The obligation set follows from what the system does, what data it touches, what it decides, how much autonomy it holds, and where it runs. Classification is the work of answering those questions and deriving the controls that result.
Akka Verify runs that classification against a corpus of 190 AI regulations and 1,230 controls. A typical system is subject to 30 to 60 of them.
Two agents deployed in the same country can carry different obligations. A payments agent that moves money falls under operational-resilience rules. A document-summarising agent deployed beside it falls under a different set. An agent that decides a person's credit is high-risk under the EU AI Act. The same model answering a product question carries a lower risk tier.
Function, data, decision authority and geography all change which controls apply. A team that starts from its head office location and works outward produces the wrong list. The list carries rules the system is not subject to, and it omits rules that do apply.
The Eval Matrix is one signed list of every safeguard the system must implement and demonstrate. Rows come from the regulations that apply, from corporate policy, and from the project itself. Each row carries its citation, the runtime binding that enforces it, and the evidence event that proves the binding ran.
The matrix is bound to a corpus version. The same survey answered against the same version produces the same matrix, so the result is reproducible and replayable for an auditor.
Industry presets shorten the work to about half a day. A preset carries the frameworks that dominate a sector, so a bank starts from DORA, the EU AI Act, GDPR Chapter V and Basel III instead of an empty list.
A monthly corpus watch detects the change and scopes the review to the rows it affects. A prompt change is a half-day cycle. A foundation-model swap runs for weeks and is budgeted before it starts.
The matrix carries corporate policy rows beside regulatory rows. Policy rows and regulatory rows both compile to runtime bindings and both produce evidence events, so an internal rule is enforced the way a statutory one is.
Each jurisdiction contributes its own rows to the same matrix. The runtime enforces the union, and the evidence record shows which authority each control answers to.
742 of the 1,230 controls in the corpus carry financial penalties. Which of them reach a given system depends on the classification.
