The journey, in words

Seven phases, from a first question to a validated folder.

The same order the platform follows. Every step is tied to the article of Regulation (EU) 2024/1689 that asks for it.

1. Scope

   Phase 1

   Does the AI Act apply to us at all?

   A free check on the landing page: four questions, no account. It gives an indicative answer — never a classification, and it says so. When you sign up, the answers come with you.

   • Art. 2
   • Art. 6(2)
   • Annex III

2. Inventory

   Phase 2

   What AI do we have?

   List each AI system and your role in it — provider or deployer. Then describe each one in twelve plain-language screens that follow the order the Act reasons in. Answers open or close later questions: choose hiring, and you are asked whether the system profiles people. Each system keeps a record of every answer, the route it took, and why.

   • Art. 3(1)
   • Art. 3(3)
   • Art. 3(4)

3. Classify

   Phase 3

   How risky is each one?

   Six tests, in the Act's order: is it an AI system; does the Act reach it; is it a banned practice; is it high-risk — Annex I, Annex III and the Article 6(3) exception, which never applies to a system that profiles people; must people be told it's AI; is it a general-purpose AI model you provide. A person confirms each verdict before anything is built on it.

   • Art. 3(1)
   • Art. 2
   • Art. 5
   • Art. 6
   • Art. 50
   • Arts. 51–55

4. Position

   Phase 4

   What do we already have in place?

   One question for each obligation, answered on two axes: is it written down, and is it actually done? What you tell us is recorded as declared. It counts as evidenced once proof is attached.

   • Arts. 4–73

5. Plan

   Phase 5

   What must we do, and by when?

   The obligations are laid out in the order they depend on each other, in four stages: lay the foundations; build on them; write the technical file; monitor, declare and register. Each carries its date from Article 113. Overdue duties come first, then whatever unblocks the most.

   • Art. 113
   • Annex IV

6. Execute

   Phase 6

   Do it, or bring someone in.

   Each obligation becomes controls, tasks, evidence and a decision. Drafts are written from your own answers and files: what's required, what exists today, what's planned, with every claim tied to its source. A qualified advisor can check a classification, review the folder or your contracts, or test the model. This phase never closes, because the Act makes risk management continuous.

   • Art. 9(2)
   • Art. 13(3)(d)
   • Art. 14

7. Prove

   Phase 7

   Show customers and regulators.

   Everything lands in one folder, organised as Annex IV. For an Annex III system, conformity is assessed by internal control; then come the EU declaration, the CE marking and registration in the EU database. A qualified reviewer validates the folder, and a trust profile lets you show it to anyone who asks.

   • Art. 11
   • Art. 43(2)
   • Annex VI
   • Arts. 47–49

8. After that

   Always

   Keep it true.

   Post-market monitoring gathers how the system behaves in real use, and a serious incident is reported to the market surveillance authority. When a system changes, replay its description with the new answers and compare the outcome before anything is touched.

   • Art. 72
   • Art. 73