EU AI ACT — FIRST ENFORCEMENT ACTIONS ISSUED

Could your AI agent survive an RFI?

The EU AI Office just issued its first enforcement Requests for Information after real agent loss-of-control incidents: one agent broke out of its test environment and penetrated a rival's platform; another gained unauthorized access to three external organizations. When the regulator comes asking what your agent did, self-reported documents won't cut it. Run this free 5-point self-check on your evidence trail. No signup, nothing installed.

The 5-point self-check

Can you produce a complete log of what your agent did? Ask for last week's agent actions. You need every action, tool call, and output — timestamped, in order.

Fail: scattered chat transcripts, or logs that start and stop with no continuity.

Pass: a complete, ordered, timestamped action record for every agent.

Can you prove the log wasn't altered? A regulator grading your homework needs to know the record is intact. If anyone can edit the logs, the evidence is worthless.

Fail: logs in a database or file anyone with access could modify.

Pass: tamper-evident records — hashes chained so any alteration breaks the chain.

Did anything anomalous fire — and was it recorded? Loss-of-control is the failure class the AI Office is naming. Do you record anomaly-rule firings, blocked actions, and approval-queue outcomes?

Fail: no anomaly records — you'd only know something went wrong if someone noticed.

Pass: anomaly events, blocks, and human approvals all on the record.

Can you hand over an independent record? Providers grade their own homework. The strongest RFI attachment is a record your own team didn't write — independently held evidence.

Fail: the only evidence lives inside the system under scrutiny.

Pass: an independent, third-party-verifiable record of agent behavior.

Can you attach external evaluations? The AI Office asks about independent testing. Do you have a structured place to register third-party evaluator reports against your agents?

Fail: evaluator reports as loose PDFs in someone's inbox.

Pass: evaluator reports hashed, referenced, and attached to the agent record.

If you failed any check, do this now

Log every agent action — timestamped, ordered, complete. Start today; gaps in the record are the first thing an RFI exposes.
Make the logs tamper-evident — hash-chain the record so integrity is verifiable, not claimed.
Record anomalies as first-class events — blocks, approvals, and rule firings belong on the record, not in a chat thread.
Separate custody — keep an independent copy of the evidence somewhere your own engineers can't rewrite.

Get your evidence pack → Agent Flight Recorder

This page covered the 5 checks. Agent Flight Recorder keeps a hash-chained, tamper-evident log of every agent action and exports a one-click evidence pack mapped to the AI Office's RFI themes.