EU AI Act — SME Article 12 Evidence (Not the Whole Act)
The EU AI Act mentions SMEs throughout — regulatory sandboxes, proportional fines, simplified documentation. Sigigo does not replace that legal layer. This guide covers what small deployers need technically when Annex III high-risk logging applies: automatic capture and retention under Articles 12/26, plus (optionally) exportable evidence packs as Sigigo’s integrity layer.
What SMEs need technically
Downstream SMEs building on GPT, Gemini, or Claude should focus on intended use — if your product screens CVs, scores credit, or automates hiring decisions, Annex III likely applies regardless of GPAI provider tier. Article 12 then requires automatic lifetime event recording. Mutable startup logs are easy to rewrite under later scrutiny; Sigigo adds signatures and export so the record remains checkable.
| Evidence dimension | Source of expectation | Sigigo action |
|---|---|---|
| Automatic capture | Article 12 (high-risk) | SDK at inference boundary |
| Retention ≥ 6 months | Art. 26(6) deployer duty | Tenant policy + export slice |
| Tamper-evident chain | Sigigo evidence quality (not Art. 12 text) | Signed ai_act.* events |
| Offline verification | Sigigo evidence quality (not Art. 12 text) | Evidence pack + VERIFY.md (roadmap) |
| GDPR-minimized payloads | Processor scope / Privacy | Private Commitment Mode default |
What to link out (legal — FLI)
- Art. 55 sandboxes, fee proportionality, simplified QMS — FLI SME guide
- Role and risk classification — FLI Compliance Checker
- December 2027 Annex III cliff — implementation timeline
Starter ai_act.* chain for SME products
ai_act.inference_started
→ ai_act.input_received
→ ai_act.output_generated
→ ai_act.human_review_completed (if oversight)
→ ai_act.inference_completed
Full field map: Article 12 hub. Self-check: Evidence readiness quiz.
FAQ
- Do lower SME fines mean mutable logs are fine?
- No. Proportional penalties under Art. 55 do not relax Article 12's automatic lifetime recording duty for high-risk systems. Cryptographic integrity is still optional under the Act — but mutable admin-editable stores are harder to defend when records are challenged.
- We are a startup using OpenAI — are we a GPAI provider?
- Usually you are a deployer or integrator. GPAI provider rules apply to foundation model vendors. Focus on your intended use and Annex III categories.
- Should we publish a full SME guide to the whole Act?
- Link FLI for legal breadth. Publish narrow technical evidence content — this page and the Article 12 hub — to rank for logging and proof queries.
Get in touch to map your SME product flow to ai_act.* events before the December 2027 deadline.
This guide supports qualification and architecture planning — it is not legal advice. Work with your legal and compliance teams on classification, DPAs, and deployment approvals. See also our Regulatory & Compliance page.