AI governance & evidence intelligence
Bring AI systems, applicable obligations and supporting evidence into one governed record. E-ARI helps governance, risk and compliance teams see what applies, what is evidenced and what needs attention.
A fictional workspace, shown in nine steps: find AI tools nobody declared, classify a recruitment screener as high risk under Annex III(4), match evidence to 20 candidate obligations, connect evidence sources, record a reviewed decision, review an AI contract before it renews, finalise a report whose fingerprint breaks if a figure changes, then try the rules on a system of your own.
Describe an AI system you use. The same rules run here, in your browser — no account, nothing sent.
Pick an example or describe your own.
Your AI programme on one page.
Systems, open questions, contracts and deadlines in one workspace, with the next thing that needs a person at the top of the inbox.
Fictional example. The rule checks, the candidate obligations, what each file supports, the catalogue matches, the spend recommendations and the report fingerprint are computed by E-ARI’s own rules; names, files and prices are illustrative.
The governance workflow
Identify AI tools in imported records. Register their purpose and ownership. Follow the applicable duties through to the evidence and documents your reviewers need.
Evidence connected to the way you work.
Import SSO or expense data to surface AI tools and bring them into the register. Coverage depends on the sources you provide.
Inspect rule-based classifications, resolve open questions and assign ownership. Follow obligation-specific evidence and control states as the record changes.
Connect evidence to obligations, review generated documentation and assemble a submission pack from the system record.
Predictive evidence readiness
E-ARI projects future evidence readiness from your recorded collection history and the obligations ahead. See which workstreams need attention, the assumptions behind the projection and when collection should begin.
Track artifact collection and, when snapshot history exists, the net rate of obligations evidenced. More uploads do not necessarily mean more coverage.
With insufficient history, E-ARI provides collection priorities instead of an unsupported projection. Scenario bands expose uncertainty in the observed pace.
At the observed collection rate
5 / 10
Scenario range 5–9 · conditional projection
Fixed fictional scenario as of 2026-09-09; deadline 2027-12-02, read from the platform timeline. Tier-and-role candidates, not a confirmed determination of applicability. Policy uploads only; no existing evidence links or measured obligation-clearance history. The projection is conditional on the observed pace: not a probability or a compliance verdict, and no customer forecast or measured accuracy is implied.
Independent verification
Sealed exports bind artifacts to a signed manifest. Independent verification checks their integrity. Audit Replay recomputes the assessment from its sealed inputs, outside E-ARI.
Verification proves a record is intact and reproducible — not that it is compliant or correct.
Illustrative transcript from the published scoring example. Use the verifier to run a check yourself.
Canonical manifests, SHA-256 artifact hashes and Ed25519 signatures bind the bundle. A public append-only transparency log supplies inclusion and consistency proofs. The independent CLI implements the published specification and can run offline.
Read the specification pathsRules, evidence, human judgement
Published rules determine scores and risk tiers. AI assists with explanation, evidence extraction and drafting. Human review remains part of the governance process.
Explore the scoring instruments
Scoring v5.6 · versioned methodology
Inspect the inputs, rule trace and method version.
Follow an obligation back to the supporting clause.
Generate explanations and documents for review.
Record human determinations and finalise artifacts.
High-risk — by presumption. PROVISIONAL — confirm before relying on this. The rule engine matched 1 Annex III area: Employment, workers management and access to self-employment (Annex III(4)), on the phrase "cv screening". Article 6(2) makes a listed system high-risk BY PRESUMPTION; Article 6(3) lets the provider rebut it — narrow procedural task, improving a completed human activity, detecting patterns without replacing human judgement, or preparatory work — and that assessment must be documented. Nothing in a one-line question can show it was made.
Articles cited: Annex III(4) · Art.6(2) · Art.6(3)Full answerEvidence infrastructure
Use source snapshots, API submissions or documents already on hand. Choose the collection route that fits the evidence; each route applies the same ingestion rules.
Documents · CI / API push
Pull connectors · runtime capture
Validation · SHA-256 integrity
Deduplication · provenance
Vault · clause support
Control states · exports
Connector maturity is stated individually; experimental connectors remain experimental. Runtime capture records configured traffic and does not enforce runtime policy. Write-scoped API access requires Enterprise.
Enterprise evaluation
Review our security posture, processing disclosures, methodology and published plans. Discuss your organisation’s requirements before deciding how to deploy E-ARI.
Certification status, hosting locations and sub-processors are set out in full on the Security page.
Before you decide
AI system registration, rule-based classification, obligation mapping, evidence, vendor questionnaires and AI literacy records. Governance teams can review generated FRIA and technical documentation and assemble submission packs from the system record. Feature availability follows the published plans.
No. Evidence coverage identifies supporting clauses and records; it does not establish that every legal requirement is satisfied in practice. Classification can require a recorded human determination, generated documents require review, and the organisation remains responsible for its decisions.
Yes. The public verifier checks sealed bundles, and the independent CLI can verify them offline. Audit Replay recomputes an assessment from its sealed inputs. These checks establish integrity and reproducibility, not legal correctness or certification.
Rules determine readiness scores and risk tiers. Models assist with narrative, clause extraction and document drafting. Processing locations, providers and current safeguards are described on the security and data-processing pages.
Start with the interactive examples and published methodology, then discuss your systems, evidence sources and procurement requirements with us. Self-service assessment and published plans are available. Connector maturity and security limitations are disclosed before you commit.
From governance to evidence
Explore the evidence workflow, inspect the verification path and discuss what your organisation needs to establish a defensible record.