Using Veritome

The first screen: five counts with denominators, your programmes with the next step in each, one action queue, what Aria found, five gated items of work this week, the dates split honestly, and the regulatory updates.

The completion figure is phase-weighted — implementation carries 45 of 100 points — with priority weighting inside each phase and a hard zero for prohibited systems.

Add an AI system, answer the guided questions — role, duties, model, prohibited practices, risk, transparency, GDPR — and get a classification with the exact obligations that apply.

The inventory every duty hangs off — four counts, the register filters, list or board, CSV import — and the seven-tab record each system opens onto.

Classification decides your risk tier and role, which decide what you must do. Eight screens and a review — role, Art. 25, GPAI, Art. 5, Annex III, Art. 6(3), Art. 50 and the five GDPR questions.

Every system moves through six gate-locked phases — Classify, Scope, Implement, Assess, Register, Monitor — and empty phases never block.

After classification, confirm which derived obligations genuinely apply, mark the rest not applicable, put a named owner on each, and settle the Art. 4 literacy duty.

Drive obligations from the register or a system record: List, Board or Timeline; filters by domain, framework, scope and system; the drawer's form, evidence and history; the four-eyes rule.

Every dated thing — obligation due dates, periodic reviews, incident clocks, statutory milestones, programme steps — is a row on the Obligations register. The Timeline view buckets them by week, and red means one thing.

The Data domain of the Obligations register: Art. 10 training, validation and testing data practices for every high-risk system, the deployer's Art. 26(4) input-data duty, and the GDPR rows generated beside them.

The Transparency domain of the Obligations register: Article 50 duties for systems that talk to people, read emotions or generate synthetic content — and the notice studio that drafts the wording.

The Oversight domain of the Obligations register: who can intervene in each high-risk system, how the stop mechanism works, how automation bias is countered — the provider designs the measures, the deployer assigns and equips the people.

For general-purpose model providers: the Documentation domain holds the downstream model documentation, the copyright policy and the training-data summary — and the extra Art. 55 layer when a model carries systemic risk.

Open a step, answer its questions or let Aria draft from what you already have, then approve. Only approval files the record as evidence and creates the control.

What a control is, how it links to requirements, why the register starts empty, and why coverage only counts verified proof.

A record that satisfies a clause in two frameworks is one record. A step whose every requirement is already evidenced elsewhere is marked done by overlap — with the record that did it.

The SoA is a view over your controls and records, not a spreadsheet you fill. Every Annex A control is listed; an exclusion needs a justification sentence.

Every file you hold as proof, fingerprinted and sealed, linked to the obligations it satisfies; upload, generate or connect; and an expiry clock so stale evidence is flagged, not counted.

Attach fingerprinted evidence to obligations and checklist items, and generate the Annex IV, FRIA and declaration documents that each carry a public verify URL.

Connect the tools your proof already lives in over read-only OAuth, then sync recent items in as evidence — deduplicated, link-checked weekly, and attachable to obligations.

The organisation-scope record register: the Art. 4 literacy programme, the Art. 17 policy pack, the retention policy, the programme steps that produce a policy, and the six policy documents you write and approve.

The six organisation-wide policies the EU AI Act asks a provider for, as clause outlines you write into — guidance is never prefilled, approving issues a version, and an approved policy is never edited in place.

Log and score Art. 9 risks with the seven-step guided wizard, read the heat-map, see which Art. 9, Art. 27 and Art. 55 assessments each system still owes, and complete scheduled reviews that leave a dossier entry.

The register of the third parties behind your AI systems, the written agreements Art. 25(4) and GDPR Art. 28 expect, the six-question supplier assessment, and how the Art. 13 instructions for use hand off along the chain.

Veritome resolves the competent authority for the member state, tracks the Art. 73 deadline (2 / 10 / 15 days), runs four-eyes approval, and drafts the notification — you review and send.

After deployment the work continues: a monitoring plan per high-risk system, recurring reviews on Assessments, and the paper trail that connects field experience back into risk management.

Who must run an Art. 27 FRIA, what the assessment covers, the Art. 27(3) notification and the Art. 27(4) link to the DPIA, when to revisit it, and how Veritome generates the report per system.

Art. 27(4) lets the FRIA draw on the GDPR Art. 35 DPIA and Art. 26(9) sends the instructions for use into it — Veritome shows both routes, maps completed FRIA answers onto the DPIA's four pillars and exports an input pack for your privacy team. None of it counts as coverage.

Who changed what, when — every mutation in the product writes a line. Lines are chained by hash and anchored once a day, so the trail can be verified, not just read.

Stream the whole tenant audit trail into your SIEM with the since-and-cursor endpoint, know what each entry carries, and verify the daily hash anchors so an altered entry cannot hide.

Art. 4 binds every provider and deployer since 2 February 2025 — answer the Academy's six questions, complete the programmes they assign, and keep a twelve-month record that counts as evidence.

Article 4 binds every person who works with AI, not only the technical roles. Six questions decide which programmes apply to you, the answers are filed as evidence, and the record you earn is valid for twelve months.

The register of every document your frameworks require, counted as instances in four buckets, laid out per system as a matrix, with the Issued archive that keeps every produced version.

The register of every document you owe — organisation-wide ones as a list, per-system ones as a grid of type against system — with four counts that say where the work actually stands, and an issued archive that never overwrites.

What a provider's instructions for use must contain under Art. 13(3), how the package is built and handed to deployers, how a deployer receives it, and where it feeds the deployer's own duties.

The classification dossier is a hash-linked chain of custody; the regulator view is the 'open the books' surface; the audit bundle is one PDF with a SHA-256 integrity manifest.

Generate audience-specific PDF reports, export the obligation matrix as CSV, build a per-system audit bundle, and schedule any template to self-generate on a cadence.

What the Annex IV technical file must contain, how Veritome composes it from the Art. 9–15 obligations in a guided editor, and how issued versions are hash-sealed and kept for ten years.

The provider's Art. 47 declaration in the Annex V field set, the Art. 48 CE marking, and registering in the EU database with Veritome's pre-filled Annex VIII copy-out sheet — nothing is submitted to any authority for you.

The organisation-wide AI management system workspace under Frameworks → ISO/IEC 42001: the Annex A control catalogue, the QMS profile, the Statement of Applicability, and the tick-only sync into every Art. 17 checklist.

Delegated acts, guidance, harmonised standards and national implementation — a change register on Frameworks → Changes: assess relevance, record the decision, and turn planned actions into scheduled reviews.

The Configure screen for the regimes your organisation is run against: the five toggles, the Programme cards, the Coverage matrix, every requirement row, and the regulatory-change register.

Switch a framework on and it becomes a programme — ordered steps in gated phases, each producing a record. The standards stop being a checklist you tick and become work you do once.

Each programme runs in phases; a phase is locked until the one before it is complete. The same rule the EU AI Act journey uses, applied to the standards — plus the GDPR bucket that sits outside the path.

Frameworks → Coverage shows every requirement and the workflow assigned to it. Give your auditor a read-only seat and the records; the certificate comes from them, not from us.

The statutory core. Obligations attach by your role for each system and its risk tier; most high-risk duties apply from 2 December 2027; Article 25 can make a deployer the provider.

Personal data through a running AI system brings the GDPR into the same register: lawful basis, transparency, DPIA, Art. 22, processor terms, transfers — per system from five questions, plus an organisation-wide programme.

The AI management-system standard as a programme from Stage 1 to Stage 2. Genuinely useful, certifiable by an accredited body — and not a presumption of conformity with the EU AI Act.

Information security, modelled as one management system with ISO/IEC 42001 where the clauses are the same. The 93 Annex A controls are worked as four guided theme records, not empty rows.

The US framework a counterparty may ask for: Govern, Map, Measure, Manage. Veritome produces the profile document from approved records; there is no certification to obtain.

Add colleagues, pick from six least-privilege roles, keep the org profile that feeds your documents, and assign obligation owners so work is accountable.

Early access is free with 30% off locked in for life; then Classify, Starter (€79), Govern (€199) and Manage (€599), Enterprise by quote; ISO/IEC 42001 and NIST included from Govern, ISO/IEC 27001 at €199 on Govern and included in Manage; annual billing at ten months for twelve, and what happens at a limit.

The Configure screen for everything set once: the organisation profile that feeds your documents, members and roles, your own AI literacy standing, billing, SSO, security, data residency, API keys, integrations and notifications.

Register an HMAC-signed webhook so downstream tools react the moment a system is registered, an obligation changes status, an incident is filed or evidence is verified.

Connect your identity provider over OIDC for single sign-on, and mint SCIM tokens so your IdP provisions and deactivates users automatically — both Enterprise features, configured by an Admin.

Create hashed, scoped API keys for programmatic access, generate a sealed export of all organisation data, and file a GDPR erasure request.