Knowledge Graph Model Systems under the EU AI Act

Overview

This course addresses operational compliance for Knowledge Graph Model (KGM) systems under Regulation (EU) 2024/1689 (the EU AI Act). For this programme, KGM systems explicitly represent, reason over and generate structured knowledge through entities and relations.

Whether a KGM system is high-risk depends on intended purpose, not on the use of a graph. Where that purpose places the system in a high-risk class, the Act continues after the system is put into service.

The course translates the articles named for this programme into purpose-specific controls for a live graph: entities, relations, inferences and link predictions, and how those are watched after go-live.

Why knowledge graphs need their own operational treatment

A graph is a structured store of claims about the world. Failures named for this course - graph poisoning, entity-disambiguation bias, and inferences that affect rights - sit in the nodes, the edges and the reasoning over them. A poisoned relation is not the same event as a wrong generated sentence. Drift in entities and relations after the last test is a production fact.

Oversight has to reach inferences and link predictions, not only a dashboard of graph size. Logs have to reconstruct which entities and relations supported an output. Monitoring has to cover graph consistency, entity-relation drift and bias that moves through the graph.

Articles in scope

The course is built around the articles already named for this programme.

• Article 8 - compliance with the Chapter III, Section 2 requirements, read through intended purpose, the generally acknowledged state of the art, and the risk-management system.
• Article 9 - the risk-management system across the life cycle.
• Article 10 - data and data governance for the datasets that build, adapt or feed the running system.
• Article 12 - automatic recording of events to a level that supports traceability.
• Article 14 - human oversight designed so natural persons can understand, monitor and intervene.
• Article 15 - appropriate accuracy, robustness and cybersecurity in operation.
• Article 17 - a quality management system covering design, testing, data, change and post-market processes.
• Article 26 - deployer obligations, including use according to instructions and monitoring of operation.
• Article 72 - the provider's post-market monitoring system, including performance in use and serious-incident reporting where it applies.

Classification remains purpose-specific. The course does not treat every deployment of this architecture as high-risk, and it does not treat high-risk status as optional once intended purpose meets the Act's tests.

What you will learn

By the end of the course, participants will be able to:

• classify a KGM system under the EU AI Act and identify which high-risk obligations follow from its intended purpose;
• apply Article 8's three interpretive lenses to a live KGM environment;
• design human oversight for graph inferences and link predictions, including when bias or reasoning error must escalate;
• set out proportionate post-market monitoring covering graph consistency, entity-relation drift and bias propagation;
• specify runtime observability, audit trails and incident response for the knowledge-graph pipeline in use.

Course structure

Six modules. Each module stays inside the articles listed above.

1. Regulatory context and the Article 8 lenses

How the Act classifies systems by intended purpose. When a KGM use is high-risk and when it is not. How intended purpose, state of the art and the risk-management system attach to the live graph.

2. Human oversight under Article 14

What a person must be able to see in an inference or link prediction. When oversight must reject a relation, freeze a subgraph, or stop a query. Escalation for disambiguation error and for inferences that affect rights.

3. Logging, traceability and observability

Article 12 as it applies to queries, inferred triples and the relations used. Article 10 as it applies to the data that populate the graph. Article 15 as it applies to robustness against poisoning and to accuracy of reasoning in operation.

4. Post-market monitoring under Article 72

Graph consistency over time. Entity and relation drift after the last test. Bias that propagates through links. The deployer's related duty under Article 26 to use the system as instructed and to watch its operation.

5. Operational risk controls and incident response

Article 9 after deployment: a poisoned node or relation, an unintended inference path, a graph that has left its intended scope. Isolating the affected subgraph. Recording the incident so the risk-management file can be updated.

6. Integration and audit readiness

How Articles 17 and 8 require these operational controls to sit inside a quality-management system. What an assessor would need in order to test the live graph against the claimed purpose. The record means the information the Act already requires. The course does not add a separate product pack.

Who the course is for

The course is written for people responsible for KGM systems that are in production, or that are being prepared for a high-risk intended purpose under the articles above. It assumes familiarity with the EU AI Act. It is not a survey of knowledge-graph methods.