← Vetro Attest · Free Art. 12/14 checker · Free EU AI Act tools

EU AI Act for migration and border control

*Engineering guidance, not legal advice. Your legal team decides how the Act applies to your products.*

Where this sector lands

Annex III point 7 covers AI systems used by or on behalf of competent public authorities, or by Union institutions, bodies, offices or agencies, in migration, asylum and border control management:

• (a) as polygraphs or similar tools;
• (b) to assess a risk, including a security risk, a risk of irregular migration, or a health risk, posed by a person who intends to enter or has entered a Member State;
• (c) to assist in the examination of applications for asylum, visas and residence permits and associated complaints, including assessing the reliability of evidence;
• (d) to detect, recognise or identify natural persons, with the exception of verifying travel documents.

An LLM that summarises an asylum interview, cross-checks a visa file for inconsistencies or translates statements for a caseworker can sit squarely in 7(c). Vendors are providers; the ministry, consulate or border agency is the deployer.

Point 7 systems are registered in a secure, non-public section of the EU database (Art. 49(4)), and the two-person verification rule for biometric identification has a carve-out in this area where law deems it disproportionate (Art. 14(5)).

The logging duties that follow

• Art. 12 (providers): automatic recording of events so each case's processing can be traced.
• Art. 19 (providers): keep logs under your control for at least six months.
• Art. 26 (deployers): competent human oversight by caseworkers (Art. 26(2)), logs kept for at least six months (Art. 26(6)), and use only of registered systems (Art. 26(8)). As public bodies, deployers also carry out a fundamental rights impact assessment.

Asylum appeals routinely outlast six months. The Act sets the floor, the appeal timeline sets the practical need.

On timing: the Digital Omnibus agreement moves Annex III high-risk obligations to December 2027 (details and caveats).

What counts as evidence

On appeal, the question is whether an AI summary or flag shaped the decision, and whether it was accurate to the source. Record the flag with a pointer to the source passage and the caseworker's handling.

Abbreviated ledger excerpt (prev, hash and sig omitted):

{"seq":1,"type":"tool.call","data":{"name":"load_file","input":{"case":"VS-26-44120","docs":["interview_tr","passport_scan"]}}}
{"seq":2,"type":"tool.result","data":{"name":"consistency_check","output":{"flag":"date_mismatch","source":"interview_tr#p7"}}}
{"seq":3,"type":"policy.decision","data":{"kind":"tool.result","action":"warn","hits":[{"rule":"flags-are-advisory"}]}}
{"seq":4,"type":"tool.call","data":{"name":"caseworker_note","input":{"officer":"cw_205","resolution":"clarify_at_hearing"}}}

A hash chain makes it detectable if a flag is removed or a caseworker note is added after the appeal was filed.

How Vetro Attest fits

Vetro Attest accepts an OpenTelemetry GenAI trace (OTLP/JSON) or a native Vetro ledger, with nothing to install. Verification is free. For 29 USD per ledger, one-off:

• a full EU AI Act report (Markdown and HTML) mapping the run onto the logging obligations, with an explicit list of what the log cannot show;
• an ed25519 countersignature over the ledger digest, event count and timestamp, verifiable by anyone with our published public key.

A practical pattern: countersign each case-processing run when the caseworker closes it, and keep the attestation in the case file. Redact identity data before export; the attestation itself covers only a digest.

Limits, stated plainly: the countersignature proves the log verified clean at a time, not that the assessment of the case was correct. The report supports a compliance conversation; it is not a conformity assessment. Paid ledgers are deleted after 7 days, and the report and attestation are emailed to you to keep.

Next steps

• Run the free EU AI Act Art. 12/14 checker against your current setup.
• Verify a trace free, then get the countersigned report for 29 USD.
• Compare approaches: vs. WORM storage, vs. signing your own logs.

See a sample ledger verified in one click, check your own logs free or get the countersigned EU AI Act report.