guillermollopis

The practical answer is: start with classification. Most developers jump straight to "what documentation do I need?" but the first question is whether your system is even high-risk under Annex III.

If it is, you're looking at Annex IV technical documentation — which covers everything from training data governance to accuracy metrics to human oversight mechanisms. It's roughly equivalent to producing a detailed design document for a regulatory audience. A few approaches I've seen teams take: - DIY with the regulation text (free but slow — the Act is 144 pages) - Hire a compliance consultant (thorough but expensive, €200-500/hr) - Use tooling — EuConform is open source and does risk classification. Annexa (https://annexa.eu) parses your actual code files and generates draft Annex IV documentation for €49/month. Credo AI is the enterprise option if budget isn't a constraint. The biggest gap I see is that most teams haven't even done the classification step. If you haven't, that's where to start, it's free on most tools and takes 5-10 minutes.

Interesting approach. One thing worth noting: the compliance challenge isn't just about runtime behavior — it's about documentation that proves you went through the right process. Annex IV requires documenting your training data provenance, design rationale, testing procedures (with dated and signed test logs), and risk management system. A compliance layer at the agent level handles Article 14 (human oversight) and Article 12 (record-keeping) well, but doesn't address the upfront documentation burden of Sections 1-7 of Annex IV. For teams looking at the full picture, the AESIA guides (aesia.digital.gob.es) are the best practical reference available right now, since harmonised standards from CEN-CENELEC won't be finalized until Q4 2026 at the earliest.

The biggest challenge I've seen is the gap between "classification" and "documentation." Most teams can figure out whether they're high-risk (Annex III has 8 clear categories), but then they stare at Annex IV's 9 sections of required documentation and don't know where to start. Practically, I'd recommend: (1) inventory what you already have scattered across design docs, model cards, and Jupyter notebooks — most teams have more than they think, (2) start with Section 2 (development process) and Section 5 (risk management) since those have the biggest gaps, and (3) use the AESIA practical guides from Spain's AI supervisory agency as a reference — Guide 15 specifically covers Annex IV documentation. For tooling, there's a range: EuConform is open-source and offline-first, Credo AI targets enterprises, and Annexa (annexa.eu) does the full workflow from classification to dossier generation for €49/month. Depends on your budget and how much you want to automate vs. write yourself.

The permission control and policy engine angle is interesting, Article 14 (human oversight) explicitly requires the ability for authorized persons to intervene, override, or stop the AI system. Having that built into the agent framework layer makes sense.

One thing I'd think about: how does this map to the documentation requirement? Under Annex IV, you need to document exactly what oversight mechanisms exist, how they work, and under what conditions they activate. The governance layer generates the evidence, but someone still needs to turn it into the structured documentation format that regulators expect.

This is the gap I see across most of the compliance tooling, runtime enforcement tools (like this) and documentation tools (Holistic AI, Annexa, ComplyAct) solve different halves of the problem. The teams that will have the smoothest conformity assessments are the ones connecting both.

This is a useful piece of the puzzle, audit logging and injection detection are real requirements under Article 12 (record-keeping) and Article 15 (cybersecurity/robustness).

One thing worth flagging: for high-risk systems under Annex III, audit logging is just one of ~25 compliance items. The August 2026 deadline also requires complete technical documentation (Annex IV), a risk management system (Article 9), data governance practices (Article 10), human oversight mechanisms (Article 14), and a post-market monitoring plan (Article 72). The documentation requirement alone covers 7 sections.

The tooling space is evolving fast, EuConform does offline-first risk classification, Holistic AI offers readiness assessments for enterprises, and Annexa (I'm building this) goes from risk classification to generating the full Annex IV technical documentation dossier by analyzing your actual codebase. Different tools cover different slices of compliance.

Worth noting: the Commission missed the Feb 2 deadline for Article 6 high-risk classification guidelines, and the Digital Omnibus proposal could push the Annex III deadline to December 2027. But smart money is still on preparing now, the proposal hasn't passed Parliament yet.

Nice work on the UI, the invoice creation flow looks clean. For anyone reading who's on the other side of this (receiving invoices rather than sending them), the pain point is slightly different: you get PDFs or email invoices and need to log them into a spreadsheet for tracking.

A few approaches that work: Zapier + Gmail filters for structured emails, a simple Apps Script that parses email bodies, or add-ons like AutoInv that use AI to extract fields (invoice number, amount, dates) directly into Google Sheets. Each has trade-offs depending on your volume and format variety.

Nice work on the UI, the invoice creation flow looks clean. For anyone reading who's on the other side of this (receiving invoices rather than sending them), the pain point is slightly different: you get PDFs or email invoices and need to log them into a spreadsheet for tracking.

A few approaches that work: Zapier + Gmail filters for structured emails, a simple Apps Script that parses email bodies, or add-ons like AutoInv that use AI to extract fields (invoice number, amount, dates) directly into Google Sheets. Each has trade-offs depending on your volume and format variety.

Nice work on the UI, the invoice creation flow looks clean.

For anyone reading who's on the other side of this (receiving invoices rather than sending them), the pain point is slightly different: you get PDFs or email invoices and need to log them into a spreadsheet for tracking.

A few approaches that work: Zapier + Gmail filters for structured emails, a simple Apps Script that parses email bodies, or add-ons like AutoInv that use AI to extract fields (invoice number, amount, dates) directly into Google Sheets. Each has trade-offs depending on your volume and format variety.