Risk classification
Establish which class each system falls into, and record the reasoning — the part most likely to be challenged first.
EU AI Act
Regulation, not a standard you can opt out of.
Regulation 2024/1689 applies by risk class rather than by sector. What you owe depends on what your system does and how it is used — and the first task is proving which class you are in.
Coverage
What ships with the platform.
- 26
- Controls
- EU AI Act control library
- 22
- Document requirements
- Mapped to the controls they satisfy
- Yes
- Crosswalked
- Evidence credits equivalent controls in the other frameworks
- Yes
- Document review
- Grade an existing document against this framework
In short
What it actually asks for.
The Act sorts AI systems into prohibited, high-risk, limited-risk and minimal-risk categories. Most of the substantive duties — risk management, data governance, technical documentation, logging, human oversight, accuracy and robustness — attach to the high-risk tier, with transparency duties reaching further down.
Unlike ISO 42001 this is law, with penalties attached and no certification to opt into. Classification is therefore the first piece of work, because it decides the size of everything after it.
Where the platform helps
The obligations that take the most work.
Technical documentation
Drafted against the specific articles it has to satisfy, and kept current as the system changes.
Data governance
Evidence about training and validation data drawn from the registries and pipelines that already hold it.
Human oversight
Show that a person can intervene, and that the intervention is recorded rather than assumed.
Logging and traceability
A trail behind each conclusion: what triggered it, what was observed, what changed and who approved it.
Post-market monitoring
Evidence expires and is re-gathered on a schedule, so the record describes the system running now.
Regulatory change against the Act is tracked continuously, and each change names the controls, policies and evidence it affects.
Alongside
Rarely the only framework you run.
Evidence is credited across every framework that asks for the same proof, so overlapping programmes cost far less than running them separately.
Next / evaluate the platform
Bring your frameworks.
See the operating system.
We will walk through the platform against your own governance and compliance needs, and what getting to audit-ready would take.