Who decides what, and how

The rules read what is recorded about a system (its name, description, purpose, sector, the role you hold and the people it affects) against 9 Article 5 prohibited practices, 8 Annex III high-risk areas and 4 Article 50 transparency triggers. A prohibited practice outranks a high-risk area, and a high-risk area outranks a transparency duty. The classification names each rule that fired and the words it fired on.

When no rule fires, the system is minimal risk, and the record says what that means: an absence of evidence, not a finding of low risk. A thin description produces it as readily as a genuinely low-risk system.

The tier is a presumption. A person confirms it, or rebuts it with an Article 6(3) assessment, and the determination is recorded with who made it and when. If the facts it rested on change, it turns provisional until someone looks again.

The catalogue holds 54 obligations from the AI Act. Most name the operator roles they bind (provider, deployer, importer, distributor), and the prohibitions and a few others bind every operator. A system owes the duties of every role you hold for it, and a company that builds a system and uses it holds both.

The tier sets the scope. A minimal-risk system owes the Article 4 literacy duty. A limited-risk one adds the Article 5 prohibitions and the Article 50 transparency duties. A high-risk system owes every duty of the roles held: 44 for a provider, 20 for a deployer, 49 for both. The duties of general-purpose AI model providers (Articles 53, 54 and 40(2)) are not counted against a single system.

Two duties turn on facts only you hold, so a person answers them: whether the Article 27(1) fundamental rights impact assessment applies, and whether you are a public authority that must register its use under Article 49(3). Until someone answers, the duty stays listed: an unanswered question is not a finding that it does not apply.

Each file is fingerprinted with SHA-256 when it is uploaded and kept in the evidence vault. Its text is read in an isolated parser with size, page and time limits. A model labels what kind of document it is and copies out its clauses, and an excerpt that is not in the file word for word is dropped. Rules then map each clause to the articles it supports.

An obligation counts as evidenced when clauses from that system’s own files cite its articles. How old that evidence is shows as a freshness band beside it, and never changes the state. Which documents a system owes (the Article 27 impact assessment, the Annex IV technical file) follows from its tier, your role and the answers you recorded, so the workflow never offers a document the Act does not ask of it.

The AI policy, the risk register, decision reviews and the ISO/IEC 42001 statement of applicability are written and approved by people, and E-ARI keeps who approved what and when. For each Annex A control a person records whether it applies and how far it is implemented. E-ARI adds the records that bear on it, and a control with nothing to show is unevidenced here, which is a different fact from unimplemented.

The go-live check reads records the product already keeps: the named owner, human oversight, the classification, critical gaps, the impact assessment and technical file where they are owed, the risk register and the published policy. A person approves the move to production, and the approval goes stale when the facts it was given change. It is advisory unless you switch enforcement on.

A sealed export binds a system’s decision trail (each rule that fired, each obligation state, the engine versions that computed them) to the SHA-256 fingerprints of its evidence, and signs the bundle with Ed25519. The engines are pinned by a digest of their rule tables, so a state can be reproduced against the exact rules that produced it.

The verifier is a separate program that shares no code with the platform. It checks the signature, the canonical form and the transparency-log proofs, and Audit Replay recomputes an assessment from the sealed inputs. Neither establishes that the source evidence is true, and neither certifies compliance.

A versioned instrument of 40 questions across 8 pillars measures how an organisation reports that it works with AI. The same answers give the same score, version 5.6, and an item you cannot answer takes Don’t know or Not applicable rather than a low rating.

Two measures sit beside the score and never rewrite it. The evidence-backed score gives full weight to an answer backed by a vault record or a behavioural check and half weight to perception alone, a product choice rather than a validated constant. 9 capability checks the questions do not cover record gaps without entering the score, and multi-rater review shows where roles agree and where they do not.

A finding becomes an improvement action with an owner, evidence and a reviewed outcome. The simulated gain beside it is arithmetic on the rules, not a promise. The instruments below show the scored part in full.

Where reading and writing are the work: the rationale around a tier, the label on a document, clause excerpts, first drafts of an impact assessment or an Annex IV file, the narrative of a readiness report, the answers in the assistant and the questions of a discovery interview.

Each output is fenced in code rather than by its prompt. A citation the rules never applied is withheld, an excerpt that is not in the source word for word is dropped, and a draft stays a draft until a person reviews it. The security page names the model provider and where each processor runs.