taskfloCOMPLIANCE / RULES IN THE EXECUTION PATH
Compliance that runs, not compliance that’s written down.
A requirement evaluated at the moment of action, versioned with the workflow and cited in the record is a control. Taskflo is designed to move your rules from a document into the execution path.
01 / REGULATORY CONTEXT
High-risk obligations from 2 December 2027.
The 2026 Digital Omnibus changed the application timeline, not the need for a compliance programme. Annex III high-risk obligations generally apply from 2 December 2027; high-risk AI integrated into Annex I regulated products follows from 2 August 2028.
Start with intended use, geography and your role. A company that builds an agent for its own use can be a provider as well as a deployer. Material changes to an existing system can change the responsible role; buying a model does not outsource the system-level obligation.
- 2 February 2025Prohibited practices and AI literacy
- 2 August 2025General-purpose AI rules
- 2 August 2026Broad application, including transparency duties
- 2 December 2027Annex III high-risk obligations
- 2 August 2028High-risk AI integrated into Annex I regulated products
€35m / 7%Prohibited practices
€15m / 3%Specified operator obligations
€7.5m / 1%Incorrect information to authorities
Application depends on use, role and transitional provisions. Fine ceilings depend on the infringement and undertaking; special rules apply to SMEs. Regulation (EU) 2026/1744 · AI Act, Article 99 · European Commission timeline.
02 / OBLIGATION → EVIDENCE
What you need to show. What you can inspect.
| Review topic | Designed evidence |
|---|---|
| Risk classification | A declared classification and the obligations your assessment attaches to it. |
| Record-keeping | Action records, control references and customer-managed retention. |
| Human oversight | Named oversight roles, approval gates and intervention controls. |
| Accuracy and robustness | Version-bound evaluation results and promotion checks. |
| Technical documentation | A System Card for each workflow version. |
| Transparency | Disclosure steps where required by the intended use. |
03 / POLICY PACKS
Your rules, as working code.
Evaluate at the action
Decide with the actual data category, model, purpose and acting authority.
Narrow, never override a deny
Organisation, workspace and workflow rules combine to tighten authority.
Enforce conditions
Approvals, redaction and retention conditions belong in the engine.
Test before publishing
Bind policy tests to the version being promoted.
Fail closed
An unavailable or indeterminate decision must not become permission.
04 / EVIDENCE
Reconstruct the decision.
Evidence should let a reviewer reconstruct who designed the workflow, who approved the version, what ran and which control allowed or denied each action.
| System Card field | Illustrative invoice-triage entry |
|---|---|
| Purpose | Prepare and route invoices |
| Human oversight | Separate approver above $500 |
| Declared reach | Three named systems |
| Version binding | Workflow, components and policy pack |
| Evidence | Action, decision, control reference and approval |
05 / FRAMEWORKS
Frameworks the architecture maps to.
Policy-pack rules are designed to carry the control references they enforce, so evidence can be reviewed by obligation rather than only by run. Exact coverage is agreed for the workflow and verified against the implemented controls.
EU AI Act
Designed to map to record-keeping (Article 12), human oversight (Article 14), accuracy, robustness and cybersecurity (Article 15), and technical documentation. Classification and conformity assessment remain separate responsibilities.
GDPR
Purpose and storage limitation, security of processing and international-transfer requirements (Articles 5(1)(b), 5(1)(e), 32 and 44). A customer-cloud boundary alone does not settle lawful basis, access or cross-border processing.
SOC 2
Logical access and monitoring control mapping. This is a design mapping, not an attestation or a completed assurance programme.
06 / IMPORTANT DISTINCTION
Technical controls support your legal assessment.
Build your readiness plan.
ONE WORKFLOW. A CLEAR NEXT STEP.
Bring one workflow. Review its controls and evidence.
Tell us about the process, the systems and the people. Let’s work through what it would take to run it.