What is Veritome?
One register of what your AI systems must do, who owns it and what proves it — across the EU AI Act, GDPR and the standards you switch on.
Veritome turns five rulebooks into one register. You register the AI systems you build or use; the engine derives the EU AI Act and GDPR obligations that apply to each one from its role, risk tier, behaviour and data; and each standard you enable — ISO/IEC 42001, ISO/IEC 27001, NIST AI RMF — becomes a guided programme whose steps produce your policies, records and Statement of Applicability as you go. A record written once counts everywhere it applies.
Veritome prepares your records and keeps the trail. It is not legal advice, and it cannot make a legal determination for you. Everything Aria drafts is a proposal until a named person approves it.
How the app is organised
Five groups in the rail, in the order you work — Position and Configure open by default, every group folds:
| Group | Screens | What lives there |
|---|---|---|
| Position | Dashboard · AI systems · Obligations | Where you stand. Obligations is the one register of what the law requires of your systems and of the organisation — filter it by source, scope, stage, status, system or domain. |
| Do the work | Evidence · Documents · Risks · Suppliers · Incidents | The proof, the records the law and your standards require (policies among them, as a kind of document), and the registers you keep. |
| Standards | Programmes, then one entry per programme you switched on | The GDPR programme appears here once you switch it on: binding law, on every plan, its steps the same organisation duties listed in Obligations. ISO/IEC 42001, ISO/IEC 27001 and NIST AI RMF are each worked as a programme on its own page; Switch on a programme or Add a standard appears when something you may switch on is still off. During the public beta the three standards are listed faded and open afterwards. |
| Prove it | Assessments · Audit trail · Academy · Reports | FRIAs, DPIAs, conformity and impact assessments, internal audits; the hash-chained log; Art. 4 literacy records; the reports you generate for a board or an auditor. |
| Configure | Organisation | Members, roles, billing, security, data residency — and the Frameworks tab, where a standard is switched on. |
Topics — human oversight, data governance, transparency, post-market monitoring — are not screens. They are domain filters on the Obligations register, and editors open from the record they edit. While the frameworks-crosswalk switch is off the three standards are absent from Standards (the GDPR programme is never behind that switch), and during the public beta they are listed faded until they open. Nothing else in the rail changes with it.
Across the top, the portal bar — the same on the marketing site, the app, the public Academy and this help centre — has four doors, Home, Workspace, Academy and Help Centre, and says which one you are in. While the free public beta runs it also carries one link at its right end, to the story of the extended beta. Signing in and out happens in each destination's own header. Aria in the app's top bar opens the assistant with the context of the screen you are on.
The spine, the overlay and the standards
The EU AI Act is the spine: its duties are generated per system by the obligation engine from the classification you confirm, and every system walks six gated stages. It is never a programme and never switched on. The GDPR runs beside it: its system duties come from the personal-data questions you answer at registration and apply to every system that processes personal data, whatever you switch on. Its organisation duties are a programme under Standards — its steps are those same organisation duties — switched on under Organisation → Frameworks when you want to run them here, free on every plan. The two laws are counted apart — each system shows an EU AI Act journey figure and a GDPR duties figure, never added together. The three voluntary standards are programmes you switch on under Organisation → Frameworks — ordered steps in gated phases, each producing a record, with credit given wherever work already on file answers them. See Programmes: a standard as a path, not a list and The GDPR programme.
Where the EU AI Act journey sits
Every system moves through six stages — Classify → Scope & literacy → Build & document → Conformity assessment → Register → Operate & monitor — gate-locked, with empty stages counting as complete. The system's header shows where it is; the Dashboard shows the whole estate. The dates come from one registry: Annex III high-risk duties apply from 2 December 2027 under Regulation (EU) 2026/1744, Art. 50 transparency has applied since 2 August 2026, and Art. 4 literacy since 2 February 2025.
Aria
Aria is the assistant: it drafts, maps, proposes and cites — it never files. By default every write it makes lands in its Inbox as a proposal until a named person applies it; an admin can set Auto-apply for low-stakes capabilities, which then apply and are logged for review. Aria runs on Mistral, hosted in Paris under a commercial agreement with no training on your data; the application and its database run in Nuremberg.
The free public beta
Veritome is in a free public beta until its full launch, planned for late November 2026 — every workspace has the Govern level of capability, capped at three AI systems, one high-risk system, fifteen members and a hundred AI-assisted assessments a month, with the three standards opening at the launch — and an organisation that joins before 01.12.2026 locks in 30% off, permanently, when billing opens. See Plans, billing and upgrades.
New here? Read Your first 15 minutes, or register your first system and let the engine show you what applies.