{ "schema_version": "1.0", "updated": "2026-10-05", "title": "AgentenCode EU Evidence Context", "principle": "Field-level evidence mapping for AI agent governance, privacy and security. Unknown remains unknown; no blanket compliance claims.", "legal_sources": [ { "name": "EU AI Act – Regulation (EU) 2024/1689", "url": "https://eur-lex.europa.eu/eli/reg/2024/1689", "relevant_articles": [ "12", "13", "14", "15" ] }, { "name": "GDPR – Regulation (EU) 2016/679", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/", "relevant_articles": [ "5", "28", "32" ] } ], "rules": [ "Unknown ist nicht false.", "Data Residency allein belegt weder DSGVO-Konformität noch Zulässigkeit internationaler Datentransfers.", "Plattform-Evidence wird nicht auf einzelne Agenten übertragen, sofern der Scope dies nicht ausdrücklich trägt.", "Ein technischer Produkt-Control ist nicht automatisch identisch mit einer gesetzlichen Pflicht.", "Jede veröffentlichte Produktaussage benötigt Scope, Prüfdatum und aktuelle Primärquelle." ], "controls": [ { "path": "privacy.residency.available", "label": "Data Residency", "pillar": "privacy", "pillar_name": "Privacy & data", "description": "Whether the provider publicly documents data residency for the relevant product or plan scope.", "legal_context": { "eu_ai_act": [], "gdpr": [ { "article": "Art. 5", "label": "Grundsätze für die Verarbeitung personenbezogener Daten", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/" } ] }, "interpretation": "Evidence mapping only; this field is not a compliance, legal or product-quality certification." }, { "path": "privacy.residency.customer_region_selectable", "label": "Customer-selectable region", "pillar": "privacy", "pillar_name": "Privacy & data", "description": "Whether customers can select a documented processing or hosting region for the relevant scope.", "legal_context": { "eu_ai_act": [], "gdpr": [ { "article": "Art. 5", "label": "Grundsätze für die Verarbeitung personenbezogener Daten", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/" } ] }, "interpretation": "Evidence mapping only; this field is not a compliance, legal or product-quality certification." }, { "path": "privacy.residency.region", "label": "Documented region", "pillar": "privacy", "pillar_name": "Privacy & data", "description": "Which region or regions are explicitly named by the primary source.", "legal_context": { "eu_ai_act": [], "gdpr": [ { "article": "Art. 5", "label": "Grundsätze für die Verarbeitung personenbezogener Daten", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/" } ] }, "interpretation": "Evidence mapping only; this field is not a compliance, legal or product-quality certification." }, { "path": "privacy.training.customer_data", "label": "Customer data used for training", "pillar": "privacy", "pillar_name": "Privacy & data", "description": "Whether the primary source explicitly says customer data is or is not used for model training.", "legal_context": { "eu_ai_act": [], "gdpr": [ { "article": "Art. 5", "label": "Grundsätze für die Verarbeitung personenbezogener Daten", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/" } ] }, "interpretation": "Evidence mapping only; this field is not a compliance, legal or product-quality certification." }, { "path": "security.encryption.at_rest", "label": "Encryption at rest", "pillar": "security", "pillar_name": "Security & access", "description": "Documented encryption of stored data within the stated product scope.", "legal_context": { "eu_ai_act": [ { "article": "Art. 15", "label": "Robustheit und Cybersicherheit bei Hochrisiko-KI", "url": "https://eur-lex.europa.eu/eli/reg/2024/1689" } ], "gdpr": [ { "article": "Art. 32", "label": "Sicherheit der Verarbeitung", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/" } ] }, "interpretation": "Evidence mapping only; this field is not a compliance, legal or product-quality certification." }, { "path": "security.encryption.in_transit", "label": "Encryption in transit", "pillar": "security", "pillar_name": "Security & access", "description": "Documented encryption for data in transit.", "legal_context": { "eu_ai_act": [ { "article": "Art. 15", "label": "Robustheit und Cybersicherheit bei Hochrisiko-KI", "url": "https://eur-lex.europa.eu/eli/reg/2024/1689" } ], "gdpr": [ { "article": "Art. 32", "label": "Sicherheit der Verarbeitung", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/" } ] }, "interpretation": "Evidence mapping only; this field is not a compliance, legal or product-quality certification." }, { "path": "security.customer_managed_key", "label": "Customer-managed keys", "pillar": "security", "pillar_name": "Security & access", "description": "Whether customer-managed encryption keys or BYOK are documented.", "legal_context": { "eu_ai_act": [ { "article": "Art. 15", "label": "Robustheit und Cybersicherheit bei Hochrisiko-KI", "url": "https://eur-lex.europa.eu/eli/reg/2024/1689" } ], "gdpr": [ { "article": "Art. 32", "label": "Sicherheit der Verarbeitung", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/" } ] }, "interpretation": "Evidence mapping only; this field is not a compliance, legal or product-quality certification." }, { "path": "security.soc2_type2", "label": "SOC 2 Type II", "pillar": "security", "pillar_name": "Security & access", "description": "Whether SOC 2 Type II coverage is publicly documented for the relevant product scope.", "legal_context": { "eu_ai_act": [ { "article": "Art. 15", "label": "Robustheit und Cybersicherheit bei Hochrisiko-KI", "url": "https://eur-lex.europa.eu/eli/reg/2024/1689" } ], "gdpr": [ { "article": "Art. 32", "label": "Sicherheit der Verarbeitung", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/" } ] }, "interpretation": "Evidence mapping only; this field is not a compliance, legal or product-quality certification." }, { "path": "governance.sso.saml", "label": "SAML SSO", "pillar": "security", "pillar_name": "Security & access", "description": "Documented support for SAML single sign-on.", "legal_context": { "eu_ai_act": [ { "article": "Art. 15", "label": "Robustheit und Cybersicherheit bei Hochrisiko-KI", "url": "https://eur-lex.europa.eu/eli/reg/2024/1689" } ], "gdpr": [ { "article": "Art. 32", "label": "Sicherheit der Verarbeitung", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/" } ] }, "interpretation": "Evidence mapping only; this field is not a compliance, legal or product-quality certification." }, { "path": "governance.sso.oidc", "label": "OIDC SSO", "pillar": "security", "pillar_name": "Security & access", "description": "Documented support for OIDC single sign-on.", "legal_context": { "eu_ai_act": [ { "article": "Art. 15", "label": "Robustheit und Cybersicherheit bei Hochrisiko-KI", "url": "https://eur-lex.europa.eu/eli/reg/2024/1689" } ], "gdpr": [ { "article": "Art. 32", "label": "Sicherheit der Verarbeitung", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/" } ] }, "interpretation": "Evidence mapping only; this field is not a compliance, legal or product-quality certification." }, { "path": "governance.scim", "label": "SCIM", "pillar": "security", "pillar_name": "Security & access", "description": "Documented support for SCIM provisioning.", "legal_context": { "eu_ai_act": [ { "article": "Art. 15", "label": "Robustheit und Cybersicherheit bei Hochrisiko-KI", "url": "https://eur-lex.europa.eu/eli/reg/2024/1689" } ], "gdpr": [ { "article": "Art. 32", "label": "Sicherheit der Verarbeitung", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/" } ] }, "interpretation": "Evidence mapping only; this field is not a compliance, legal or product-quality certification." }, { "path": "governance.rbac", "label": "RBAC", "pillar": "security", "pillar_name": "Security & access", "description": "Documented role-based access control.", "legal_context": { "eu_ai_act": [ { "article": "Art. 15", "label": "Robustheit und Cybersicherheit bei Hochrisiko-KI", "url": "https://eur-lex.europa.eu/eli/reg/2024/1689" } ], "gdpr": [ { "article": "Art. 32", "label": "Sicherheit der Verarbeitung", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/" } ] }, "interpretation": "Evidence mapping only; this field is not a compliance, legal or product-quality certification." }, { "path": "governance.custom_roles", "label": "Custom roles", "pillar": "security", "pillar_name": "Security & access", "description": "Documented custom or granular administrative roles.", "legal_context": { "eu_ai_act": [ { "article": "Art. 15", "label": "Robustheit und Cybersicherheit bei Hochrisiko-KI", "url": "https://eur-lex.europa.eu/eli/reg/2024/1689" } ], "gdpr": [ { "article": "Art. 32", "label": "Sicherheit der Verarbeitung", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/" } ] }, "interpretation": "Evidence mapping only; this field is not a compliance, legal or product-quality certification." }, { "path": "governance.human_approval", "label": "Human approval", "pillar": "control", "pillar_name": "Human control", "description": "Documented human approval inside an agentic workflow.", "legal_context": { "eu_ai_act": [ { "article": "Art. 14", "label": "Menschliche Aufsicht bei Hochrisiko-KI", "url": "https://eur-lex.europa.eu/eli/reg/2024/1689" } ], "gdpr": [] }, "interpretation": "Evidence mapping only; this field is not a compliance, legal or product-quality certification." }, { "path": "governance.approval.pre_action", "label": "Pre-action approval", "pillar": "control", "pillar_name": "Human control", "description": "Documented approval before a consequential or sensitive action is executed.", "legal_context": { "eu_ai_act": [ { "article": "Art. 14", "label": "Menschliche Aufsicht bei Hochrisiko-KI", "url": "https://eur-lex.europa.eu/eli/reg/2024/1689" } ], "gdpr": [] }, "interpretation": "Evidence mapping only; this field is not a compliance, legal or product-quality certification." }, { "path": "governance.human_oversight", "label": "Human oversight", "pillar": "control", "pillar_name": "Human control", "description": "Documented mechanisms for human oversight of agent behavior.", "legal_context": { "eu_ai_act": [ { "article": "Art. 14", "label": "Menschliche Aufsicht bei Hochrisiko-KI", "url": "https://eur-lex.europa.eu/eli/reg/2024/1689" } ], "gdpr": [] }, "interpretation": "Evidence mapping only; this field is not a compliance, legal or product-quality certification." }, { "path": "governance.permission_controls", "label": "Permission controls", "pillar": "control", "pillar_name": "Human control", "description": "Documented permission controls for agents or workflows.", "legal_context": { "eu_ai_act": [ { "article": "Art. 14", "label": "Menschliche Aufsicht bei Hochrisiko-KI", "url": "https://eur-lex.europa.eu/eli/reg/2024/1689" } ], "gdpr": [] }, "interpretation": "Evidence mapping only; this field is not a compliance, legal or product-quality certification." }, { "path": "governance.policy_controls", "label": "Policy controls", "pillar": "control", "pillar_name": "Human control", "description": "Documented policy controls that constrain agents or actions.", "legal_context": { "eu_ai_act": [ { "article": "Art. 14", "label": "Menschliche Aufsicht bei Hochrisiko-KI", "url": "https://eur-lex.europa.eu/eli/reg/2024/1689" } ], "gdpr": [] }, "interpretation": "Evidence mapping only; this field is not a compliance, legal or product-quality certification." }, { "path": "governance.tool_permissions", "label": "Tool permissions", "pillar": "control", "pillar_name": "Human control", "description": "Documented controls over which tools an agent may use.", "legal_context": { "eu_ai_act": [ { "article": "Art. 14", "label": "Menschliche Aufsicht bei Hochrisiko-KI", "url": "https://eur-lex.europa.eu/eli/reg/2024/1689" } ], "gdpr": [] }, "interpretation": "Evidence mapping only; this field is not a compliance, legal or product-quality certification." }, { "path": "governance.action_permissions", "label": "Action permissions", "pillar": "control", "pillar_name": "Human control", "description": "Documented controls over which external actions an agent may execute.", "legal_context": { "eu_ai_act": [ { "article": "Art. 14", "label": "Menschliche Aufsicht bei Hochrisiko-KI", "url": "https://eur-lex.europa.eu/eli/reg/2024/1689" } ], "gdpr": [] }, "interpretation": "Evidence mapping only; this field is not a compliance, legal or product-quality certification." }, { "path": "governance.delegation_controls", "label": "Delegation controls", "pillar": "control", "pillar_name": "Human control", "description": "Documented limits on delegation to other agents or components.", "legal_context": { "eu_ai_act": [ { "article": "Art. 14", "label": "Menschliche Aufsicht bei Hochrisiko-KI", "url": "https://eur-lex.europa.eu/eli/reg/2024/1689" } ], "gdpr": [] }, "interpretation": "Evidence mapping only; this field is not a compliance, legal or product-quality certification." }, { "path": "governance.kill_switch", "label": "Kill switch", "pillar": "control", "pillar_name": "Human control", "description": "Documented ability to stop or disable agentic execution.", "legal_context": { "eu_ai_act": [ { "article": "Art. 14", "label": "Menschliche Aufsicht bei Hochrisiko-KI", "url": "https://eur-lex.europa.eu/eli/reg/2024/1689" } ], "gdpr": [] }, "interpretation": "Evidence mapping only; this field is not a compliance, legal or product-quality certification." }, { "path": "governance.rollback", "label": "Rollback", "pillar": "control", "pillar_name": "Human control", "description": "Documented rollback or recovery after agent actions.", "legal_context": { "eu_ai_act": [ { "article": "Art. 14", "label": "Menschliche Aufsicht bei Hochrisiko-KI", "url": "https://eur-lex.europa.eu/eli/reg/2024/1689" } ], "gdpr": [] }, "interpretation": "Evidence mapping only; this field is not a compliance, legal or product-quality certification." }, { "path": "governance.audit_logs.available", "label": "Audit logs", "pillar": "trace", "pillar_name": "Auditability & traceability", "description": "Whether audit or compliance logs are publicly documented.", "legal_context": { "eu_ai_act": [ { "article": "Art. 12", "label": "Aufzeichnungspflichten bei Hochrisiko-KI", "url": "https://eur-lex.europa.eu/eli/reg/2024/1689" } ], "gdpr": [] }, "interpretation": "Evidence mapping only; this field is not a compliance, legal or product-quality certification." }, { "path": "governance.audit_logs.retention_days", "label": "Audit-log retention", "pillar": "trace", "pillar_name": "Auditability & traceability", "description": "Documented retention period for audit or compliance logs.", "legal_context": { "eu_ai_act": [ { "article": "Art. 12", "label": "Aufzeichnungspflichten bei Hochrisiko-KI", "url": "https://eur-lex.europa.eu/eli/reg/2024/1689" } ], "gdpr": [] }, "interpretation": "Evidence mapping only; this field is not a compliance, legal or product-quality certification." }, { "path": "governance.audit_logs.api", "label": "Audit log API", "pillar": "trace", "pillar_name": "Auditability & traceability", "description": "Whether audit logs can be retrieved programmatically through an API.", "legal_context": { "eu_ai_act": [ { "article": "Art. 12", "label": "Aufzeichnungspflichten bei Hochrisiko-KI", "url": "https://eur-lex.europa.eu/eli/reg/2024/1689" } ], "gdpr": [] }, "interpretation": "Evidence mapping only; this field is not a compliance, legal or product-quality certification." }, { "path": "governance.audit_logs.siem_export", "label": "SIEM export", "pillar": "trace", "pillar_name": "Auditability & traceability", "description": "Whether export or integration with SIEM systems is documented.", "legal_context": { "eu_ai_act": [ { "article": "Art. 12", "label": "Aufzeichnungspflichten bei Hochrisiko-KI", "url": "https://eur-lex.europa.eu/eli/reg/2024/1689" } ], "gdpr": [] }, "interpretation": "Evidence mapping only; this field is not a compliance, legal or product-quality certification." }, { "path": "observability.available", "label": "Observability", "pillar": "trace", "pillar_name": "Auditability & traceability", "description": "Whether observability or monitoring capabilities are documented.", "legal_context": { "eu_ai_act": [ { "article": "Art. 12", "label": "Aufzeichnungspflichten bei Hochrisiko-KI", "url": "https://eur-lex.europa.eu/eli/reg/2024/1689" } ], "gdpr": [] }, "interpretation": "Evidence mapping only; this field is not a compliance, legal or product-quality certification." }, { "path": "observability.tracing", "label": "Tracing", "pillar": "trace", "pillar_name": "Auditability & traceability", "description": "Whether execution traces are documented for agentic runs.", "legal_context": { "eu_ai_act": [ { "article": "Art. 12", "label": "Aufzeichnungspflichten bei Hochrisiko-KI", "url": "https://eur-lex.europa.eu/eli/reg/2024/1689" } ], "gdpr": [] }, "interpretation": "Evidence mapping only; this field is not a compliance, legal or product-quality certification." }, { "path": "governance.audit_logs.action_level", "label": "Action-level audit", "pillar": "trace", "pillar_name": "Auditability & traceability", "description": "Whether individual agent actions can be traced at audit level.", "legal_context": { "eu_ai_act": [ { "article": "Art. 12", "label": "Aufzeichnungspflichten bei Hochrisiko-KI", "url": "https://eur-lex.europa.eu/eli/reg/2024/1689" } ], "gdpr": [] }, "interpretation": "Evidence mapping only; this field is not a compliance, legal or product-quality certification." }, { "path": "privacy.retention.policy", "label": "Data retention / retention policy", "pillar": "privacy", "pillar_name": "Privacy & data", "description": "Documented retention or deletion logic for relevant customer or product data.", "legal_context": { "eu_ai_act": [], "gdpr": [ { "article": "Art. 5", "label": "Grundsätze für die Verarbeitung personenbezogener Daten", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/" } ] }, "interpretation": "Evidence mapping only; this field is not a compliance, legal or product-quality certification." }, { "path": "privacy.dpa.available", "label": "DPA / data processing agreement", "pillar": "privacy", "pillar_name": "Privacy & data", "description": "Whether a Data Processing Agreement is publicly documented for the relevant scope.", "legal_context": { "eu_ai_act": [], "gdpr": [ { "article": "Art. 28", "label": "Auftragsverarbeiter", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/" } ] }, "interpretation": "Evidence mapping only; this field is not a compliance, legal or product-quality certification." }, { "path": "privacy.subprocessors.list_available", "label": "Subprocessor list", "pillar": "privacy", "pillar_name": "Privacy & data", "description": "Whether the provider publishes a current list of subprocessors for the relevant scope.", "legal_context": { "eu_ai_act": [], "gdpr": [ { "article": "Art. 28", "label": "Auftragsverarbeiter", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/" } ] }, "interpretation": "Evidence mapping only; this field is not a compliance, legal or product-quality certification." }, { "path": "privacy.processing.scope", "label": "Data processing / deployment scope", "pillar": "privacy", "pillar_name": "Privacy & data", "description": "The product, plan, region or deployment scope to which a privacy or processing statement actually applies.", "legal_context": { "eu_ai_act": [], "gdpr": [ { "article": "Art. 5", "label": "Grundsätze für die Verarbeitung personenbezogener Daten", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/" }, { "article": "Art. 28", "label": "Auftragsverarbeiter", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/" } ] }, "interpretation": "Evidence mapping only; this field is not a compliance, legal or product-quality certification." }, { "path": "security.secrets.credential_handling", "label": "Secrets / credential handling", "pillar": "security", "pillar_name": "Security & access", "description": "Documented handling of secrets, tokens or credentials in the relevant agent or platform scope.", "legal_context": { "eu_ai_act": [ { "article": "Art. 15", "label": "Genauigkeit, Robustheit und Cybersicherheit", "url": "https://eur-lex.europa.eu/eli/reg/2024/1689" } ], "gdpr": [ { "article": "Art. 32", "label": "Sicherheit der Verarbeitung", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/" } ] }, "interpretation": "Evidence mapping only; this field is not a compliance, legal or product-quality certification." }, { "path": "governance.activity_history.available", "label": "Activity history", "pillar": "trace", "pillar_name": "Auditability & traceability", "description": "Whether an activity or execution history is documented for relevant agent actions.", "legal_context": { "eu_ai_act": [ { "article": "Art. 12", "label": "Aufzeichnungspflichten / Logging", "url": "https://eur-lex.europa.eu/eli/reg/2024/1689" } ], "gdpr": [] }, "interpretation": "Evidence mapping only; this field is not a compliance, legal or product-quality certification." } ], "query_examples": [ { "question": "Welche Agenten dokumentieren Datenresidenz, Human Approval und Audit Logs?", "url": "https://agentencode.de/frage/" }, { "question": "Welche Evidence ist für DPA, Retention und Subprocessor-Liste vorhanden?", "url": "https://agentencode.de/trust/abfrage/" }, { "question": "Was hat sich an einem Trust-Control seit einem Datum geändert?", "url": "https://agentencode.de/historie/" } ] }