Common EU AI Act gaps teams discover at launch

The gaps that appear when you actually score

Most teams assume they are "mostly fine" until they map the system to the articles. The same gaps show up again and again — none of them exotic, all of them easy to miss until you look.

Gap 1 — no named human-oversight owner (Art. 14)

High-risk systems need a natural person who understands, monitors, and can interrupt the system. Teams ship the model but never assign the owner. The control exists in theory, unowned in practice.

Gap 2 — data governance not documented (Art. 10)

Training and evaluation data need examination for bias and representativeness. Teams use the data but never document the governance, so they cannot evidence Art. 10 at assessment time.

Gap 3 — no risk management file (Art. 9 / Art. 11)

The Act expects a risk-management system and technical documentation. Teams iterate on the model but keep no risk file, so the conformity assessment has no artifact to point at.

Gap 4 — transparency duties unlabeled (Art. 50)

A chatbot or synthetic-content feature needs disclosure. Teams ship it without labeling, hitting the "limited-risk" transparency layer they did not know applied.

Closing the gaps

Score the system, list the gaps per article, assign an owner to each, and log the assessment. Re-run after any material change. The report is a view of your exposure, not a guarantee — but it turns invisible gaps into an owned remediation list.

Authoritative references

EU AI Act (Reg. 2024/1689), Art. 9 / 10 / 11 / 14 / 50: https://eur-lex.europa.eu/eli/reg/2024/1689/oj
AI Act explorer: https://artificialintelligenceact.eu/
European Commission AI policy: https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai

FAQ

What EU AI Act gap is most common?

No named human-oversight owner (Art. 14). Teams ship the model but never assign the person who monitors and can interrupt it, so the control is unowned in practice.

Do I need a risk-management file?

For high-risk systems, Art. 9 and Art. 11 expect a risk-management system and technical documentation. Without a risk file, the conformity assessment has no artifact to point at.

What is the transparency gap (Art. 50)?

Chatbots and synthetic-content features need disclosure. Teams often ship them without labeling, hitting the limited-risk transparency layer they did not know applied.

Does a gap report make me compliant?

No. It lists the gaps you must close; closing them is the deployer's responsibility. A report is decision-support, not a certificate or a legal opinion.

Is ClauseGuard a legal opinion?

No. ClauseGuard returns a risk-tier classification and a gap report. It is decision-support, not a legal opinion, a certification, or a guarantee of conformity.

## Disclaimer

Disclaimer (decision-support, not legal advice): ClauseGuard is a tool that helps teams classify AI-system risk tiers and report remediation gaps against EU AI Act obligations. It is not a legal opinion, a compliance certificate, or a guarantee that a system is safe or compliant. EU AI Act conformity depends on the full deployed system and is the responsibility of the deploying organization. Verify current obligations and effective dates with qualified counsel before relying on any timeline.

Try ClauseGuard to find your AI system's EU AI Act gaps before you launch into the EU — try ClauseGuard.