For the EU AI Act and ISO/IEC 42001
AI systems, policy, risk and evidence on one record. See what needs attention and who owns the next decision.
Matched Annex III(4) · Employment, workers management and access to self-employment, on “job applicant”
20 candidate obligations for a deployer
How it works
Four steps from one fictional workspace. Every count, match and fingerprint is computed by the same rules the product runs.
01Find
Drop an SSO or expense export. Each app or merchant name is matched against a versioned catalogue of AI tools, and nothing is saved until you confirm.
3 of 6 merchants match the AI catalogue
| Tool | Found as | Risk | Trains on data |
|---|---|---|---|
| Otter.aiMeeting transcription | OTTER.AI BUSINESS ANNUAL | High | Default on |
| Fireflies.aiMeeting transcription | FIREFLIES.AI PRO | High | Configurable |
| GrammarlyWriting assistant | GRAMMARLY BUSINESS | Medium | Configurable |
No catalogue match for 3 lines: NORTHSTAR LTD SCREENER SEATS, ADOBE CREATIVE CLOUD, SLACK TECHNOLOGIES. Bespoke tools are registered by hand.
Preview — nothing is saved until you confirm
02Classify
9 prohibited practices and 8 high-risk areas are checked in order, without a model. What the description can’t answer goes to a named reviewer.
PurposeRank job applicants for recruitment shortlisting.
20 candidate obligations
High risk by presumption, not by finding. The description can’t answer the 2 questions that decide it, so a person does.
Determination recorded · Nadia Ferreira · 9 Sep 2026, 11:20
03Prove
Drop a procedure and the clause it cites is matched to the duties it supports. Library files are linked, not copied. What is already in force comes first.
§3.2 Review of rankingsA human recruiter reviews every ranked applicant and records the reason for accepting or overriding the recommendation.
15 / 20 candidate obligations with supporting evidence
A supporting citation is not proof of compliance.
04Seal
Finalise the report under a reviewer’s name. Its fingerprint is computed from every figure in it — change one, and it no longer matches.
Matches the sealed fingerprint
Finalised by Nadia Ferreira · 9 Sep 2026
3 of 6 merchants match the AI catalogue
| Tool | Found as | Risk | Trains on data |
|---|---|---|---|
| Otter.aiMeeting transcription | OTTER.AI BUSINESS ANNUAL | High | Default on |
| Fireflies.aiMeeting transcription | FIREFLIES.AI PRO | High | Configurable |
| GrammarlyWriting assistant | GRAMMARLY BUSINESS | Medium | Configurable |
No catalogue match for 3 lines: NORTHSTAR LTD SCREENER SEATS, ADOBE CREATIVE CLOUD, SLACK TECHNOLOGIES. Bespoke tools are registered by hand.
Preview — nothing is saved until you confirm
PurposeRank job applicants for recruitment shortlisting.
20 candidate obligations
High risk by presumption, not by finding. The description can’t answer the 2 questions that decide it, so a person does.
Determination recorded · Nadia Ferreira · 9 Sep 2026, 11:20
§3.2 Review of rankingsA human recruiter reviews every ranked applicant and records the reason for accepting or overriding the recommendation.
15 / 20 candidate obligations with supporting evidence
A supporting citation is not proof of compliance.
Matches the sealed fingerprint
Finalised by Nadia Ferreira · 9 Sep 2026
The programme in the order the work happens: 17 capabilities across 5 stages.
AI tools in your SSO and expense exports that nobody declared.
Purpose, owner, data and stage for every system, an agent’s autonomy and reach, and its EU AI Act classification.
Questionnaires, data processing agreements and review dates for the AI services you buy.
Governance bodies, an owner and human oversight for each system, and a go-live check before production.
The rules staff work by, published as numbered versions and acknowledged by name.
Likelihood and impact on fixed bands, the treatment, the residual rating and an impact assessment per system.
Training assigned by role, with a completion record for each person.
Every duty that applies to each system, and whether evidence supports it.
A statement of applicability: 38 Annex A controls, each with its records or a justified exclusion.
Files and connector snapshots, hashed on arrival and linked to the clauses they support.
Which duties will still lack evidence at the deadline, at the pace you collect.
Owned work, and recorded decisions that come back for review when their facts change.
Cost, seat use and renewal dates for each AI contract, with a recommendation to check before notice.
The programme captured at a point in time, finalised by a person and compared with the last.
Signed evidence bundles a reviewer verifies offline with the independent CLI.
A readiness assessment recomputed from its sealed inputs, outside E-ARI.
A public, hash-verified page of your AI governance for customers and procurement.
Each judgement on the record has one owner: a published rule, a model inside fixed limits, or a named person.
Scoring v5.6 · versioned methodology
Verify a record
A sealed export and a reviewer’s replay of it. The check runs on the reviewer’s machine, where E-ARI is not.
Try the public verifierVerification proves a record is intact and reproducible — not that it is compliant or correct.
Illustrative transcript from the published scoring example. Use the verifier to run a check yourself.
Canonical manifests, SHA-256 artifact hashes and Ed25519 signatures bind the bundle. A public append-only transparency log supplies inclusion and consistency proofs. The independent CLI implements the published specification and can run offline.
Read the specification pathsFrom a source file to a reviewable record. Connect a supported source, use the API or upload a document. The same integrity checks apply.
Your systems
E-ARI
Server-recomputed SHA-256
Content-addressed dedupe
Sealable into the public transparency log
Your reviewer
A recruiter reviews every shortlisted applicant.
Trace a requirement to the clause and source that support it.
Keep supporting records together for the person making the decision.
Include evidence in sealed exports that others can check independently.
The policy is here. The oversight test is missing.Collect the test, then review the gap.
Nadia Ferreira · Head of Compliance
Where the evidence will run short
A fictional workspace’s collection history, projected to the deadline: which duties will lack evidence, and when collection has to start.
At the observed pace of 2.0 files a month
5of 10candidate duties projected to lack evidence by 2 Dec 2027
Scenario range 5–9 · conditional projection
Time before collection must startLatest responsible startCollection window: 5–40 days of work, plus a buffer
All 10 duties:5 projected gaps4 on pace1 date not settled
Fixed fictional scenario as of 2026-09-09; deadline 2027-12-02, read from the platform timeline. Tier-and-role candidates, not a confirmed determination of applicability. Policy uploads only; no existing evidence links or measured obligation-clearance history, so capacity comes from the raw upload rate. A start-by date is the latest responsible start — the duty's collection effort before the deadline, less a published buffer — not a recommendation to wait. The projection is conditional on the observed pace: not a probability or a compliance verdict, and no customer forecast or measured accuracy is implied.
Track artifact collection and, when snapshot history exists, the net rate of obligations evidenced. More uploads do not necessarily mean more coverage.
With insufficient history, E-ARI provides collection priorities instead of an unsupported projection. Scenario bands expose uncertainty in the observed pace.
Connector scope and setup requirements are documented in the catalogue. Runtime capture records configured traffic and does not enforce runtime policy. Write-scoped API access requires Enterprise.
Our security posture, data processing, methodology and plans are published, so procurement can start before the first call.
Certification status, hosting locations and sub-processors are set out in full on the Security page.
As a record, not a certificate. The statement of applicability lists every Annex A control: you record whether it applies, how far it is implemented and why any exclusion is justified, and E-ARI shows the records that bear on it, such as the published AI policy, governance bodies, impact assessments, risks, training and vendor reviews. The mapping from records to controls is E-ARI’s own, a starting point for an auditor’s questions. Certification is an auditor’s decision.
No. Evidence coverage identifies supporting clauses and records; it does not establish that every legal requirement is satisfied in practice. Classification can require a recorded human determination, generated documents require review, and the organisation remains responsible for its decisions.
Yes. The public verifier checks sealed bundles, and the independent CLI can verify them offline. Audit Replay recomputes an assessment from its sealed inputs. These checks establish integrity and reproducibility, not legal correctness or certification.
Rules determine readiness scores, risk tiers and risk-register levels. Models assist with narrative, clause extraction and document drafting, and never decide a tier, a level or an approval. Processing locations, providers and current safeguards are described on the security and data-processing pages.
AI Spend brings contract costs, reported usage, renewal and notice timing into review. Source-linked actions collect evidence and record a human decision. Material changes to tracked facts or due review dates can bring that decision back for attention; governance reports preserve a point-in-time record. E-ARI does not autonomously cancel contracts or certify compliance.
Start with the interactive examples and published methodology, then discuss your systems, evidence sources and procurement requirements with us. Self-service assessment and published plans are available. Connector maturity and security limitations are disclosed before you commit.
Free: register your AI systems, see which obligations apply and run a readiness assessment. Pro adds evidence, FRIA, technical documentation and records anyone can verify.
Check your exposure without an account