EU AI Act compliance
without the Big Four invoice.

Discovery

An AI-guided interview identifies every AI system you provide, deploy, or integrate — including the ones hidden inside your SaaS.

Classification

A six-gate engine maps each system against Articles 5, 6, 50 and Annex III with traceable reasoning at every step.

Gap assessment

Role-aware analysis for providers and deployers across Articles 9–15 and 26, with priorities and deadlines.

Expert validation

Every material classification is reviewed by a qualified analyst before it becomes your compliance record.

Audit evidence

Generate Annex IV documentation, FRIAs, post-market monitoring plans, and Article 73 incident reports on demand.

Intelligent discovery

Conversational AI + document intelligence surfaces every AI system in your organisation, including vendor-embedded features most inventories miss.

Six-gate classification

Deterministic rules for clear cases; LLM reasoning with citations for edge cases; mandatory human validation on every material output.

Role-aware gap assessment

Different obligations apply to providers and deployers. Each gap maps to a specific Article, with recommended actions, priorities, and deadlines.

FRIA workflow

Guided Fundamental Rights Impact Assessment for public authorities, private entities providing public services, and Annex III points 5(b)/(c).

Serious incident reporting

2-day / 10-day / 15-day SLA countdown, EU-27 + EEA authority directory, structured Commission-template report generator.

Post-market monitoring

Default metric catalogue grounded in Arts. 9–15, threshold-driven alerts, periodic reviews with Art. 79 risk escalation, Annex IV-ready plan PDF.

Value-chain contracts

Six grounded templates (Provider–Deployer, GPAI, Art. 25(4) addendum, substantial modification, purpose change, supplier bundle). Track counterparties and role-switching events.

AI literacy programme

Six role-based training modules with 37 quiz questions, completion certificates, and org-wide coverage tracking — auditable Art. 4 evidence.

Audit-ready exports

Technical documentation, conformity evidence, incident reports, literacy certificates, and monitoring plans in PDF and JSON formats.

A structured 11-question wizard that gives you a deterministic scope verdict in a coffee break. Out-of-scope users leave with a signed PDF certificate — no upsell, no funnel trap.

Import your Art. 30 ROPA entries and Art. 35 DPIAs. One click turns ROPA-with-AI into inventory entries; one click syncs your DPIA into a pre-filled FRIA. Article 27(4) exists for exactly this.

Send a 47-question DDQ to your AI vendors via a tokenised public link — no account for them to create. Responses auto-file into your Art. 25 dossier. Vendors answer once, share with every customer.

Publish a versioned, SHA-256-signed attestation at a shareable URL. Enterprise buyers see your compliance posture without an NDA; you stop filling in the same RFP questionnaire twice a month.

Triage, discovery, classification, Trust Profile — no card.

• Express Triage — Am I in scope?
• Discovery + AI Systems inventory
• Gap assessment (view-only)
• Public Trust Profile

Run the operate tier: literacy, DDQs, roadmap.

• Art. 4 Literacy programme
• Vendor DDQ campaigns
• GDPR Bridge — team features
• Roadmap kanban · 3 seats

Full Operate: monitoring, incidents, contracts.

• Everything in Essentials
• Art. 72 Monitoring plans
• Art. 73 Incident workflow
• Art. 25 Contracts · 10 seats

Groups, regulated sectors, priority support.

• Everything in Professional
• Unlimited seats
• Advisory credits bundled
• Priority support + SLA

Provider

You develop, train, or place AI systems on the EU market. Providers carry the bulk of the compliance load: conformity assessment, documentation, post-market monitoring.

• Risk management system (Art. 9)
• Technical documentation (Art. 11 + Annex IV)
• Conformity assessment (Art. 43)
• Post-market monitoring (Art. 72)
• Serious incident reporting (Art. 73)

Deployer

You use AI systems under your authority in the EU. Deployers are responsible for operational governance, human oversight, and transparency to affected persons.

• Use per instructions (Art. 26(1))
• Human oversight assignment (Art. 26(2))
• Log retention for 6+ months (Art. 26(6))
• FRIA where applicable (Art. 27)
• Transparency to affected persons (Arts. 26(9), 50)