RFC-028: EU AI Act Alignment — Regulatory Governance Framework — 4. High-Risk AI Systems — Mandatory Governance (Art. 6-49)

AIGP Specification › RFC-028: EU AI Act Alignment — Regulatory Governance Framework › 4. High-Risk AI Systems — Mandatory Governance (Art. 6-49)

← 3. Prohibited Practices (Art. 5) — Non-Derogable Rules · Section index · 5. Fundamental Rights Impact Assessment (Art. 27) →

4. High-Risk AI Systems — Mandatory Governance (Art. 6-49)

4.1 When risk_classification == "HIGH_RISK"

The following become mandatory AIGP protocol behaviors (non-optional):

Article	Requirement	AIGP Mechanism	Implementation
Art. 9	Risk management system	Governance engine + policy evaluation	risk_management_active: true on REGISTER
Art. 10	Data governance	Data classification on REQUEST	data_classification field already exists — extend with EU categories
Art. 11	Technical documentation	Evidence chain (RECORD + TRACE + D-DNA)	Already covered — add conformity_documentation_ref
Art. 12	Record-keeping	Automatic logging (10 years retention for high-risk)	Evidence retention: retention_years: 10
Art. 13	Transparency to deployers	Disclosure metadata on VendorRecord	Add deployer_disclosure object
Art. 14	Human oversight	RFC-027 human_authority pattern	Extend: human_oversight_measures field
Art. 15	Accuracy, robustness, cybersecurity	Feedback loop (RFC-026) + quality monitoring	accuracy_metrics + robustness_level
Art. 16	Provider obligations	Conformity declaration	ce_marking: true, eu_declaration_of_conformity_ref
Art. 17	Quality management system	Evidence of QMS	quality_management_system_ref
Art. 19	Automatically generated logs	TRACE spans (all 14 stages)	Already covered — mandate TRACE for HIGH_RISK
Art. 26	Deployer obligations	Monitor for risks during operation	Post-market monitoring signal
Art. 27	FRIA	Fundamental Rights Impact Assessment	New fria field — see §5

4.2 Mandatory Evidence Retention (Art. 12)

def calculate_retention(record: dict) -> int | None:
    regulatory = record.get("regulatory_context", {})
    if regulatory.get("framework") == "EU_AI_ACT":
        if regulatory.get("risk_classification") == "HIGH_RISK":
            return 365 * 10  # 10 years — Art. 12
    # ... existing logic

4.3 Mandatory TRACE Mode (Art. 19)

When regulatory_context.risk_classification == "HIGH_RISK":

• TRACE is mandatory (cannot be disabled)
• Mode forced to REPORT-TRACE minimum
• All 14 governance stages must be recorded

---

---

← 3. Prohibited Practices (Art. 5) — Non-Derogable Rules · Section index · 5. Fundamental Rights Impact Assessment (Art. 27) →