EU AI Act Risk Scan & Readiness Platform
Your company probably already uses AI — in hiring, customer support, documents, or operations. The question is not whether the EU AI Act is real. It is what you need to check, and in what order.
7–8 questions · immediate result · no registration to start
Does this apply?
If your company uses AI at work, it is worth checking.
The EU AI Act is not only for big tech. It can matter when AI supports a process, decision, product, or employee workflow.
Employees use ChatGPT, Copilot, or Gemini
AI supports hiring, HR, or employee assessment
AI analyses documents, tickets, or customer data
AI supports marketing, customer service, scoring, or recommendations
You buy an AI-enabled tool from an external vendor
You build a product or service with an AI component
Two paths
Different questions when you use AI. Different when you offer AI to customers.
The scan separates these scenarios because obligations, evidence, and risk follow different logic.
You use AI in internal processes
Common when AI is used in HR, finance, customer support, documents, or everyday team workflows.
The key questions are visibility, data, employee rules, human review, and whether AI affects people.
You offer AI in a product or service
Common for SaaS, apps, platforms, advisory services, or customer workflows where AI is part of the offer.
Product responsibility becomes central: documentation, transparency, logging, instructions, and review paths.
How it works
From fast signal to structured readiness.
Answer about 7 questions
No legal jargon. No text fields. Usually seven short questions, sometimes eight if you use AI both internally and in a client-facing product. Takes about 2 minutes.
Receive your exposure scan
Your inputs are run against EU AI Act structure. You receive your likely scope, likely risk area, top red flags, a qualitative readiness signal, and your top next steps.
Unlock your readiness workspace
Move from preliminary signal to structured governance. Inventory your AI systems. Manage evidence, assign tasks, track remediation — with your whole team.
Who this is for
Built for four kinds of teams.
Founders & Product Leaders
You've deployed AI in your product or operations. You need to know whether that creates regulatory exposure — before your board, investors, or customers raise the question first.
DPOs & Legal Leads
You've been asked to map AI systems and document likely obligations. You need a structured, evidence-based workflow — not a spreadsheet, and not a law firm engagement for every use case.
COOs & Compliance Leads
You're responsible for making AI governance operational. That means task ownership, documented evidence, clear deadlines, and a way to report progress to the board.
Procurement & Vendor Leads
You manage third-party AI vendors. Deploying a vendor's AI system may carry its own obligations. The workspace includes structured vendor intake to help document and manage that risk.
Full workspace
From signal to structured governance.
The readiness workspace is where your team manages EU AI Act readiness as an ongoing programme — not a one-time exercise.
AI Systems Inventory
You know exactly what AI your company uses, who owns it, and what role it plays — before anyone asks. Register systems with vendor, deployment context, and preliminary risk signal.
Structured Assessment
You understand what obligations likely apply to each system. 40+ structured inputs per system, mapped to EU AI Act provisions with plain-language explanation of implications.
Action Checklist
You have a clear, prioritised list of what to do next — auto-generated from your assessment, linked to specific AI Act provisions, with owners, due dates, and status tracking.
Evidence & Documents
You know exactly what you have, where it is, and when it was last updated — when an auditor, regulator, or legal dispute requires it. Versioned, tagged, and linked to checklist items.
Remediation Tracker
Gaps become assigned tasks with owners and deadlines. Progress is visible. Nothing falls through the cracks between the assessment and the action.
Vendor Assessment
You have documented due diligence for third-party AI vendors. Structured questionnaire, stored responses, versioned — so deploying a vendor's AI system does not mean accepting unknown risk.
Annex IV Builder
You have a structured foundation for technical documentation that your legal counsel or technical team can build on — not a blank page when documentation becomes mandatory.
Exportable Reports
You can show the board, legal counsel, or an auditor where you stand — with dated, clearly-labelled summaries that reflect your actual governance work.
Audit Trail
Every action, upload, and status change is timestamped and user-attributed. You can demonstrate that governance was a real, ongoing process — not something assembled after the fact.
Civil claims risk
This is not only about regulator fines.
When AI affects candidates, employees, customers, patients, insured persons, or users, lack of transparency, review routes, or decision evidence can become a business risk.
A candidate may ask whether AI influenced a rejection.
A customer may challenge scoring, recommendations, or refusal.
An employee may expect explanation when AI supports assessment or monitoring.
First practical step: identify where AI touches people and whether a human can review the output before a decision.
Questions
Frequently asked.
Yes, it can. The important question is not only company size, but how you use AI: whether it affects people, customers, workers, business decisions, personal data, or a product you offer on the market. The scan helps you see whether your current AI use looks low, unclear, or worth organising further.
It can. Using AI for simple drafting is different from using it to assess candidates, customers, employees, health, finance, or decisions that affect people. The data you enter and the rules your company has for employee use also matter. The scan starts by separating these everyday situations.
The scan distinguishes two operationally different situations: AI used internally (by employees in HR, sales, support, finance, documents, or operations) and AI offered in a product or service to customers or users. They carry different obligations under the EU AI Act. A company can be in one scenario or both at the same time.
Often, at least partly. The vendor may be responsible for its own system, but your company still needs to understand how the tool is used, what data goes through it, who relies on the output, and whether you need rules, human review, user information, or vendor documentation.
That is itself a readiness signal. In many companies AI appears bottom-up: someone pastes data into a public tool, summarizes documents, reviews CVs, or prepares customer replies. The first step is visibility, not panic: list the tools, use cases, and types of data involved.
No. The scan is a preliminary operational analysis based on your answers. It helps you understand where exposure may exist and what to check next. It does not replace legal advice, a formal conformity assessment, or counsel review for regulatory decisions.
You receive a practical starting profile: likely path, broad exposure level, key risk signals, a short explanation of the result, and next steps. The goal is to move from "we do not know if this matters" to "we know what to check first."
Start with one real AI use case, not the whole regulation. Identify the owner, tool, vendor, input data, people affected by the output, and whether a human checks the result before a decision. If the result shows higher exposure, organise the facts and evidence before escalating to legal or compliance review.
Not always. A low result usually means the described AI use does not look strongly exposed today. You should still keep a basic AI inventory, practical rules for employees, and a clear place for AI questions. The profile can change if AI starts affecting customers, workers, personal data, or business decisions.
No. The scan is built for business users, not AI Act specialists. You answer questions about real AI use in your company: what the tool does, who uses it, what data is involved, and whether the output affects people. Operius turns those answers into a practical readiness profile.
Legal disclaimer
This platform provides automated, operational analysis of AI use cases in the context of Regulation (EU) 2024/1689 (EU AI Act). All outputs — including exposure scans, risk signals, readiness indicators, and workspace content — are informational and operational in nature. They do not constitute legal advice, legal opinions, formal conformity assessments, or declarations of conformity. All preliminary signals and readiness indicators are based solely on information provided by the user. They are indicative, not conclusive. For formal legal advice, regulatory filings, or decisions with legal or regulatory consequence, engage qualified legal counsel with EU AI Act expertise. Operius is not a law firm and does not provide regulated legal services.