EU AI Act
How the governance layer supports the EU AI Act.
The EU AI Act sets expectations for how AI systems are overseen, recorded, explained and stopped. Every Stackmint operating system runs on one governance layer with a control for each of those themes, and the evidence to show it.
Themes and controls
Four themes of the Act, four controls you can show.
The Act’s requirements for high-risk AI systems sit in Articles 9 to 15. Here are four of its themes, and the control in every operating system that supports each one.
Human oversight
What it is about
People should be able to oversee an AI system, understand its outputs and decide whether to use them.
The Stackmint control
Human approval. Workflows stop at approval gates, and nothing reaches a client until a named person approves the exact version.
Logging and record-keeping
What it is about
Events should be recorded automatically so that how a system operated can be traced afterwards. This is the subject of Article 12.
The Stackmint control
Immutable, granular audit logs. Every request, decision, change and result is recorded, with who or what did the work and which version was used.
Transparency
What it is about
The people using a system should know how it works and be able to interpret what it produces.
The Stackmint control
Versioned agents. Each agent, playbook and model version is pinned, so there are no silent changes to how the work gets done, and every run shows what produced it.
Ability to stop a system
What it is about
A person should be able to interrupt a system or bring it to a safe stop.
The Stackmint control
Kill switches. Stop any agent or workflow at once, at run, workflow and organization level.
Also in the governance layer
Bounded actions, isolated data, fixed budgets.
Execution gateway
Agent actions run through a controlled gateway, with credentials kept server-side.
Client data isolation
Every client and matter has its own context. Documents are treated as content, never as instructions.
Budgets per run
Each run has its own budget and stays within it.
Your obligations
Controls and evidence, not a compliance verdict.
What the Act requires of you depends on your role and on how you use AI. Stackmint gives you the controls and the records; classifying your systems and assessing your obligations stays with you and your advisers.
EU data residency
Available on request.
Data processing agreement
DPA available on request.
Subprocessors
Our subprocessor list is published.
View the listSOC 2
In progress.
Security at Stackmint
This page describes product controls and is not legal advice. Read about the governance layer
Next step
Walk through the controls on your own workflows.
Bring one service and the questions your clients or regulators ask. We show you where each approval, log and stop sits.