Ask Aria: what the assistant can and can't do

Aria is Veritome's built-in assistant. It knows the EU AI Act and the frameworks you have enabled, it can read your workspace — your systems, obligations, evidence, team and Academy progress — and it can see the context of the page you are on, so you can ask plain-language questions instead of hunting through 113 articles and 13 annexes, or through your own register. The words beside its mark are the whole rule: drafts, proposes, never files.

Aria runs on Mistral, served from Mistral's EU infrastructure in Paris under a commercial agreement with no training on your data; the application and its database are hosted by Hetzner in Nuremberg, Germany. Organisation → Data, privacy & residency states the same facts for your own records.

Where you'll find Aria

• The Aria button in the top bar opens a drawer that carries the context of the screen you are on — a system, an obligation, a register — and links to the full page. When proposals are waiting, the drawer says how many and links straight to the Inbox.
• Aria's page has six tabs in one header:

• The Dashboard's Needs attention card lists what Aria prepared first, and each register — Documents, Suppliers, the Risk register, Obligations and Assessments — shows its own Prepared by Aria strip. Prepared means drafted, not applied: nothing counts until you approve it.
• On the classification Review screen, Aria drafts a reading of the answers you gave; the answers, and the classification, are yours.

What Aria is good for

• "Does Annex III cover a CV-screening tool?" — interpreting the EU AI Act.
• "What does Article 13 require me to give my deployers?" — explaining an obligation in your situation.
• "What's due this week?" or "Which of my systems are high-risk?" — answered by reading your workspace, not guessed.
• "Draft the human-oversight section for this system." — a first draft you then review and edit.
• "What applies before 2 December 2027?" — dates, with the provision cited.

Asking a question

Open the Ask tab or the launcher, type your question or pick a suggestion. To answer a question about your own workspace, Aria reads it with read-only tools: it sees only the systems and records you can see yourself, honours the What Aria may read switches, and tells you when your role does not give you access rather than quietly answering from less. To ground the answer in your own material, attach a document (PDF, DOCX, TXT, MD or CSV) — Aria reads it and answers against it. Aria replies with clickable citations; citations are always on — it names the provision it relies on or says it cannot. Rate an answer, copy it into your work, or resume an earlier conversation from the list on the Ask tab.

In a conversation Aria can also propose a task or a review on a system it has just read. The proposal lands in the Inbox marked as coming from chat, and nothing changes until a person approves it. Aria only proposes what you yourself could approve.

The monthly allowance

Each answer and each Run counts as one AI-assisted assessment against the workspace's monthly allowance; an org admin sees what has been used on Organisation → Billing & plan. A question Aria declines as out of scope does not count. Once the allowance is used up, Aria says so rather than failing quietly.

Controlling what Aria sees

Settings is grouped by whom a setting applies to. Your answers (yours, on every device): answer length, a confidence note, suggested next steps and plain language — citations are fixed on. What Aria may read (yours): obligations and due dates, your systems' classifications, team member names, evidence and document titles, Hide system names from the model, which sends generic identifiers instead of real names, and whether conversation history is kept. The Knowledge sources follow Organisation → Frameworks: binding law (the EU AI Act, GDPR) is always grounded, and each standard is grounded once you switch it on there — there is no separate list to maintain.

Autonomy: Approve each, or Auto-apply

Autonomy belongs to the organisation, not to one person: each capability Aria has carries a level, and only people who manage organisation security can change it — everyone else sees it read-only, and every change is in the audit log. Approve each means nothing applies without sign-off. Auto-apply lets low-stakes changes apply and be logged for review; the header pill reads Auto-apply · partial so nobody mistakes the posture. Some capabilities carry a floor that cannot be lowered — classification always needs sign-off, and anything on a high-risk system needs a person.

Under each capability, and on its group in the Inbox, is its approval rate: of the proposals people decided in the last 90 days, the share they approved — for example 83% approved of 24 decided in 90 days. Applying, signing off, or finishing a draft in its editor counts as approved; dismissing counts against. Changes Aria applied on its own under Auto-apply are not counted, so Auto-apply never produces its own evidence, and a proposal closed because it would only duplicate an existing record counts neither way. Until a capability has ten decisions in the window it reads Not enough decisions yet, because a percentage from a handful of decisions is not evidence. The figure covers only the proposals you can see.

The guardrail

Aria is a drafting and research aid, not a legal sign-off. Every suggestion — a proposed risk tier, a drafted record, a reprioritised due date, an agent action — is a proposal for a human to confirm. Regulator-facing actions (incident notifications, EU database registration, dossier submissions) are never automated; Aria will not even propose them. Veritome records who confirmed what, so the human decision, not Aria's suggestion, is the one in your audit trail.