For the EU AI Act and ISO/IEC 42001
Keep every AI system and agent on one record: who owns it, what it may do, the policy people have acknowledged, its risks and the evidence behind each duty. Exported as sealed records a reviewer can verify outside E-ARI.
A fictional workspace, shown in ten steps: find AI tools nobody declared, classify a recruitment screener as high risk under Annex III(4), match evidence to 20 candidate obligations, treat a risk and watch the enforced go-live check refuse production until the rest is done, connect evidence sources, record a reviewed decision, review an AI contract before it renews, finalise a report whose fingerprint breaks if a figure changes, then try the rules on a system of your own.
Describe an AI system you use. The same rules run here, in your browser — no account, nothing sent.
Pick an example or describe your own.
Your AI programme on one page.
Systems, open questions, contracts and deadlines in one workspace, with the next thing that needs a person at the top of the inbox.
Fictional example. The rule checks, the candidate obligations, what each file supports, the catalogue matches, the spend recommendations and the report fingerprint are computed by E-ARI’s own rules; names, files and prices are illustrative.
17 modules in 5 stages, arranged the way the workspace is. They share one record: the owner you name is the owner the go-live check asks for, and the policy you publish counts in the ISO/IEC 42001 statement.
AI tools in your SSO and expense exports that nobody declared.
Purpose, owner, data and stage for every system, an agent’s autonomy and reach, and its EU AI Act classification.
Questionnaires, data processing agreements and review dates for the AI services you buy.
Governance bodies, an owner and human oversight for each system, and a go-live check before production.
The rules staff work by, published as numbered versions and acknowledged by name.
Likelihood and impact on fixed bands, the treatment, the residual rating and an impact assessment per system.
Training assigned by role, with a completion record for each person.
Every duty that applies to each system, and whether evidence supports it.
A statement of applicability: 38 Annex A controls, each with its records or a justified exclusion.
Files and connector snapshots, hashed on arrival and linked to the clauses they support.
Which duties will still lack evidence at the deadline, at the pace you collect.
Owned work, and recorded decisions that come back for review when their facts change.
Cost, seat use and renewal dates for each AI contract, with a recommendation to check before notice.
The programme captured at a point in time, finalised by a person and compared with the last.
Signed evidence bundles a reviewer verifies offline with the independent CLI.
A readiness assessment recomputed from its sealed inputs, outside E-ARI.
A public, hash-verified page of your AI governance for customers and procurement.
Each judgement on the record has one owner: a published rule, a model inside fixed limits, or a named person. The three instruments below run on the product’s own engines.
Scoring v5.6 · versioned methodology
What the record rests on: the risk tier, the readiness score, the dates. The rules are published and versioned, so the same inputs give the same result, and a classification names the rule that fired and the words it fired on.
Where reading and writing are the work: the rationale around a tier, document labels, clause excerpts, first drafts of a FRIA or an Annex IV file. It never decides a tier or a score. A citation the rules never applied is withheld, and an excerpt that is not in your file word for word is dropped.
What the Act leaves to judgement: the Article 6(3) assessment, the answers to open questions, decisions, the sign-off on a report. Each is recorded with who made it and when, kept apart from what the rules said.
The EU AI Act engine the product runs on. It marks the words its rules fired on, and says what it leaves to a person.
It classifies
It looks up
It won’t guess
No account, and no logging: your question is answered and forgotten.
is a CV screening tool high risk?
Read as a classification question
Decided by rules
High-riskby presumptionprovisional
Left to a person
Does an Article 6(3) derogation apply — narrow procedural task, improving a completed human activity, detecting patterns without replacing human judgement, or preparatory work — and has that assessment been documented? +1 more
Written by a model
Nothing. This answer is rules only.
Articles citedAnnex III(4) · Art.6(2) · Art.6(3)
Not legal advice — a deterministic reading of Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744. Same question in, same answer out, every time. Verify with counsel.
A fictional workspace’s collection history, projected to the deadline: which duties will lack evidence, and when collection has to start.
At the observed pace of 2.0 files a month
5of 10candidate duties projected to lack evidence by 2 Dec 2027
Scenario range 5–9 · conditional projection
Time before collection must startLatest responsible startCollection window: 5–40 days of work, plus a buffer
All 10 duties:5 projected gaps4 on pace1 date not settled
Fixed fictional scenario as of 2026-09-09; deadline 2027-12-02, read from the platform timeline. Tier-and-role candidates, not a confirmed determination of applicability. Policy uploads only; no existing evidence links or measured obligation-clearance history, so capacity comes from the raw upload rate. A start-by date is the latest responsible start — the duty's collection effort before the deadline, less a published buffer — not a recommendation to wait. The projection is conditional on the observed pace: not a probability or a compliance verdict, and no customer forecast or measured accuracy is implied.
Track artifact collection and, when snapshot history exists, the net rate of obligations evidenced. More uploads do not necessarily mean more coverage.
With insufficient history, E-ARI provides collection priorities instead of an unsupported projection. Scenario bands expose uncertainty in the observed pace.
A sealed export and a reviewer’s replay of it. The check runs on the reviewer’s machine, where E-ARI is not.
Sealed exports bind artifacts to a signed manifest. Independent verification checks their integrity. Audit Replay recomputes the assessment from its sealed inputs, outside E-ARI.
Verification proves a record is intact and reproducible — not that it is compliant or correct.
Illustrative transcript from the published scoring example. Use the verifier to run a check yourself.
Canonical manifests, SHA-256 artifact hashes and Ed25519 signatures bind the bundle. A public append-only transparency log supplies inclusion and consistency proofs. The independent CLI implements the published specification and can run offline.
Read the specification pathsConnect a source, push through the API or upload documents you already have. Each route validates the file, records its SHA-256 and where it came from, and keeps one copy however many systems use it.
Server-recomputed SHA-256
Content-addressed dedupe
Sealable into the public transparency log
Trace a requirement to the clause and source that support it.
Keep supporting records together for the person making the decision.
Include evidence in sealed exports that others can check independently.
Connector maturity is stated individually; experimental connectors remain experimental. Runtime capture records configured traffic and does not enforce runtime policy. Write-scoped API access requires Enterprise.
Our security posture, data processing, methodology and plans are published, so procurement can start before the first call.
Certification status, hosting locations and sub-processors are set out in full on the Security page.
The AI system register, agents included, with shadow AI discovery and vendor reviews; governance bodies, owners and a go-live check; a versioned AI policy acknowledged by name; a risk register with impact assessments; rule-based EU AI Act classification, obligations and evidence; an ISO/IEC 42001 statement of applicability; AI literacy records; and reviewed decisions, AI spend and governance reports. Governance teams review generated FRIA and technical documentation before using it. Feature availability follows the published plans.
As a record, not a certificate. The statement of applicability lists every Annex A control: you record whether it applies, how far it is implemented and why any exclusion is justified, and E-ARI shows the records that bear on it, such as the published AI policy, governance bodies, impact assessments, risks, training and vendor reviews. The mapping from records to controls is E-ARI’s own, a starting point for an auditor’s questions. Certification is an auditor’s decision.
No. Evidence coverage identifies supporting clauses and records; it does not establish that every legal requirement is satisfied in practice. Classification can require a recorded human determination, generated documents require review, and the organisation remains responsible for its decisions.
Yes. The public verifier checks sealed bundles, and the independent CLI can verify them offline. Audit Replay recomputes an assessment from its sealed inputs. These checks establish integrity and reproducibility, not legal correctness or certification.
Rules determine readiness scores, risk tiers and risk-register levels. Models assist with narrative, clause extraction and document drafting, and never decide a tier, a level or an approval. Processing locations, providers and current safeguards are described on the security and data-processing pages.
AI Spend brings contract costs, reported usage, renewal and notice timing into review. Source-linked actions collect evidence and record a human decision. Material changes to tracked facts or due review dates can bring that decision back for attention; governance reports preserve a point-in-time record. E-ARI does not autonomously cancel contracts or certify compliance.
Start with the interactive examples and published methodology, then discuss your systems, evidence sources and procurement requirements with us. Self-service assessment and published plans are available. Connector maturity and security limitations are disclosed before you commit.
Classify a use case against the EU AI Act without an account, or talk to us about running the whole programme in E-ARI.