docs(verification): profile floors are specification choices, not regulatory derivations - #310

Approved.

The correction is right, and for the reason that matters: Annex IV is the technical documentation schedule Article 11(1) points at, so "Annex IV high-risk" named nothing a reader could look up, while classification runs through Article 6 with Annexes I and III.

I checked the new section's citations rather than taking them, since this is the kind of text that gets quoted back at us. They hold, including the two that rest on the amended Regulation:

• Annex IV is titled "Technical Documentation Referred to in Article 11(1)" and is a documentation schedule, not a classification annex.
• Article 6(1) classifies safety components under the Annex I harmonisation legislation and Article 6(2) classifies the Annex III uses, so the substituted label names something a reader can check.
• Article 15(5) is outcome-framed, and its list is the one you give.
• Articles 11 and 15 sit in Chapter III Section 2 and Article 25 in Section 3.
• Regulation (EU) 2026/1744 entered into force on 27 July 2026, it does amend both Article 25(4) and Article 111(2), and the new Article 113 dates are 2 December 2027 for Article 6(2) and Annex III and 2 August 2028 for Article 6(1) and Annex I. That is what you wrote, mapping included.
• The Cyber Resilience Act dates are right as well: Annex I obligations from 11 December 2027, Article 14 reporting from 11 September 2026, which is in two days.

One suggestion, not a condition. The section leaves out Article 12, which is the provision this repository leans on everywhere else: spec/trace-v0.2.md cites it for tamper-evident logging and LIMITATIONS.md maps it to Level 1. It supports your thesis rather than complicating it, since Article 12 requires that a system technically allow the automatic recording of events over its lifetime and says nothing about provenance or supply-chain depth. A reader who knows this repository will look for it in a section that promises what the Regulation actually requires.

Two notes for whoever reads this next, neither of them yours to act on.

spec/trace-v0.2.md still describes the Article 12 timeline as "the current provisional timeline" with obligations "from around December 2027". After 2026/1744 that is stale, and the date is now split by classification. It deserves its own issue: it is normative-adjacent and correctly out of scope for a documentation-only change.

The same file's comparison table reads "EU AI Act Annex IV / Article 12" in a row about mandating documentation. That use of Annex IV is correct and should not be swept by analogy with this fix.

Checked on the branch: 1319 passed and 1 skipped, with check_dashes.py, ruff and mypy clean. Nothing in the package or the vectors depends on the profile names and no test parses this table, which is also why nothing caught the original wording.

Approving. The table correction is right and the informative section is the more useful half.

On the table. Annex IV was the wrong citation for what that row meant. Annex IV is the technical-documentation schedule whose elements Article 11(1) requires the documentation to contain; classification runs through Article 6 with Annexes I and III. A reader configuring a floor from the old row would have been reading a documentation annex as a classification test.

What I verified, against the primary texts rather than the PR body.

• Regulation (EU) 2026/1744 exists, and EUR-Lex confirms it amends Article 25(4) to exactly the list quoted here: "AI system, AI model, tools, services, components, or processes". The addition of AI model to that list is the amendment, and it is stated correctly.
• The two application dates are exact: 2 December 2027 for systems high-risk under Article 6(2) and Annex III, 2 August 2028 for Article 6(1) and Annex I.
• Article 15(5)'s outcome framing, data poisoning, model poisoning, adversarial examples, confidentiality attacks and model flaws, matches the published wording, and the point that it states an outcome rather than a supply-chain verification depth is the right reading.
• Regulation (EU) 2024/2847 Annex I obligations from 11 December 2027 and the Article 14 reporting obligations from 11 September 2026 both match.

What I did not verify, so it is on the record rather than implied. The free-and-open-source carve-out wording inside the amended 25(4): the EUR-Lex text truncated at that sentence, and I read the carve-out forward from the original rather than from the amended text. And the characterisation of the Article 111(2) grace period as covering units of a type and model already placed on the market. Neither changes a floor in the table.

Why this is worth having beyond accuracy. The section says a floor that is met is not evidence of compliance with either regulation, and that neither requires a verification depth at all. That makes our own claim weaker and it is correct. A profile floor is a choice this specification makes for deployments that describe themselves as operating under a regime, and saying so in the document stops the table being cited as though the Regulation produced it.

CI: the runs were held pending first-time-contributor approval and reported 2 checks. Released, and the rollup came back at 6 with everything green apart from the maintainer-hold gate, which this approval clears.