Enterprise · 500+ employees

EU AI Act compliance across the whole portfolio.

At two hundred AI systems, compliance is a portfolio problem. Give compliance, risk and IT one register, with the audit trail the committee asks for.

No card · EU-hosted · 5 minutes to a first classification
AI systems4 in the register
SystemRole · riskStageDone
Recruitment assistantDeployerHighBuild & document5/13
Credit-scoring modelProviderHighBuild & document8/25
Meeting summariserDeployerMinimalOperate & monitor2/2
Document searchDeployerMinimalOperate & monitor2/2
One register, each system its own role
Illustrative workspace · roles, tiers and obligations are the engine's
What we hear from groups

Problems a consultant does not solve.

What we hear

“Every business unit has its own list. We don't have one register.”

What the product does

One register at group level, a view for each unit and the same engine underneath.

What we hear

“Our quarterly compliance update is a slide deck someone hand-makes.”

What the product does

The board summary is generated from the dashboard as a sealed PDF.

What we hear

“Audit asked for evidence per system per article. Nobody could produce it on the day.”

What the product does

Evidence is hash-sealed per obligation item, and auditors verify without a login.

What changes at scale

Sized for an estate of 200 AI systems.

01

One login, many organisations

Each subsidiary keeps its own systems; group leads switch between them.

02

Role-based access and SSO

Roles for compliance, risk, IT and unit owners, enforced at the API; OIDC single sign-on from the Manage plan.

03

See where work is stuck

The dashboard lists every system held at one of the six phase gates.

04

Progress weighted by risk tier

One prohibited system takes the portfolio score to zero.

05

API, webhooks and MCP

A REST API with an OpenAPI spec, outbound webhooks and an MCP server.

06

An audit trail you can produce

Every change is logged, hash-chained and anchored daily; any break shows.

In practice

Three groups, each governed differently.

Use case 01

A retail bank with 80 in-house models: provider for its own, deployer for vendor systems.

  • Separate organisations keep provider and deployer obligations apart.
  • The phase-gate view shows systems held at Assess, awaiting conformity assessment.
  • Each model's Annex IV draws on its model card, risk and governance plans.
Obligation registerDerived by the engine
13obligations applyDeployerHigh

13 obligations apply to a deployer of a high-risk system.

Classify1
Scope & literacy2
Build & document4
Conformity assessment0
Register1
Operate & monitor5
Art. 26(1)Use system per provider's instructions for use
Art. 26(2)Assign human oversight person(s)
Art. 26(5)Monitor operation; suspend & notify on serious risk
Art. 26(9)Use Art. 13 information for the GDPR Art. 35 DPIA
Computed by the engine for one system · switch the role to compare
Use case 02

A multinational pharma group with 30 AI systems across R&D, clinical and commercial.

  • Annex III §5 and §3 systems trigger different obligation sets.
  • The FRIA runs only for systems with public impact.
  • The verify URL saves the audit team a dozen email threads.
Quality management systemArt. 17
QMS documented through written policies and procedures from the policiesArt. 17(1)
Post-market monitoring system included from the monitoring planArt. 17(1)(h)
Procedure for reporting serious incidents included from the incident procedureArt. 17(1)(i)
Systems and procedures for data management covered from the data recordArt. 17(1)(f)
Risk management system (Art. 9) included from the risk planArt. 17(1)(g)
One PDF
Organisation compliance report
sha256sha256 fingerprint c008cbfadd5b9161b70f68cb8fcb441be44ab13e9a046cd8890c7dfcd3443fe3
Illustrative system · the parts are Article 17(1)’s
Use case 03

An insurance group bringing risk, GDPR and EU AI Act work into one instrument.

  • The Art. 9 risk plan links to the enterprise risk register via API.
  • Residual sign-off feeds the Solvency II ORSA: one evidence set, two regimes.
  • GPAI obligations on in-house fine-tunes are tracked apart from third-party deployments.
  • AI literacy runs group-wide, with completion per subsidiary.
AI literacy registerArt. 4
78%of the organisation trained · 53 of 68 people
Executive AI AwarenessBoard / C-suite4/4
Compliance Officer ProgrammeCompliance / Legal / GRC2/2
Technical Team ProgrammeEngineering / Data Science / ML7/9
Deployer Operations ProgrammeOperations / Business Units11/14
Provider Operations ProgrammeEngineering / Product / R&D2/3
General Staff AI LiteracyAll Staff27/36
LatestEU AI Act AI Literacy — Certificate of Completionverify URL attached · filed toArt. 4
Illustrative team · the programmes are the catalogue’s
What enterprises lean on

Features that keep up as the estate grows.

Straight answers

EU AI Act compliance for enterprises: questions groups ask

Can one instrument hold a group with several subsidiaries?

Yes. Each subsidiary keeps its own systems, classifications and obligations under one login, and a group-level view rolls the whole estate up for the audit committee.

How does Veritome fit beside ISO/IEC 27001 and NIST AI RMF?

Both run as programmes on the same register. Clauses ISO/IEC 42001 and 27001 share are one record each, a NIST AI RMF profile is generated on request, and coverage exports per framework.

Is there an API?

Yes: a REST API with an OpenAPI 3.1 specification, outbound webhooks for system, incident, obligation and evidence events, and an MCP server, so evidence flows both ways with ServiceNow, Jira or your GRC tool.

What does the board see?

Portfolio completion, averages by risk tier, gate blockers and systems near completion, in a board summary generated on a schedule as a sealed PDF. A prohibited system takes the score to zero, so an average cannot hide it.

Where to next

Bring the whole estate in.

We meet your compliance, risk and IT leads, scope the rollout and run your first ten systems on a working call.

Book the working call Read the architecture