cascade:

Regulatory findings

Article 15 violations under the EU AI Act trigger formal investigations. For FCA/ECB-supervised firms, this compounds existing GDPR and DORA scrutiny. Expect detailed findings, not informal warnings.

Remediation costs

You'll need to reconstruct what happened, which AI systems touched customer data, where that data went, whether it crossed borders. Without logs, this means weeks of manual discovery, external consultants, and system audits.

Reputational risk

Public enforcement actions attract attention. For regulated financial institutions especially, the question isn't just "did you breach?", it's "did you know, and did you document it?"

Regulatory action

Persistent non-compliance leads to fines, mandatory remediation timelines, and increased supervision. The EU AI Act's penalty framework scales with turnover, and intent matters.

The clock started 2 August 2026. The question isn't whether you use AI. It's whether you can prove you control it.

Frequently Asked Questions

When does the EU AI Act take effect?

Transparency obligations (Article 15) are active from 2 August 2026, that is now. High-risk requirements under Annex III apply from 2 December 2027, and Annex I regulated products from 2 August 2028.

Does the EU AI Act apply to my firm?

Article 2 contains narrow exclusions, military, defense, national security, and pure research. If you run AI on customer data for credit decisions, fraud detection, KYC, or claims processing, especially under FCA, ECB, or DORA supervision, those exclusions don't cover you.

What does the EU AI Act require me to prove?

Article 15 requires technical documentation and record-keeping for your AI systems. In practice: verifiable evidence of what data went in, what came out, and where it went, and that you can detect manipulation.

Does SAGITTERA make us compliant?

No. Compliance is your responsibility. SAGITTERA provides tamper-evident sealed audit logs, runtime evidence your DPO can decrypt and open when the auditor asks. We provide evidence, not a compliance guarantee.

See how SAGITTERA provides this evidence →