The draft guidelines on high-risk AI classification address classification criteria thoroughly. There is one enforcement gap that deserves specific attention before the guidelines are finalised.
When a market surveillance authority requests dataset documentation from a high-risk AI provider under Article 10, the provider submits a written declaration. The authority has no independent technical means to verify a single claim in that document.
This is not a gap in the guidelines specifically. It is the defining enforcement gap in every AI governance framework currently in force globally — the EU AI Act, GDPR, ISO/IEC 42001, and equivalent national frameworks. Obligations exist everywhere. Independent technical verification exists nowhere.
The practical consequence is a regulator with authority but no instrument. A market surveillance authority that can demand documentation but cannot confirm whether it reflects reality.
The technical solution to this gap is machine-verifiable cryptographic dataset attestation — specifically a signed Merkle root fingerprint over the training dataset, verifiable by any competent authority using a published key in under one second, without accessing raw data and without specialised technical staff.
We filed a formal proposal to this consultation addressing this gap — Contribution ID 55806b7b, 21 May 2026 — and published an open protocol specification at doi.org/10.5281/zenodo.20330053
The specification is openly published under CC BY and submitted as a candidate technical standard for consideration under Article 40 harmonised standards.
Interested to hear from other members whether this gap is visible in your own regulatory or compliance work, and whether a harmonised cryptographic attestation standard would address the enforcement challenge you are facing.
Paul G. Henry
Founder, Veraxis
- Značky
- recommendation AI Act Trustworthy AI
- Prihlásiť sa na účely uverejňovania komentárov