← Vetro Attest · Free Art. 12/14 checker · Free EU AI Act tools

EU AI Act for critical infrastructure operators

*Engineering guidance, not legal advice. Your legal team decides how the Act applies to your products.*

Where this sector lands

Annex III point 2 covers AI systems intended to be used as safety components in the management and operation of critical digital infrastructure, road traffic, or the supply of water, gas, heating or electricity. A safety component is one whose failure or malfunction endangers the health and safety of people or property (Art. 3(14)).

The key word is *safety*. An agent that drafts maintenance reports or answers operator questions is usually not a safety component. One that closes a valve, sheds load, reroutes traffic signals or throttles a network segment may be. The recitals add that components used solely for cybersecurity are not safety components on that basis alone.

Two procedural points specific to point 2: these systems are registered at national level rather than in the public EU database (Art. 49(5)), and deployers of point 2 systems are exempt from the fundamental rights impact assessment of Article 27.

The logging duties that follow

• Art. 12 (providers): automatic recording of events over the system's lifetime, so that situations where the system may present a risk can be identified and post-market monitoring is possible.
• Art. 19 (providers): keep the logs under your control for at least six months.
• Art. 26 (deployers), meaning the grid, water or network operator: use the system according to its instructions, assign competent human oversight (Art. 26(2)), monitor its operation and report risks and serious incidents (Art. 26(5)), and keep logs for at least six months (Art. 26(6)).

Grid and network incident investigations often need records far older than six months; treat the Act as a floor. See Art. 12 logging and serious incident reporting.

On timing: the Digital Omnibus agreement moves Annex III high-risk obligations to December 2027 (details and caveats).

What counts as evidence

After an outage, the question is what the system recommended, what it actually actuated, and whether an operator was in the loop. Record the setpoint change, the policy check and the operator's decision in one chain.

Abbreviated ledger excerpt (prev, hash and sig omitted):

{"seq":2,"type":"llm.response","data":{"model":"grid-assist-2","usage":{"input_tokens":1840,"output_tokens":96}}}
{"seq":3,"type":"policy.decision","data":{"kind":"tool.call","action":"warn","hits":[{"rule":"load-shed-requires-operator"}]}}
{"seq":4,"type":"tool.call","data":{"name":"shed_load","input":{"feeder":"F-112","mw":4.5,"approved_by":"op_night_03"}}}
{"seq":5,"type":"tool.result","data":{"name":"shed_load","output":{"status":"executed","scada_ref":"evt_88213"},"is_error":false}}

A hash chain shows no step was dropped between recommendation and actuation. An independent countersignature shows the record predates the incident review.

How Vetro Attest fits

Vetro Attest accepts an OpenTelemetry GenAI trace (OTLP/JSON) or a native Vetro ledger, with nothing to install. Verification is free. For 29 USD per ledger, one-off:

• a full EU AI Act report (Markdown and HTML) mapping the run onto the logging obligations, with an explicit list of what the log cannot show;
• an ed25519 countersignature over the ledger digest, event count and timestamp, verifiable by anyone with our published public key.

A practical pattern: countersign every run that ends in an actuation, and keep the attestation with the SCADA event reference so the two records can be cross-checked.

Limits, stated plainly: the countersignature proves the log verified clean at a time, not that the control action was safe or correct. The report supports a compliance conversation; it is not a conformity assessment. Paid ledgers are deleted after 7 days, and the report and attestation are emailed to you to keep.

Next steps

• Run the free EU AI Act Art. 12/14 checker against your current setup.
• Verify a trace free, then get the countersigned report for 29 USD.
• Compare approaches: vs. WORM storage, vs. OpenTelemetry alone.

See a sample ledger verified in one click, check your own logs free or get the countersigned EU AI Act report.