EU AI Act — compliance: how CSOAI measures it

Compliance is not a checkbox. It is a measurement, on a published harness, signed so a third party can verify. This page is the operational guide for what we measure and how the evidence is produced.

The four pillars of credible evidence

Frozen harness — the tests are published before the run, so the run cannot be tuned to pass.
Deterministic execution — pinned seeds, published splits, confidence intervals on every figure.
Signed artefacts — Ed25519-signed result records a third party can verify without trusting us.
Corpus-watch — when the provision text changes, the affected measurements re-fire. Compliance that goes stale is not compliance.

What we publish for the EU AI Act

AI Act frozen-split harness — closed-book statutory citation measurement.
ProvBench — Article 50 provenance survival (0 of 20 embedded manifests survived any measured transform).
Article 50 Passport — free signed transparency record in about two minutes.
Article 43 (internal-control route) — most Annex III systems can self-assess; what makes the assessment credible is evidence, not assertion.

What we do not do

Issue certifications. We measure; a regulator certifies.
Replace notified bodies where the law requires them.
Sign "passed" claims without a measurement and a harness.
Issue accreditations — we are a measurement body, not an accreditation body.

Boundary

This is not legal advice. The evidence layer is verifiable and inexpensive; the legal interpretation is its own layer (notified bodies, regulators, counsel). Get a lawyer for anything that touches liability.