Designing inside the EU AI Act, not around it
Most of what the EU AI Act asks for maps cleanly onto choices we’d already made for other reasons. Run locally by default, show your work, keep a person in the loop unless they choose otherwise. None of that was written to satisfy a regulator. It happened to satisfy one anyway.
The Act sorts AI systems into risk tiers and attaches obligations to each one. A general-purpose orchestration tool like Soriku sits in the limited-risk bracket, not the high-risk categories built for things like biometric identification or credit scoring. But the obligations that do apply, transparency about what the system is and traceability of what it decided, aren’t things we treat as paperwork. They’re the same information a developer wants when a routing decision looks wrong.
Transparency: you always see who answered
Every response carries the model that produced it and the category it was scored against. That’s not a label added for a compliance officer to find. It’s the same detail you’d want at 11pm when an answer looks off and you’re trying to work out whether the model was a bad fit for the task or the task itself was the problem.
Traceability: a decision you can look back at
Because routing is deterministic, a decision made today can be checked next month against the measurement that produced it. For a team, that becomes an audit log: who ran what, against which model, and which score justified the pick. Nothing about that log requires you to trust our memory of what happened, it’s just what the router already recorded.
Human oversight: nothing runs that you didn’t choose to allow
Routing can be pinned to a specific model per category when you want full control instead of the measured default. Multi-model verification, where two or three models check each other on a high-stakes prompt, is opt-in, not something that switches on quietly because a prompt looked important. The default behaviour is visible and adjustable, not a black box you have to trust blind.
Where the data actually goes
Local mode keeps prompts, completions, and agent memory on the device. The cloud is opt-in per prompt and per model, not a setting buried three menus deep that quietly sends everything out by default. When you do reach for a remote model, Atypisch is a Dutch company running on European infrastructure, with Mistral as the recommended primary provider, so the default path for a cloud call stays inside the EU.
None of this makes Soriku exempt from anything. It means the hardest parts of the Act were already true before we read the text, because local-first architecture and a system you can explain tend to end up in the same place.