Regulation (EU) 2024/1689
Under the EU Artificial Intelligence Act (2024/1689), these policies enforce prohibited practices, high-risk system obligations and transparency requirements at runtime. Sectors classified as critical infrastructure under Annex III — such as energy and utilities — carry high-risk obligations; policies marked with an asterisk (*) target those critical-infrastructure and high-risk scenarios directly.
Coverage focus
Policies marked with a star target critical-infrastructure and high-risk use scenarios under Annex III.
Blocks generation of manipulative content that distorts a person's behavior beyond their conscious awareness. As a prohibited practice, BLOCK is applied without exception.
Blocks content and decision-making that exploit vulnerabilities arising from age, disability or socioeconomic situation.
Detects and blocks general-purpose scoring requests based on individuals' social behavior or personality traits. Prompts aimed at behavioral profiling of employees or customers are caught here.
Blocks use cases aimed at analyzing employees' emotional states with AI (except safety and medical exceptions). Emotion-analysis requests over meeting recordings and correspondence are a typical violation pattern.
Blocks inference of race, political opinion, union membership, belief or sexual orientation from biometric data.
Detects high-risk use scenarios (employment decision, critical-infrastructure operation, credit evaluation) from prompt content and automatically classifies the interaction as high-risk. A class change triggers additional controls such as human oversight and enhanced logging.
Prevents AI output from being used as the final decision on CV screening, promotion, performance evaluation and termination; human approval is mandatory and the decision rationale is logged.
Blocks fully automated AI use in creditworthiness evaluation and decisions on access to essential services. Supplier financial-evaluation scenarios are bound to this policy.
Requires human oversight for AI-assisted decisions on energy generation, transmission and distribution operations (load forecasting, maintenance prioritization, field instructions) and restricts agent systems' authority to write directly to operational systems. The most critical policy of the package for a critical-infrastructure operator.
Prevents AI output from solely determining outcomes in internal training and certification evaluations; requires evaluator approval.
Requires chatbots interacting with customers and employees to clearly disclose that they are AI. Chatbot responses that do not contain the disclosure statement are caught in the POST_LLM phase and passed with the disclosure added.
Blocks AI-generated image, audio and video content from being published without labeling. If synthetic content is detected in corporate communications materials, a labeling requirement is enforced.
Prevents an AI agent from proceeding without human approval on high-impact actions (data deletion, system configuration, financial transaction, field operation). Approval and rejection decisions are written to the audit ledger.
Continuously measures guardrails' precision/recall metrics against benchmark datasets and raises an alarm on performance drops. In high-risk projects, model accuracy metrics are reported periodically.
Continuously records each project's risk class, active guardrail configuration and Governance Health Score trend, producing automatic documentation that proves to an auditor that risk management is a living process.
Requires RAG sources and fine-tuning data to come from approved, high-quality and representative datasets. Connecting an unapproved data source to the system is blocked.
Keeps automatic event logs of all AI interactions in high-risk systems in the hash-chained ledger. Log immutability is cryptographically provable, directly meeting Art. 12 and Art. 19 obligations.
Inventories all GPAI models used in the organization (GPT, Claude, Gemini, open-source models) per project and detects and blocks use of unapproved models.
Requires enhanced monitoring, incident reporting and an additional guardrail layer in projects using frontier models in the systemic-risk class.
Detects AI outputs that show systematic differences by protected attributes (gender, age, ethnic origin). In HR and customer-decision scenarios, outputs are run through bias scoring.
Detects serious AI incidents affecting fundamental rights or safety, opens an incident record and starts notification-deadline tracking. An incident impact report is prepared automatically.
Automatically collects the data points needed for a fundamental-rights impact assessment in high-risk projects (affected population groups, decision types, human-oversight rate) and feeds the FRIA document.