- The headline is what the Act's record-keeping articles add up to: the AI you rely on stays documented and recoverable.
- The Act was amended this summer. Regulation (EU) 2026/1744 (the Digital Omnibus on AI), of 8 July 2026, published in the Official Journal on 24 July 2026, moved the high-risk dates and rewrote Article 4. Every quote on this page was checked in EUR-Lex's consolidated text as at 27 July 2026, which includes those changes.
- The visual is the same fictional AI application as on the home and AI escrow pages (Risk Assistant), shown as an AI Act evidence file. Names, dates and contents are fictional and labelled.
- Prices are the AI row of the 6 Oct list.
The AI you rely on, documented and recoverable.
The AI Act asks providers of high-risk AI systems to keep their technical documentation available for ten years after the system is placed on the market or put into service, and names backup or fail-safe plans as one route to robustness. Codekeeper holds every layer of the AI you build or buy, and proves it rebuilds without the vendor.
For AI applications: Escrow from $649. Escrow Pro from $849. Per application per month.
- Trusted by 3,500+ teams
- ISO/IEC 27001:2022 certified
- Our own models, no third-party AI
Trusted by 3,500+ teams, from regulated enterprises to fast-growing software vendors
- Sources: Articles 11(1), 15(4), 18(1) and 18(2) were read in the consolidated text on EUR-Lex (CELEX 02024R1689-20260727). Article 113, as amended, was read on the Commission's AI Act Service Desk, which states it follows that same consolidated text; our fetch tool couldn't reach Article 113 on EUR-Lex because the page is cut off after Article 26. The new high-risk dates also appear in recital 40 of Regulation (EU) 2026/1744, read on EUR-Lex. Legal should check Article 113 on EUR-Lex before launch.
- Dates fixed. Production says "Full high-risk Annex III obligations apply … December 2, 2027" (right, after the Omnibus) but describes the Omnibus as "provisionally agreed on May 7, 2026", which we couldn't verify. It's now adopted law, so the page cites the regulation. Annex I systems follow on 2 August 2028.
- Not used: production's "four tiers", "AI literacy … staff must demonstrate sufficient understanding" (Article 4 now asks providers and deployers to "take measures to support the development of AI literacy"), "Escrow agreement drafted … in 1-3 days", "live within 24 hours", the Article 79 withdrawal line and "Italy's national AI law". None was checked.
What the AI Act asks
Documentation that outlives the release. Plans for when things fail.
For high-risk AI systems, most duties sit with the provider: the organisation that develops the system and places it on the market. Three of them are about keeping the system's records available, and one names backup plans.
“The technical documentation of a high-risk AI system shall be drawn up before that system is placed on the market or put into service and shall be kept up-to date.”
“The provider shall, for a period ending 10 years after the high-risk AI system has been placed on the market or put into service, keep at the disposal of the national competent authorities: (a) the technical documentation referred to in Article 11; …”
“Each Member State shall determine conditions under which the documentation referred to in paragraph 1 remains at the disposal of the national competent authorities for the period indicated in that paragraph for the cases when a provider or its authorised representative established on its territory goes bankrupt or ceases its activity prior to the end of that period.”
“The robustness of high-risk AI systems may be achieved through technical redundancy solutions, which may include backup or fail-safe plans.”
Quoted from the consolidated text on EUR-Lex as at 27 July 2026. Codekeeper's evidence supports your assessment. Whether it meets a specific requirement is for you and your assessor to decide.
Where AI you don't control fits
The Act keeps the records available. Your way back is up to you.
If your AI vendor fails, retires a model or changes its terms, the documentation and the system can go with it. A deposit with Codekeeper keeps both within reach, and a rebuild shows they work.
Map the AI system
Models, prompts and agents, pipelines, workflows and documentation, layer by layer.
Agree the terms
Two-party, three-party or multi-party, so release or recovery is settled with the AI vendor up front.
Sync and check
Deposits sync daily. We check what's deposited and issue a Software Resilience Certificate.
Prove it rebuilds
With Pro, AI agents rebuild it in the Codekeeper AI Verification Lab, on supported technology stacks, in hours.
What goes into an AI deposit, layer by layer: AI escrow.
- No retention claim. Article 18(1) says ten years. How long Codekeeper keeps earlier deposit versions isn't confirmed (open item from the CRA page), so the page never says we keep documentation for ten years.
- Logs are left out on purpose. Articles 12, 19 and 26(6) put log-keeping on providers and deployers. Holding logs isn't a confirmed Codekeeper feature, so the FAQ says so plainly instead of mapping it here. Confirm whether log exports can be deposited.
- The DORA row uses the verified Article 28(8) wording for financial entities whose AI vendor supports a critical or important function.
- 16 Oct: Continuity Pro added. The rebuild row now names Continuity Pro, since base Continuity no longer includes Agentic Verification; the live-service row covers both Continuity levels.
Evidence map
Evidence for each article.
What you can put on file for documentation, robustness and your exit plan, and which protection it comes with.
| EU AI Act | Codekeeper evidence |
|---|---|
| Art. 11(1) Technical documentation, kept up to date | The system's documentation deposited with its models, prompts and configuration, with an automated check of what's there. Software Resilience CertificateVault reportEvery protection, for AI applications |
| Art. 18(1) and (2) Documentation available, even if the provider stops | Release terms agreed up front, so the deposit, documentation included, comes to you if an agreed condition such as the vendor's insolvency is met. Escrow AgreementEscrow · Escrow Pro |
| Art. 15(4) Backup or fail-safe plans | Proof the system rebuilds from the deposit in the Codekeeper AI Verification Lab, with no help from the vendor, and the steps to do it again. Recoverability CertificateRun reportExit workbookDeployable copyEscrow Pro · Resilience Pro · Continuity Pro |
| Art. 15(4) A fail-safe for a live AI service | A recovery Codekeeper runs for you. With Continuity, we also keep the live environment paid and switched on for an agreed period while we recover. Resilience ArrangementLive environment mapResilience · Resilience Pro · Continuity · Continuity Pro |
| Art. 16(d) Keeping the documentation, for AI providers | A dated, independent copy of your documentation and system, held by a neutral party, that you can show your customers. Software Resilience CertificateRecoverability CertificateEscrow · Escrow Pro, for AI vendors |
| Your exit plan for an AI supplier DORA Art. 28(8) for financial entities | Our specialists rebuild the AI system by hand in a clean room and test the business functions you nominate, without the original developers. Tested Exit ReportFramework annexExit Exercise, an add-on to any plan |
Codekeeper's evidence supports your assessment. Whether it meets a specific requirement is for you and your assessor to decide.
Which protection fits
Who runs the recovery if your AI vendor stops?
Escrow means the deposit is released to you and you run the recovery. Resilience costs more because we do the recovery. Continuity costs more again because we also keep the live environment switched on.
Escrow
Released to you→Self-Run Recovery
When the agreed conditions are met, the deposit is released to you. Escrow Pro adds proof it builds, from $849. Explore Escrow
From $649
Resilience
Comes to us→Managed Recovery
If the AI system fails, Codekeeper runs the recovery for you. Resilience Pro starts from a deposit we know builds, from $1,149. Explore Resilience
From $949
Continuity
Live service kept on+Managed Recovery
Everything in Resilience, plus the live environment kept paid and switched on for an agreed period while we recover. Continuity Pro adds Agentic Verification, from $2,149. Explore Continuity
From $1,949
Prices per AI application per month. Setup is $499 per arrangement for Escrow and Resilience, and $999 for Continuity. One claimant is included; more are an add-on. Enterprise: talk to us. See all prices
What goes into an AI deposit?
Models and weights, prompts and agents, pipelines, vector stores, workflows and deployment settings. The AI escrow page goes through each layer.
Sample evidence pack
See what your auditor would receive.
An anonymised set of outputs from a real Agentic Verification run, so you can judge the evidence before you talk to us.
- Recoverability Certificate
- Run report
- SBOM and Exit workbook excerpts
- Article 26(6) (deployers keep logs under their control for at least six months) was read on the Commission's AI Act Service Desk, not on EUR-Lex, because our fetch tool couldn't reach that part of the EUR-Lex page. Check it before launch.
- Fines: Article 99(3), (4) and (5) were read on the AI Act Service Desk (same consolidated text). Production's hero line "fines up to €35 million" is the prohibited-practices maximum and isn't what a vendor failure exposes you to.
- The guide link points to the production EU AI Act guide, listed on the Resources hub.
Questions
The AI Act, answered.
What is the EU AI Act?
Regulation (EU) 2024/1689, which lays down harmonised rules on artificial intelligence. It was published in the Official Journal on 12 July 2024 and entered into force twenty days later. Regulation (EU) 2026/1744, the Digital Omnibus on AI, amended it in July 2026.
When do the high-risk rules apply?
After the Digital Omnibus, the high-risk rules in Chapter III, Sections 1 to 3, apply from 2 December 2027 for systems that are high-risk under Article 6(2) and Annex III, and from 2 August 2028 for systems under Article 6(1) and Annex I. The Act's general date of application is 2 August 2026. Chapters I and II have applied since 2 February 2025, apart from some points of Article 5 that apply from 2 December 2026.
What did the Digital Omnibus change?
Regulation (EU) 2026/1744 of 8 July 2026, published on 24 July 2026, made a number of changes. The ones most buyers ask about: the new high-risk dates above, and a rewritten Article 4, which now asks providers and deployers to take measures to support the AI literacy of their staff.
We use AI from a vendor. Does the Act apply to us?
It can. The Act applies to deployers of AI systems established or located in the EU, not only to providers (Article 2(1)(b)). Most documentation duties for high-risk systems sit with the provider. Deployers have their own, including keeping the logs a high-risk system generates, where they're under their control, for at least six months (Article 26(6)).
Can we become the provider of a vendor's AI system?
Yes, in the cases Article 25(1) lists. You're treated as the provider of a high-risk AI system, with the provider's obligations under Article 16, if you put your name or trademark on it, make a substantial modification so it remains high-risk, or change an AI system's intended purpose so it becomes high-risk. Check your position with counsel.
Does Codekeeper keep our AI logs?
No. Keeping logs is the provider's job under Article 19 and, for logs under their control, the deployer's under Article 26. Codekeeper holds the AI system itself: its models, prompts, agents, pipelines, workflows, deployment settings and documentation.
What are the fines?
Article 99 sets maximum fines. Breaching the obligations of providers (Article 16) or deployers (Article 26), among others, can mean up to €15 million or 3% of total worldwide annual turnover, whichever is higher, for an undertaking. The prohibited practices in Article 5 carry up to €35 million or 7%.
Will this make us AI Act compliant?
No product can do that on its own. Codekeeper gives you evidence for your file: certificates, run reports, SBOMs, Exit workbooks and, with an Exit Exercise, a Tested Exit Report. Whether it meets a specific requirement is for you and your assessor to decide.
Does our deposit go through a third-party AI?
No. Agentic Verification runs on Codekeeper's own models. There's no third-party AI, and your code stays in our environment.
Want the background first? Our EU AI Act guide is in Resources.
Keep your AI documented and recoverable.
We'll map your AI systems layer by layer and show you the evidence each protection adds to your file.