A wizard that walks the law, not your gut.
A branching decision tree that mirrors the Act's exact classification logic — prohibited practices first, then Annex I sectoral overlap, then Annex III §1–§8 domains, then Article 6(3) self-exclusion, then Article 6(4) authority notification when the system stays out. Every step is anchored to its article; every answer becomes a Classification record you can re-open without restarting.
- Prohibited-practice screening (Art. 5) before anything else.
- Annex III domain picker with conditional flags (biometrics, workplace, GPAI).
- Art. 6(3) exception wizard with the six criteria, individually argued.
- Art. 6(4) authority-notification record for self-excluded systems.
- Aria suggests the answer; you confirm and sign — every decision audited.
The right obligations, auto-mapped.
Once a system is classified, the engine reads role + risk tier + Annex III domain + behavioural flags and materialises the exact obligations that apply. A workbench, not a checklist: drag tasks between To-do, In Progress, In Review and Complete. Article-derived deadlines, role-aware filters, evidence at the item level.
- Conditional logic for biometrics, workplace AI, GPAI, emotion recognition.
- Role-aware: deployer, provider, importer, distributor — different journeys.
- Tabs auto-generated from the engine; phase gates lock the next step.
- Granular checklist auto-tick from backing data (RiskPlan, Annex IV doc, Oversight plan).
From risk register to residual sign-off.
A working RiskPlan with item-level controls, inherent and residual scoring, and a sign-off ledger. Mitigations that close items also tick the Art. 9 checklist. Reality wins — delete every risk item and the obligation flips back to NOT_STARTED.
- Inherent + residual scoring per item, with a heat-map view.
- Mitigation actions tied to evidence + assignee + due date.
- Residual-risk sign-off transitions Art. 9 to COMPLETE; the ledger is permanent.
- Periodic review (Art. 9(8)) scheduled automatically; calendar integration.
QMS that lives where the work happens.
The Art. 17 quality management system is not a Word document — it's the union of every other obligation. Veritome gives you the QMS shape (policies, responsibility allocation, change management, post-market plan, incident reporting) and wires each piece to the live evidence already attached to your obligations.
- Policies + responsibility matrix maintained inside the platform.
- Change management triggers re-classification when systems materially change.
- Post-market monitoring plan and serious-incident reporting workflow.
- QMS export: a single PDF that references every backing document by hash.
Documents you can prove.
Annex IV technical files, Fundamental Rights Impact Assessments, EU Declarations of Conformity and Annex VIII registration packs assemble themselves from your live system data. Smart forms with Aria suggestions, evidence at item level, audit trail of who filled what when. Every document is hash-sealed; every dossier carries a public verify URL.
- Annex IV builder pulls from RiskPlan, oversight plan, training data record.
- FRIA wizard for Annex III §5 deployers; auto-skipped where not required.
- EU DoC editor pre-fills from the chosen Art. 43 pathway.
- Annex VIII export: the EUDB registration sheet, ready to paste.
- verify.veritome.eu — a regulator or buyer can check the seal without an account.
Art. 13 IFU exchange, in one click.
When a provider hands a high-risk system to a deployer, the Instructions for Use must travel — system purpose, performance, known limitations, oversight measures, monitoring obligations. Veritome seals the IFU package on the provider side and lets the deployer paste-import it on theirs. Cross-org, cross-account, cryptographically sealed.
- Provider seals the IFU package; gets a one-time sharing token.
- Deployer pastes the token; the package imports into their system record.
- Hash chain links the deployer's copy back to the provider's seal.
- Audit log on both sides — fields imported, who imported, when.
Six role-based programmes, tracked.
Article 4 obliges providers and deployers to ensure a sufficient level of AI literacy across staff. Veritome ships six role-tailored programmes (Executive AI Awareness, Compliance Officer, Technical Team, Deployer Operations, Provider Operations, General Staff AI Literacy), tracks completion per person, and surfaces the org-level percentage your auditor will ask for first.
- Programmes calibrated to role responsibilities, not generic e-learning.
- Per-person completion certificates; org-level dashboard for the board.
- Refresher cadence (annual / on-role-change) tracked and prompted.
- Certificate hash + verify URL — same trust mechanism as Annex IV docs.
