What Veritome does for EU AI Act compliance
Classify each AI system, get the exact obligations for your role and risk tier, and generate the Annex IV file, FRIA, Declaration of Conformity and Annex VIII registration. Every record is hash-sealed into a dossier with a public verify URL.
The GDPR, ISO/IEC 42001, ISO/IEC 27001 and the NIST AI Risk Management Framework run on the same systems, sharing evidence, owners and dates: 403 catalogue requirements, 83 programme steps, 69 distinct records.
See the output first: the sample dossier is a real generated file, not a screenshot. Ask the same of every vendor, us included.
How this started
Veritome began as an EU AI Act tool. While building it, Tomislav took the ISO/IEC 42001 Foundation certificate to decide whether the AI management system standard belonged in the product.
Section after section, it asked what the Act already asks: risk management, roles and accountability, data quality, human oversight, logging and incident handling. Those are Articles 9, 10, 12, 14, 15 and 17 in other words, and the GDPR has asked several since 2018.
Yet the frameworks are sold as separate products, so a forty-person company buys three tools and writes the same policy three times. So the product went from one framework to five.
Why the EU AI Act is the spine
Of the five, only one is not optional. ISO/IEC 42001, ISO/IEC 27001 and NIST AI RMF are voluntary; the GDPR applies where personal data flows. The EU AI Act applies because it is law, and its dates arrive whether or not you are ready.
So every system is classified against the Act first, and its obligations follow. The other four run as programmes over the same register, so a certificate you pursue later does not start from an empty project.
Credit is strict. A record counts toward a second framework only when verified against both clause sets: 14 records today, all shared between ISO/IEC 42001 and ISO/IEC 27001. Every other connection, the EU AI Act crosswalks included, is a related link that ticks nothing; 38 records carry one. The crossover matrix shows both, kept apart.
Why this exists
The EU AI Act carries fines of up to €35 million or 7% of global turnover. Large enterprises hired consultancies at six-figure rates; SMEs were left to work it out alone.
Veritome gives a forty-person company the clarity on its obligations a multinational gets, without the consultancy price. ISO/IEC 42001 and NIST AI RMF are included from the €199 Govern plan upward, not priced per framework.
Who it is for
Deployers using third-party AI, providers of high-risk systems, GPAI model providers, and the counsel advising them. A UK or US organisation is in scope when its AI system reaches the EU market or its output is used in the Union.
And the security lead handed AI governance on top of ISO/IEC 27001, or the team whose customers ask for ISO/IEC 42001: the same systems and evidence, on one register.
How it works
Six phases, each opening when the one before is complete, so you always know the next task and its owner. The engine derives it from the classification; the other four frameworks run as programmes beside it.
Who builds it
Relay Labs Limited, a small, AI-native software studio in Dublin, led by Tomislav after over two decades in operational roles in regulated industries, first banking, then healthcare. He has had to make a documentation framework work for busy staff under a real deadline.
That means updates in days rather than quarters, prices for SMEs, and someone you can actually reach.
One distinction: Tomislav holds the ISO/IEC 42001 Foundation certificate, a personal qualification. Relay Labs holds no certifications, and the table below says so.
Where we are today
Our comparison of twelve tools assesses us on the same criteria as everyone else. Here are those facts, unedited. If one rules us out, better to learn it now.
What that buys you: a product that moves fast and a founder who answers the email. What it costs you: no audit history, no Big Four channel, no certification for procurement.
What we believe
Where your data lives
Your compliance data is stored in the EU, which is why the assistant runs on a French model rather than the obvious American one.
Some supporting services are not EU-only: payments (Stripe), Google and Microsoft sign-in, Google Analytics (with your consent) and the optional GitHub, Jira, Google Drive and SharePoint connectors can process data in the United States under standard contractual clauses. See sub-processors, the Trust Centre and the data processing agreement.
Questions we get asked
Is Veritome an EU AI Act tool or an AI governance platform?
Both, in that order. Veritome runs five regimes on one register of AI systems: the EU AI Act, the GDPR, ISO/IEC 42001, ISO/IEC 27001 and NIST AI RMF. The Act is the spine because it is law. If you only need the Act today, it works on its own.
Who is behind Veritome?
Relay Labs Limited, registered in Dublin, Ireland under company number 807438 and founded on 30.01.2026. It is led by Tomislav, after over two decades in operational roles in banking and then healthcare. Bootstrapped, no outside investment, and a team of one.
Why did Veritome expand beyond the EU AI Act?
Taking the ISO/IEC 42001 Foundation certificate while building the first version showed the standard asking what the EU AI Act and the GDPR already ask. Most tools sell the frameworks separately; Veritome makes the Act the spine and runs the voluntary standards from it.
If I do the work once, does it count across all five frameworks?
Sometimes, and strictly. A record is credited in a second framework only where it has been verified against both clause sets: today 14 records shared between ISO/IEC 42001 and ISO/IEC 27001. Every other connection, all EU AI Act crosswalks included, is a related link that ticks nothing.
Does Veritome hold ISO 27001, ISO 42001 or SOC 2, and can it certify me?
No to both. Relay Labs holds no certifications; the founder's ISO/IEC 42001 Foundation certificate is a personal qualification. Veritome is not a certification body or an auditor: the certificate comes from an accredited body. If a vendor certification is a procurement requirement, choose someone else.
Where is my data stored?
Your compliance data is stored in the EU: the application and database on Hetzner in Nuremberg, object storage in Falkenstein, the cache in Frankfurt and the AI assistant on Mistral in Paris. Payments (Stripe), Google sign-in and Google Analytics (with your consent), Microsoft sign-in and the optional GitHub, Atlassian Jira, Google Drive and SharePoint connectors can process data in the United States under standard contractual clauses. Transactional email is sent from Plunk in Germany through AWS SES, whose region Plunk does not state. Every provider is listed at veritome.eu/sub-processors.
Is Veritome legal advice?
No. Classification involves judgement no software resolves definitively, and the documents Veritome generates are drafts built from what you tell it. Have a qualified lawyer review your classification and documents before you place a high-risk system on the market. Every classification screen names the article it rests on.
What does Veritome not do?
It does not monitor models: no drift detection, bias testing or runtime enforcement. It does not certify or audit you, file anything with a regulator on your behalf, or replace legal review. Our published comparison of twelve tools names the vendors that do.
How many AI systems can I manage, and do the frameworks cost extra?
Classify is free for three systems. Starter, €79 per month, covers up to five systems, none high-risk; Govern, €199, covers 25 systems with one high-risk system, plus ISO/IEC 42001 and NIST AI RMF (their programmes open at the full launch); Manage, €599, covers three high-risk systems with the Article 17 quality management system and ISO/IEC 27001, and €49 per additional high-risk system. Enterprise is quoted. The GDPR is included on every plan.
Beyond Veritome
Relay Labs builds practical software for regulated industries, with a focus on healthcare workflows and compliance tooling. Veritome is our flagship.
What ships next must overlap what is already on the register, verifiably, clause by clause. We will announce it once it has a date.
Something wrong on this page? Tell us. We correct things publicly.