Turn EU AI Act compliance from a legal project into a guided process

The EU AI Act (Regulation 2024/1689) is the European Union's first comprehensive law regulating artificial intelligence. It classifies AI systems by risk level and sets obligations for providers and deployers, especially for high-risk AI systems used in critical infrastructure, employment, law enforcement, and other Annex III sectors. Read our full guide to EU AI Act for a detailed overview with deadlines and penalties.

Any organisation that develops, deploys, or uses AI systems affecting people in the EU. This includes providers based outside the EU if their AI system's output is used in the EU. Deployers — companies that buy and use AI systems — also have compliance obligations.

The Act entered into force in August 2024. Banned practices took effect in February 2025, GPAI rules from August 2025, and transparency obligations from August 2026. For high-risk AI systems under Annex III — covering employment, credit, education, law enforcement, and critical infrastructure — the key compliance deadline including risk management and technical documentation is now December 2, 2027 (postponed from August 2026 by the Digital Omnibus). High-risk AI embedded in regulated products is postponed to August 2, 2028.

Fines can reach up to 35 million euros or 7% of global annual turnover for banned AI practices, up to 15 million or 3% for high-risk obligations, and up to 7.5 million or 1% for incorrect information to authorities. Enforcement is handled by national regulators in each EU member state.

Use our free AI risk assessment tool to find out in 30 seconds. High-risk AI systems generally include those used in critical infrastructure, education, employment, law enforcement, migration, access to essential services, and systems that profile individuals — typically covered under Annex III. No account or credit card required.

The Act classifies AI systems into four tiers: Unacceptable risk (banned) — social scoring, real-time biometric surveillance in public, and manipulative systems are prohibited entirely. High risk (regulated) — AI used in critical infrastructure, education, employment, law enforcement, migration, and access to essential services must meet strict obligations including risk management, technical documentation, and human oversight. Limited risk (transparency) — chatbots and deepfake generators must inform users they are interacting with AI. Minimal risk (unregulated) — most AI systems like spam filters and recommendation engines are not regulated. Read our full risk-level guide.

We cannot provide legal guarantees or substitute for legal advice. Evideva generates structured documentation aligned with the requirements of Articles 9, 11, 13, 14, and 17. We recommend review by a qualified professional before submission.

Evideva generates up to 13 document types per system: Cover Page, Risk Management System (Art 9), Technical Documentation (Art 11), Logging & Record-Keeping (Art 12), Transparency & User Information (Art 13), Human Oversight (Art 14), Quality Management System (Art 17), Transparency Obligations (Art 50), EU Declaration of Conformity, and conditional reports — Prohibited Practice Risk Memo, Classification Analysis, Inconsistency Report, and GPAI Dependency Analysis — generated automatically when your system's profile triggers them.

High-risk AI systems require a Risk Management System (Article 9), Technical Documentation (Article 11), Logging & Record-Keeping (Article 12), Transparency & User Information (Article 13), Human Oversight (Article 14), a Quality Management System (Article 17), Transparency Obligations (Article 50), and an EU Declaration of Conformity. Evideva generates all of these from a single guided intake. Additional documents — such as a Prohibited Practice Risk Memo, Classification Analysis, Inconsistency Report, or GPAI Dependency Analysis — are added automatically when your system's risk profile triggers them.

Yes. All generated documents are fully editable before export. You can review and modify content directly in the application. Your changes are preserved in the version history.

You answer questions about your AI system through our guided intake wizard for AI risk assessment. All required EU AI Act compliance documents are then generated, encrypted, and stored securely. You can review, edit, and export them as professional PDFs.

You can regenerate documents anytime your system changes. Subscriptions include regulatory alert digests that notify you when updates may be needed. Each generation creates a new version while preserving the previous one in your audit log.

Yes. Paid plans include multiple team seats. Each member can access and contribute to the organization's compliance documentation. Access controls and audit logs track all changes.

Yes. The Free plan includes risk classification for one AI system and one preview document generation — no credit card required. When you're ready to generate additional documents, choose a subscription starting at €99 per month or a one-time export.

Absolutely. The one-time export option costs €129 per system and gives you full document generation with a 30-day access window. No subscription, no recurring billing, no card retained — just pay once and download. It's designed for single compliance reviews, outside audits, or consulting engagements. If you need ongoing regulatory monitoring, upgrading to a subscription provides better value.

Yes. All intake data is encrypted at the application layer using AES-256-GCM before it reaches our database. Documents are stored in encrypted storage with signed URL access. We never share your data with third parties.

Evideva supports any AI system that falls under the EU AI Act's scope, including machine learning models, natural language processing systems, computer vision, recommendation engines, decision support systems, biometric systems, and GPAI-based applications. If your system processes data to make or inform decisions about individuals, Evideva can help.

No. Evideva uses a deterministic compliance engine for all critical logic — risk classification, article applicability, document validation, cross-document consistency checks, and quality gates are all rule-based with no AI involvement. AI (Claude) is used only to draft the narrative content of each document, guided by structured prompts built from your intake answers. The compliance guarantees come from the deterministic layer, not the AI.