Methodology: ten versioned test protocols for the EU AI Act

A protocol on this site is a versioned, public test procedure derived from named standards, with a citation on every step that derives from a standard. Ten protocols cover the fourteen obligations mapped on this site under Regulation (EU) 2024/1689, plus classification under Art. 6 and the mock assessment under Art. 43. Every service page names the protocol version it runs, within the limits stated on what we cannot do. The protocols are procedures written from the documents in their derivation line and make no claim of field use.

Protocols

Each protocol page holds the scope, the articles covered, the inputs required, the numbered steps with a citation and a record per step, the thresholds and criteria, the outputs, the limitations, the sources and the revision history.

The published protocols with articles covered, derivation sources and version
Protocol	Name	Articles	Derived from	Version
PR-CLS v1.0	Classification and role determination protocol	Art. 6 Art. 51 Art. 50 Art. 53 Art. 54 Art. 55	Commission guidelines on high-risk classification; Commission guidelines on GPAI scope; Annex III; Article 6(3)	v1.0
PR-50-MARK v1.0	Article 50 marking and detection protocol	Art. 50	Code of Practice on Transparency of AI-Generated Content; Commission guidelines on Article 50; C2PA specification	v1.0
PR-15-ROB v1.0	Robustness and adversarial testing protocol	Art. 15 Art. 55 Art. 9 Art. 13	ISO/IEC TR 24029-1; ISO/IEC 24029-2; prEN 18229-2; prEN 18282; OWASP LLM Top 10; MITRE ATLAS; GPAI Code of Practice	v1.0
PR-10-BIAS v1.0	Bias and subgroup performance protocol	Art. 10 Art. 26	ISO/IEC TR 24027; prEN 18283; prEN 18284	v1.0
PR-12-LOG v1.0	Logging completeness and reconstruction protocol	Art. 12 Art. 26	prEN 18229-1; prEN ISO/IEC 24970; Article 12 minimum content	v1.0
PR-14-OVR v1.0	Human oversight verification protocol	Art. 14 Art. 26	prEN 18229-1; Article 14; Article 26	v1.0
PR-11-DOC v1.0	Annex IV documentation assembly and consistency protocol	Art. 11 Art. 13 Art. 53	Annex IV; Article 13; Article 11 SME simplified form where issued; Annex XI; Annex XII	v1.0
PR-43-MOCK v1.0	Pre-conformity mock assessment protocol	Art. 43	Annex VI; Annex VII; Article 43	v1.0
PR-27-FRIA v1.0	FRIA facilitation protocol	Art. 27	ISO/IEC 42005; Article 27	v1.0
PR-17-QMS v1.0	QMS gap analysis protocol	Art. 17 Art. 9	prEN 18286; ISO/IEC 42001	v1.0

How a protocol is built

Every step of a protocol carries a citation. The citation names the provision of Regulation (EU) 2024/1689 or the clause of the standard the step derives from, in the form "Regulation (EU) 2024/1689, Art. 15(5), third subparagraph" or "ISO/IEC TR 24029-1:2021, clause on statistical methods". The standards behind the citations are listed with their stage on the standards page. A step that no provision or standard covers, such as writing the environment manifest or assembling a held-out set, is marked "AIAssuranceLabs procedure" in its citation field.

The pass criteria of a protocol come from one of six levels, in this order:

A harmonised standard cited in the Official Journal, of which none is cited as of the anchor date shown on the regulation timeline. No presumption of conformity therefore attaches to any step of any protocol, since no harmonised standard is yet cited.
A JTC 21 draft standard, named with its stage. prEN 18229-2Draft supplies the accuracy metric categories, the declaration structure and the perturbation classes to PR-15-ROB v1.0, and the draft publishes no numeric pass level.
An ISO/IEC standard or technical report, named with its stage. ISO/IEC TR 24029-1:2021Published supplies the statistical, formal and empirical method categories to the same protocol.
A Commission guideline or code of practice, with its publication date rendered from the standards data. The GPAI Code of PracticePublished supplies the systemic-risk evaluation measures whose acceptance criteria the provider sets in its own framework.
A risk management framework from a national standards body, or a sector framework, for the rationale behind metric and target selection.
The state of the art, which the provider justifies and documents. The protocol records the justification in a named step and reports the measured value next to the target; the protocol does not set the target.

A clause from a draft standard is cited with the stage of the draft, and a step derived from it is not presented as a requirement of the Act. Regulation (EU) 2024/1689 sets almost no numeric threshold; Art. 15 requires an appropriate level of accuracy and, under Art. 15(3), requires the provider to declare the level and the metrics in the instructions for use. The thresholds section of each protocol page states which of the six levels each pass criterion comes from and names the step that records it.

Versioning

Every reference to a protocol on the site renders through a component that reads the version from the protocol data, so a service page under /services/ that runs PR-10-BIAS v1.0 shows the version it runs, and a deliverable on /deliverables/ names the protocol that produced it with the same version. A change to a step, to a citation or to a source document raises the version. A published version is not edited in place.

The revision history on each protocol page stamps each version with the regulation entry it was verified against, and the stamp shows the verified-on date of that entry. Version 1.0 of all ten protocols is stamped against the Omnibus entry-into-force regulation entry 2026-07-27In force, so the standards in each derivation line are taken as they stood on that entry's verified-on date.

The trigger for a new version is recorded on the regulation change log. A change to the Act, a standard that moves stage, or a guideline that is published enters the change log with its source URL, and a protocol that derives from the changed document receives a new version whose revision note cites the change log entry.

Tool logic

The tools at /tools/ run in the browser from JSON bundled at build time and send nothing to any server. The logic of each tool is published here as JSON: the classifier mirrors the steps of PR-CLS v1.0, and the obligation tracker reads the same regulation data that renders the timeline. A tool result is a reasoned technical assessment for discussion with counsel, and each tool states below its output that no data leaves the browser.