Using Veritome

The first screen: your position under the EU AI Act, the GDPR beside it, the standards you run, what needs your attention, recorded progress, the dates split honestly, and the regulatory watch.

The EU AI Act completion figure is stage-weighted — Build & document carries 45 of 100 points — with priority weighting inside each stage, GDPR counted apart, and a hard zero for prohibited systems.

Delegated acts, guidance, harmonised standards and national implementation — a change register on its own page: assess relevance, record the decision, and turn planned actions into scheduled reviews.

Add an AI system, answer the guided questions — prohibited practices, models, product law, risk, your role, personal data, what it does — and get a classification with the exact obligations that apply.

The inventory every duty hangs off — four counts, the register filters, list or board, CSV import, two figures per system — and the seven-tab record each system opens onto.

Classification decides your risk tier and role, which decide what you must do. One question at a time, with follow-ups only where an answer calls for them — Art. 5, GPAI, Annex I, Annex III, Art. 6(3), your role, Art. 25, Art. 50 and GDPR — then a review.

Every system walks six gate-locked stages — Classify, Scope & literacy, Build & document, Conformity assessment, Register, Operate & monitor — and empty stages never block.

After classification, confirm which derived obligations genuinely apply, mark the rest not applicable, put a named owner on each, and settle the Art. 4 literacy duty.

Drive obligations from the register or a system record: List, Board or Timeline; filters by source, scope, stage, status and system; the record, the guided assessment, evidence and review.

Obligation due dates, statutory milestones and incident clocks on the Obligations register; periodic reviews and programme steps beside them. The Timeline view buckets them by week, and red means one thing.

The Data domain of the Obligations register: Art. 10 training, validation and testing data practices for every high-risk system, the deployer's Art. 26(4) input-data duty, and the GDPR rows generated beside them.

The Transparency domain of the Obligations register: Article 50 duties for systems that talk to people, read emotions or generate synthetic content — and the notice studio that drafts the wording.

The Oversight domain of the Obligations register: who can intervene in each high-risk system, how the stop mechanism works, how automation bias is countered — the provider designs the measures, the deployer assigns and equips the people.

For general-purpose model providers: the Documentation domain holds the downstream model documentation, the copyright policy and the training-data summary — and the extra Art. 55 layer when a model carries systemic risk.

Every file you hold as proof, fingerprinted and sealed, linked to the obligations it satisfies; upload, generate or connect; and an expiry clock so stale evidence is flagged, not counted.

Attach fingerprinted evidence to obligations and checklist items, and generate the Annex IV, FRIA and declaration documents that each carry a public verify URL.

Connect the tools your proof already lives in over read-only OAuth, then bring items in as evidence — chosen in Google's picker for Drive, synced for the others — deduplicated, link-checked weekly, and attachable to obligations.

Policies are the Policy kind on the Documents register — what the organisation decided once, for every system: written in your own words, approved, issued, and versioned rather than edited in place.

The register of every record the law and your standards require, with its Source and Kind, counted as instances in four buckets, per system as a matrix, and the Issued archive.

The register of every document you owe — organisation-wide ones as a list, per-system ones as a grid of type against system — with four counts that say where the work actually stands, and an issued archive that never overwrites.

The organisation-wide policies and procedures — the EU AI Act's own, an AI acceptable-use policy and three ISO/IEC 42001 procedures — as clause outlines you write into: guidance is never prefilled, approving issues a version, and an approved policy is never edited in place.

What a provider's instructions for use must contain under Art. 13(3), how the package is built and handed to deployers, how a deployer receives it, and where it feeds the deployer's own duties.

Log and score Art. 9 risks with the seven-step guided wizard, read the heat-map, see which Art. 9, Art. 27 and Art. 55 assessments each system still owes, and complete scheduled reviews that leave a dossier entry.

The register of the third parties behind your AI systems, the written agreements Art. 25(4) and GDPR Art. 28 expect, the six-question supplier assessment, and how the Art. 13 instructions for use hand off along the chain.

Veritome resolves the competent authority for the member state, tracks the Art. 73 deadline (2 / 10 / 15 days), runs four-eyes approval, and drafts the notification — you review and send.

After deployment the work continues: a monitoring plan per high-risk system, recurring reviews on Assessments, and the paper trail that connects field experience back into risk management.

The AI management system is the ISO/IEC 42001 programme's records, its Statement of Applicability a tab of that programme; the Art. 17 quality management system stays an obligation whose status is yours.

There is no Controls page any more: a control is a row of an ISO Statement of Applicability, and a measure your organisation runs is added there. Credit counts only verified proof.

Switch on ISO/IEC 42001, ISO/IEC 27001 or NIST AI RMF and it becomes a programme — ordered steps in gated phases, each producing a record, on one page under Standards.

Each programme runs in phases; a phase is locked until the one before it is complete — the rule the EU AI Act journey uses, applied to the standards. GDPR's duties are grouped, never gated.

Open a step, answer its questions or let Aria draft from what you already have, then the assigned approver approves. Only approval files the record as evidence and marks the step Done.

A record that answers two frameworks is one record. A step whose every part is already evidenced elsewhere reads Done · credited — with the record that did it.

Each ISO programme has its own SoA tab: every Annex A row, pre-filled from your approved records and credited EU AI Act work. An exclusion needs a justification sentence.

A programme's Clauses tab shows every clause and the step that handles it. Give your auditor a read-only seat and the records; the certificate comes from them, not from us.

The GDPR binds every system that processes personal data. Its organisation duties are a programme under Standards you switch on, free on every plan, and the same rows on Obligations.

Who must run an Art. 27 FRIA, what the assessment covers, the Art. 27(3) notification and the Art. 27(4) link to the DPIA, when to revisit it, and how Veritome generates the report per system.

Art. 27(4) lets the FRIA draw on the GDPR Art. 35 DPIA and Art. 26(9) sends the instructions for use into it — Veritome shows both routes, maps completed FRIA answers onto the DPIA's four pillars in a combined view and exports it as a PDF for your privacy team. None of it counts as coverage.

Who changed what, when — every mutation in the product writes a line. Lines are chained by hash and anchored once a day, so the trail can be verified, not just read.

Stream the whole tenant audit trail into your SIEM with the since-and-cursor endpoint, know what each entry carries, and verify the daily hash anchors so an altered entry cannot hide.

Art. 4 binds every provider and deployer since 2 February 2025 — answer the Academy's six questions, complete the programmes they assign, and keep a twelve-month record that counts as evidence.

Article 4 binds every person who works with AI, not only the technical roles. Six questions decide which programmes apply to you, the answers are filed as evidence, and the record you earn is valid for twelve months.

The classification dossier is a hash-linked chain of custody; the regulator view is the 'open the books' surface; the audit bundle is one PDF with a SHA-256 integrity manifest.

Generate audience-specific PDF reports, export the obligation matrix as CSV, build a per-system audit bundle, and schedule any template to self-generate on a cadence.

What the Annex IV technical file must contain, how Veritome composes it from the Art. 9–15 obligations in a guided editor, and how issued versions are hash-sealed and kept for ten years.

The provider's Art. 47 declaration in the Annex V field set, the Art. 48 CE marking, and registering in the EU database with Veritome's pre-filled Annex VIII copy-out sheet — nothing is submitted to any authority for you.

Add colleagues, pick from six least-privilege roles, keep the org profile that feeds your documents, and assign obligation owners so work is accountable.

The public beta is free with 30% off locked in for life; from the full launch, Classify, Starter (€79), Govern (€199) and Manage (€599), Enterprise by quote; ISO/IEC 42001 and NIST included from Govern, ISO/IEC 27001 at €199 on Govern and included in Manage; annual billing at ten months for twelve, and what happens at a limit.

Organisation → Frameworks: the EU AI Act and the GDPR, always in scope, and ISO/IEC 42001, ISO/IEC 27001 and NIST AI RMF, each a switch that adds a programme under Standards.

The Configure screen for everything set once: the organisation profile, members and roles, your AI literacy standing, billing, SSO, security, data residency, API keys, notifications and the Frameworks tab.

The statutory core. Obligations attach by your role for each system and its risk tier; most high-risk duties apply from 2 December 2027; Article 25 can make a deployer the provider.

The GDPR runs beside the EU AI Act: lawful basis, transparency, DPIA, Art. 22, processor terms, transfers per system from the data questions, plus the organisation's own duties as a programme you switch on.

The AI management-system standard as a programme from Stage 1 to Stage 2. Genuinely useful, certifiable by an accredited body — and not a presumption of conformity with the EU AI Act.

Information security, modelled as one management system with ISO/IEC 42001 where the clauses are the same. The 93 Annex A controls are worked as four guided theme records, not empty rows.

The US framework a counterparty may ask for: Govern, Map, Measure, Manage. Veritome produces the profile document from approved records; there is no certification to obtain.

Register an HMAC-signed webhook so downstream tools react the moment a system is registered, an obligation changes status, an incident is filed or evidence is verified.

Connect your identity provider over OIDC for single sign-on, and mint SCIM tokens so your IdP provisions and deactivates users automatically — both Enterprise features, configured by an Admin.

Create hashed, scoped API keys for programmatic access, generate a sealed export of all organisation data, and file a GDPR erasure request.