Getting started
How everything connects
The lifecycle turns system facts into obligations, obligations into tested controls and evidence, and evidence into an accountable decision that is monitored over time.
Register → Scope check → Classify → Governance plan → Assess and test → Evidence → Findings and risks → Corrective actions → Decision → Monitor → Reassess → Report
From facts to obligations
- AI System → Scope Check: is it an AI system within the EU AI Act?
- Scope Check → Classification: the EU AI Act risk tier (Prohibited, High risk, Limited risk or Minimal risk).
- Classification and project frameworks → Governance plan: which frameworks, workspaces and controls apply to this system.
- Framework assessment → Tasks, Controls and Risks: approving a self-assessment creates the work for its gaps.
From controls to decisions
- Control → Control Test: a failed test raises a linked Finding automatically.
- Technical Evaluation → Evidence: results submitted by your runner become evidence. A failure raises a Finding.
- Finding → Corrective action → Verification: fix the cause, then verify the fix before closing the plan.
- Assurance → Approval request → Decision: eligible approvers decide under the matching Approval Policy, and the outcome is stored in the Decision Ledger.
Continuous governance
- Decision → Monitoring: runtime signals are checked against thresholds you define.
- Threshold breach, vendor change, regulatory update or decision expiry → Reassessment: affected decisions move to Review Required.
- Governance records → Reports, Certificates and Audit Export: communicate the result with its evidence trail.
Last reviewed 2 October 2026
Next stepCompaniesYour Company is the organisation behind your account. It holds members, roles, the subscription, and every Project you run.