For companies that use, build or sell AI in the EU
Register every AI system, see what the EU AI Act and ISO/IEC 42001 require of each, and keep the evidence your customers and auditors will ask for.
Matched Annex III(4) · Employment, workers management and access to self-employment, on “job applicant”
20 candidate obligations for a deployer
The duties and their dates differ for companies that use AI and companies that build or sell it.
Dates from Regulation (EU) 2024/1689, as amended by the Digital Omnibus on AI.
Four steps from one fictional workspace. Every count, match and fingerprint is computed by the same rules the product runs.
Drop an SSO or expense export. Each app or merchant name is matched against a versioned catalogue of AI tools, and nothing is saved until you confirm.
3 of 6 merchants match the AI catalogue
| Tool | Found as | Risk | Trains on data |
|---|---|---|---|
| Otter.aiMeeting transcription | OTTER.AI BUSINESS ANNUAL | High | Default on |
| Fireflies.aiMeeting transcription | FIREFLIES.AI PRO | High | Configurable |
| GrammarlyWriting assistant | GRAMMARLY BUSINESS | Medium | Configurable |
No catalogue match for 3 lines: NORTHSTAR LTD SCREENER SEATS, ADOBE CREATIVE CLOUD, SLACK TECHNOLOGIES. Bespoke tools are registered by hand.
Preview — nothing is saved until you confirm
9 prohibited practices and 8 high-risk areas are checked in order, without a model. What the description can’t answer goes to a named reviewer.
PurposeRank job applicants for recruitment shortlisting.
20 candidate obligations
High risk by presumption, not by finding. The description can’t answer the 2 questions that decide it, so a person does.
Determination recorded · Nadia Ferreira · 9 Sep 2026, 11:20
Drop a procedure and the clause it cites is matched to the duties it supports. Library files are linked, not copied. What is already in force comes first.
§3.2 Review of rankingsA human recruiter reviews every ranked applicant and records the reason for accepting or overriding the recommendation.
15 / 20 candidate obligations with supporting evidence
A supporting citation is not proof of compliance.
Finalise the report under a reviewer’s name. Its fingerprint is computed from every figure in it — change one, and it no longer matches.
Matches the sealed fingerprint
Finalised by Nadia Ferreira · 9 Sep 2026
The programme in the order the work happens: 17 capabilities across 5 stages.
AI tools in your SSO and expense exports that nobody declared.
Purpose, owner, data and stage for every system, an agent’s autonomy and reach, and its EU AI Act classification.
Questionnaires, data processing agreements and review dates for the AI services you buy.
Governance bodies, an owner and human oversight for each system, and a go-live check before production.
The rules staff work by, published as numbered versions and acknowledged by name.
Likelihood and impact on fixed bands, the treatment, the residual rating and an impact assessment per system.
Training assigned by role, with a completion record for each person.
Every duty that applies to each system, and whether evidence supports it.
A statement of applicability: 38 Annex A controls, each with its records or a justified exclusion.
Files and connector snapshots, hashed on arrival and linked to the clauses they support.
Which duties will still lack evidence at the deadline, at the pace you collect.
Owned work, and recorded decisions that come back for review when their facts change.
Cost, seat use and renewal dates for each AI contract, with a recommendation to check before notice.
The programme captured at a point in time, finalised by a person and compared with the last.
Signed evidence bundles a reviewer verifies offline with the independent CLI.
A sealed assessment recomputed from its inputs, outside E-ARI, to show the result follows from them.
A public, hash-verified page of your AI governance for customers and procurement.
A sealed record and a reviewer’s check of it. The check runs on the reviewer’s machine, where E-ARI is not.
Verification proves a record is intact and in the public log — not that what it says is true or compliant.
The checks shown are the ones the verifier runs on E-ARI’s own sealed AI statement, a real file you can download and check yourself.
Open E-ARI’s AI statementCanonical manifests, SHA-256 artifact hashes and Ed25519 signatures bind the bundle. A public append-only transparency log supplies inclusion and consistency proofs. The independent CLI implements the published specification and can run offline.
Read the specification pathsConnect a supported source, use the API or upload a document. Every file goes through the same integrity checks.
Server-recomputed SHA-256
Content-addressed dedupe
Sealable into the public transparency log
Connector scope and setup requirements are documented in the catalogue. Runtime capture records configured traffic and does not enforce runtime policy. Write-scoped API access requires Enterprise.
Our security posture, data processing, methodology and plans are published, so procurement can check everything in writing, on its own schedule.
FreeSee what applies
€0
Register your AI systems and see which obligations apply to each
ProGovern
€299/month
Evidence, FRIA, technical documentation and records anyone can verify
EnterpriseAutomate & scale
From€20,000/year
Everything in Pro without limits, with API access and SSO
Certification status, hosting locations and sub-processors are set out in full on the Security page.
E-ARI is built and run by one accountable author. Questions get an answer in writing.
Founder's letterAs a record, not a certificate. The statement of applicability lists every Annex A control: you record whether it applies, how far it is implemented and why any exclusion is justified, and E-ARI shows the records that bear on it, such as the published AI policy, governance bodies, impact assessments, risks, training and vendor reviews. The mapping from records to controls is E-ARI’s own, a starting point for an auditor’s questions. Certification is an auditor’s decision.
No. Evidence coverage identifies supporting clauses and records; it does not establish that every legal requirement is satisfied in practice. Classification can require a recorded human determination, generated documents require review, and the organisation remains responsible for its decisions.
Yes. The public verifier checks sealed bundles, and the independent CLI can verify them offline. These checks establish integrity, not legal correctness or certification.
Rules determine risk tiers, the obligations that apply and risk-register levels. Models assist with narrative, clause extraction and document drafting, and never decide a tier, a level or an approval. Processing locations, providers and current safeguards are described on the security and data-processing pages.
AI Spend brings contract costs, reported usage, renewal and notice timing into review. Source-linked actions collect evidence and record a human decision. Material changes to tracked facts or due review dates can bring that decision back for attention; governance reports preserve a point-in-time record. E-ARI does not autonomously cancel contracts or certify compliance.
Start with the interactive examples and published methodology, then discuss your systems, evidence sources and procurement requirements with us. Self-service assessment and published plans are available. Connector maturity and security limitations are disclosed before you commit.
Register it, see what applies and decide from there. No card needed.