Hivemind AX. EU AI Act Compliance Mapping.

On 31 March 2026, Hypereum conducted an internal compliance audit of Hivemind AX against Articles 9, 11, 12, 14, and 15 of the EU AI Act. The audit was performed against the production system. Every requirement was assessed with evidence drawn from live database queries, API responses, and functional testing. Hivemind AX satisfies all five articles.

The evidence follows.

Article 12. Record keeping.

Tamper-evident by architecture.

Every event in Hivemind AX produces a record in the audit_log table. Every record contains an entry_hash computed as SHA-256 of the record’s contents concatenated with the previous record’s hash. This creates a mathematically verifiable chain. Modifying a single byte in any historical record invalidates every subsequent hash.

What gets recorded. Every mission lifecycle event. Every agent action with role, tokens consumed, output, and timestamp. Every document access in the Secure Data Workspace. Every human oversight intervention. Every sandbox command. Every web access with domain verification verdict. The system does not distinguish between “important” and “unimportant” events. Everything is recorded.

The compliance API returns a documented retention policy. Audit logs, risk assessments, and human oversight events carry a 24-month retention with a deletion policy of “NEVER.” The legal basis is cited explicitly in the API response.

Article 9. Risk management.

Continuous, automated, evidenced.

The risk-assessor service runs automatically at the completion of every mission. Not manually triggered. Not periodic. Every mission, without exception.

The assessor queries live production data. Failed tasks. Sandbox command counts. Encrypted document access events. Coordinator revision counts. Each finding maps to a specific article of the EU AI Act with a severity rating and a corresponding mitigation.

Ten security invariants are verified on every mission. Each tests a specific architectural guarantee. All ten must pass. A single failure means the compliance report flags it.

Article 14. Human oversight.

Pause, resume, override, cancel.

During every mission execution, the Human Oversight Panel labelled “HUMAN OVERSIGHT, EU AI Act Art. 14” is visible. Not optional. Not hideable. Four controls are available at all times during execution.

Pause halts execution at the current point. Resume continues from exactly where it stopped. Override opens a modal allowing the operator to modify the last agent output, with the modified text injected into downstream task context. Cancel terminates immediately. Every human intervention is recorded in the human_oversight_events table with event type, timestamp, triggering user, original value, and new value.

Verified by live functional test on 31 March 2026. A mission was launched, paused, resumed, and completed. Both intervention events appear in the database with correct timestamps.

Article 15. Accuracy, robustness, cybersecurity.

Defence in depth.

Cybersecurity. AES-256-GCM encryption for every document in the Secure Data Workspace. Each document gets a unique DEK (Data Encryption Key). Each DEK is encrypted with a KEK (Key Encryption Key) derived via PBKDF2 with 310,000 iterations from the tenant secret. Zero-knowledge architecture. Hypereum cannot read client documents. Verified by querying the database directly. The encrypted_content column in secure_documents contains ciphertext, never plaintext.

Tenant isolation enforced at the query level. Every database query includes a workspace scope. An agent in workspace A cannot access workspace B. This is architectural, not application-layer.

Accuracy. Every completed task is assessed by a dedicated Verifier agent. The verification produces structured metadata with checks count, average confidence, minimum confidence, and a verdict (APPROVED or REJECTED). Multi-agent challenge protocol adds a second layer. Agents can challenge other agents’ outputs. The Coordinator can issue REVISE directives. Maximum 2 revisions per task before escalation.

Robustness. Retry classification separates transient failures (timeout, network error, rate limit) from permanent failures (policy violation, security invariant breach, invalid output). Transient failures retry automatically up to 3 times with exponential backoff. Permanent failures terminate immediately. Every retry and failure category is recorded. If the system encounters an unhandled error, the mission fails entirely. No degraded mode. No reduced protections.

Article 11. Technical documentation.

Annex IV, generated from production.

The Hivemind AX compliance API generates Annex IV-structured technical documentation from live production data. The endpoint returns a JSON document covering general description, intended purpose, detailed technical architecture, models used, compute infrastructure, risk management methodology, and applicable standards (AES-256-GCM per NIST FIPS 197, SHA-256 per NIST FIPS 180-4).

The document is available as a download from the /compliance page of the Hivemind AX dashboard. It is not a static PDF written once and forgotten. It is generated from production state and reflects the current system configuration.