EU AI Act Compliance for AI-Generated Code

Compliance

The EU AI Act obliges organisations to keep AI systems documented, logs available, and output under human oversight. If your engineers ship AI-generated code, that applies to your software supply chain. Here is what the articles require and how self-hosted provenance satisfies them.

Which articles touch your codebase

  • Art. 12 — Record-keeping: automatically generated logs over the AI system's operation must be kept. For coding assistants: prompts, outputs, and model versions used to produce shipped code.
  • Art. 14 — Human oversight: measures ensuring outputs are reviewed. Evidence that AI-inserted code was accepted and reviewed by a named human.
  • Art. 11 — Technical documentation: documentation supporting conformity — an exportable AI-BOM of AI-generated content per release.

The evidence gap most teams have

Ask an engineering org today to list the AI-generated code in last month's release: they cannot. Git attributes commits to humans; AI use lives in personal accounts and ephemeral session history. When the audit arrives, the data does not exist.

How LineageLens produces the evidence

  • Capture — every AI insertion recorded with prompt lineage, model version, tool, developer, timestamp (11 tools supported).
  • Oversight evidence — accepted/rejected status and human review state per insertion (Art. 14).
  • Retention & redaction — configurable policies for log lifetime (Max).
  • Integrity — SHA-256 hash chain over records; signed AI-BOM export (Plus).
  • Self-hosting — prompts and code stay in your infrastructure; nothing leaves your VPC.

The compliance brief maps each feature to the obligations in detail, and Max adds SSO, retention policies and graph lineage for regulated environments.

EU AI Act code compliance FAQ

Does the AI Act apply to code assistants?
General-purpose AI coding assistants are not high-risk per se, but obligations around logging and oversight apply to how organisations deploy AI systems — and auditors increasingly ask for AI-code evidence regardless. Provenance is the cheapest answer.

Is a spreadsheet audit trail enough?
It does not scale and cannot be verified. A hash-chained, self-hosted provenance record is tamper-evident and queryable.

What is an AI-BOM?
A signed inventory of AI-generated content in a build — the AI analogue of an SBOM. Generated from the provenance chain on the Plus tier.