How it works

You start by naming the AI system and describing what it does. The tool then walks you through EU AI Act risk tier classification — Unacceptable, High, Limited, or Minimal. Each field comes with a plain-language explanation of why it matters and which regulatory obligation it fulfills.

You answer 32 guided questions across six governance domains: Models, Data, Vendors, Infrastructure, Controls, and Monitoring. Every question shows you why it matters and which regulation it corresponds to — EU AI Act, GDPR, NIST AI RMF 1.0, or SBOM-for-AI minimum elements. You don't need to know the regulations; the tool surfaces the context for you.

The gap register is generated automatically from your inventory answers — no manual analysis required. Every gap includes a severity rating (Critical, Major, or Minor), the specific regulatory article or standard it maps to, a plain-language explanation of the risk if it remains unaddressed, and a precise description of what evidence would close it.

For each gap, you assign an owner (by name or role), select a remediation approach, and set a target date. This is where a list of findings becomes an action plan. The ownership data flows directly into every report — so when the board sees a gap, they also see who is responsible for closing it and by when.

With one action, you generate five stakeholder-specific HTML reports from the record you've built. Each report is written for its intended audience — the board report uses narrative and summary; the technical record includes every question and answer; the legal package focuses on GDPR and EU AI Act obligations; the CISO report covers controls and monitoring; the procurement review surfaces vendor obligations. All five download as self-contained files you can share immediately.