Free tool · Agent mesh · EU AI Act
EU AI Act Agent-Risk Heatmap Generator
Describe your agent-mesh configuration — how many agents, how autonomous they are, what they can delegate, and what data they touch. This generator maps that configuration against the EU AI Act's high-risk criteria and returns a risk-exposure score with a heatmap of the gaps that drive it. Everything runs in your browser.
Generator
What the mesh's outputs decide or influence. Annex III domains carry the Act's high-risk duties.
Delegation chains multiply exposure: each hand-off is a place oversight and logging can silently drop.
How far an agent can act before a human sees the action.
The most sensitive data any agent in the mesh can read, store in shared memory, or pass to another agent.
Controls you already have
Tick only controls that exist today and would survive an audit — not planned ones.
Results
Shareable report
Copy this report for your risk register, or use Print / Save as PDF. It is built only from the selections above — no private data leaves your device.
How to read the heatmap
Each cell is one exposure driver. Its colour combines your configuration (domain, mesh, autonomy, data) with whether the matching control exists. A missing control hurts most where the configuration is hottest — a fully autonomous mesh making Annex III decisions with no tested stop procedure is the reddest cell this generator can produce.
- Human oversight (Art. 14): high-risk systems need named humans who can monitor, interpret, override, and stop them — across every agent, not just the first one.
- Record-keeping (Art. 12): logs must reconstruct what the mesh did, including which agent delegated what to whom.
- Risk management (Art. 9) & data governance (Art. 10): shared memory and delegation do not dilute these duties — they extend them to every agent that touches the data.
- Transparency (Art. 13 & 50): deployers and affected people need to know an agent mesh is acting, what it can do, and where its limits are.
This is an informational self-assessment, not legal advice. It does not determine your legal classification under the EU AI Act. For binding answers, consult qualified counsel.
FAQ
Is this legal advice?
No. This tool is an informational self-assessment for operational readiness — it is not legal advice and does not classify your system.
Does my input leave my device?
No. The generator runs entirely in your browser and stores nothing.
Why does mesh size matter?
Because duties attach to the system, while failures happen at hand-offs. Every delegation is a point where oversight, logging, and data controls can drop — larger, more open meshes have more of those points.
What should I fix first?
Red and critical cells first, in heatmap order. Then document the fix, keep the evidence, and re-run this generator whenever the mesh, its autonomy, or its data changes.
Close the red cells with the Playbook — Studio Edition
The $29 Studio Edition gives you the approval-gate patterns, oversight and audit-trail templates, delegation bounds, and incident runbook behind every fix on your heatmap.
Get the Studio Edition — $29