Two things a plan can be extended with.
No per-framework fees anywhere else. ISO/IEC 42001, GDPR and the NIST AI RMF crosswalk are included from Govern up.
| Add-on | Price | Available on |
|---|---|---|
| Extra high-risk system | €49 / month each | Any plan that includes at least one high-risk system (Govern and above) |
| ISO/IEC 27001 programme | €199 / month | Govern. Already included in Manage and Enterprise |
Management system programmes.
ISO/IEC 42001 and the NIST AI RMF crosswalk come with Govern and above; ISO/IEC 27001 is the one programme sold separately, and it is part of Manage. Shared policies and evidence are credited across your EU AI Act, GDPR and ISO work, with the basis for each reuse shown so you can check it.
ISO/IEC 42001, ISO/IEC 27001 and NIST AI RMF cross-mapping lands by 13 October.
Veritome is not a certification body and does not audit or certify. Certification is granted by an accredited certification body following its own audit. Auditor access means read-only access for your auditor — an audit is not included. Obligation sets and mappings are drafts for your review; they are not legal advice and do not establish that a requirement has been met.
Every detail across the plans.
For context: EU AI Act fines reach €35M or 7% of turnover (Art. 99). Every plan here is a rounding error against that.
| Feature | Classify | Starter | Govern | Manage | Enterprise |
|---|---|---|---|---|---|
| Limits | |||||
| AI systems in the register | 3 | 5 | 25 | Unlimited | Unlimited |
| High-risk systems | — | — | 1 | 3 + add-on | Unlimited |
| Users | 2 | 5 | 15 | Unlimited | Unlimited |
| Read-only auditor seat | – | – | ✓ | ✓ | ✓ |
| AI-assisted assessments per month | 5 | 50 | 250 | Fair use | Fair use |
| Register and assessment | |||||
| Inventory, role and risk classification, with article citations | ✓ | ✓ | ✓ | ✓ | ✓ |
| Obligation list | View only | Work | Work | Work | Work |
| Working obligation sets — owners, dates, evidence | — | Non-high-risk | All | All | All |
| PDF / DOCX export | Watermarked | Branded | Branded | Branded | Branded |
| Evidence pack export | – | – | ✓ | ✓ | ✓ |
| Compliance data hosted in the EEA | ✓ | ✓ | ✓ | ✓ | ✓ |
| Frameworks | |||||
| EU AI Act — literacy (Art. 4) and transparency (Art. 50) | – | ✓ | ✓ | ✓ | ✓ |
| High-risk provider programme (Arts. 9–15) | – | – | – | ✓ | ✓ |
| Quality management system (Art. 17) | – | – | – | ✓ | ✓ |
| Post-market monitoring, incidents, conformity and registration (Arts. 20, 43, 47, 49, 72, 73) | – | – | – | ✓ | ✓ |
| GDPR | — | Records | Full | Full | Full |
| ISO/IEC 42001 programme | – | – | ✓ | ✓ | ✓ |
| ISO/IEC 27001 programme | — | — | Add-on | Included | Included |
| NIST AI RMF crosswalk | – | – | ✓ | ✓ | ✓ |
| Operations and support | |||||
| Policies, approvals, suppliers, risk register, evidence library, audit trail | – | – | ✓ | ✓ | ✓ |
| Multi-entity | – | – | – | – | ✓ |
| Single sign-on | – | – | – | – | ✓ |
| API access | – | – | – | – | ✓ |
| Custom Data Processing Agreement | – | – | – | – | ✓ |
| Support | Help centre | Email, 2 business days | Email, 1 business day | Priority, 1 business day | Priority, 1 business day |
- Enterprise is Manage plus multi-entity, single sign-on, API access and a custom Data Processing Agreement. No self-serve checkout — talk to us.
- Prices exclude VAT. Irish business customers are charged Irish VAT. EU business customers who supply a VAT number validated through VIES are reverse-charged.
Questions we get asked about pricing
Can I switch plans at any time?
Yes. Upgrade or downgrade at any time from the billing portal. Upgrades take effect immediately and are charged pro rata for the rest of your period; downgrades take effect at the end of the current billing cycle. The Refund Policy says what is and is not refundable.
What counts as one AI system?
One AI system as placed on the market or put into service. Versions, environments and deployments of the same system under the same owner count as one. Archived systems do not count against your allowance. Your plan sets how many systems the register holds — three on Classify, five on Starter, twenty-five on Govern, unlimited from Manage — and how many of them may be high-risk.
Which plan do I need?
Your obligations depend on your role, the system's classification and how it is used. Veritome generates the set that applies to each system you register, and you can do that on Classify for free before you decide. One or two systems and none of them high-risk: Starter. A governance programme across several systems and frameworks, with one high-risk system: Govern. Any provider duties on a high-risk system, or more than one: Manage.
What if I have more than one high-risk system?
Govern includes one and Manage includes three. Each additional high-risk system is €49 a month on either plan, because the second system reuses your quality management system, your policies and most of the technical file structure. Enterprise has no limit.
What is the founding rate?
30% off your plan for as long as you stay subscribed, for any organisation created before 13 October 2026. It is applied to your invoice automatically — there is no code — and it stacks with annual billing: ten months for twelve first, then the discount. Add-ons are never discounted.
Do I need the ISO/IEC 42001 programme to satisfy Article 17?
No. The quality management system required by Article 17 is included in Manage — it is a statutory duty for high-risk providers and we do not sell it back to you. The ISO/IEC 42001 programme is the certifiable management system around it: the Annex A controls, the Statement of Applicability, the internal audit and management review records an accredited certification body will ask to see. It is included from Govern up.
Is my data stored in the EU?
Yes. Your compliance data is stored and processed in the EEA: the application, database and object storage run on Hetzner in Germany, and Aria's AI processing runs on Mistral in France. We have no US entity. A small number of supporting services are US-based and operate under EU Standard Contractual Clauses — transactional email, payments, optional single sign-on and the optional evidence connectors — and every one is named in our sub-processor register.
How does annual billing work?
Annual plans are billed up front and charge 10 months for 12 — 2 months free. A founding organisation gets its 30% on top of that.
Does Veritome certify us, or audit us?
No. Veritome is not a certification body and does not audit or certify. Certification is granted by an accredited certification body following its own audit. What we provide is the workspace, the records and the evidence trail that audit runs against — and a read-only seat so your auditor can read them.
Does Veritome provide legal advice?
No. Veritome is an EU AI Act compliance toolkit — it structures your documentation, classification and obligation mapping against the Act's requirements. Obligation sets and mappings are drafts for your review; they do not establish that a requirement has been met. Consult an EU AI Act specialist for complex legal questions.
What happens when new EU AI Act guidance is published?
We monitor the EU AI Office, the European Commission and the relevant supervisory authorities, and update the regulatory registry the toolkit runs on. Updates reach you automatically — there is nothing for you to install.
Can I export my compliance documentation?
Yes. Classify exports a watermarked classification report. From Starter onwards every generated document — technical files, assessments, transparency notices, obligation maps — exports as branded PDF or DOCX to keep for your records, review with counsel, or use as the basis of a submission you make yourself. The evidence pack export starts at Govern.