EU AI Act Compliance for SOC Automation

Classification depends on deployment. Morpheus is high-risk when deployed by critical-infrastructure operators (Annex III §2) or law enforcement entities (Annex III §6). Typical enterprise SOC triage often falls under the Article 6(3) carve-out for preparatory tasks that feed human analyst decisions. D3 builds Morpheus to high-risk-system standards regardless, so deployers in scope are covered and deployers outside scope inherit the same controls.

The customer is the deployer under Article 26. D3 Security is the provider under Article 16. Provider obligations cover design, documentation, conformity assessment, quality management, post-market monitoring, and serious-incident reporting. Deployer obligations cover operating within provider instructions, qualified human oversight, monitoring against expected performance, log retention, worker information, and fundamental-rights impact assessment where required.

Four autonomy levels (Deterministic, AI-Assisted, AI-Led, Autonomous) function as the deployer’s oversight dial, configurable per tenant or per case type. Adaptive Tasking pulls cases back into lower autonomy levels mid-investigation. The mode, every override, every dismissal, and every pause are logged with analyst identity, timestamp, and stated reason. The Act’s four capacities (intervene, override, decide not to use, safely interrupt) are produced as records.

One unified case record per incident. The Cybersecurity Triage Reasoning Graph captures the reasoning chain, the evidence tree, confidence scores per node, every analyst interaction, and the Attack Path Discovery output. The same record maps to NIS2 Article 21 documentation, DORA incident-reporting requirements, and GDPR Article 22 documentation for automated decision-making with legal effects.

Chapter III high-risk obligations apply on 2 August 2026. General-purpose AI model rules applied to new models from 2 August 2025 and to pre-existing models from 2 August 2027. Prohibited practices and AI literacy obligations have been live since 2 February 2025. Most 2026 SOC procurement cycles are anchored on the 2 August 2026 date.

Yes. Case summaries are analyst-readable. Evidence trees explain the reasoning behind autonomous decisions. The Article 13 deployer instruction package documents capabilities and limitations in plain language. Article 26(7) worker-information requirements are supported by the platform’s documented autonomy settings and the analyst-readable case record. GDPR Article 22 documentation pulls from the same audit trail.

Three architectural commitments. 70–80% of reasoning runs through deterministic code paths, so the risk surface is bounded by design. Bounded agentic reasoning enforces four explicit bounds per task (scope, capability, authority, time) that map directly to Article 9 risk-mitigation documentation. Self-Healing Integrations maps to Article 72 post-market monitoring as a property of how integrations operate.

Yes. The case record is constructed once and mapped to the reporting cadence of each mandate. NIS2 Article 21 documentation, DORA incident classification and reporting, EU AI Act Articles 12 and 14 evidence, and GDPR Article 22 automated-decision-making documentation all draw from the same unified record.