EU AI Act AI quality control: what the audit requires

The entry into force of the EU AI Act redefines compliance standards for automated production lines. For manufacturers, AI quality control is no longer just a question of technical performance, but a strict legal traceability requirement. TrustalAI, as a reliability layer for industrial AI, makes it possible to meet these new regulatory obligations. This article details the concrete actions to implement to calmly prepare for your next audit.

What the EU AI Act requires of an AI vision system in quality control

Sophie, Quality Manager, faces a real-world paradox: her AI vision system has been sorting parts for months with good overall results, but she has absolutely no idea what she would need to produce if an EU AI Act auditor showed up tomorrow. The EU AI Act classifies this type of system as "high risk" as soon as it makes automated decisions that have a direct impact on product safety, regulatory compliance, or customer liability. For an automated quality control line, three articles of the regulation apply directly: Art. 9 (risk management), Art. 10 (data governance), and Art. 12 (traceability of decisions). Let's translate these texts into immediate field obligations.

Article 12: Traceability prediction by prediction

"The EU AI Act Art. 12 requires high-risk AI systems to automatically generate logs of each individual decision, with timestamps, input data, and produced output. For a vision system in quality control: every sorting decision must be traceable — not just the overall accuracy rate."

Let's anchor this in Sophie's daily routine: if a customer disputes a batch of delivered parts, she must be able to reconstruct the decision made on each individual part. It is not about providing the weekly accuracy rate, but about proving the decision made at 2:37 p.m. on part no. 4,821 of series B. An overall accuracy rate is not an Art. 12 compliance log. As Datenschutz-Notizen details in its analysis of the EU AI Act logging infrastructure for high-risk systems, data granularity is imperative. TrustalAI automatically generates these logs per inference, by associating a timestamped confidence score for each prediction, without modifying the existing model.

Article 9: Documenting model limits

Art. 9 imposes a documented risk management system specific to the deployed AI model. For a vision system in quality control, this means precisely documenting situations outside the model's validity domain (parts or configurations never seen during training, known as OOD for Out of Distribution), identified gradual drifts (model drift), and production conditions not covered by the training dataset (changes in lighting, new references, sensor wear).

The central argument for Sophie is relentless: it is technically impossible to document the limits of a model whose confidence per prediction is not measured. The overall accuracy rate of 96% does not say where the model fails; it hides the 4% of errors that constitute precisely the risk situations. Without a confidence score per prediction, Art. 9 is impossible to satisfy seriously during an audit.

Article 10: Governance of training data

Art. 10 requires complete documentation of training, validation, and testing data. This includes representativeness with respect to real production conditions, identified biases, as well as covered and uncovered conditions. In field terms for Sophie: if your dataset does not cover all produced part references, all line lighting conditions, or all possible defect variants, this is a major documentation gap in the sense of Art. 10. A dataset built in a laboratory or over a perfectly homogeneous production period will not be sufficient for the audit. As The Recursive summarizes: "If you can't reconstruct a decision, you can't ship." The EU AI Act imposes exactly this logic of reconstructibility to guarantee user safety and supplier compliance.

What your AI audit must contain: the operational checklist

Let's move to the actionable. Sophie does not manage her company's legal infrastructure; she needs to know exactly what she must have ready before the audit. Here is the checklist structured into three distinct blocks to meet the requirements of the EU AI Act AI quality control.

The most frequent gap: documenting the reliability that we do not measure

The compliance checklist is built around three fundamental pillars:

• (1) What you must have: formal documentation (dataset, risk management, system architecture, declaration of conformity).

• (2) What you must measure: technical reliability metrics in production, per prediction and over time.

• (3) What you must demonstrate: the ability to reconstruct an individual decision, to show model drift over a given period, and to prove that the system issued an alert before making a low-confidence decision.

The industrial reality is that most companies partially have block (1), almost none have block (2), and block (3) is impossible without (2). According to joint data from Bureau Veritas and AWS (April 2026), 68% of companies struggle to interpret the EU AI Act, and 60% do not have the necessary governance to comply. The field explanation is simple: the problem is not the willingness to comply, it is that most quality teams do not have tools to measure the reliability of their AI model by individual prediction. They only have a global rate. They therefore cannot produce Art. 12 logs or Art. 9 risk documentation.

The analogy for Sophie is obvious: she would not accept a supplier quality report that only gave the annual compliance rate without detail by batch. The EU AI Act applies exactly the same logic to her AI system. TrustalAI measures reliability per prediction in real-time, plug-and-play, without modifying the existing model, and automatically generates the necessary logs.

Digital Omnibus: the delay should happen, but obligations remain

The European regulatory context is evolving, but rigor remains key. The European Parliament voted on March 26, 2026, in favor of delays within the framework of the Digital Omnibus. However, this text has not yet been adopted. The trialogue between the Council, the Parliament, and the Commission is ongoing, with adoption expected mid-2026. The application date should be pushed back if the Digital Omnibus is adopted.

<table> <thead><tr><th>Classification of AI systems</th><th>Initial application date</th><th>Ceiling date if Digital Omnibus is adopted</th></tr></thead> <tbody> <tr><td>Annex III (QC, biometrics, employment, health)</td><td>August 2, 2026</td><td>Ceiling Dec 2, 2027</td></tr> <tr><td>Annex I (Machinery Directive, embedded systems)</td><td>August 2, 2027</td><td>Ceiling August 2, 2028</td></tr> </tbody> </table>

The takeaway message is clear: the safest strategy is to prepare your documentation as if August 2026 is real, and plan your deployments as if December 2027 is the likely date. The delay does not remove any documentation obligations; it simply shifts their regulatory audit by the competent authorities. Companies that start now will be ahead of the market, not behind.

Reliability per prediction as a technical response to Article 12

Art. 12 requires logs per inference. Reliability per prediction produces exactly these logs, offering a direct technical response to the traceability requirements imposed by European legislation.

For each sorting decision made by the vision system, TrustalAI generates a timestamped, traceable, and documentable confidence score. The architecture of our solution is black-box compatible and plug-and-play: it integrates without modifying the existing model and without any process changes on the production line. Latency is kept below 100ms (and even 20ms in edge computing), guaranteeing real-time operation essential for high industrial cadences.

Field results demonstrate the robustness of this approach. On the VEDECOM PoC (Fadili et al., Intelligent Robotics and Control Engineering, 2025), integrating these confidence metrics allowed for an 83% reduction in critical false positives, without retraining the customer's model. In industrial quality control, TrustalAI reduces false rejects by 30% to 60% with its confidence metrics (TrustalAI data). This reduction in classification errors protects profitability while ensuring compliance.

As highlighted by DevDiscourse, 100% automated AI decisions without measurable proof of reliability are legally exposed under the EU AI Act. The ability to prove that a decision was made with an adequate level of certainty becomes a legal shield for deployers and providers.

Discover how TrustalAI automatically generates Art. 12 compliance logs on your existing vision model, request a 2-week PoC.

Conclusion: Anticipating the audit for peaceful and high-performance compliance

To succeed in your EU AI Act AI quality control audit, three pillars are essential: Art. 12 requires logs per prediction, Art. 9 imposes documentation of the model's limits, and Art. 10 requires strict training data governance. Although the Digital Omnibus should shift the application dates, it does not change these fundamental obligations in any way. Companies that build their reliability documentation now will be in a position of strength before the authorities, regardless of the final date chosen. TrustalAI offers the black-box compatible reliability layer for the EU AI Act audit, the technical layer that makes this documentation possible without modifying the existing model or industrial processes.

FAQ: AI Audit, EU AI Act and industrial quality control

Find answers to the most frequently asked questions regarding the compliance of your industrial vision systems and European regulatory requirements.

Is my quality control vision system affected by the EU AI Act?

Yes, if the system makes automated decisions that impact product safety, regulatory compliance, or customer liability. These systems are classified under Annex III, which corresponds to the high-risk category of the legislation. This classification implies strict obligations regarding human oversight and risk management. The Machinery Directive (Regulation 2023/1230) applies simultaneously for robotic cells integrating AI: the integrator bears legal responsibility for the delivered machine, including the AI layer.

What must an AI decision log compliant with Article 12 contain?

A compliant log must contain a precise timestamp, the identifier of the inspected part, the input data used by the model, the prediction result produced, the associated confidence score, and the downstream action triggered. A weekly accuracy rate or a monthly performance report is not sufficient under Art. 12, as it does not allow for reconstructing an individual decision. Datenschutz-Notizen confirms that the logging infrastructure for high-risk EU AI Act systems must descend to this unit granularity.

Does the Digital Omnibus delay give me more time?

Technically yes if the Digital Omnibus is adopted: the ceiling for Annex III systems would shift to December 2, 2027. However, the Digital Omnibus is not yet adopted (the trialogue is ongoing, with adoption expected mid-2026). If the Council and Parliament do not finalize the text before August 2026, the original date remains legally binding. Documentation obligations (Art. 9, 10, 12) do not disappear; they are simply shifted in their regulatory control. Starting documentation now constitutes a competitive advantage, not an anticipated constraint.

How does reliability per prediction improve compliance and performance?

Reliability per prediction automatically generates Art. 12 logs for each individual decision of the vision system, in real-time and without modifying the existing model. At the same time, it helps reduce false rejects by 30% to 60% (TrustalAI data) by detecting low-confidence predictions before they trigger an incorrect action. These are two effects in one: compliance documentation is produced automatically, and operational performance improves.