EU AI Act Compliance Guides

Engineering-first answers to the questions every AI team in the EU is asking right now.

• AI-BOM vs SBOM — why your SBOM misses your models

  A software bill of materials inventories packages. An AI-BOM inventories models, weights, datasets, and GPU infrastructure — the parts regulators and security teams now ask about. Here is the difference in practice.

• Exporting an AI SBOM in CycloneDX 1.5 (for Dependency-Track & friends)

  How to emit a CycloneDX SBOM of your AI components from CI so your existing security toolchain — Dependency-Track, GUAC, procurement portals — ingests your ML supply chain like any other.

• EU AI Act Annex IV — the complete technical documentation checklist (2026)

  What Annex IV actually requires, section by section, which parts you can auto-generate from your repository, and which parts only a human can write.

• EU AI Act Article 53 — documentation duties for GPAI model providers

  If you train, fine-tune, or substantially modify a general-purpose AI model, Article 53 documentation obligations have applied since August 2025. What they require and how to keep the technical half current.

• EU AI Act Article 9 — implementing continuous risk management in CI/CD

  Article 9 requires a continuous, iterative risk management system for high-risk AI. Here is what that means in engineering terms, and how to build the evidence trail into your pipeline.

• Is my AI system high-risk under the EU AI Act? An Annex III walkthrough

  A practical classification walkthrough for engineering and product teams — the eight Annex III categories, the Article 6 filter, common edge cases, and what to do once you know.

• EU AI Act penalties — what actually happens after 2 August 2026

  The real enforcement picture — penalty tiers up to €35M or 7% of turnover, who enforces them, what triggers them, and the engineering work that reduces exposure.

• How to generate an AI-BOM in GitHub Actions (5-minute tutorial)

  Add continuous AI Bill-of-Materials generation to your CI pipeline — dependency detection, model weights, CycloneDX SBOM output, and EU AI Act posture in one job.

• Catching expensive GPU misconfigurations in Terraform and Kubernetes

  A p4d left on-demand costs six figures a year. How static analysis of your infrastructure manifests surfaces GPU cost risks in CI — before the invoice, and with the numbers your Annex IV file needs anyway.

• Scanning container images for hidden model weights (no Docker daemon)

  Model weights routinely ship inside container layers where no repo scan can see them. How daemonless OCI layer scanning finds them, and why your compliance inventory is incomplete without it.