EU AI Act and NATO AI Strategy vs. SAVANT-AI and GENESIS-AI
SAVANT-AI and GENESIS-AI are research projects in the inLABs programme. The capabilities described are research goals, not an available product. Project status: inLABs
The EU AI Act and NATO's AI strategies describe exactly what strategically important institutions and companies need: factories for lawful AI systems and a cognitive-decision layer that ensures explainability, auditability, and risk control.
GENESIS-AI and SAVANT-AI are a pair of research projects conceived in exactly this way — a technical “engine” and a governance layer — grounded in EU and NATO regulatory requirements.
Three pillars: EU AI Act, Council documents, and NATO strategies
The foundation for public administration is based on three pillars: the EU AI Act itself (Reg. 2024/1689), preparatory documents from the EP/Council, and NATO strategies for AI. Together, they form a coherent picture: AI is to be a responsible technology, supervised by humans, tested, certified, and interoperable, with full respect for fundamental rights and humanitarian law.
The EU AI Act introduces stringent requirements for high-risk systems: continuous risk management, data management, technical documentation, logging, transparency, human oversight, resilience to disruptions, errors, and changes in conditions (robustness), cybersecurity, quality system, and post-market monitoring. The regulation imposes obligations not only on providers and end users (deployers), including public authorities, with mandatory fundamental rights impact assessments (FRIA) for certain applications. For general-purpose models (GPAI), there are separate obligations: documentation, stress tests, risk management, copyright policy, training data summary, and participation in codes of practice.
NATO strategies emphasize responsible use of AI, accountability, human-in-the-loop/over-the-loop, life cycle management, testing, evaluation, verification, and validation (TEVV), interoperability, and cybersecurity. They explicitly define six Principles of Responsible Use (PRU): legality, responsibility and accountability, explainability and traceability, reliability, manageability, and bias mitigation.
GENESIS-AI: a factory for high-risk AI systems
The GENESIS-AI project aims at a DevSecOps/MLOps environment in which projects are built in line with the EU AI Act from the start. Key articles of the regulation are meant to be part of the platform rather than “checklists” ticked off at the end of a project.
Key mechanisms:
- Risk management system (Article 9): each AI project is carried out in a pipeline with a built-in risk register, use and abuse scenarios, and CI/CD gates that block implementation if risk criteria are not met.
- Data governance (Article 10): the data factory provides data quality profiles, representativeness and bias-mitigation tests, anonymization, and synthetic data generation for sandboxes and TEVV.
- Documentation and logging (Articles 11–12): GENESIS-AI is meant to automatically generate an “AI conformity package” — model documentation, versioning and pipeline logs — prepared for audit.
- Transparency and instructions for use (Articles 13–14): the platform creates instructions, model cards, and message templates for deployers in a unified format, in multiple languages.
- Human oversight and governability (Article 14 + NATO PRUs): human-in-the-loop/over-the-loop patterns, integration with approval systems, and a full audit trail of overrides are enforced in the project architecture.
- Robustness and cybersecurity (Article 15): automated resilience tests (adversarial, data/model poisoning, regression) are part of the standard pipeline; metrics are included in reports and management dashboards.
- Quality management system (QMS) and post-market monitoring (Article 17): configurable QMS for AI (policies, workflows, checklists, report templates) combined with telemetry, drift and incident detection.
- FRIA and DPIA support (recitals 58b, 58g): FRIA/DPIA processes are built into the project cycle, linked to specific system versions and data used in training.
- GPAI and systemic risk models: the "model factory" records compute/FLOPs, conducts adversarial testing, generates training data summaries, and supports copyright policy (TDM, codes of practice).
The GENESIS-AI project is therefore meant to be not so much a “toolkit” as an engineering mapping of the EU AI Act and NATO PRUs onto the processes of building and maintaining AI systems.
SAVANT-AI: cognitive decision-making and governance layer
SAVANT-AI is meant to be a cognitive system: a layer of oversight, explainability, audit and regulatory knowledge that “understands” both the AI systems built in GENESIS-AI and their legal context. Its role is meant to be to translate the requirements of the EU AI Act and NATO from the technical level to the decision-making level – department directors, inspectors, doctors, controllers, and officers.
Key features:
- XAI and explainability: SAVANT-AI is meant to provide explanations for decisions (reason codes, feature impact, what-if scenarios) in accordance with NATO PRU explainability and traceability requirements.
- Traceability and full audit trail: a central layer of knowledge about AI systems allows you to reconstruct "who, what, when, and on what basis" guided a specific decision.
- Human oversight in practice: dedicated "decision console" interfaces present AI recommendations with context, quality indicators, warnings, and accept/reject options, protecting against automation bias.
- High-risk AI systems registry: SAVANT-AI is meant to maintain a catalogue of systems within the department, mapped to EU AI Act categories, compliance status, TEVV results, and related FRIA.
- FRIA assistant: a module meant to guide officials step by step through the assessment of the impact on fundamental rights, identifying vulnerable groups, risks, and possible mitigation measures.
- NATO PRU Compliance View: view of each application's compliance with the six NATO principles – identified gaps, recommended actions, repository of good practices.
- AI literacy and training: personalized educational paths for different profiles (lawyer, procurement, IT architect, analyst) based on EU and NATO documents and real-world use cases from the ministry.
The SAVANT-AI project aims to make what the EU AI Act and NATO call “governance” part of decision-makers’ daily work rather than a theoretical document on a shelf.