Start by checking which law, supervisory expectation, proposal, or guidance applies to your organization. The table identifies each instrument, its status, and who it addresses. The contribution section then explains what AAES Govern records can help a reviewer examine.
These pages describe the product and cite public instruments. They are not legal advice, not a certification, and not a statement that any instrument applies to your organization. The official source is authoritative; applicability questions belong to your advisers.
Instruments, by status
| Instrument | Status | What it addresses |
|---|---|---|
| AI Act, Regulation (EU) 2024/1689 | Binding law, staged application. In force 1 August 2024.
| Providers and deployers of AI systems, including systems used in the EU by organizations established elsewhere. Human oversight (Article 14), record-keeping, and deployer duties for high-risk systems are provisions a reviewer may examine using action-layer records. AAES is not a conformity-assessment tool. |
| GDPR, Article 22 | Binding law. | Decisions based solely on automated processing with legal or similarly significant effect, subject to exceptions and safeguards. GDPR roles are controller and processor; meaningful human involvement routes, safeguards and information duties sit with the controller. |
| DORA, Regulation (EU) 2022/2554 | Binding law; applies since 17 January 2025. | ICT risk management, incident reporting, and third-party oversight for financial entities. AI agents acting on financial systems sit inside the entity's ICT risk picture. The entity answers to its supervisor; designated critical ICT third-party providers can also face direct oversight. |
What AAES Govern records may contribute
| Expectation | AAES contribution | Capability status |
|---|---|---|
| Named accountability for AI-supported work (deployer governance and internal accountability) | Each registered agent has an accountable manager whose chain of managers ends at a person. AAES Govern records the approver for human approval decisions; those assignments do not establish statutory appointments. | Implemented. |
| Human oversight of consequential actions (AI Act Article 14 pattern; GDPR Article 22 safeguards) | Capabilities registered as irreversible require human approval bound to the exact request, with expiry. The operator classifies the action and must ensure reviewers have the information and authority to decide. | Implemented. |
| Records supporting internal review and supervisory evidence (AI Act record-keeping pattern; DORA ICT documentation) | Decision records are linked by cryptographic fingerprints to help detect changes. The client's own reviewer can check an export offline. | Implemented. An independently controlled witness can be configured separately; that is not an external assessment, and the default deployment has none. |
AAES Govern decision records may support review of access and approval controls. They do not establish conformity with the AI Act, lawful processing under the GDPR, DORA compliance, or compliance with any instrument as a whole.
Export checks do not establish complete capture, downstream success, or meaningful human oversight. Enforcement requires a credential path the agent cannot bypass. See the verification checks and their limits.
Your responsibilities
- The client remains the regulated entity. Ask your advisers whether you are a provider or deployer and which annex applies.
- Activity outside AAES Govern is visible only where telemetry is supplied. Decision records cover routed requests; reported telemetry may describe other activity without establishing complete coverage.
- AAES has no independent certification or assessment. No SOC 2 report exists, no penetration test has been performed, and AAES performs no conformity assessment of your AI system.
- Status changes. The application dates shown here have already moved once (see the AI Act entry above), and further amendment proposals are in the pipeline. Re-check the Official Journal before relying on the dates shown here.
Bring the instruments your risk team cites to a scoped evaluation.