EU AI Act

Statute European Union

The EU Artificial Intelligence Act is the first regime to regulate artificial intelligence horizontally rather than sector by sector, and it arrives at an industry that has almost nothing machine-readable to show it. It sorts AI systems by risk — prohibited practices, high-risk systems carrying the heaviest duties, limited-risk systems owing transparency, and minimal-risk systems left alone — and adds a separate track of obligations for general-purpose AI models, including the systemic-risk tier that the frontier labs sit in.

• Risk tiers, not licences - Obligations attach to what a system does and to whom, so two companies shipping near-identical inference endpoints can land in different tiers based on the downstream use they enable.
• Documentation, logging and traceability - High-risk providers must maintain technical documentation, keep automatic logs, and be able to reconstruct how a system behaved. That is an audit and telemetry requirement expressed in prose, and almost nobody expresses it in a contract.
• Transparency and disclosure duties - Users must be told when they are interacting with an AI system, when content is synthetic, and when emotion recognition or biometric categorization is in play.
• Human oversight as a design requirement - High-risk systems must be built so a person can intervene, which is the regulatory twin of the human-in-the-loop escalation an agentic API contract should declare.
• General-purpose model obligations - Model providers owe technical documentation, copyright policy, and a training-content summary; systemic-risk models owe evaluation, adversarial testing, incident reporting and cybersecurity on top.

The AI Act is the clearest case in my catalog of a regime that restricts without requiring an interface. No article of it obliges a provider to publish an OpenAPI, a scope model, or a consent endpoint — which is exactly why the artificial-intelligence cohort scores the way it does. The duties it creates are provable duties: who acted, on whose behalf, under what disclosure, with what human able to stop it, retained in a log somebody can read back. Every one of those is a thing an API contract can carry and almost no AI provider carries it. Consent and identity surfaces appear in 3.9% of the industry; idempotency, the property that decides whether a retried autonomous action happened once or twice, appears in 2.6%. When the conformity assessments start landing, the companies that treated machine-readable governance as optional polish will be assembling their evidence by hand.

This is also why the Kin Score does not yet fold a Regulatory Posture facet into artificial intelligence the way it does for banking, health, energy or telecom: the AI Act compels no interface, so there is no mandated contract to score against. That is a finding about the regime, not an omission in the rubric — and it is the thing most likely to change as the Act’s obligations phase in.