Every Penaxtra finding carries the specific EU AI Act article
PDF and JSON exports format the evidence for technical-documentation Annex IV submission..
EU AI Act Compliance Mapping
The EU AI Act creates a horizontal regulatory regime for AI systems across the European Union, with the strictest obligations falling on providers of high-risk AI systems. Cybersecurity, robustness, and accuracy obligations under Article 15 plus risk-management obligations under Article 9 apply to Annex III high-risk systems from 2 December 2027, after Regulation (EU) 2026/1744 (in force 27 July 2026) moved the original 2 August 2026 date; Article 50 transparency duties have applied since 2 August 2026.
Last reviewed October 2026
Why EU AI Act evidence is hard
An auditor works from a framework control list; a scan produces a finding list. Without a mapping between the two, each finding has to be translated onto the controls by hand before an audit.
How Penaxtra maps to EU AI Act
Penaxtra produces evidence aligned to high-risk provider obligations: risk-management system (Art. 9), data governance (Art. 10), technical documentation (Art. 11), record-keeping (Art. 12), transparency to deployers (Art. 13), human oversight (Art. 14), accuracy and cybersecurity (Art. 15), quality management (Art. 17), and post-market monitoring (Art. 72).
EU AI Act capabilities
Audit-ready PDF export with control IDs attached
JSON export for GRC ticketing systems
Configurable audit retention from 1 day to 10 years
Cross-framework overlaps reduce duplicate evidence collection
EU AI Act control coverage
A prompt-injection finding against an internal copilot maps to EU AI Act Art. 15(4) cybersecurity, Art. 9(2)(a) risk management, and Art. 12(1) record-keeping in a single row.
Controls in this framework
Each control has a dedicated page: what it covers and how Penaxtra tests and evidences it.
Art.10 Data and Data Governance
Art.11 Technical Documentation
Art.12 Record-Keeping
Art.13 Transparency + Information to Users
Art.14 Human Oversight
Art.15 Accuracy, Robustness, Cybersecurity
Art.5 Prohibited AI Practices
Art.50 Transparency for AI-Generated Content
Art.6 Classification Rules for High-Risk AI
Art.9 Risk Management System