EU AI Act Readiness, as Composable Skills
The Digital Omnibus moved the high-risk deadline to December 2027 — it did not move the obligations: serious-incident reporting, tamper-evident logs, human oversight, data governance. Evidence trails are built during the runway, not the week before. Five pay-per-call skills your pipeline can adopt now.
Obligation → Skill Mapping
Each operational obligation in the Act, mapped to a marketplace skill that discharges it — priced per call, paid in USDC via x402, no procurement cycle.
Serious-incident reporting
Providers of high-risk AI systems must report serious incidents — within 15 days of awareness, 2 days for widespread incidents — using the Commission’s structured template.
Assembles hash-chained incident files from records your pipeline already produces: invocation traces with payment proofs, approval decisions, audit entries, and liveness receipts. Structured to double as the Article 73 report.
Record-keeping & logging
High-risk systems must automatically record events over their lifetime, and deployers must retain logs for at least six months, in a form suitable for authority inspection.
SHA-256 hash-chained audit entries in JSONL/CSV/CEF. Tamper-evident by construction — the same export serves SOC 2, ISO 27001, and AI Act inspection requests.
Human oversight
High-risk systems must be designed for effective human oversight, and deployers must assign oversight to competent, trained natural persons.
Pauses any pipeline step for a human decision with Slack/email/webhook delivery, quorum rules, timeout escalation, and audit-ready decision records — oversight you can point an auditor at.
Data governance
Training, validation, and testing data must follow documented governance practices, including examination for biases and appropriate handling of personal data.
Field-level PII and special-category classification with jurisdiction-aware handling recommendations for EU/UK/California/Brazil — inline, before data enters your pipeline.
Deployer usage controls
Deployers must use high-risk systems in accordance with their instructions for use and suspend use when risks emerge.
Sub-25ms policy evaluation with allow/deny/require_approval verdicts and dry-run testing — encode the instructions for use as machine-checkable policy and enforce them on every action.
The Compliance Timeline
The Act phases in over four years, and the May 2026 Digital Omnibus reshaped the back half: GPAI enforcement starts August 2026, high-risk obligations follow in December 2027.
Why Composable Skills Beat a Compliance Suite
Adopt in days, not quarters
Each obligation is one API call added to an existing pipeline step. No platform migration, no seat licenses, no procurement cycle before the deadline.
Evidence you already generate
Invocation records, payment proofs, approval decisions, and liveness receipts become your compliance evidence — hash-chained and exportable on demand.
Pay per governed action
Full oversight — classification, policy gates, approval, audit trail, and incident readiness — costs roughly a cent per governed action in x402 micropayments. Compliance scales with usage, not headcount.
Building Compliance Infrastructure?
Conformity assessment helpers, FRIA generators, CE-marking documentation, post-market monitoring — the AI Act creates demand for skills that don't exist yet. List yours before the deadline traffic arrives.