Most compliance tools weren't built for the EU AI Act.
Generic GRC platforms don't understand AI risk tiers, Annex III domains, or Article-specific obligations. We built for the regulation, not around it.
Too small for the enterprise tools. Too serious for a checklist.
Compliance software splits in two: platforms priced for companies a hundred times your size, and cheap tools that were never really built for the AI Act. Veritome is the instrument made for the middle.
Enterprise GRC
- Powerful — but priced for the Fortune 500
- Months of procurement and demos
- AI governance bolted onto a generic suite
- Needs a dedicated team to run it
Dedicated. Self-serve. Deep.
- Article-by-article classification built for the Act
- Annex IV, FRIA & DoC dossiers for audit preparation
- Transparent pricing — no sales call required
- EU-hosted, GDPR-native, verifiable evidence
Cheap SME tools
- Broad multi-framework, shallow on the AI Act
- Stops at a questionnaire or a checklist
- Little real documentation or evidence
- No living review cycle
Classification that follows the law.
A branching decision tree that mirrors the Act's exact classification logic: prohibited practices, Annex III domains, Article 6(3) exceptions, role determination. Every decision documented with its article reference, every wizard step backed by Aria.
- Every branch lands on a specific article or recital.
- Aria proposes the classification; you confirm and sign.
- Re-classification is a diff, not a reset.
The right obligations, auto-mapped.
The engine reads your classification and materialises the exact obligations that apply — by role, risk tier and Annex III domain. A workbench, not a checklist: drag tasks between To-do, In Progress, In Review, and Complete, with the deadline chip derived from the article, never guessed.
- Role-aware — deployer vs. provider vs. importer vs. distributor.
- Conditional logic for biometrics, workplace AI, GPAI on top.
- One click to open the form that closes the obligation.
Documentation, verifiable.
Annex IV technical docs, Fundamental Rights Impact Assessments and EU Declarations of Conformity assemble themselves from your live data. Every page is timestamped and hash-sealed; every dossier carries a public verify URL a regulator or buyer can check without an account.
- Smart forms with Aria suggestions; evidence at item level.
- Provider ↔ deployer Art. 13 IFU handoff in one click.
- Regulator view: Fraunces display, marginalia article refs.
AI literacy is not optional. Article 4 is in force.
Every company using AI professionally must ensure staff have sufficient literacy. Veritome's training module covers six role-based programmes, needs assessment, individual progress tracking, and compliance evidence generation.
Explore AI LiteracyCompliance isn't a project. It's a cycle.
Veritome automates the review schedule. When a review is due, you know. When evidence expires, you know.
Six phases, one continuous thread.
Every system walks the same gated journey — classify, scope, build, assess, register, monitor. Each phase unlocks the next; every obligation is tied to its article.
One price. No surprises.
All plans include EEA data residency and GDPR-native infrastructure.
EU AI Act, in plain English.
When do the EU AI Act rules actually apply?
Prohibited practices (Art. 5) have been banned since February 2025, and Art. 4 AI-literacy duties are already in force. High-risk obligations for stand-alone Annex III systems apply from 2 December 2027, and for AI embedded in regulated products (Annex I) from 2 August 2028 — both moved later by the Digital Omnibus.
How do I know if my AI system is high-risk?
A system is high-risk if it falls within an Annex III domain — biometrics, critical infrastructure, education, employment, essential services, law enforcement, migration, or justice — unless an Art. 6(3) exception applies. Veritome's classification wizard walks this logic question by question and lands every system on its specific article.
I only use third-party AI tools like ChatGPT. Does the Act still apply to me?
Yes. You are a "deployer," and deployers have real duties — Art. 4 staff literacy, Art. 50 transparency for limited-risk tools, and full obligations if a tool is used in a high-risk way. Veritome defaults to the deployer journey, which is the one most SMEs need.
What's the difference between a deployer and a provider?
A provider develops or places an AI system on the market under its own name; a deployer uses an AI system under its authority. Most SMEs are deployers. Veritome determines your role during classification and maps role-specific obligations automatically.
What are the penalties for non-compliance?
Fines reach up to €35 million or 7% of global annual turnover for prohibited practices, with lower bands for other breaches. Even Veritome's top self-serve plan is a rounding error against that exposure. The free readiness check gives you a worst-case fine estimate.
Where is my data stored?
Entirely in the EU. Application and database on Hetzner (Germany), file storage on Hetzner S3, AI processing by Mistral (France) with training use contractually excluded, and no US sub-processors for compliance-critical data. Supervisory authority: the Irish DPC.
Start before you sign up.
EU AI Act Readiness Check
15 branching questions. Score out of 100, risk classification per use case, fine-exposure estimate, and a prioritised action plan — delivered as a PDF.
Take the checkEU AI Act Compliance Tracker
Six ready-to-use worksheets with pre-built templates, obligation checklists, and the full regulatory timeline. Works offline.
Download free tracker