What is AI agent governance?

AI agent governance is the practice of defining, enforcing, and auditing what AI agents are allowed to do in an organization. It includes policy rules (what actions are permitted), an audit trail (logging every agent action), and compliance reporting (proving adherence to regulations like the EU AI Act, SOC2, and HIPAA). InspectModular provides a governance layer that works with any AI agent via MCP.

How does InspectModular comply with EU AI Act Article 12?

EU AI Act Article 12 requires high-risk AI systems to automatically record events throughout their lifetime. InspectModular satisfies this requirement by logging every AI agent action — including tool calls, file operations, policy checks, and session starts — to a tamper-resistant audit trail. Compliance reports can be exported for regulatory evidence.

How do I add an audit trail to my AI agent?

With InspectModular, you add an audit trail to any AI agent in two steps: (1) Connect via MCP — paste the InspectModular config into your IDE (Cursor, Claude Code, VS Code, Windsurf, etc.) and every agent action is automatically logged. (2) For Python or Node.js pipelines, call the REST API or use the Primer SDK — one line of code instruments your entire agent session.

What AI tools does InspectModular work with?

InspectModular works with any MCP-compatible AI tool: Cursor, Claude Code, Windsurf, VS Code (GitHub Copilot), Zed, Gemini CLI, and more. It also works with Python and Node.js AI pipelines via REST API, and with local models like Ollama and LM Studio.

Is InspectModular compliant with SOC2 and HIPAA?

InspectModular helps organizations achieve SOC2 and HIPAA compliance for their AI agent usage. It provides the audit trail (access logs, action logs), access control (policy rules that block unauthorized actions), and compliance reporting needed to satisfy SOC2 Type II audit requirements and HIPAA security rule requirements for AI systems accessing patient data.

How do I set policy rules for AI agents?

In the Primer dashboard, go to Policy → add rules. Each rule has a pattern (e.g. "delete *", "access production database"), an action (block or warn), a severity level, and a reason. When an AI agent calls primer_agent_check before performing that action, it will be blocked or warned according to your rule. Rules apply to all agents in your workspace immediately.

What does EU AI Act Article 12 require for AI agents?

Article 12 requires high-risk AI systems to automatically record events throughout their lifetime. For AI agents this means logging every action — tool calls, file operations, policy checks, decisions, session starts — with timestamps, agent identity, and outcomes.

How does InspectModular satisfy EU AI Act Article 12?

InspectModular automatically logs every AI agent action — session starts, tool calls, policy checks, file operations — to a tamper-resistant audit trail. Each log includes timestamp, agent identity, action type, and outcome. No additional code needed when agents connect via MCP.

What are the EU AI Act non-compliance penalties?

Up to €35M or 7% of worldwide annual turnover for serious violations. €15M or 3% for other violations including record-keeping failures such as missing audit trails.

EU AI ACT · ARTICLE 12

EU AI Act Article 12
Compliance for AI Agents

Article 12 requires high-risk AI systems to automatically log all events. Here's what that means for AI agents — and how InspectModular satisfies it in under 5 minutes.

⚠️

Enforcement starts August 2026

High-risk AI requirements including Article 12 logging become enforceable August 2026. Penalties: up to €35M or 7% of global revenue. Start compliance preparation now.

What Article 12 Requires

Article 12 states that high-risk AI systems must be designed to "automatically record events ('logs') throughout the lifetime of the AI system." For AI agents this means logging:

⏱ Session starts and ends

When an agent session begins and terminates

🔧 Tool calls and actions

Every tool invoked, file accessed, API called

🛡 Policy checks

Every action checked against your org rules

✓ Decisions and outcomes

What the agent decided and why

👤 Agent identity

Which agent, tool, and model acted

📅 Precise timestamps

When each event occurred, in UTC

How to Comply — 4 Steps

Create a InspectModular account

Create account →

Paste MCP config into your IDE

Go to MCP Setup → select your IDE (Cursor, Claude Code, VS Code, Windsurf, Zed) → copy the JSON config block → paste into your IDE config file. Logging starts immediately.

MCP Setup →

Set policy rules (Article 9 risk management)

In Policy → Rules, define what agents are allowed to do. Every rule check is logged with outcome — satisfying Article 9 risk management requirements.

Policy →

Verify your audit trail

Open Audit in your dashboard. Every agent action appears with timestamp, agent, action type, and outcome. Export for regulatory evidence.

View audit →

Audit Log Format

// Every audit log entry (Article 12 compliant):
{
  "timestamp": "2025-08-12T14:32:07.412Z",   // UTC, millisecond precision
  "workspace_id": "ws_...",                    // Your organization
  "agent": "claude-code",                      // Agent identity
  "action": "write",                           // What was attempted
  "target": "src/config/database.ts",          // Target of action
  "outcome": "allowed",                        // allowed | blocked | warned
  "policy_rule": null,                         // Rule triggered (if any)
  "session_id": "sess_...",                    // Session grouping
  "severity": "info"                           // Log severity
}

Frequently Asked Questions

When does EU AI Act Article 12 become enforceable?

High-risk AI system requirements become enforceable in August 2026. The EU AI Act entered into force August 2024. Penalties can reach €35M or 7% of global annual revenue.

Which AI systems are "high-risk" under the EU AI Act?

Per Annex III: AI used in HR/employment, credit/finance, education, law enforcement, critical infrastructure, healthcare, and justice administration. If your AI agents operate in these domains, Article 12 applies.

Does InspectModular work for Python pipelines and not just IDE agents?

Yes. IDE agents connect via MCP config (Cursor, Claude Code, VS Code, Windsurf). Python/Node.js pipelines connect via REST API. Both produce identical audit trail entries. One dashboard covers all.

Are the audit logs tamper-resistant?

Yes. InspectModular audit logs are stored in an append-only database partition. They cannot be modified or deleted by agents or users. They can be read and exported for regulatory purposes.

Start EU AI Act compliance today

Free plan includes full audit trail. No CLI installation. Connect in under 60 seconds.

Start free →View audit trail →