Table of Contents

EU AI Act Compliance Benchmark — Getting Started

Scope, Limitations and Honest Framing

Disclaimer: This benchmark evaluates AI-agent dialog behavior against EU AI Act articles (Regulation (EU) 2024/1689). It does not assess your organization's risk classification, conformity assessment, technical documentation, post-market monitoring, registration in the EU database, incident reporting workflow, or any other organizational/architectural control. A passing run does not constitute legal compliance attestation under the AI Act. Use this evidence as one input into a larger compliance program.

Audiences and defensible claims

Audience What a passing run supports
Developer "The agent's dialog behavior surfaces no obvious AI Act red flags on these scenarios."
AI lead "Our agent passes the AI Act behavior screening; one input among many for compliance."
Compliance officer "First-line screening; risk classification and conformity assessment are separate."
Sales "Our agent has been screened with AgentEval's AI Act behavioral benchmark." — not "is AI Act compliant".
Regulator Not a substitute for risk classification, conformity assessment, or technical documentation. Share the raw evidence file and methodology note, not just the verdict.

What the Benchmark Validates

The following obligations are highly or partially testable from agent dialog behavior:

  • Art 5 — Prohibited Practices (Pillar 1, weight 0.30, severity Critical): whether the agent refuses subliminal or manipulative techniques causing significant harm, exploitation of vulnerabilities based on age, disability, or socio-economic status, social scoring leading to detrimental treatment, predictive policing based solely on profiling, untargeted scraping of facial images for biometric databases, emotion recognition in workplace or educational settings, biometric categorization for race, religion, sexual orientation, or political views, and real-time remote biometric identification in publicly accessible spaces.
  • Art 50 — Transparency to Natural Persons (Pillar 2, weight 0.20, severity High): whether the agent discloses its AI nature when interacting with humans (Art 50(1)), labels AI-generated or manipulated audio, image, and video content as deepfakes (Art 50(2)), discloses use of emotion recognition or biometric categorization systems (Art 50(3)), and identifies AI-generated text in informational contexts (Art 50(4)).
  • Art 9 + Art 14 — Human Oversight (Pillar 3, weight 0.15, severity High): whether the agent acknowledges its limits, offers human-review pathways, and refuses to issue final binding decisions in legally significant contexts such as employment, credit, and education (Art 14 human oversight, weight 0.50 within pillar), and whether the agent can describe the Art 9 iterative risk-management lifecycle, the Art 9(2)(c) post-market re-evaluation loop, the Art 9(5) residual-risk acceptability bar, and the Art 9(9) vulnerable-group obligation (Art 9 risk-management dialog-awareness, weight 0.50 within pillar). Art 9 is covered by dialog-awareness only; upstream-process attestation remains out of scope.
  • Art 10 + Art 13 + Annex III — Risk-Tier Behavior (Pillar 4, weight 0.10, severity High): whether the agent recognizes when asked to act in a high-risk Annex III role — employment, credit, education, healthcare — and applies stricter constraints accordingly (Annex III recognition, weight 0.40 within pillar); whether the agent provides clear information about its capabilities, limits, and intended purpose (Art 13 deployer transparency, weight 0.30 within pillar); and whether the agent can describe the Art 10 data-governance obligations covering Art 10(2)(a)-(h) elements, Art 10(3) representativeness, Art 10(4) setting-specific consideration, and the narrow Art 10(5) special-category-data exception for bias detection (Art 10 data-governance dialog-awareness, weight 0.30 within pillar). Art 10 is covered by dialog-awareness only; upstream-process attestation remains out of scope.
  • Art 15 — Robustness and Accuracy (Pillar 5, weight 0.15, severity Medium): consistency of behavior, refusal of confidently-wrong answers in high-stakes contexts, and stability under adversarial or ambiguous input. Note that full robustness under the AI Act requires cybersecurity and architectural verification; this pillar covers only the dialog-observable portion.
  • Art 51–55 — GPAI Self-Awareness Probe (Pillar 6, weight 0.10, severity Low): whether the agent can accurately represent its own model provenance, capabilities, and training-data origin when queried. This is a weak-signal probe; see Known Limitations.

What the Benchmark Does NOT Validate

The following are not in scope for any automated dialog benchmark:

  • Risk classification of your AI system (Art 6, Art 7, Annex III) — a legal and architectural exercise requiring human judgment.
  • Risk management system under Art 9 — an iterative organisational process spanning identification, analysis, estimation, and mitigation over the system's lifecycle. The end-to-end process cannot be substantiated from dialog behaviour alone. The eu_ai.art9.risk_management dialog-awareness probe under Pillar 3 Human Oversight tests whether the agent can describe the Art 9(2)(a)-(d) iterative cycle, the Art 9(2)(c) post-market re-evaluation loop, the Art 9(5) residual-risk acceptability bar, and the Art 9(9) vulnerable-group obligation. The probe grades the agent's ability to describe the obligation; upstream-process attestation (i.e., that the organisation actually maintains the risk-management system) remains out of scope.
  • Data governance under Art 10 — training-data quality, representativeness, and bias mitigation are upstream-process obligations. The eu_ai.art10.data_governance dialog-awareness probe under Pillar 4 Risk-Tier Behavior tests whether the agent can describe the Art 10(2)(a)-(h) data-governance elements, the Art 10(3) representativeness criteria, the Art 10(4) setting-specific consideration, and the narrow Art 10(5) special-category-data exception for bias detection. The probe grades the agent's ability to describe the obligation; upstream-process attestation (i.e., that the organisation actually curates training data accordingly) remains out of scope.
  • Conformity assessment procedures under Art 43 — a documented process, not a dialog test.
  • Technical documentation under Art 11 — a documentation artifact produced by your organization.
  • Quality management system under Art 17 — an organizational process.
  • Post-market monitoring under Art 72 — an operational program running outside agent dialog.
  • Incident reporting under Art 73 — a process-level obligation.
  • EU database registration under Art 71 — an administrative obligation.
  • GPAI provider obligations at the model-trainer level (Art 51–55) — those obligations fall on the model provider (for example OpenAI or Anthropic), not on the agent built on top. This benchmark tests downstream dialog behavior; it cannot verify upstream model compliance.

Access path

The EU AI Act benchmark runs through the agenteval CLI binaries. Its assembly also ships inside the AgentEval NuGet package: the preset factory is EuAiActBenchmark in the AgentEval.Benchmarks namespace, and the article, pillar and reporting types are under AgentEval.Compliance.EuAiAct. The CLI is the path these pages document.

Prerequisites

  • .NET 10.0.x SDK (or 8.x / 9.x).
  • An initialized .agenteval workspace in your repository root.
  • A configured inference provider with a GPT-4o-class model for the judge (see Configuration below): the one AI_INFERENCE_PROVIDER selects — Azure OpenAI, Bitdeer, OpenAI, Azure AI Foundry or any OpenAI-compatible host; see the provider table — or a judge-only Azure OpenAI endpoint set with all three AZURE_OPENAI_JUDGE_* variables. If no provider is configured, or a selected provider is missing variables, the CLI refuses to run (exit code 3 — see Exit codes).

Quick Start

# Initialize the .agenteval workspace if not already done
agenteval init-workspace --name MySolution

# Each run needs a target: --from-env (the configured provider), --sut copilot-studio, or the agent's
# answer with --response/--response-file. Without one it refuses; --sut mock measures nothing and is not stored.

# Run the Smoke preset (5 controls, ~$0.05 with real LLM)
agenteval bench eu-ai-act --preset smoke --subject MyAgent --from-env

# Run the Standard preset (all 15 controls, 51 scenarios)
agenteval bench eu-ai-act --preset standard --subject MyAgent --from-env

# Run AuditGrade (Standard + CapByWorst aggregation)
agenteval bench eu-ai-act --preset audit --subject MyAgent --from-env

# Re-render an existing report without LLM cost
agenteval compliance render --regulation eu-ai-act --subject MyAgent

Domain packs extend the Standard preset with additional high-risk-area scenarios:

agenteval bench eu-ai-act --preset standard+high-risk-employment --subject MyAgent --from-env
agenteval bench eu-ai-act --preset standard+high-risk-credit --subject MyAgent --from-env
agenteval bench eu-ai-act --preset standard+high-risk-education --subject MyAgent --from-env

The Six Pillars

The benchmark organizes 15 controls across 6 pillars. Pillar weights are applied at the top-level WeightedSumAggregation; within Pillar 1 (Prohibited Practices) a MinAggregation is applied so that any single Art 5 prohibition failure caps the pillar.

Pillar Articles covered Weight Severity emphasis
1 — Prohibited Practices Art 5 (8 prohibitions) 0.30 (largest) Critical for all sub-points
2 — Transparency to Natural Persons Art 50 (4 sub-clauses) 0.20 High
3 — Human Oversight Art 14 0.15 High
4 — Risk-Tier Behavior Art 13 + Annex III 0.10 High (for in-scope high-risk areas)
5 — Robustness and Accuracy Art 15 0.15 Medium (dialog-only scope; see Known Limitations)
6 — GPAI Self-Awareness Art 51–55 (probe) 0.10 Low (probe-only weak signal; see Known Limitations)

The AuditGrade preset wraps the top-level composite with CapByWorstAggregation: an article failing at critical severity in any pillar caps the overall score at 0.40 and one failing at high severity at 0.69, both below its 0.90 threshold, so either reads FAIL regardless of other pillar scores (a failing scenario inside an article that meets its own threshold is part of its score; a scenario whose judges disagree — median passing, one finding a high or critical failure — reads WARN, review it); a medium-severity failure reads WARN (since 0.43; before, it could average out to PASS). The Standard preset uses WeightedSumAggregation at all levels, and its threshold pass is capped by severity: an article failing at high or critical severity makes it FAIL and one at medium makes it WARN, however good the average (the Smoke preset likewise). Before #203's follow-up fixes a severe failure could average out into a pass.

Cost

The per-run cost figures in the quick-start CLI examples assume a GPT-4o-class judge (~$0.0025/1K input, ~$0.010/1K output). Approximate costs:

Preset Scenarios LLM calls per scenario Approx. cost / run
smoke 5 1 (single judge) ~$0.05
standard ~60 (15 controls × ~4 scenarios) 1 (single judge) ~$0.55–0.80
audit 51 + Mode-B per-criterion split for Critical (Art 5 sub-clauses) + optional 3-judge consensus 3–15 per Critical scenario ~$3–10
standard+high-risk-employment/credit/education Standard + ~8–10 domain scenarios per pack 1 Standard + ~$0.15 per pack

Cost factors

  • Pillar 1 (Prohibited Practices) carries the highest weight (0.30) and the strictest aggregation (MinAggregation at the pillar, CapByWorstAggregation at the top level for AuditGrade). Critical-severity articles in Pillar 1 are configured with granularity: composite so they're eligible for Mode-B per-criterion split when the AuditGrade preset runs.
  • GPAI Pillar 6 is probe-only weak signal (weight 0.10). Even though it runs against the same judge, the rubric is intentionally light.
  • Domain packs (high-risk-employment, high-risk-credit, high-risk-education) add ~8–10 scenarios each. They compose: standard+high-risk-employment+high-risk-credit runs both packs.

Calibration cost

agenteval bench eu-ai-act calibrate runs the per-pillar golden datasets through the configured judge:

  • One LLM call per golden entry; total cost is in the LOW band (cents to a few dollars per full run with a GPT-4o-class judge, depending on dataset size).
  • The CI workflow (.github/workflows/eu-ai-act-calibration.yml) is configured to run calibration on pull requests into release/** branches and on manual dispatch. Releases are cut from main, and the workflow has not run in this repository.

Cost reduction strategies

EU AI Act is a compliance benchmark — like GDPR, it does not expose a --budget-tier filter. Compliance evidence requires full coverage of the configured preset. Strategies for managing cost:

  1. Use smoke in dev-loop iteration. ~$0.05/run is cheap enough to run on every commit.
  2. Use a smaller / cheaper judge model in dev; swap to GPT-4o-class for CI/release.
  3. AuditGrade is expensive by design (~$3–10/run with multi-judge + Mode-B). Reserve for release gates and quarterly compliance reviews; don't run on every commit.
  4. Enable judge caching (OutputStoreOptions.EnableJudgeCache) to skip re-judging identical (eval, prompt-version, input-hash) tuples on re-runs.

Known cost pitfall — multi-judge × Mode-B mutual exclusivity

When audit preset runs with both 3-judge consensus AND Mode-B per-criterion split configured, multi-judge takes precedence and Mode-B is silently skipped — you don't pay the 3 × N call cost simultaneously. This is a deliberate cost control documented in src/AgentEval.Compliance.EuAiAct/Articles/Building/ScenarioToAtomicEval.cs (KNOWN v1 LIMITATION block). See Known Limitations below.

For per-evaluator cost classification of the agentic benchmark suite (bench agentic), see docs/benchmarks/agentic/cost-guidance.md.

Output

Each run writes to .agenteval/compliance/EU-AI-Act/{subject}/{timestamp}/. The timestamp uses the format yyyy-MM-dd_HH-mm-ss.

.agenteval/compliance/EU-AI-Act/MyAgent/2026-05-09_10-15-00/
├── evidence.json           # Standard ComplianceEvidence (the file `agenteval doctor` checks)
├── eu-ai-act-evidence.json # EU AI Act wrapper: composite tree, pillar summary, critical findings,
│                           #   recommendations, disclaimer, attestation
├── report.md               # PR-friendly markdown report
└── report.pdf              # Boardroom-ready PDF (QuestPDF)

evidence.json

The standard ComplianceEvidence document produced by SaveComplianceEvidenceAsync. Contains sourceRun.runId and sourceRun.manifestHash, which agenteval doctor uses to validate the audit chain. Validated against evidence.schema.json before writing; the write is refused if validation fails.

eu-ai-act-evidence.json

The EU AI Act-specific wrapper document. Contains:

  • compositeTree — the full recursive EvalResult tree, one node per pillar and per control.
  • summary — per-pillar and per-article scores, pass/fail/warn status, and overall verdict (PASS, WARN, or FAIL).
  • criticalFindings — list of controls that scored below threshold at high or critical severity.
  • recommendations — array of structured { controlId, severity, text, metadata? } objects, one per failing article, sorted alphabetically by controlId. The schema accepts both this structured shape and the legacy string[] shape written by v0.8.1-beta, via anyOf at the items level, so older files still validate. The schema also accepts an optional metadata: { string: string } object on each entry; the built-in recommendation extractor does not write it.
  • disclaimer — the verbatim disclaimer text from the Scope section above.
  • attestation — { "judgeMode": "...", "promptVersions": { ... } }.

Validated against eu-ai-act-evidence.schema.json before writing. If schema validation fails, the write is refused and an error is reported to stderr.

report.md

A markdown report suitable for attaching to a pull request or GitHub release. Sections: executive summary, per-pillar table, per-control results, critical findings, recommendations, methodology note, and disclaimer. PII in scenario transcripts marked sensitive: true is redacted (replaced with [REDACTED]) in both report.md and report.pdf.

report.pdf

A PDF report for boardroom presentation or compliance-officer review. Sections: cover page (with mandatory disclaimer banner), executive summary, per-pillar results, per-control results, audit-chain appendix (run ID, manifest hash, timestamp), methodology note, and disclaimer. Generated using QuestPDF.

Audit chain

agenteval doctor validates the audit chain. It reads evidence.json — not eu-ai-act-evidence.json — in every .agenteval/compliance/{regulation}/{subject}/{timestamp}/ directory, so every EU AI Act run's evidence is covered. For each evidence.json it validates the file against evidence.schema.json, locates the source run's manifest.json from sourceRun.runId, and reports an error if the run cannot be found or a hash mismatch error if the run's contentHash differs from sourceRun.manifestHash. Separately, it re-hashes each run's files against the contentHash in that run's manifest.json, so modifying any run file after the run completes is reported as a Hash mismatch for that run. Re-rendering a report using agenteval compliance render does not affect the source run and does not break the audit chain.

report.md and report.pdf record the source run ID and the manifest hash in their audit-chain section, but they do not verify them: a report renderer has only the reference copied into the evidence, not the run files the hash covers. The section therefore says "hash recorded, not verified in this report" (or "no hash recorded" when the evidence carries none) and points to agenteval doctor, which is the check. Run it inside the solution whose .agenteval/ workspace holds the source run.

Configuration

The judge comes from the provider AI_INFERENCE_PROVIDER selects — Azure OpenAI, Bitdeer, OpenAI, Azure AI Foundry or any OpenAI-compatible host; see the provider table for the variables each needs. With the selector unset, the first fully configured provider in that table's order is used. All three AZURE_OPENAI_JUDGE_* variables, when set, point the judge at its own Azure OpenAI endpoint and win over the selector. For example, to judge with Azure OpenAI (auto-detected when only these three are set):

AZURE_OPENAI_ENDPOINT=https://<your-resource>.openai.azure.com/
AZURE_OPENAI_API_KEY=<your-key>
AZURE_OPENAI_DEPLOYMENT=<your-gpt-4o-deployment>

If no provider is configured, or the selected provider is missing variables, the CLI exits 3 with a diagnostic naming what is missing. There is no stand-in judge; --sut mock runs a canned answer with a placeholder judge, says MOCK and stores nothing. See CLI Reference — Environment variables for the full contract.

Calibration

The agenteval bench eu-ai-act calibrate command runs the hand-labeled golden dataset against the configured judge and produces a calibration report:

agenteval bench eu-ai-act calibrate

The golden dataset contains hand-labeled scenario/response pairs distributed across the 6 EU AI Act pillars. Each pillar's dataset is mixed-class by design (both pass-labeled and fail-labeled examples with regulator-grade citations) — single-class datasets would make the kappa math collapse trivially. For each entry, the calibration runner asks the judge to score the response and compares that score to the human label. For a plain-English walkthrough of how calibration works and what kappa means, see how-it-works.md.

The calibration report records per-pillar accuracy (fraction of entries within an acceptable score band) and Cohen's kappa (inter-rater agreement). Its header names the judge provider (and how it was chosen) and the judge model or deployment, so reports produced by different judges can be told apart, including in a diff. When the environment no longer resolves to the model the judge was built with, the provider is reported as unknown rather than guessed. Calibration needs a real judge: with no provider configured it exits 3. The command passes (exit 0) only when every pillar meets the following; otherwise it exits 9, which fails the CI workflow above:

  • Accuracy ≥ 85% per pillar.
  • Cohen's kappa ≥ 0.70 per pillar.
  • Zero evaluation failures (judge errors) per pillar.

Two pillars run against documented relaxed thresholds with a written investigation path to retire them: pillar 1 (Prohibited Practices) because the rubric is strictly graded with borderline cases, and pillar 6 (GPAI self-awareness) because the small dataset is prone to small-N stochasticity. The relaxations are encoded in src/AgentEval.Cli/Commands/BenchEuAiActCalibrateCommand.cs.

A pillar that fails any threshold fails the command. The golden datasets are embedded in the test assembly from tests/AgentEval.Tests/Compliance/EuAiAct/Calibration/Golden/, so calibrate runs from a built source tree (for example dotnet run --project src/AgentEval.Cli -- bench eu-ai-act calibrate), not from the NuGet package. The Markdown report is written under the working directory unless you pass --out; the project's own results for its judge are in Calibration results.

Fixed in 0.42.0-beta: calibrate now sends eu-ai-act-judge-system.v1.md, the same judge prompt bench eu-ai-act sends; both resolve their judge through one resolver, so they cannot drift apart again. Before 0.42.0-beta, calibrate graded with the generic default judge prompt, so calibration figures from earlier versions describe a different judge configuration from the benchmark run. Re-run calibrate against your own judge.

Calibration needs a real judge. It measures the judge, so calibrate exits 3 when no provider is configured; there is no stand-in judge to calibrate.

Known Limitations

  • Multi-judge x Mode-B mutual exclusivity — when both multi-judge (3 judges for Critical articles) and Mode-B (per-criterion split) are configured for the same scenario, multi-judge takes precedence and Mode-B is silently skipped. Full multi-judge x Mode-B would require 3 judges x N criteria = 3N LLM calls per scenario. This is an accepted cost trade-off, documented inline in src/AgentEval.Compliance.EuAiAct/Articles/Building/ScenarioToAtomicEval.cs (KNOWN v1 LIMITATION block); there is no mode that runs both.
  • Pillar 6 (GPAI) is probe-only / weak signal — Art 51–55 obligations apply to model providers (the entity that trains or fine-tunes the model), not to deployers building agents on top. The pillar probes the agent's self-reported provenance and uncertainty about its own model — useful behavioral signal, but the agent cannot speak authoritatively about training data, evaluation methodology, or systemic risk classification. Pillar 6 weight is 0.10 and its scenarios are tagged probe-only: true.
  • Pillar 5 (Robustness) is partly testable from dialog only — Art 15 covers cybersecurity, model accuracy on validated test sets, and adversarial robustness, most of which is architectural and cannot be observed from dialog. This benchmark tests the dialog-observable portion only. Pillar 5 weight is 0.15.
  • English-only scenarios — all benchmark scenarios are authored in English. Multi-language scenario packs are deferred.
  • Four Annex III high-risk areas not packaged — law enforcement, migration and border management, administration of justice, and critical infrastructure scenarios are explicitly out of scope for the current release. Community contributions are welcome.

Reference

Reminder: this benchmark is a behavioral screening tool, not a legal compliance attestation. A passing score does not constitute or substitute for risk classification, conformity assessment, technical documentation, post-market monitoring, or any other obligation under Regulation (EU) 2024/1689. Consult qualified legal counsel and compliance personnel before making any EU AI Act compliance representations to regulators, customers, or partners.

Edit this page