Compliance & Governance

Compliance overview

The compliance surface is the set of API routes, audit primitives, and dashboard tools Meridian Blue exposes for EU AI Act and GDPR obligations. This section maps each obligation to the route or feature that satisfies it, so you can build evidence as you ship.

Regulatory scope

Meridian Blue is built for organisations operating AI under the EU AI Act and GDPR, with hooks for sectoral regimes (DORA for financial services, MDR for medical devices, HDS for French health hosting). Where the platform's defaults differ across regimes, those decisions are documented per page.

EU AI Act article map

ArticleSubjectWhere it lives
Art. 4AI literacyShadow AI & literacy — quizzes + completion records via /api/v1/literacy.
Art. 5Prohibited practicesRisk classification — built-in detector + LLM-judge.
Art. 13Transparency to usersExplainability — explainability field on every response.
Art. 14Human oversightHuman oversight — review queue at /api/v1/review.
Art. 26Deployer obligationsPolicy engine — signed deployer policy at /api/v1/policies.
Art. 27FRIAFRIA & conformity — assessments via /api/v1/conformity.
Art. 28Sub-processorsGDPR alignment — public list at /api/v1/sub-processors.
Art. 50User disclosureUser disclosure — user_notice on response envelope.
Art. 53/55GPAI obligationsGPAI — provider compliance posture via /api/v1/gpai.
Art. 72Post-market monitoringPost-market — drift detection + corrective-action workflow.
Art. 73Serious incident reportingIncidents — /api/v1/incidents.
Art. 86Right to explanationExplainability + appeals via /api/v1/appeals.

Shared responsibility

The EU AI Act distinguishes providers (who build a model), deployers (who use it in production), and importers / distributors. Meridian Blue is a processor that sits between the deployer and the model providers. Each side owns its share of obligations:

  • Model provider — Article 53/55 obligations, model card, training data summary, systemic-risk red-teaming.
  • Deployer (you) — Article 26 logging, Article 27 FRIA, Article 14 oversight, Article 50 disclosure, lawful basis under GDPR.
  • Meridian Blue — Audit log integrity, residency awareness in the catalogue, policy versioning, request-level evidence.

Where to start

← Previous Headers Next → Risk classification