Regulation (EU) 2024/1689Major rules from 2 Aug 2026

A living operating record for the AI Act.

Inventory every AI system, map its obligations to the exact articles, and assign control owners. Evidence auto-marks stale at 90 days. Close a signed monthly review and you have a record procurement, counsel, or an auditor can review.

Start free trial Run the free classifier

From €124/mo billed yearly
14-dayfree trial
Nocredit card

System brief

Review-ready

Customer Support Copilot

OpenAI · gpt-4o · Live chat triage · EU customers

82/ 100Readiness

Classification

Limited risk

Art. 50 transparency · no Annex III trigger

Obligations

3 mapped

Art. 4 + 50 · 1 open

Evidence

8 items

1 stale · last reviewed 2h ago

Next action

Sign off monthly review

Due in 6 days

Free · no signup

What likely applies to your AI system under the EU AI Act?

Run a 60-second readiness check against Articles 5, 6, and 50 and the Annex III high-risk list. The result also flags the baseline Article 4 literacy duty. Based on the public text of Regulation (EU) 2024/1689 — informational guidance, not legal advice.

The five-step check

01Describe the system
02Pick deployment areasAnnex III
03Who signs off?Art. 6(3) · 14
04Quick Art. 5 / 50 triggers
05Optional · email a copy

Maps selected sectors to the operative Annex III point and cites the article triggered.
Returns specific operational next steps — which articles are implicated, what evidence to gather, and what to escalate.
If the quick result suggests high-risk, the full /assessment walks every Article 5 / Annex I / Annex III branch.

Your result includes

Risk class
Articles triggered
Operational next steps

In your own words, what does the system do?

Who is on the receiving end, what data goes in, what comes out. Plain language is fine. Minimum 30 characters.

0 / 30+

Where is the system deployed?

Annex III

Pick every area the system operates in. The first eight map onto an operative Annex III high-risk point; the rest are common contexts outside Annex III.

Who signs off on the output?

Art. 6(3) · 14 · 50

Several AI-Act questions hinge on who acts on the output — the Art. 6(3) high-risk exceptions, Art. 14 human oversight once a system is high-risk, and Art. 50 transparency when people interact with the system directly.

Autonomous actionThe AI's output is the action. No staff member signs off before the person affected sees it.

Review before releaseA staff member checks every output and releases it. The AI prepares; the human commits.

Advisory onlyA staff member does the work and decides. The AI surfaces options, references, or suggestions.

Quick triggers — does either apply?

Art. 5 · 50

Either one alone determines the outcome. Tick whichever is true; leave both unchecked if neither applies.

Art. 5The system does one or more things Article 5 forbids outright. For example: social scoring by public authorities, untargeted scraping of facial images, real-time remote biometric ID for law enforcement in public spaces, exploiting vulnerabilities of a specific group, or inferring emotions in the workplace or classroom.Art. 50People talk to it directly, or it produces content that could be mistaken for the real thing. Chatbots, voice agents, deepfake imagery, synthetic audio or video, AI-written text aimed at the public.

Send me a copyOptional

We keep this only to email you the memo and to let you claim the result into an Attevera account. We will not sell it or add you to a newsletter. See Privacy.

5 runs per day. Guidance only — not legal advice.

The spine

One chain. Five steps. Nothing skipped.

Each step feeds the next. Evidence auto-marks stale at 90 days, monthly reviews surface on schedule, and the incident workflow tracks Article 73's severity-based reporting deadlines.

01/05

Register

Inventory every AI system with vendor, purpose, data, and deployer context.

14 systems

02/05

Classify

Decision tree across Art. 5, Art. 6, Annex III, and Art. 50. Rationale stored.

LIMITED · Art. 50

03/05

Obligations

Map the articles that apply, broken into controls with named owners.

Art. 9–15 · 14 mapped

04/05

Evidence

Capture proof, link it to the control it supports. Stale after 90 days.

22 items · 2 stale

05/05

Audit

Every classification, assignment, and sign-off. Append-only ledger.

1,247 entries

01/05

Register

Inventory every AI system with vendor, purpose, data, and deployer context.

14 systems

02/05

Classify

Decision tree across Art. 5, Art. 6, Annex III, and Art. 50. Rationale stored.

LIMITED · Art. 50

03/05

Obligations

Map the articles that apply, broken into controls with named owners.

Art. 9–15 · 14 mapped

04/05

Evidence

Capture proof, link it to the control it supports. Stale after 90 days.

22 items · 2 stale

05/05

Audit

Every classification, assignment, and sign-off. Append-only ledger.

1,247 entries

The artifact

The System Readiness Packet

One system, one packet. Classification, obligations, controls, evidence, records, and sign-off — assembled in one place, exportable in one click.

System readiness packet · Rev. 012

Customer Support Copilot

OpenAI GPT-4o · Article 50 workflow · EU live support

Stale after change

Risk tier

LIMITED

Art. 4 + 50

Obligations

3 / 4

mapped · 1 open

Evidence

items · 1 stale

Sign-off

04 APR

by R. Choi

Obligation map · Articles applied

Art. 4· AI literacyArt. 50(1)· AI interactionArt. 50(5)· Disclosure delivery+9 more

System profile

Ready

Customer Support Copilot · OpenAI GPT-4o · deployed to live support queue since Q1.

Owner: Rina ChoiScope: EU customers

§1

Risk classification

Limited · reviewed

Classified Limited risk — chatbot with transparency obligations under Art. 50.

Reviewed by legal · 12 days ago

§2

Obligation coverage

3 mapped · 1 open

Art. 50 disclosure delivery is live. Art. 4 literacy evidence still needs a current review.

Art. 4 · literacy review overdue

§3

Evidence state

8 items · 1 stale

Disclosure screenshot is current. Staff training roster exceeded the 90-day freshness window. Review or replace.

Literacy roster · 101 days old

§4

Generated documents

2 drafts · 1 placeholder

Transparency notice draft has a placeholder for the escalation contact. Fix before export.

§5

Audit trail

1,247 entries · append-only

Every classification change, assignment, and sign-off preserved with actor + timestamp.

§6

Definition

What Attevera is. What it isn't.

Four promises · four refusals

#Attevera isWe are not

§01

An AI Act specialist.

Built for Regulation (EU) 2024/1689. Art. 5 screenings, Art. 6(3) exceptions, Annex III mapping, Art. 50 transparency duties, the Art. 73 incident workflow with severity-based deadlines, and Art. 4 literacy.

Not SOC 2 with an AI bolt-on.

§02

An operating record.

Your AI systems, their obligations, controls, evidence, and sign-off state. When a system changes, the packet marks stale and the affected articles flag for re-review.

Not another document generator.

§03

A monthly rhythm, not a file.

Fresh readiness review every month. Evidence marks stale at 90 days. The incident workflow tracks Article 73's severity-based reporting deadlines once a serious incident is logged. Open work lands on the dashboard.

Not a one-shot audit export.

§04

Evidence you can prove.

Source, owner, linked control, external URL, date, stale state. Reviewed in one click. Append-only audit ledger.

Not a GRC spreadsheet.

For developers · Optional fast-start

Bootstrap a draft AI system register from your codebase.

Open Claude, Cursor, or Codex in your repo and point it at our OpenAPI spec. The agent scans for model calls and POSTs draft system entries with vendor, model, purpose, and deployer role. Your team still confirms the register, classifies risk, assigns owners, attaches evidence, and signs off. Faster setup, same operating record.

Read the API docs →OpenAPI spec

Operations: 28
Resources: 9
Auth: Bearer

agent brief → api → response

you → claude / cursor / codex

Scan src/ for model calls to OpenAI, Anthropic, Bedrock, Cohere, HF.
For each, POST /api/v1/systems with name, vendor, model,
purpose inferred from surrounding code, deployer_role=deployer.
Skip dev-only mocks and tests. Stop and ask when unclear.

agent → POST /api/v1/systems

curl https://www.attevera.com/api/v1/systems \
  -H 'Authorization: Bearer att_live_…' \
  -H 'Content-Type: application/json' \
  -d '{
    "name": "Customer Support Copilot",
    "vendor": "OpenAI",
    "model": "gpt-4o",
    "purpose": "Live chat triage · EU customers",
    "deployer_role": "deployer"
  }'

201 · response

{
  "id": "sys_01HX7Q…",
  "name": "Customer Support Copilot",
  "classification": "unclassified",
  "next_action": "Run classification"
}

AI Act timeline · major rules from 2 Aug 2026

Ready when the review starts.

Start with one system. Walk it through the spine. Come back every month to a record that auto-flags stale evidence and a packet procurement, counsel, or an auditor can review.

14 days, full product
No card · cancel any time
Import + export both directions

Start free trial See pricing