There are two kinds of EU AI Act preparation happening right now. Legal teams are classifying systems against Annex III, drafting instructions for use, and deciding what counts as high-risk. That work is necessary and none of it is ours to sell you.
The second kind is operational, and it is dramatically underweighted: when the obligations apply, your pipeline has to actually do things. Log events in a form an authority can inspect. Put a competent human in the loop where the Act requires oversight. File a structured serious-incident report within fifteen days of awareness — two days if the incident is widespread. These are runtime behaviors, not documents, and a pipeline that doesn't have them wired in on August 1 will not grow them overnight.
The good news: every one of these behaviors already exists on BluePages as a composable, pay-per-call skill. Here is the checklist.
1. Can you file an Article 73 report in fifteen days?
Article 73 is the obligation with a stopwatch attached. A serious incident — death, serious harm, infringement of fundamental rights, serious disruption of critical infrastructure — triggers a report to the market surveillance authority within 15 days of awareness. Widespread incidents compress that to 2 days. The Commission has published a structured reporting template; "we emailed our lawyer" is not a submission format.
The hard part isn't the form. It's assembling defensible evidence of what your agents actually did, in order, with timestamps that survive scrutiny.
incident-claim-packager ($0.004/call, AgentSure.io) builds exactly that file from records your pipeline already produces: invocation traces with payment proofs, approval decisions, audit entries, spending-limit state, and liveness receipts, hash-chained so nobody can quietly edit history. It was designed as an insurance claim packager — the same structure is the Article 73 report, the SOC 2 incident evidence, and the post-mortem source document.
Checklist test: trigger a synthetic incident today and time how long it takes to produce a complete, hash-verified incident file. If the answer is measured in meetings, you have four weeks to make it one API call.
2. Are your logs evidence, or just logs?
Articles 12 and 19 require high-risk systems to automatically record events across their lifetime, and deployers to retain those logs — at least six months — in a form suitable for inspection. Application logs in a rotating CloudWatch group do not clear that bar: they're mutable, unordered across services, and indistinguishable from logs you could have rewritten.
audit-trail-generator ($0.001/call, ComplianceKit) writes SHA-256 hash-chained entries in JSONL, CSV, or CEF. Each entry commits to the previous one; tampering breaks the chain visibly. Exports serve SOC 2 and ISO 27001 audits with the same file.
3. Is a human actually in the loop, and can you prove it?
Article 14 requires high-risk systems be designed for effective human oversight; Article 26 makes deployers assign that oversight to competent, trained people. Auditors will not accept "an engineer watches the dashboard." They will ask: which decisions paused for a human, who decided, when, and under what escalation rules?
approval-gate ($0.002/call, ApprovalLoop.dev) pauses any pipeline step for a human decision — Slack, email, or webhook delivery, any/all/majority quorum, timeout policies with explicit default actions — and records every decision in audit-ready form. Pair it with confidence-threshold-router to route only genuinely uncertain actions to humans, so oversight is effective and affordable.
4. Do you know what personal data your agents touch?
Article 10's data governance obligations — and GDPR, which never went away — require you to know when personal and special-category data enters your pipeline. Agent pipelines are spectacular at accidentally forwarding PII to third-party endpoints.
gdpr-data-classifier ($0.002/call, ComplianceKit) classifies fields inline with jurisdiction-aware recommendations, and data-anonymizer ($0.002/call, DataLens.ai) redacts, hashes, masks, or synthesizes before data leaves your boundary.
5. Are the instructions for use enforced, or aspirational?
Article 26 requires deployers to use high-risk systems in accordance with their instructions for use and to suspend use when risk emerges. In agent terms: the constraints your provider documented must be enforced at runtime, not filed in Confluence.
policy-gate-checker ($0.001/call, ComplianceKit) evaluates allow/deny/require_approval policies in under 25ms with dry-run testing. Encode the instructions for use as policy; every action either conforms, is blocked, or escalates to your approval gate. Suspension-on-risk becomes a policy flip, not an incident retro action item.
The arithmetic
For a pipeline running 500 governed actions a day, the full stack — classification ($0.002) + policy gate ($0.001) + oversight on the ~10% that escalate ($0.0002 amortized) + audit trail ($0.001) — comes to about $2.10/day, with incident packaging invoked only when something actually goes wrong. Call it a cent per governed action. Compare that to a compliance-suite procurement cycle that won't even finish its security review by August 2.
All five skills ship together in the EU AI Act Ready collection, and the new /eu-ai-act page maps each obligation to its skill with the full compliance timeline.
What this is not
This is not legal advice, and skills don't make an unclassified system compliant. Whether your system is high-risk, what your instructions for use must say, whether an incident is "serious" — those are determinations for counsel. What these five primitives do is make the operational obligations — the ones with clocks and templates and inspectors — a solved engineering problem, so your legal team's determinations have something real to attach to.
Four weeks. Five API calls. The deadline doesn't move.