Use case
EU AI Act compliance, enforced inline
The EU AI Act turns AI governance from a good intention into a legal obligation. Turrigan makes those obligations something you enforce on every request and can prove years later, instead of a policy no one can show was ever in force. Every AI output and every agent action passes one chokepoint that returns allow, block, or escalate, and leaves a tamper-evident record mapped to the Act.
Who the Act applies to
The EU AI Act reaches providers and deployers of AI systems whose output is used in the European Union, whether or not the company is established there. If EU users or EU-based customers rely on your AI, you are likely in scope. Obligations scale with risk. Most business AI falls under limited-risk transparency duties, while uses such as credit, employment, education, and essential services can fall into the high-risk tier with far heavier requirements.
What the Act asks you to have in place
For higher-risk uses the Act expects a working set of controls, not a one-time assessment:
- Risk management that runs across the life of the system.
- Data and model governance with documentation an auditor can review.
- Human oversight that can intervene in real decisions.
- Accuracy, robustness, and security measures appropriate to the use.
- Transparency so people know when they are dealing with AI.
- Record-keeping that lets you reconstruct what the system did.
The hard part is the last two. Most teams can write a policy. Very few can show, after an incident, exactly what their AI produced, what was blocked, and that oversight was actually applied at the moment it mattered.
How Turrigan enforces it
Turrigan is the inline governance layer that closes that gap. It sits in front of your AI as a single endpoint. Nothing reaches a user or a downstream tool without passing through it.
- Human oversight becomes real. Decisions that need review are escalated rather than shipped, so oversight is enforced at the point of action.
- Transparency and safety are checked every time. Deterministic detectors screen for prompt injection, unsafe content, leaked personal data, and unverifiable claims before an output leaves the door.
- Record-keeping is automatic and tamper-evident. Every verdict is written to a hash-chained log an auditor can verify, mapped to the obligation it satisfies.
- Agent actions are governed too. Tool calls made by AI agents pass the same chokepoint, so autonomy does not mean unaccountable.
- AI content carries a verifiable mark. When enabled, a governed output is issued a machine-readable, cryptographically signed content credential (Article 50(2)), which anyone can verify in their browser, so AI-generated content stays detectable downstream.
Because the core is deterministic, this happens in milliseconds and can run self-hosted or air-gapped, with no external AI service in the decision path. Turrigan also maps evidence to the NIST AI RMF and ISO/IEC 42001, so one control layer serves several frameworks at once.
Frequently asked questions
Does the EU AI Act apply to my company if we are not in the EU?
It can. The Act reaches providers and deployers whose AI system output is used in the EU, regardless of where the company is established. If EU users or EU-based customers rely on your AI, you are likely in scope.
What does the EU AI Act actually require teams to produce?
For higher-risk uses it requires risk management, data governance, technical documentation, human oversight, accuracy and robustness measures, transparency to users, and record-keeping. In practice you must be able to show, after the fact, what your AI did and that controls were in force.
How does Turrigan help with EU AI Act compliance?
Turrigan sits inline in front of your AI. Every output and agent action passes one chokepoint that returns allow, block or escalate, and each decision is written to a tamper-evident, hash-chained log mapped to EU AI Act obligations, so oversight and record-keeping are enforced by default rather than promised in a policy document.
Can Turrigan run without sending data to an external AI service?
Yes. The core is deterministic and can run self-hosted or air-gapped with no external AI service in the decision path, which supports data-sovereignty and confidentiality requirements.
Turrigan is guidance on scope, not legal advice. Use it to turn your obligations into enforced, provable controls, and confirm your specific duties with qualified counsel.