EU AI ACT / BUILT FOR THE ERA · Regulation (EU) 2024/1689 · Est. Europe

# Your AI is now regulated infrastructure. Ship the record with it.

The EU AI Act's general-purpose obligations land 2 August 2026. Audit trails, Annex IV technical documentation, risk classification, and human oversight stop being optional. Sandcastle is built for that era — every artefact the regulation references is a built-in primitive, generated on infrastructure you control.

Download compliance pack Book a demo
Key dates

- 2 Aug 2026 GPAI obligations apply
- 2 Aug 2027 High-risk system enforcement
- ≥ 6 mo Log retention, Art. 12
- 15 days Serious incident report, Art. 73

To GPAI deadline · calculating…
Tamper-evident audit trail Annex IV documentation Risk-level classification Human oversight gates PII redaction at the edge EU-only execution Record & replay every run Self-hostable · BSL 1.1 → Apache 2.0 Tamper-evident audit trail Annex IV documentation Risk-level classification Human oversight gates PII redaction at the edge EU-only execution Record & replay every run Self-hostable · BSL 1.1 → Apache 2.0
What changes on 2 August 2026

## Three new liabilities your AI suddenly has.

The EU AI Act is the world's first horizontal AI regulation. General-purpose AI obligations take effect 2 August 2026, with full high-risk enforcement following 2 August 2027. National competent authorities can audit, demand records, and fine.

1. 01
   Article 99 · Penalties

   ### Fines that move the share price.

   Prohibited practices: up to EUR 35M or 7% of global annual turnover, whichever is higher. Provider-obligation breaches: up to EUR 15M or 3%. Incorrect information to authorities: up to EUR 7.5M or 1%. Penalties scale with turnover, not infringement size.
2. 02
   Article 12 · Record-keeping

   ### Audit records on demand.

   Providers of high-risk AI systems must keep automatically generated logs for at least six months. Authorities can request them at any time. No logs is treated as presumed non-compliance — logging is a provider duty, not a feature request.
3. 03
   Article 11 + Article 50 · Transparency

   ### Mandatory documentation.

   Technical documentation per Annex IV must exist before a system is placed on the market and stay current. Deployers must tell users they are interacting with AI, and GenAI output must be machine-readable as AI-generated. Documentation is a market-access condition.

How Sandcastle answers

## Six controls. Already shipping.

Sandcastle was built EU-first. Every control below is a built-in primitive, not a roadmap item — each maps to a specific Article of Regulation (EU) 2024/1689.

1. 01
   Article 12 · Record-keeping

   ### Tamper-evident audit trail.

   Every step, prompt, model call, approval, and output is logged with a SHA-256 hash chain. Each entry links cryptographically to the previous one — any retroactive edit breaks the chain and is detectable. → ARTICLE 12 · RECORD-KEEPING → tamper-evident audit trail

       GET /api/audit/verify
       { "verified": true, "events": 14823,
         "chain_intact": true, "since": "2026-01-01" }

2. 02
   Article 11 + Annex IV · Technical documentation

   ### Annex IV transparency report.

   One command generates the full Annex IV technical documentation: system purpose, training-data sources, risk assessment, performance metrics, human-oversight measures, and post-market monitoring plan. Versioned, exportable, ready for authorities. → ANNEX IV · TECHNICAL DOCUMENTATION → one-command export

       $ sandcastle compliance annex-iv \
           --workflow loan-decisioning \
           --format pdf --output annex-iv-2026.pdf

3. 03
   Article 9 · Risk management

   ### Risk-level classification.

   Every workflow declares risk_level in YAML: minimal, limited, high, or unacceptable. The engine refuses to execute unacceptable workflows and enforces mandatory approval gates on high-risk ones — the Article 9 risk-management system is enforced by the runtime. → ARTICLE 9 · RISK MANAGEMENT → runtime-enforced risk gates

       risk_level: high
       steps:
         - id: review
           type: approval
           approval_config:
             message: "Human oversight required (Art. 14)"

4. 04
   Article 14 · Human oversight

   ### Emergency stop + approval gates.

   Every running workflow exposes an emergency-stop endpoint that halts execution within seconds. Approval steps let a human accept, edit, or reject any decision before it propagates — the Article 14 oversight measures are not theoretical, they are clickable. → ARTICLE 14 · HUMAN OVERSIGHT → emergency stop + approval

       POST /api/runs/{run_id}/emergency-stop
       { "stopped": true, "reason": "operator intervention",
         "logged_in_audit_chain": true }

5. 05
   Article 10 · Data governance

   ### Privacy router (PII redaction).

   Configurable per-workflow regex + named-entity redaction for emails, phone numbers, national IDs, IBAN, credit cards, and custom patterns. Operates in redact or audit-only mode. Outbound model traffic can be scrubbed before it leaves your network. → ARTICLE 10 · DATA GOVERNANCE → outbound PII redaction

       privacy:
         mode: redact
         patterns: [email, phone, iban, national_id]
         applies_to: [outbound_llm]

6. 06
   Article 13 + Article 50 · Transparency

   ### Compliance mode + AI disclosure.

   Compliance mode tightens defaults across the board: forces approval on every high-risk step, blocks workflows missing risk_level, requires Annex IV freshness, and stamps GenAI outputs with machine-readable AI-generated metadata as required under Article 50. → ARTICLE 13 + 50 · TRANSPARENCY → strict compliance mode

       $ sandcastle serve --compliance-mode strict
       [ok] Audit chain verified
       [ok] All workflows have risk_level
       [ok] AI-output watermarking enabled

Why self-hosted matters · EU-only execution

## The provider obligations sit with you. Keep the substrate too.

Under Article 25, the entity that puts an AI system on the market under its own name is the provider — even if it builds on a third-party model. The Act's provider duties cannot be outsourced to your SaaS vendor's privacy policy.

Sandcastle is open-source and runs entirely on your infrastructure. The audit trail lives in your database. The logs live on your disk. Model traffic can be pinned to EU regions or to on-premise inference — no data leaves your jurisdiction without your explicit configuration.

Self-hosted sandboxes for regulated workloads. Sandcastle wires Anthropic Managed Agents self-hosted sandboxes — tool calls run in your infrastructure (Cloudflare / Daytona / Modal / Vercel / Docker), orchestration brain at Anthropic. Combine with our Memory MCP server via tunnel to fill the memory_stores gap Anthropic disclaims. Read the deployment guide →

- ✓Audit logs stored in your PostgresArticle 12 · logs are your obligation, not your vendor's
- ✓EU-only execution enforced at the routing layerArticle 25 · provider responsibility for data flows
- ✓On-premise model inference via Ollama or oMLXNo third-party processor for sensitive prompts
- ✓Source-available BSL 1.1 — inspect every lineNo vendor lock-in for a 10-year retention obligation
- ✓Annex IV documents export as PDF or JSONArticle 11 · portable for handover to authorities

Ten ready-to-run workflows

## The Sandcastle Compliance Pack.

Pre-built YAML workflows for the documents and processes the Act references. Drop them into `workflows/`, edit the input schema, run them through the dashboard. Each declares its risk_level and maps to specific Articles.

Article 27 dpia.yaml

Data Protection Impact Assessment that walks through Annex IV section by section. Outputs a signed PDF ready for your DPO.

Vendor due diligence vendor-risk-assessment.yaml

Score third-party AI vendors on data residency, audit-trail support, model lineage, and incident history.

Article 73 incident-report.yaml

Serious incident reporting to the market-surveillance authority within the 15-day window required by Article 73.

Annex IV transparency-report.yaml

Generates the Annex IV technical documentation from your run history. Versioned, signed, exportable.

Article 10 bias-audit.yaml

Fairness check on a labelled dataset with demographic slicing, disparate-impact ratio, and recommendations.

Article 14 human-oversight-log.yaml

Records every human review decision (accept, edit, reject) with reviewer identity and timestamp.

Article 53 · Model governance model-card-generator.yaml

Produces a model card per the Article 53 GPAI provider obligations: training data, evaluation, limitations.

Article 9 risk-register.yaml

Maintains an ongoing risk register across your AI portfolio with severity, likelihood, and mitigation status.

GDPR Article 15 gdpr-data-subject-request.yaml

Orchestrates a DSAR fulfilment: search the audit trail, redact third-party data, package the response.

Article 49 ai-inventory.yaml

Org-wide AI system inventory: every workflow, model, provider, data class, and risk level in one register.

The deadline does not move.

## Stop drafting policy.
Start shipping artefacts.

Get the compliance pack, run it through the dashboard, and have the documents ready before 2 August 2026. Built for the EU AI Act era — designed to support compliance, on infrastructure you control.

Get the compliance pack ↗ Book a 30-min walkthrough Docs ↗