eu-ai-act scorecard maps your runs onto specific obligations of
Regulation (EU) 2024/1689: Article 55
(obligations for general-purpose AI models with systemic risk, including
adversarial testing) and Article 73 (serious-incident reporting).
This is finer-grained than the compliance scorecard, which shows EU AI Act
risk tiers. Here each obligation is a row, and the scorecard says which of your
runs speak to it.
Running it
Reading the table
Each obligation carries its own status and counts:
Runs that errored are counted separately and never reported as bypasses. Five
provider timeouts against a systemic-risk category show up as five errored
runs, not five systemic-risk bypasses. A control that could not run is not a
finding.
The obligation identifiers (55(1)(a) through 73(6)) are real provisions of the
regulation, but the mapping from ai-blackteam findings to obligations is this
project’s interpretation, marked unverified in the data. It is a starting point
for an audit conversation, not a legal compliance certificate.