Reference · EU AI Act and GDPR
Which scenarios bear on which references, counted from the suite itself.
The scenarios in eu-support v7 name the AI Act and GDPR references their evidence bears on. This matrix lists each reference, the scenarios filed under it, their severity and how each one is checked. Nothing on it is typed by hand: it is read from the suite a new run uses.
No card. About ten minutes to a first report.
- 18
- references carried by eu-support v7
- 4 · 14
- AI Act · GDPR references
- 49 of 49
- scenarios filed under at least one
- 13 of 49
- carry rules that can fail them outright
Testing evidence, not certification
This matrix maps technical testing evidence to duties you may already have. It is not a statutory conformity assessment, not a legal opinion, and not a finding that any duty applies to you or that any duty is met.
A reference says which duty a scenario's evidence may help you document. Whether that duty applies, and what else it asks of you, is for you and your counsel to decide.
The matrix
Filter by framework, article or how a scenario is checked. Each filter is a link, so a view can be shared or bookmarked.
Reading the AI Act references
What it isArticle 50 sets transparency obligations for AI systems that interact directly with people, and Novera tests whether the agent discloses that it is an AI. Articles 12 (record-keeping), 13 (transparency to deployers), 14 (human oversight) and 15 (accuracy, robustness and cybersecurity) are requirements for high-risk AI systems.Why it mattersMost customer-support agents are not high-risk, so Novera references those four as engineering benchmarks for logging, escalation to a person and robustness, not as duties the operator necessarily has. Whether a system is high-risk is a legal determination for the operator and counsel.What to do nextOpen the regulatory mapping to see which scenarios sit under each reference. Ask your counsel whether your agent is high-risk before treating any of them as a duty.
Article 50 sets transparency obligations for AI systems that interact directly with people, and Novera tests whether the agent discloses that it is an AI.
Articles 12 (record-keeping), 13 (transparency to deployers), 14 (human oversight) and 15 (accuracy, robustness and cybersecurity) are requirements for high-risk AI systems. Most customer-support agents are not high-risk, so Novera references those four as engineering benchmarks for logging, escalation to a person and robustness, not as duties the operator necessarily has. Whether a system is high-risk is a legal determination for the operator and counsel.
Article
Checked by
0 of 18 references · 0 of 49 scenarios checked by read-back
Clear filtersNo scenario in this view is checked that way. Show every scenario in it.
A scenario can carry several references, so it appears under each. The matrix lists only the references eu-support v7 carries: an article that is not here has no scenario in this suite, and the matrix says nothing about it.
How each scenario is checked
Read off what each scenario declares, in the order a run applies them. A layer a scenario does not declare is not claimed for it.
- 01
Rules
Deterministic checks the scenario declares — text or patterns that must not appear, tools that must not be called, tool arguments required or excluded, turn by turn in a conversation. A rule can fail a scenario and can never pass one.
- 02
Tool record
The scenario expects an action. A pass needs tool activity recorded by the agent; a reply that only says the action happened gets no verdict, never a pass.
- 03
Read-back
The scenario expects a change in your own system. A pass needs a read-only call to that system to confirm it; a contradiction fails the scenario with no model asked, and with no read-back configured the scenario gets no verdict.
- 04
Graders
Whatever rules and read-back leave open goes to models, each reading the expected behaviour and assertions against the reply. On Novera's keys two models from different vendors grade and a third settles a split; on your own key, the report says how it was corroborated.
What Novera records about each test
Records of the test Novera ran, kept by Novera. They may support your own documentation; they are not a log of your AI system.
Inputs declared before the run
Suite version and scenario order, policy version, agent host, grading plan, pass mark, runner version and rubric digest are frozen before the first scenario is sent.
Append-only evidence
Each declared scenario is recorded once. A verdict cannot be edited, or deleted short of erasing the whole workspace — by you or by Novera.
Sealed and chained
Each report carries a SHA-256 digest of its content and the hash of the previous report for the same agent, so anyone holding a copy can re-check it.
Who graded
Every model consulted is recorded with its vote, including one that was overruled, and the report says how each verdict was corroborated. A scenario settled by a rule or the read-back names no model.
Authorisation on record
The confirmation that you own the agent or are authorised to test it is stored with the run and sealed into its report.
Retention
The agent's raw replies are kept for your workspace's retention period, 30 to 365 days (180 by default), then emptied, leaving the verdict and a SHA-256 of each reply.
About AI Act Article 12
These are Novera's records of a test it ran. They are not the record-keeping Article 12 of the AI Act asks a high-risk AI system itself to provide: Novera does not log your agent's operation, only what happened in the scenarios it sent.
No scenario in eu-support v7 is filed under AI Act Article 12, so the matrix has no row for it. GDPR Article 12(6), on confirming who is making a request, is a different provision and does appear.
What Novera is not
A document that overstates itself is worth less — especially to the person you hand it to.
Testing evidence, not certification
This report records Novera's testing of the declared agent, scenarios and configuration at the time shown. It is not a legal opinion, a conformity assessment, a certification or an assurance that any law is met, and Novera is not a notified body.
Not a conformity assessment. Novera is not a notified body, and this matrix is not an approval by one.
Not legal advice. It does not say which obligations apply to your organisation.
Only this suite. The references eu-support v7 carries — not every duty the AI Act or the GDPR contains.
Evidence, not outcome. A scenario under a reference says what was tested, not whether your agent passed it.
Every report carries the same notice and its own scope and limitations. Read the limits in full.
Run these scenarios against your own agent
Connect an HTTP endpoint, write the policy it should keep, and get a sealed report with every verdict filed under these references.
- No card
- Email, Google or GitHub
- Database in Frankfurt (EU)