What it is, who it applies to, the dates, what it asks, how Veritome runs it, and where it overlaps the other four — with every figure computed from the shipped catalogues and templates.
Per-system obligations derived by the rules engine from your role, risk tier and the system's behaviour, across six gated phases.
Not: A certificate. No harmonised standard has been cited in the Official Journal, so nothing gives a presumption of conformity today.
The articles the EU AI Act sends you to — lawful basis, transparency, Art. 22, DPIA, processor terms, transfers — attached per system by five data questions.
Not: Your whole GDPR programme. Veritome models where the two regimes meet, and a DPIA shares its parts with the FRIA.
A gated programme of steps producing the AI management system: policy, roles, risk method, impact assessment, competence, audit, review, and the Statement of Applicability.
Not: A legal shield, and not certified by us — ISO/IEC 17021-1 §5.2.5 keeps the consultant and the certifier apart.
One management system with ISO/IEC 42001 where the clauses are the same; the 93 Annex A controls as guided themes with a generated SoA.
Not: A second set of forms for the clauses you already answered — a shared step is one record.
Govern, Map, Measure, Manage as twelve steps that reuse EU AI Act records, ending in a generated profile document.
Not: A certificate. None exists for the NIST AI RMF, and the product never implies one.
The dates are the law's, read from one registry: Art. 5 prohibitions and Art. 4 literacy since 02.02.2025, Art. 50 transparency since 02.08.2026, the Annex III high-risk obligations from 02.12.2027 under the Digital Omnibus deferral. Nothing on any screen turns red before its statutory date. The GDPR has applied since 25.05.2018; the three standards are voluntary and carry no date of their own.
A framework you switch on becomes a programme: gate-locked phases, one record per step, and the coverage matrix that shows which requirement each record closes. A record that is a step in two programmes is written once.
Each cell is the number of shipped records whose one piece of evidence is credited in both frameworks, then how many more only carry a related link between them. Credit follows the owner-verified matrix, checked clause by clause against each standard; a related link is a supporting candidate the product shows and never counts.
| Credited in both · related only | EU AI Act | GDPR | ISO 42001 | ISO 27001 | NIST AI RMF |
|---|---|---|---|---|---|
| EU AI Act | — | 0 · 17 related | 0 · 34 related | 0 · 17 related | 0 · 21 related |
| GDPR | 0 · 17 related | — | 0 · 16 related | 0 · 11 related | 0 · 4 related |
| ISO/IEC 42001 | 0 · 34 related | 0 · 16 related | — | 14 · 18 related | 0 · 23 related |
| ISO/IEC 27001 | 0 · 17 related | 0 · 11 related | 14 · 18 related | — | 0 · 7 related |
| NIST AI RMF | 0 · 21 related | 0 · 4 related | 0 · 23 related | 0 · 7 related | — |
55 of the 69 records behind the shipped programme steps touch two or more frameworks. The first number in a cell is records whose one piece of evidence is credited in both; a related count is a supporting link the verified matrix shows but never counts. Counted from the step templates on every build.
Each toggle adds a programme; the figures update from the same templates the product ships.