The EU AI Act classified a TypeScript data serialisation library as High Risk. Here is what happened.

On 21 April I audited trpc/trpc, the TypeScript library for building end-to-end type-safe APIs. Score came back at 80. Healthy. Three High findings, 58% confirmation rate. On 24 April I re-audited with a corrected product description. Score dropped to 47.6. Critical Risk. Three new High findings under AI Governance appeared in the sections evaluated by the AI Governance agent. The reason: tRPC's "transformer" components were classified as High Risk under the EU AI Act. tRPC has no machine learni