Admin guide · Organization

EU AI Act

Three things live under Admin → EU AI Act: a classifier that labels your Prompt Vault prompts by risk level, the per-key enforcement that compares live traffic against what a key declared, and an evidence pack you can hand to an authority.

The risk classifier

Turn it on and pick the model that powers it. A dedicated API key is provisioned on the internal System project and stored encrypted.

The EU AI Act admin page: an explanatory banner, then a Configuration card with an Enabled toggle, a model picker and a provisioned API key. — Admin → EU AI Act — the classifier and the model behind it.

With it on, every prompt in the Prompt Vault carries a risk level — minimal, limited, high or unacceptable — shown in the editor next to the prompt content, with a Mitigate risk action that proposes a safer rewrite. With it off, classification simply disappears from the Vault; nothing else changes.

Enforcement is per API key

The page configures the classifier. Whether a request is actually blocked is decided on the key that made it.

Each API key carries an EU AI Act policy block: a self-assessed risk level for the application behind that key, and whether traffic that contradicts it is blocked or merely flagged. A key with no declaration is not judged at all — its calls are counted as skipped.

warning · A drift detector, not a legal classifier

Under the EU AI Act, risk is assessed on a system and its intended purpose — never on a single request. A flagged call means the traffic is inconsistent with the key's declared self-assessment: a signal to review the declaration or the application. It is not a legal determination, and the platform does not make one for you.

Watching the drift

The Compliance tab of Monitoring is the reporting side of this page.

The Compliance tab of Monitoring: calls evaluated, violations, judge failures and judge cost, a guardrail activity chart split into within-declaration, violations and skipped, and risk-level breakdowns. — Monitoring → Compliance — evaluated calls, violations and the risk mix.

Field	Type	Description
Calls evaluated	counter	Evaluations recorded in the period, including calls skipped for want of a declaration.
Violations	counter	Calls whose deduced risk contradicted the declaration, split into blocked and flagged.
Judge failures	counter	Timeouts and provider errors on the judge itself — these are not verdicts, and a rising count means the signal is going blind.
Judge cost	spend	What the classification itself cost, with its average latency. It is real gateway traffic and shows up in your spend.

Deduced risk mix is what the judge inferred from the conversations; Declared risk on API keys is what you told it to expect. Comparing the two is the point of the page — a large skipped share means the keys are not declaring anything yet, not that you are compliant.

Evidence pack

A period's compliance evidence as one ZIP: traces, audit logs, guardrail events, roles and AI Act declarations, with a PDF summary.

Scope it by period and, optionally, a single project or key. Past exports stay listed with who requested them, their size and a SHA-256 digest — so an export you hand over can be shown later to be the same bytes.

tip · Export before retention catches up

The pack can only contain what still exists. Payload bodies are kept 30 days and generations follow your retention policy, so a pack for a period older than that comes back thinner. If an incident may need evidence, export it while the window is open.