Using Veritome

The first screen: your position under the EU AI Act, the GDPR beside it, the standards you run, what needs your attention (with what Aria prepared), recent activity and the regulatory watch.

The EU AI Act completion figure is stage-weighted — Build & document carries 45 of 100 points — with priority weighting inside each stage, GDPR counted apart, and a hard zero for prohibited systems.

Delegated acts, guidance, harmonised standards and national implementation — a change register on its own page: assess relevance, record the decision, and turn planned actions into scheduled reviews.

Add an AI system, answer the guided questions — prohibited practices, models, product law, risk, your role, personal data, what it does — and get a classification with the exact obligations that apply.

Step by step: add an AI system, answer the guided questions, check the tier and the obligations on the review, and confirm. What you need first, and what to do when it refuses.

The inventory every duty hangs off — four counts, the register filters, list or board, CSV import, two figures per system — and the seven-tab record each system opens onto.

Classification decides your risk tier and role, which decide what you must do. One question at a time, with follow-ups only where an answer calls for them — Art. 5, GPAI, Annex I, Annex III, Art. 6(3), your role, Art. 25, Art. 50 and GDPR — then a review.

Every system walks six gate-locked stages — Classify, Scope & literacy, Build & document, Conformity assessment, Register, Operate & monitor — and empty stages never block.

Step by step: open an obligation, build its supporting record, attach evidence, choose a reviewer and request review — and what the reviewer does to take it to Done.

After classification, confirm which derived obligations genuinely apply, mark the rest not applicable, put a named owner on each, and settle the Art. 4 literacy duty.

Drive obligations from the register or a system record: List, Board or Timeline; filters by source, scope, stage, status and system; the record, the guided assessment, evidence and review.

Obligation due dates, statutory milestones and incident clocks on the Obligations register; periodic reviews and programme steps beside them. The Timeline view buckets them by week, and red means one thing.

The Data domain of the Obligations register: Art. 10 training, validation and testing data practices for every high-risk system, the deployer's Art. 26(4) input-data duty, and the GDPR rows generated beside them.

The Transparency domain of the Obligations register: Article 50 duties for systems that talk to people, read emotions or generate synthetic content — and the notice studio that drafts the wording.

The Oversight domain of the Obligations register: who can intervene in each high-risk system, how the stop mechanism works, how automation bias is countered — the provider designs the measures, the deployer assigns and equips the people.

For general-purpose model providers: the Documentation domain holds the downstream model documentation, the copyright policy and the training-data summary — and the extra Art. 55 layer when a model carries systemic risk.

Step by step: connect Google Drive, SharePoint / OneDrive, GitHub or Jira read-only, bring items in, link them to obligations — and have a colleague review each one, because a connector never accepts evidence on anyone's behalf.

Every file you hold as proof, fingerprinted and sealed, linked to the obligations it satisfies; upload, generate or connect; and an expiry clock so stale evidence is flagged, not counted.

Attach fingerprinted evidence to obligations and checklist items, and generate the Annex IV, FRIA and declaration documents that each carry a public verify URL.

Connect the tools your proof already lives in over read-only OAuth, then bring items in as evidence — chosen in Google's picker for Drive, synced for the others — deduplicated, link-checked weekly, and attachable to obligations.

Step by step, with a policy as the example: open it from Documents, write each clause (Aria can draft one for you to check), approve it into the Issued archive, and download it as a PDF (or as Word, from Govern) — then reopen it for a new version without losing the old one.

Policies are the Policy kind on the Documents register — what the organisation decided once, for every system: written in your own words, approved, issued, and versioned rather than edited in place.

The register of every record the law and your standards require, with its Source and Kind, counted as instances in four buckets, per system as a matrix, and the Issued archive.

The register of every document you owe — organisation-wide ones as a list, per-system ones as a grid of type against system — with four counts that say where the work actually stands, and an issued archive that never overwrites.

The organisation-wide policies and procedures — the EU AI Act's own, an AI acceptable-use policy and three ISO/IEC 42001 procedures — as clause outlines you write into: guidance is never prefilled, approving issues a version, and an approved policy is never edited in place.

What a provider's instructions for use must contain under Art. 13(3), how the package is built and handed to deployers, how a deployer receives it, and where it feeds the deployer's own duties.

Log and score Art. 9 risks with the seven-step guided wizard, read the heat-map, see which Art. 9, Art. 27 and Art. 55 assessments each system still owes, and complete scheduled reviews that leave a dossier entry.

The register of the third parties behind your AI systems, the written agreements Art. 25(4) and GDPR Art. 28 expect, the six-question supplier assessment, and how the Art. 13 instructions for use hand off along the chain.

Veritome resolves the competent authority for the member state, tracks the Art. 73 deadline (2 / 10 / 15 days), runs four-eyes approval, and drafts the notification — you review and send.

After deployment the work continues: a monitoring plan per high-risk system, recurring reviews on Assessments, and the paper trail that connects field experience back into risk management.

Who must run an Art. 27 FRIA, what the assessment covers, the Art. 27(3) notification and the Art. 27(4) link to the DPIA, when to revisit it, and how Veritome generates the report per system.

Art. 27(4) lets the FRIA draw on the GDPR Art. 35 DPIA and Art. 26(9) sends the instructions for use into it — Veritome shows both routes, maps completed FRIA answers onto the DPIA's four pillars in a combined view and exports it as a PDF for your privacy team. None of it counts as coverage.

Who changed what, when — every mutation in the product writes a line. Lines are chained by hash and anchored once a day, so the trail can be verified, not just read.

Stream the whole tenant audit trail into your SIEM with the since-and-cursor endpoint, know what each entry carries, and verify the daily hash anchors so an altered entry cannot hide.

Step by step: answer the six questions, assign a course to colleagues with a reason and a date, follow who is current, and see how a completion — in the app or on the Academy — reaches the Art. 4 record.

Art. 4 binds every provider and deployer since 2 February 2025 — answer the six questions on AI Literacy, complete the programmes they assign, and keep a twelve-month record that counts as evidence.

Article 4 binds every person who works with AI, not only the technical roles. Six questions decide which programmes apply to you, the answers are filed as evidence, and the record you earn is valid for twelve months.

The classification dossier is a hash-linked chain of custody; the regulator view is the 'open the books' surface; the audit bundle is one PDF with a SHA-256 integrity manifest.

Generate audience-specific PDF reports, export the obligation matrix as CSV, build a per-system audit bundle, and schedule any template to self-generate on a cadence.

What the Annex IV technical file must contain, how Veritome composes it from the Art. 9–15 obligations in a guided editor, and how issued versions are hash-sealed and kept for ten years.

The provider's Art. 47 declaration in the Annex V field set, the Art. 48 CE marking, and registering in the EU database with Veritome's pre-filled Annex VIII copy-out sheet — nothing is submitted to any authority for you.

The AI management system is the ISO/IEC 42001 programme's records, its Statement of Applicability a tab of that programme; the Art. 17 quality management system stays an obligation whose status is yours.

There is no Controls page any more: a control is a row of an ISO Statement of Applicability, and a measure your organisation runs is added there. Credit counts only verified proof.

Switch on ISO/IEC 42001, ISO/IEC 27001 or NIST AI RMF and it becomes a programme — ordered steps in gated phases, each producing a record, on one page under Frameworks.

Each programme runs in phases; a phase is locked until the one before it is complete — the rule the EU AI Act journey uses, applied to the standards. GDPR's duties are grouped, never gated.

Open a step, answer its questions or let Aria draft from what you already have, then the assigned approver approves. Only approval files the record as evidence and marks the step Done.

A record that answers two frameworks is one record. A step whose every part is already evidenced elsewhere reads Done · credited — with the record that did it.

Each ISO programme has its own SoA tab: every Annex A row, pre-filled from your approved records and credited EU AI Act work. An exclusion needs a justification sentence.

A programme's Clauses tab shows every clause and the step that handles it. Give your auditor a read-only seat and the records; the certificate comes from them, not from us.

The GDPR binds every system that processes personal data. Its organisation duties are a programme under Frameworks you switch on, free on every plan, and the same rows on Obligations.

Add colleagues, pick from six roles with every access control in the role editor, keep the org profile that feeds your documents, and assign obligation owners so work is accountable.

The public beta is free, and an organisation that joins before the full launch keeps 30% off for as long as it stays subscribed; from the full launch, Classify, Starter (€79), Govern (€199) and Manage (€599), Enterprise by quote; ISO/IEC 42001 and NIST included from Govern, ISO/IEC 27001 at €199 on Govern and included in Manage; annual billing at ten months for twelve, and what happens at a limit.

When the Help Centre and Aria do not answer it, open a support request from your workspace. A person at Veritome answers in the request and by email.

Step by step: decide what each role may do, narrow a built-in role or create your own, invite colleagues, limit someone to the systems they work on, and remove a teammate.

Organisation → Frameworks: the EU AI Act and the GDPR, always in scope, and ISO/IEC 42001, ISO/IEC 27001 and NIST AI RMF, each a switch that adds a programme under Frameworks.

The Configure screen for everything set once: the organisation profile, members and roles, your AI literacy standing, billing, SSO, security, data residency, API keys, notifications and the Frameworks tab.

The statutory core. Obligations attach by your role for each system and its risk tier; most high-risk duties apply from 2 December 2027; Article 25 can make a deployer the provider.

The GDPR runs beside the EU AI Act: lawful basis, transparency, DPIA, Art. 22, processor terms, transfers per system from the data questions, plus the organisation's own duties as a programme you switch on.

The AI management-system standard as a programme from Stage 1 to Stage 2. Genuinely useful, certifiable by an accredited body — and not a presumption of conformity with the EU AI Act.

Information security, modelled as one management system with ISO/IEC 42001 where the clauses are the same. The 93 Annex A controls are worked as four guided theme records, not empty rows.

The US framework a counterparty may ask for: Govern, Map, Measure, Manage. Veritome produces the profile document from approved records; there is no certification to obtain.

Register an HMAC-signed webhook so downstream tools react the moment a system is registered, an obligation changes status, an incident is filed or evidence is verified.

Connect your identity provider over OIDC for single sign-on, and mint SCIM tokens so your IdP provisions and deactivates users automatically — both included from the Manage plan, configured by an Admin.

Create hashed, scoped API keys for programmatic access, generate a sealed export of all organisation data, and file a GDPR erasure request.