EU AI Act readiness, one AI system at a time.
Start with a free self-assessment and a four-page report for your board. Then build a conformity dossier for each AI system from the architecture, controls and findings your teams already keep in Aribot, with evidence that a reviewer has accepted.
The Act asks for evidence per AI system
The EU AI Act, Regulation (EU) 2024/1689, sets rules by what an AI system is used for and who is responsible for it. A chatbot on a website, a model that screens job applicants and a large language model offered to other companies each sit in a different place, with different duties for the company that built them and for the company that uses them.
For most organisations the hard part comes before any control is written. Nobody has a full list of the AI in use. Teams describe the same system in different words. The evidence for one obligation sits in a wiki, another in a ticket, a third in the head of an engineer who has since moved teams. When a board member asks how ready the company is, the answer is a spreadsheet that was correct last quarter.
Ayurak approaches this from the systems themselves. Aribot already holds the architecture, the threat model and the security findings for the systems your teams build. EU AI Act readiness reads that same material and lays it out against the obligations, one AI system at a time, with the evidence and its review status next to each line.
Who uses it
You have to say which AI systems fall under the Act, in which role, and what evidence exists for each obligation.
A dossier per AI system with every obligation, its mapped controls and the evidence on file, plus a technical file you can export and hand to counsel or a notified body for review.
Article 15 and the logging duties land on security. So do the AI-specific threats in each system.
The same threat model and findings your team already works from, shown against the obligations they affect, so closing a finding moves the readiness score.
Teams want to ship models and assistants, and each new use can change the risk tier.
A four-question screen for each new system before it is built, and a clear list of what a high-risk tier will require from the team.
Record-keeping, human oversight and resilience have to be designed into the systems you run.
Obligations tied to the components and cloud resources in each architecture, from company down to a single resource, so each requirement has an owner in engineering.
Provider, deployer and the other roles
Your obligations depend on your role for each system. One company is often a provider for the models it builds and a deployer for the AI services it buys. The definitions below follow Article 3 of the regulation, in plain words.
Settle the role for each system first, and agree it with counsel. A deployer can use the dossier to check what the provider has supplied and what it must add itself. A provider uses it to build the evidence the Act expects before the system goes into service.
Risk tiers, as the regulation sets them
The Act sorts AI by the harm its use could cause. The tier decides the work, so it is the first thing to settle for every system. The classifier in Aribot asks the same four screening questions for each one, and a classification you disagree with is a prompt to talk to counsel before you build on it.
- Prohibited practicesArticle 5
Practices the Act bans outright, such as harmful manipulation, social scoring, and untargeted scraping of facial images to build recognition databases. There is nothing to comply with here except stopping.
- High-risk systemsArticle 6, Annexes I and III
AI that is a safety component of a regulated product (Annex I), or is used for a purpose listed in Annex III, such as recruitment, access to education, creditworthiness assessment of individuals, or access to essential services. Articles 9 to 15 apply, with conformity assessment and registration. Article 6(3) lets a provider document why a listed use does not pose a significant risk.
- Transparency obligationsArticle 50
Systems that interact with people must tell them they are dealing with AI, and generated or manipulated content must be marked. These duties can sit on top of a high-risk classification.
- General-purpose AI modelsChapter V
Obligations on the providers of general-purpose models, including technical documentation and a summary of training content, with further duties for models with systemic risk.
- Minimal riskNo specific obligations
Most AI falls here. The AI literacy duty in Article 4 still applies to the organisation, and voluntary codes of conduct are encouraged.
Dates to plan around
The Act applies in stages. The early dates below are fixed in the published regulation. Check the later ones against the current consolidated text, since the application dates for some obligations have been amended.
- 1 August 2024The regulation enters into force.
- 2 February 2025Prohibited practices (Article 5) and the AI literacy duty (Article 4) apply.
- 2 August 2025Obligations for providers of general-purpose AI models apply, with the governance and penalty provisions.
- Later datesTransparency duties, Annex III high-risk obligations and Annex I embedded systems follow on later dates. Some of these were moved by amendments to the Act, so Aribot holds each date as a record with its legal citation and updates it when the law changes.
The milestone runway in Aribot shows each date with its citation and the days left. A date that has passed is marked in effect, one that is close is marked imminent, and the high-risk milestone links straight to the obligations it brings into force.
From a first answer to a full dossier
Readiness builds in four stages, and you can stop at any of them. Each stage reuses the work of the one before, so nothing is answered twice.
1. The free AI readiness self-assessment
Sign up with your work email and your email domain becomes your company space. Choose the EU AI Act template and how to answer. Yes or No with evidence is fastest and ready for an audit: a Yes needs a document or link, and a No asks what is missing, which becomes a gap. The 1 to 5 maturity scale shows how far along each practice is, with each level defined so two people rate the same practice the same way.
2. The four-page report
When you submit, the report is ready: your score, the gaps that matter most, and a 90-day plan, written for an executive reader. Unanswered questions count as gaps.
3. The conformity dossier in Aribot
The report covers the organisation. The dossier covers each AI system. Aribot compiles it from the system's architecture, the controls mapped to it and its open findings. You can read readiness at any level, from the company down to an asset, an environment, a component and a single cloud resource, and a resource inherits the readiness of the environment it runs in.
4. The detailed assessment on Ayurak Trust
When readiness has to be shown to someone outside, Ayurak Trust runs a detailed, evidence-backed assessment with Ayurak's team. Trust templates are built from the official text of each framework, and its crosswalks let one answer count towards several frameworks. Trust has no public sign-up: existing customers sign in, and new ones book a call to start.
The dossier, obligation by obligation
Each obligation in the dossier shows how many of its controls have evidence. Filters narrow the view to gaps only, satisfied obligations, the Annex III requirements in Articles 9 to 15, or the Article 50 transparency duties. Every gap carries the same next step: map a control, or attach evidence to one.
Where the system's threat model has AI-specific findings, such as data leaving through an AI tool, prompt injection, poisoned training data or an agent using more access than its task needs, they appear in the dossier with a plain description of the business risk. Closing the finding in the threat model is reflected here.
If an article has no mapped control yet, the dossier lists it as not assessed and leaves it out of the coverage figure. A missing mapping is never presented as a pass.
Evidence that someone has checked
The control inspector lists what each control requires, which pieces of evidence are mandatory and how recent they must be. The system owner uploads a document, an image, a log export or a spreadsheet against a named requirement, with a note for the reviewer.
The upload is recorded under the uploader's name and waits for review. A colleague with the right to update the compliance register accepts or rejects it. Only an accepted file satisfies the control, so the score moves when evidence has been looked at, and a rejected file leaves the gap open with its reason.
The full dossier can be exported as CSV or downloaded as data, and the Annex IV technical file draft can be exported as Markdown for counsel to edit.
What you see in Aribot
Pick a modelled system and see the obligations assessed, controls in scope, controls satisfied with evidence, open gaps and the readiness deadline for its tier.
Four screening questions covering prohibited practices, Annex III uses, Article 50 transparency and general-purpose models, with the resulting tier and its first next steps.
For each control: what it asks for, which evidence is mandatory, how fresh it must be, the files uploaded against it and whether a reviewer has accepted them.
A working draft of the technical documentation, built from the dossier, which you can preview and export as a Markdown file for your own editing.
Each statutory date with its citation and a countdown, marked as upcoming, imminent or in effect, so planning conversations start from the same dates.
An Article 72 post-market monitoring report you can generate and download, so monitoring after release has a record of its own.
A worked example: Tarnwick Lending
Tarnwick Lending is a fictional company, and every number below is illustrative. It shows the order in which a mid-sized lender might use the self-assessment, Aribot and Trust over one quarter and the next.
- Week 1: the free self-assessment
Tarnwick Lending, an invented consumer lender with about 600 staff, wants a first view before its board meeting. The head of compliance signs up for the free AI readiness self-assessment with her work email, picks the EU AI Act template, chooses Yes or No with evidence, and gives the data and security sections to two colleagues. Two days later they submit. The four-page report gives Tarnwick a score and a short list of priority gaps, among them no documented human oversight for the credit model and no AI system register. It ends with a 90-day plan the board can discuss.
- Week 2: an honest inventory
The register gap is the first to close. The platform team connects Tarnwick's repositories to Aribot, and shadow AI discovery finds five AI uses: the in-house credit pre-check model, a fraud scoring model, a customer chat assistant bought from a vendor, a document summariser used by underwriters, and an embeddings service nobody had listed. Each one gets an owner.
- Week 3: tiers and roles
Each system goes through the risk tier classifier. The credit pre-check model is high-risk under Annex III, and Tarnwick is its provider because it built the model and uses it under its own name. Fraud detection is carved out of the Annex III credit entry, so the fraud model is not high-risk on that basis. The chat assistant brings Article 50 transparency duties, and Tarnwick is its deployer. Counsel reviews the tiers and agrees them before anything is built on top.
- Weeks 4 to 8: the dossier fills
The credit model's architecture is already modelled in Aribot for threat modelling. Its dossier opens with seven obligations from Article 9 to Article 15, the controls mapped to each and the evidence on file. Five obligations have accepted evidence. Two show gaps: information for deployers and human oversight. The underwriting lead writes the oversight procedure, uploads it against the control, and the head of model risk accepts it. The count moves from five of seven to six of seven.
- Week 9: the technical file and the board
Tarnwick exports the Annex IV technical file draft, and its counsel edits it into the version the company will keep. The board sees the dossier status, the one remaining gap with its owner and date, and the next statutory milestone from the runway.
- Quarter 2: the detailed assessment
A large partner bank asks Tarnwick for assurance on its AI controls. Tarnwick books a detailed assessment on Ayurak Trust. Answers come from the work already done, evidence is attached, Ayurak's team reviews it with them, and the partner receives a report that is marked for that recipient.
How it connects to the rest of Ayurak
Standards it maps to
Ayurak Trust publishes 73 frameworks, seven of them for AI, with assessment templates by Aristiun written from the official text. The EU AI Act work in Aribot lines up with these.
- EU AI Act
- Obligations for high-risk systems in Articles 9 to 15, transparency in Article 50, the technical documentation in Annex IV and post-market monitoring in Article 72, each shown with the controls and evidence that support it.
- ISO/IEC 42001
- An AI management system needs an inventory, defined roles, risk treatment, monitoring and retained records. Much of the dossier work doubles as evidence for it, and Trust can assess against it directly.
- NIST AI RMF
- Inventory and risk tiering support Map, findings and monitoring support Measure, gap closure supports Manage, and named owners and review support Govern.
- ISO 27001 and SOC 2
- Article 15 cybersecurity and the logging duties overlap with controls you may already run for these. Mapped controls can carry evidence for more than one framework.
- OWASP
- AI-specific threats such as prompt injection, data leakage and excessive agency appear as findings in each system's threat model, and those findings feed the Article 15 picture.
About this page
This page describes the EU AI Act at the level of its published text, to explain what the product helps with. It is general information and is no substitute for legal advice. The self-assessment, the dossier and the Trust assessment help you organise systems, controls and evidence. Deciding if your organisation meets its obligations is a judgement for you and your legal counsel. Always check dates and obligations against the current consolidated text of the regulation.
Questions people ask
- Is this legal advice?
- No. Ayurak helps you organise systems, controls and evidence against the published text of the Act. Decisions about your role, your risk tier and your obligations should be confirmed with qualified legal counsel.
- Do I need an Aribot account to take the self-assessment?
- You sign up with your work email and confirm a six-digit code. The self-assessment is free, needs no card, and no licence for Aribot or Trust.
- How long does the self-assessment take?
- Between about 20 minutes and an hour and a half, depending on the framework and how you answer. Answers save as you go, and you can split sections across colleagues from your company.
- What is in the four-page report?
- Your score, the gaps that matter most in priority order, and a plan for the next 90 days. Every gap links back to the clause it comes from. It is written for an executive reader and comes as a PDF.
- Who can see our answers?
- Only signed-in people from your email domain, and Ayurak administrators for support.
- What if a system has no architecture model in Aribot?
- The dossier is built per modelled system. If a system is missing, the selector says so; model it in Aribot, or import its diagram, and its dossier appears. Shadow AI discovery helps you find systems that were never listed.
- Why does an uploaded file not count straight away?
- Evidence counts once a reviewer accepts it. Uploads are recorded under the uploader's name and wait for review, so the score reflects evidence someone has checked.
- What happens to obligations with no mapped control?
- They are listed as not assessed and left out of the readiness percentage, so a missing mapping never shows as compliance.
- We are only a deployer. Is this still useful?
- Yes. Deployers of high-risk systems have their own duties, including human oversight, monitoring, log retention and in some cases a fundamental rights impact assessment. Transparency duties for chat assistants also fall on deployers.
- When do we need Ayurak Trust?
- When someone outside the team needs assurance: a board, a customer, a partner or an auditor. Trust runs a detailed, evidence-backed assessment with Ayurak's team and produces a report each recipient receives in their own marked copy.
Demos and related pages
The overview of governing AI in Aribot.
Find the AI nobody registered, the start of every inventory.
Give each AI agent only the authority its task needs.
A tamper-evident record of AI actions, and what they cost.
From a finding to a fix, with proof in the record.
Detailed, evidence-backed framework assessments with Ayurak's team.
The EU AI Act self-assessment, with a four-page executive report.
Start with the free self-assessment. Go deeper with evidence.
- Step 1, free
Answer the AI readiness self-assessment online. You get a view of where you stand against the EU AI Act, the NIST AI RMF and related frameworks, in minutes.
- Step 2, with Ayurak's team
A detailed, evidence-backed assessment on Ayurak Trust: each answer supported by evidence, reviewed with our team, and reported in a form you can hand to a board or an auditor.
Pick your starting point
Most teams begin with the free self-assessment, then build a dossier for each AI system in Aribot. Existing Ayurak Trust customers can continue straight to a detailed assessment.
