A Structural Socio-technical Compliance Procedure for Agentic AI Systems: ReflectOR's Iterative Sandboxing under the EU AI Act

Agentic artificial intelligence challenges static risk management approaches because its behaviour is generated by a changing socio-technical configuration rather than by an isolated model. Task decomposition, tool use, memory, multi-agent coordination, and reduced human intervention create risks that may propagate across a workflow and change when models, data sources, permissions, users, or deployment settings are modified. This study applies a functional, step-by-step method for iterative compliance under Regulation (EU) 2024/1689, a.k.a. the EU AI Act, to ReflectOR, an LLM-based architecture for post-operative surgical debriefing. The method operationalises an iterative sandboxing framework developed building on empirical learnings from the EUSAiR sandbox pilots: it freezes a versioned configuration, constructs layered deployment scenarios, identifies applicable obligations, orders mitigation measures, designs multi-iteration tests, evaluates direct and fallback fulfilment, and defines compliance-stability and change-trigger rules. The framework implementation shows that compliance evidence must be generated for both individual components and the composed workflow. This study provides an empirically informed, structured, and technically implementable framework for maintaining a traceable claim of compliance as an agentic system evolves.