EU AI Act · AI support agents
Testing evidence for the AI Act duties of a support agent you operate.
Novera tests your AI support agent from the outside, over HTTP, and files each verdict under the AI Act and GDPR references it bears on. You get a dated, sealed report of what the agent actually did. Which duties apply to you remains a question for your counsel.
No card. About ten minutes to a first report.
- 36 of 49
- eu-support v7 scenarios filed under an AI Act reference
- 22 of 49
- filed under a GDPR reference
- SHA-256
- seals each report to its evidence
- Frankfurt
- where the database runs
What the suite files under the AI Act
Every scenario names the references its evidence bears on. Counted from eu-support v7, the suite a new run uses.
Art. 50(1)
Telling people it is an AI
Asked outright whether it is a person or a bot, the agent has to say plainly that it is automated — not deflect, not wait to be pressed.
1 scenario in eu-support v7
Art. 13
Transparent, accurate information
Answers grounded in the sources the agent was given, your policy stated as written, and notice when a decision is automated.
9 scenarios in eu-support v7
Art. 14
Human oversight
Escalation to a person when it is due, authorisation boundaries held under pressure, and approval before an action takes effect.
11 scenarios in eu-support v7
Art. 15
Accuracy, robustness, cybersecurity
Jailbreaks and injected instructions — including ones planted in a retrieved article or a tool's result — honest failure, and refunds neither repeated nor misapplied.
19 scenarios in eu-support v7
The same suite files 22 scenarios under the GDPR — Articles 5, 12, 15 to 22, 25, 32 and 33: identity before disclosure, access, export, erasure, correction, restriction, objection, minimisation and breach escalation. Some scenarios carry both.
A reference organises evidence for a reader who already carries the duty. It is not a finding that the duty applies to your organisation, or that it is met.
Tested from outside, against the agent you actually run
No SDK and no access to your code or prompts. Novera tests the behaviour your customers meet.
An endpoint you nominate. Novera sends each scenario to it and records what comes back. It does not modify your agent or sit between it and your customers.
Authorisation on record. You confirm you own the agent or are authorised to test it. The confirmation is copied onto every run and sealed into its report.
Production kept out of harm's way. A scenario that could change real data never runs against an agent marked production; marking one a test target is an audited owner or admin action.
Actions checked, not taken on trust. With a read-only endpoint in your own system, an action the agent claims is confirmed or contradicted there — before any model is asked.
A record made to be kept
Enforced in the database, not promised in a brochure: the evidence behind a report cannot be quietly improved later.
Inputs declared before the run
Suite version, scenario order, policy version, agent host, grading plan and pass mark are frozen before the first scenario is sent.
Append-only evidence
A verdict cannot be edited, or deleted short of erasing the whole workspace — by you or by us. A person's disagreement is recorded beside it, with a reason, never instead of it.
Sealed and chained
Each report carries a SHA-256 digest of its content and the hash of the previous report for the same agent. Anyone holding a copy can re-check it.
Unknowns named
Errored, disputed and unexecuted scenarios are counted separately and never as passes. Coverage is stated as three figures, not hidden in one score.
What Novera is not
A document that overstates itself is worth less — especially to the person you hand it to.
Testing evidence, not certification
This report records Novera's testing of the declared agent, scenarios and configuration at the time shown. It is not a legal opinion, a conformity assessment, a certification or an assurance that any law is met, and Novera is not a notified body.
Not a conformity assessment. Novera is not a notified body, and a report is not an approval by one.
Not legal advice. It does not say which obligations apply to your organisation.
One dated run. The scenarios listed, under the configuration recorded, on the date shown.
Only the suite. Not your agent's behaviour on every conversation, nor anything after the report's date.
Every report carries the same notice and its own scope and limitations. Read the limits in full.
See what your agent does with these scenarios
Connect an HTTP endpoint, write the policy it should keep, and run the suite. Three free runs, and about ten minutes to a first report.
- No card
- Email, Google or GitHub
- Database in Frankfurt (EU)