The rules engine behind your EU AI Act compliance process.
It reads each system's role and risk tier and returns only the obligations it owes. No language model decides them.
13 obligations apply to a deployer of a high-risk system.
The engine's logic is our intellectual property; the article behind every obligation is yours to audit in full.
From first classification to live monitoring, in six phases.
Every system takes the same gated path. A phase with nothing for your role passes automatically.
Classify
Know exactly what you are holding.
Answer a short set of questions per system and get its risk tier, with the articles that decide it.
Scope
See only the obligations that apply to you.
Your role and risk tier decide the list: a chatbot deployer and a high-risk provider get different ones.
Implement
Put the measures in place, with the proof attached.
Work through each obligation as a guided checklist, attaching evidence that carries an expiry date.
Assess
Run the assessments the Act requires, on the record.
Guided FRIA and conformity assessments end in a sealed report; overlap with an existing DPIA is mapped.
Register
Hand over a dossier traced article by article.
Annex VIII fields pre-filled, a Declaration of Conformity and a hash-sealed dossier with a public verify URL.
Monitor
Keep the obligations current after the system goes live.
Post-market monitoring, serious-incident reporting, scheduled reviews and a watch on changes in the law.
Switch a standard on and it becomes a programme.
ISO/IEC 42001, ISO/IEC 27001 and NIST AI RMF are yours to enable. Each becomes a programme with its own page.
One record per step, and a step your other work covers is marked Done, credited. The certificate comes from an accredited body, never from us.
The five frameworks and their crossoverISO/IEC 42001 is a voluntary standard. Certification against it confers no presumption of conformity under Article 40 of the EU AI Act; harmonised standards, once cited in the Official Journal, are the only route to that presumption.
What the engine will and will not do
Answered as the product ships today.
Is the obligation mapping done by an AI model?
No. A deterministic rules engine maps role, risk tier, Annex III area and behavioural flags to the obligations, each citing its article. Aria drafts and proposes; it never decides a classification or files anything.
What happens to the other frameworks?
The EU AI Act and the GDPR are statutory and always on. ISO/IEC 42001, ISO/IEC 27001 and NIST AI RMF are voluntary programmes. A record you already have is credited where it satisfies an ISO clause.
Can I skip a phase?
No. Phases are gate-locked, so you cannot register a system you have not assessed. A phase with nothing that applies to your role is complete by definition.
Is any of this legal advice?
No. Veritome structures the work and cites the law; the judgement calls are yours and your counsel's. Every screen names the article it rests on.
Want the article-by-article view? Read the EU AI Act guide.