Three things small teams tell us first.
Built for teams that do not have a compliance officer.
Three companies, three starting points.
A 25-person marketing agency using generative tools on client work.
- Each tool added to the system register in under two minutes.
- Classification: most land in limited risk — the Art. 50 transparency duties.
- The engine flags the disclosure notice; the smart form drafts the text.
- Done — no Annex IV, no FRIA, no high-risk burden.
A 40-person e-commerce SME with a recommendation engine that ranks suppliers.
- Supplier ranking returns limited risk; the customer-facing scoring model is flagged for a closer look under Annex III.
- The engine materialises the provider obligations across the phases.
- The QMS shape is scaffolded from existing policies; the sign-off ledger is started.
- Annex IV assembles from the smart forms; the Declaration of Conformity is drawn up in the editor.
A 12-person professional-services firm receiving a high-risk provider's IFU package.
- The provider sends an Art. 13 sharing token by email.
- The compliance lead pastes the token; the package imports in seconds.
- Deployer obligations populate — oversight plan, monitoring schedule, worker notification.
- The hash chain links the deployer's record back to the provider's seal.
The capabilities small teams use most.
Questions small businesses ask
Does the EU AI Act apply to a small company that only uses AI tools?
Usually yes, as a deployer. Using a chatbot, a generative tool or a vendor's scoring model puts you under the deployer duties — Article 4 AI literacy for everyone, Article 50 transparency where people interact with the AI, and Article 26 where a system is high-risk. Most SME systems turn out limited or minimal risk, and the free check says which.
Do I need a lawyer to use Veritome?
No. The engine maps obligations from your classification and every screen names the article it rests on. You spend lawyer time on the judgement calls that genuinely need one, not on a glossary exercise — and Veritome is not legal advice.
Does GDPR come into it?
Where personal data flows, yes. Five data questions in the intake decide which GDPR duties join the same register — Art. 6, Art. 9, Art. 22, Art. 28, Art. 35 and the transfer rules — so the EU AI Act and data-protection work is one list, not two.
What does it cost?
Classification of one system is free, without a card. Paid plans follow the role the Act gives you — deployer or provider — and are published in full on the pricing page.