Classify each system the way the Act does.
Guided questions in the Act's own order, plus five on the GDPR. Every answer becomes a record you can reopen.
- Prohibited practices screened first, before anything else.
- Art. 6(3) exceptions argued one by one, with the documentation Art. 6(4) requires.
- Aria suggests; a named person confirms. Every decision is audited.
Only the obligations that apply to you.
Your classification decides the list. Each obligation carries an owner, a statutory date and its evidence.
- Same inputs, same obligations, each traced to its article.
- Separate lists for providers, deployers, importers and distributors.
- Six gated phases from Classify to Monitor; the next step is visible.
13 obligations apply to a deployer of a high-risk system.
Switch a standard on. Follow an ordered path.
ISO/IEC 42001, ISO/IEC 27001 and NIST AI RMF run as programmes: ordered steps, each producing a record.
- Statement of Applicability generated; a read-only Clauses tab exports as CSV.
- GDPR duties always run per system; its organisation programme is optional.
- Voluntary standards are labelled voluntary; certificates come from an accredited body.
File proof once. It counts wherever it applies.
Upload it, generate it, or pull it from Google Drive, SharePoint, GitHub or Jira.
- One record satisfies every obligation and clause that names it.
- A SHA-256 fingerprint and an expiry on each; lapsing proof reminds its owner.
- A hash-chained, daily-anchored audit trail behind every change.
The record is credited only where it has been verified against both clause sets. The other clauses are signposted, and nothing is ticked on your behalf.
From risk register to residual sign-off.
A working risk plan with mitigations, scoring and a sign-off ledger. The status follows the data.
- Inherent and residual scoring per item, with a heat-map view.
- Mitigations tied to evidence, an assignee and a due date.
- Residual-risk sign-off completes Art. 9; the ledger is permanent.
- Periodic reviews scheduled automatically.
A QMS that lives where the work happens.
Policies, responsibilities, change management, post-market plan and incident reporting, wired to the evidence on your obligations.
- A material change to a system triggers re-classification.
- Run ISO/IEC 42001 as a programme and the same records count there.
- One PDF that references every backing document by hash.
Documents you can prove.
Annex IV files, FRIAs, declarations of conformity and registration sheets assemble from your live system data, hash-sealed.
- FRIA answers laid under the DPIA's headings, so the overlap shows.
- Declaration of Conformity pre-filled from the chosen Art. 43 pathway.
- A regulator or buyer checks the seal by public link, no account.
Instructions for use, handed over sealed.
Hand a deployer the instructions for use, sealed, across organisations.
- The provider shares a one-time token; the deployer imports the package.
- The hash chain links the deployer's copy to the provider's seal.
- Both sides log which fields were imported, by whom and when.
AI literacy, tracked and filed as evidence.
Six role-based programmes, completion tracked per person, and the organisation figure your auditor asks for first.
- Programmes matched to the responsibilities of each role.
- Refreshers yearly or on a change of role, tracked and prompted.
- Each record carries a hash and a verify URL, like the dossier.
Questions buyers ask about our EU AI Act compliance software
True of the product as shipped today.
Is Veritome one product or a suite of modules?
One product. Classification, obligations, programmes, evidence, risk, the QMS, documents, the IFU handoff and AI literacy share one engine, one evidence ledger and one audit trail.
Which frameworks does Veritome cover?
The EU AI Act is the spine and the GDPR sits beside it; both are statutory and always on. ISO/IEC 42001, ISO/IEC 27001 and NIST AI RMF are voluntary programmes you switch on, each with its own page.
Does Veritome file anything with a regulator?
No. It prepares the artefacts (the Annex VIII registration sheet, the Declaration of Conformity, the dossier) and you make the submission. Nothing here is legal advice.
Where does the data live?
In the EU. The application and database run on Hetzner in Germany, object storage in Falkenstein, and Aria runs on Mistral in Paris. The sub-processor register names every supporting service.