2026-08-03 · ~5 min read

Your open AI stack is not AI Act ready. Neither is a letter grade.

I live in Spain, so the AI Act lives in my LinkedIn feed. Thinkpieces. Webinars. “Are you ready?” decks with more arrows than locks. Almost none of them start with the boring question: can a stranger already drive your model API, read your traces, or pull the documents your agents retrieve?

This is not legal advice. If the Act actually applies to what you ship, talk to counsel. What follows is an opinion from someone who watches open AI control planes for a living: most “AI Act readiness” talk is theater until the doors are closed.

If a vendor sells you “AI Act compliant” because a scanner printed a B, walk away. Ask for your money back. A letter grade is not a certificate. A certificate is not a closed port.

Three articles people wave at unlocked doors

The Act is large. GPAI, prohibited practices, national procedure — fine, later. The three articles that collide first with a messy stack are the ones about cybersecurity, logging, and data that left the building. Not because lawyers love them. Because engineers keep shipping without locks.

Art. 15 — can a stranger use the control plane? Model server with no auth. MCP endpoint anyone can call. Chat UI with signup left open. Inference proxy without a master key. Management console on a public URL. Call it what it is: an open surface. Fix that before you debate robustness taxonomy. Auth in front, network that is not the entire internet, or take the endpoint down.

Art. 12 — record-keeping. Tracing is useful. It is also a continuous tape of prompts and outputs. Leaving that dashboard reachable by anyone is not “observability culture.” It is a stranger reading your audit trail — laptop, VPC, or SaaS project someone made public by mistake. The real question is not “do we log?” It is “who can read it, and for how long?”

Art. 10 — data that leaves the building. RAG on the company wiki. Vector store with no auth. Agent tools that pull customer files for whoever finds the URL. You do not need a risk-classification workshop to notice that. You need to know where the bytes sit and who can fetch them.

Stop confusing vocabulary with posture

Security people say CVE. Compliance people say Article. An open model API is both free compute for strangers and a cybersecurity failure mode that Art. 15 language already knows how to name. Shared vocabulary helps. Shared theater does not.

Bring counsel facts: product, URL or port, who can reach it, what happens if they do. Not a screenshot of a grade. Not a slide that says “mapped to Art. 15” while the API still answers curl from a café.

Cloud consoles, vendor admin panels, internal-only networks — the Act does not stop caring at home-lab ports. The failure mode is the same: someone can use the system who should not.

Fix the door

If this post is wrong on the law, say so — I will correct it. If a stranger can still drive your stack, fix that first. The LinkedIn thinkpieces will still be there when you get back.