LLM guardrails for EU AI Act robustness and cybersecurity

Auditors expect every rail definition to sit under version control, with a named owner, a review record and a link to the deployed release. For NeMo Guardrails, that means the config.yml file, Colang files and any Python actions stored in a repository, with each deployed configuration traceable to a commit. Guardrails AI validator selections and their settings should be pinned the same way. Ask your implementation partner to show how a change moves from a pull request to the running gateway, because that path is what a reviewer will test.

You need dated results from a repeatable test suite that runs against the exact guardrail configuration in production. The suite should cover direct prompt injection, indirect injection through retrieved documents, multi-turn jailbreaks and data extraction attempts, with the pass and fail counts recorded per release. NeMo Guardrails includes jailbreak and injection detection, and the results should show which rails caught each attempt. Testing belongs to your red-team program, and the results are evidence you prepare, not a certification.

Article 12(1) requires high-risk AI systems to technically allow automatic event logging over their lifetime, and Article 19(1) requires providers to keep those logs for at least six months unless other law provides otherwise. Guard decisions should be logged with a timestamp, the rail that fired, the policy version, a request identifier and a redacted reason, but not raw personal data. The AI gateway, such as LiteLLM or Apache APISIX, can record the request path, while Langfuse can hold traces and evaluation scores in your own storage. Confirm retention periods with your legal team, since other law may set a longer period.

Article 15(3) requires accuracy levels and metrics to be declared in the instructions for use. For a guarded assistant, that means reporting detection rates and false positive rates for each rail against a labeled evaluation set that reflects your own data, not only vendor benchmarks. Langfuse evaluations can store these scores over time, and the declared figures must match what the test records show. Ask your partner which metrics the instructions for use will state and how each one is measured.

Reviewers look for a record of each policy change, including what changed, who approved it, why, the test results before release and the rollback point. Keep these records alongside the configuration history in version control and the deployment history of the gateway. Changes to Colang 1.0 or 2.0 configurations also need manual review after any automated conversion, as NVIDIA's migration guidance says, and that review should be recorded. A change without a test run and an approval record is the most common gap in these files.

Article 15(4) requires resilience to errors, faults and inconsistencies and allows redundancy such as backup or fail-safe plans. Test records should show what happens when a guard service times out, a classifier model is unavailable or the gateway is down: the system should either block the request or route it to a defined safe response, depending on your risk decision. Record each fallback test with the expected behavior, the observed behavior and the date. Confirm with your architects whether the guard runs in the request path, since that choice determines the failure mode.

DeployOpen can plan, implement, harden and document the guardrail stack in your infrastructure, run security testing of applications, APIs and AI systems, and prepare the controls, logs and test records that an assessment will examine. DeployOpen does not issue audit reports, attestations or certifications, and independent auditors or certification bodies make those determinations. Engagements are fixed-scope, so the evidence deliverables, test suites and documentation should be listed in the written scope before work starts. Ask for that list explicitly in any proposal.

The main cost drivers are classifier compute, policy engineering, red-team testing, documentation and log storage. Classifier compute depends on which detection models you run on premises and the request volume they must handle. Policy engineering covers writing and tuning input and output rails for your use case, which usually takes the most iteration. Red-team testing scales with the number of attack categories you cover and how often you retest after each model or policy change. Documentation and log storage grow with traffic, because Article 12 and Article 19 expect automatically generated logs kept for at least six months unless other law requires longer.

One-time costs include the initial risk assessment, the first policy set, integration with your AI gateway, the first red-team campaign and the initial technical documentation. Recurring costs include compute for guard models, log storage and retention, retesting after each model, prompt or policy change, monitoring of false positives and negatives, and periodic updates to the technical file. Because guardrails sit in the request path, the recurring share often grows as usage grows. Ask any partner to split its quote into these two groups so you can budget for both.

A capable internal team can build and run guardrails, but it needs skills in several areas at once: Python and configuration of NeMo Guardrails or Guardrails AI, security testing of language models, infrastructure operations and compliance documentation. Article 15 also expects a declared accuracy level and metrics in the instructions for use, so product, legal and quality staff must be involved. Many organizations split the work: internal owners keep accountability and policy decisions, while an implementation partner handles setup, hardening and testing. The right split depends on the skills you already have, which is worth assessing before you commit to a scope.

Under Regulation (EU) 2026/1744, Articles 8 to 15 apply from 2 December 2027 for Annex III systems and from 2 August 2028 for Annex I systems. Work backward from those dates: classify your system, define its intended purpose, agree accuracy metrics, build and test the guardrails, then produce technical documentation and logs that an assessment can review. Most Annex III systems use internal-control conformity assessment under Annex VI, so the evidence has to be ready for your own review and for market surveillance authorities. The durations of each phase depend on your system and existing controls, so ask any partner to justify its plan against these dates rather than accepting a generic timeline.

A fixed-scope quote should state the system and intended purpose covered, the risks addressed and the rails to be built, such as input, output, retrieval or execution rails. It should list the models and components that run on your infrastructure, the integration points with your AI gateway and logging, and the red-team test categories and number of test rounds. Ask for deliverables in writing: configuration and policy files under version control, test results, a handover of the technical documentation inputs, and the operating runbook. Also ask which items are excluded, what support follows delivery, and how changes to scope are priced.

No. DeployOpen plans, implements, tests and documents guardrail controls in your own infrastructure and prepares the evidence an assessment will review. Independent auditors, notified bodies where they apply, and market surveillance authorities make the conformity determination and issue any reports. DeployOpen does not publish a price list, so a quote follows from a written scope that you agree before work starts. Ongoing testing, upgrades and support are available as retainers, which is where most of the recurring effort sits.

A one-time red-team exercise establishes a baseline, but it does not cover model updates, new prompts or changed policies. Each change can alter how rails behave, so testing needs to repeat on a schedule and after material changes. The cost depends on the attack categories in scope, such as prompt injection, data poisoning of retrieved content, and evasion, plus the size of the test suite you keep. Ask for the retest triggers in writing, the evidence each round produces, and whether the test suite itself is handed over so your team can rerun it.

Open-source guardrails shift cost from per-request fees to infrastructure and engineering. You pay for the compute that runs classifier models, the staff or partner time to write and tune policies, and the storage for logs. Hosted APIs charge per request but send prompts outside your infrastructure, which may conflict with your data handling duties. Neither option removes the testing and documentation work that Article 15 requires. Compare the two using your expected request volume, latency budget and data residency needs, and confirm each vendor's terms in writing.