Re: UPDATED, for immediate action! [was] Draft EU Commission guidelines on the classification of high-risk AI system

Lars and everyone, thanks
I have updated the note as follows as per the discussion
https://docs.google.com/document/d/1xbnOx7d8I4aUTLczbdkiL9Ttafl6iDbm3h6RsYWktLw/edit?usp=sharing
Please send additional suggested edits and comments before 23 July-


*Changelog — Consultation submission revisions*

*Section affected:* 2.3 only — "Open question for the guidelines:
classification persistence across lifecycle events." All other sections
unchanged.

*Change 1 — New paragraph added* (connecting 2.2 and 2.3):
Added a paragraph arguing that an evidentiary record establishing *who
acted* is not the same as establishing that the *authorization* for that
action still held at the time it was taken. Recommends that an Article 12
record commit identity, decision, *and*
authorization-state-at-time-of-action, not just the first two. Flags two
open scoping questions: (a) whether this level of detail belongs in the
Commission's guidelines or in referenced technical-standards work, and (b)
whether it bears on the Article 25(1) provider-obligation transfer —
explicitly left unanswered as outside the group's competence. Sourced to a
mailing-list thread (linked, no name attached).

*Change 2 — Test-bed citations rewritten:*
The two supporting-project references were reframed from reading as one
combined grounding into two clearly separate, early-stage, unreviewed items:

   - Added repo-age context for the lifecycle write-up (created April 2026,
   small star count).
   - Clarified the second project is a different, single-author work (not
   connected to the first repo), noted it's a Zenodo self-publication, not
   peer-reviewed, and flagged that its "verification" claim was added weeks
   after the original publication and hasn't been independently checked by
   anyone, including the group.

*Change 3 — Closing line added:*
A sentence clarifying both projects are offered only as illustrative test
beds, and that the section's conceptual argument doesn't depend on either
project's claims holding up.


On Tue, Jul 21, 2026 at 5:31 PM Lars Kersten Kroehl <lars@moltrust.ch>
wrote:

> Greetings AI KR CG Participants,
>
> I build DID/VC verification infrastructure for autonomous agents,
> including a deployed layer that anchors per-action verdicts against a
> committed mandate. I comment here because Section 2 touches a problem I run
> in production: the relationship between an evidentiary record and the
> authorization it is supposed to attest.
>
> == On §2.2 and §2.3: the record and the delegation should anchor at the
> same point ==
>
> Sections 2.2 (evidentiary record) and 2.3 (speaks-for authority) address
> two halves of one question, and the draft does not yet connect them.
>
> A content-addressed record of a commitment and decision establishes that
> an action occurred and by which identity. It does not, on its own,
> establish that the delegation authorizing that action held at the moment
> the action was taken. For a static system this gap is invisible. For an
> agentic system whose authorization can be narrowed, delegated onward, or
> revoked between classification and action, it is the substance of the
> question 2.3 raises: after a fork, identifying which instance acted is not
> the same as establishing that the acting instance was authorized at that
> time.
>
> The practical consequence for record-keeping guidance: an evidentiary
> record satisfying Article 12 should commit the identity, the decision, and
> the authorization state in force at the moment of the action. Without the
> last, a fork preserves the classification but not the binding that made the
> action accountable. Whether this belongs in the guidelines or in the
> referenced technical work (W3C AI Agent Protocol CG) is a scoping question
> for the group.
>
> Whether this bears on the Article 25(1) provider-obligation transfer —
> where a fork or substantial modification may move provider status to
> another party — is a legal question outside our competence.
>
> Best,
> Lars
>
>
>
>
>
>
> Am 21.07.2026 um 16:07 schrieb Paola Di Maio <paola.dimaio@gmail.com>:
>
> Greetings AI KR CG Participants
>
>
>