CRSA-1 EU Edition: Compositional Runtime Safety Attestation Protocol — Compositional Safety Compliance Profile for EU AI Act Regulation 2024/1689

This specification provides the first published compositional safety compliance framework for multi-model AI systems under the EU AI Act (Regulation (EU) 2024/1689). No harmonized standard under development within CEN-CENELEC JTC 21 addresses the compositional safety challenges arising when multiple AI components — foundation models, retrieval systems, routing classifiers, tool-calling agents — are integrated into pipelines, ensembles, or multi-agent architectures whose system-level behaviour emerges from the interaction of their components.The document maps thirty-eight distinct AI Act obligations to their compositional implications, identifying five critical regulatory gaps where the mandate exists but no methodology is provided: system architecture documentation (Annex IV 2(c)), safe interruption of multi-agent systems (Article 14(4)(d)-(e)), declared accuracy metrics for composed systems (Article 15(2)), written agreements for multi-vendor AI value chains (Article 25(4)), and conformity assessment of composed systems (Article 43).The specification establishes the CRSA-1 Compositional Risk Taxonomy (CRT-1 through CRT-8): eight categories of risk specific to composed AI systems, each mapped to affected AI Act obligations with detection methodology and mitigation patterns. Five architecture-specific compliance profiles are provided for RAG pipelines, agentic systems, ensemble architectures, cascade/routing systems, and MCP-based multi-agent systems, each with article-by-article compliance requirements, logging architecture specifications, human oversight intervention frameworks, and accuracy specification methodologies.A complete conformity assessment methodology for composed systems covers both internal control (Annex VI) and third-party notified body (Annex VII) procedures, structured around six evidence domains. Model contract terms for Article 25(4) compliance in multi-vendor composed systems are provided — the first published template addressing this regulatory requirement. Intersecting regulatory obligations under DORA, MDR, NIS2, GDPR, the Product Liability Directive, and the Cyber Resilience Act are mapped to their compositional implications.This is Document 1 of the CRSA-1 EU Compliance Series. Subsequent editions will provide sector-specific compliance profiles for financial services (DORA dual-compliance), medical devices (MDR dual-conformity), and critical infrastructure (NIS2 supply chain security)