The rules we map to. The ones we don’t pretend to.

High-risk AI systems must “technically allow for the automatic recording of events over the lifetime of the system,” and deployers must retain those logs for at least six months — a floor, not a target; sector law (AML, SOX, HIPAA) routinely demands longer. Article 17 adds a Quality Management System; Annex IV adds technical documentation.

The Act does not explicitly require cryptographic logs — but it does require completeness, integrity, and reconstruction. A mutable log fails all three. Runfile produces an Article 12 monthly log-integrity report as a single command.

The May 2026 Digital Omnibus moved standalone high-risk obligations to 2 Dec 2027 and embedded high-risk to 2 Aug 2028. Both are now fixed calendar dates, not standards-conditional.

Live across EU financial services since 17 Jan 2025. ICT risk management, ICT third-party register, incident reporting within 48 hours, and audit trails. Mid-2025 BaFin guidance pulled AI explicitly into DORA scope; the UK CTP regime adopted parallel rules from 1 Jan 2025.

Runfile generates DORA major-ICT-incident packets directly from the captured event graph — detection, classification, response, recovery, post-incident review — with hashes that survive the 48-hour timeline.

On 17 April 2026 the Fed, FDIC and OCC rescinded SR 11-7, SR 21-8, OCC 2011-12, the OCC MRM Handbook booklet, and OCC Bulletins 1997-24 and 2021-19, replacing them with risk-tiered, principles-based, technology-neutral interagency guidance. The agencies signaled a forthcoming AI-specific RFI; dedicated agentic-AI guidance is still pending. SR 11-7’s three pillars — independent validation, ongoing monitoring, documentation — remain the operating template AI and agentic systems will be measured against.

Runfile ships an annual model-documentation pack and a continuous monitoring report that maps directly to those three pillars.

Article 22 governs automated decisions with legal or significant effect on a person; Article 30 mandates records of processing. When an agent denies credit, declines a claim, or routes a hire, both articles fire.

Runfile records the human-in-the-loop intervention that lifts a decision out of Article 22’s “solely automated” carve-out — with the approver identity, timestamp and signed justification needed to prove it.

When an agent triggers or affects a financial control — revenue recognition, journal entries, period close — the agent action becomes SOX-relevant. Internal Audit teams already worry about this; few have the records to answer.

Seven-year retention with continuous integrity proofs and reconstruction queries on any single financial control event.

Six-year retention. When an agent is the actor touching PHI, the covered entity needs an identifiable agent principal, the action, the PHI fields touched, and any human approval. BAA-capable from day one; healthcare residency on request.