Compliance Wizard

The compliance wizard helps you classify a workflow under the EU AI Act and produces an audit-ready PDF assessment plus a tailored requirements checklist.

Why this exists

The EU AI Act distinguishes between AI systems by risk level. Each level has a different set of obligations. Doing this by hand for every workflow is tedious and error-prone; the wizard standardises the classification and the resulting paperwork.

Risk levels

The wizard outputs one of four risk levels:

Minimal Risk - common-use cases such as spam filters and basic recommenders. Few obligations.
Limited Risk - chatbots, content generators. Transparency obligations apply.
High Risk - systems used in recruitment, credit scoring, critical infrastructure, etc. Substantial obligations: data governance, human oversight, conformity assessment.
Prohibited - systems banned under the Act (e.g. social scoring, manipulative subliminal techniques, certain biometric uses). The wizard marks these clearly.

The classification follows a priority-based decision matrix authoritative on the platform side. The UI gives you a real-time preview as you answer questions.

How it runs

From the Compliance sidebar item, start a new assessment or open an existing one.
Walk through the question categories. Each category groups related questions; each question has options that affect the risk level.
The wizard previews the likely risk level as you go.
On submit, the platform recomputes the risk authoritatively, stores your answers, and links the applicable requirements to the assessment.
A PDF is generated and stored in the platform. You can download it from the Documents Hub under the Compliance Assessment category.

What goes into the PDF

The generated PDF contains:

The workflow being assessed (identifier, name, version).
The full question-and-answer trail.
The derived risk level.
The requirements checklist applicable to that level.
The user who completed the assessment and the timestamp.

The PDF is suitable as evidence for internal audit and for sharing with external assessors.

The requirements checklist

For risk levels with obligations (limited and above), the wizard produces a checklist. Each item is tracked through three states:

Pending - not addressed yet.
Partial - work in progress.
Done - evidence collected, control implemented.

You can update item states from the assessment page; updates are reflected in the next generated PDF.

Re-running an assessment

Workflows evolve. When you change a workflow, the previous compliance assessment may no longer reflect reality. The recommended pattern:

Open the existing assessment.
Update answers as needed.
Re-submit - a new PDF is generated, versioned alongside the previous one.

The Documents Hub keeps both versions for traceability.

Common questions

My workflow uses several models. Do I run the wizard once or multiple times? Once per workflow. The wizard captures the workflow's intended use; the choice of model is a configuration detail that does not change the legal classification of the system.
Can I export answers in machine-readable form? Yes - the assessment is also accessible through the API as a JSON document, suitable for ingestion into your GRC tooling.
How long do assessments persist? Indefinitely, unless explicitly deleted. They constitute audit evidence and should not be erased unless your retention policy explicitly requires it.

Compliance Wizard

The compliance wizard helps you classify a workflow under the EU AI Act and produces an audit-ready PDF assessment plus a tailored requirements checklist.

Why this exists

Risk levels

The wizard outputs one of four risk levels:

Minimal Risk - common-use cases such as spam filters and basic recommenders. Few obligations.
Limited Risk - chatbots, content generators. Transparency obligations apply.
High Risk - systems used in recruitment, credit scoring, critical infrastructure, etc. Substantial obligations: data governance, human oversight, conformity assessment.
Prohibited - systems banned under the Act (e.g. social scoring, manipulative subliminal techniques, certain biometric uses). The wizard marks these clearly.

The classification follows a priority-based decision matrix authoritative on the platform side. The UI gives you a real-time preview as you answer questions.

How it runs

From the Compliance sidebar item, start a new assessment or open an existing one.
Walk through the question categories. Each category groups related questions; each question has options that affect the risk level.
The wizard previews the likely risk level as you go.
On submit, the platform recomputes the risk authoritatively, stores your answers, and links the applicable requirements to the assessment.
A PDF is generated and stored in the platform. You can download it from the Documents Hub under the Compliance Assessment category.

What goes into the PDF

The generated PDF contains:

The workflow being assessed (identifier, name, version).
The full question-and-answer trail.
The derived risk level.
The requirements checklist applicable to that level.
The user who completed the assessment and the timestamp.

The PDF is suitable as evidence for internal audit and for sharing with external assessors.

The requirements checklist

For risk levels with obligations (limited and above), the wizard produces a checklist. Each item is tracked through three states:

Pending - not addressed yet.
Partial - work in progress.
Done - evidence collected, control implemented.

You can update item states from the assessment page; updates are reflected in the next generated PDF.

Re-running an assessment

Workflows evolve. When you change a workflow, the previous compliance assessment may no longer reflect reality. The recommended pattern:

Open the existing assessment.
Update answers as needed.
Re-submit - a new PDF is generated, versioned alongside the previous one.

The Documents Hub keeps both versions for traceability.

Common questions

My workflow uses several models. Do I run the wizard once or multiple times? Once per workflow. The wizard captures the workflow's intended use; the choice of model is a configuration detail that does not change the legal classification of the system.
Can I export answers in machine-readable form? Yes - the assessment is also accessible through the API as a JSON document, suitable for ingestion into your GRC tooling.
How long do assessments persist? Indefinitely, unless explicitly deleted. They constitute audit evidence and should not be erased unless your retention policy explicitly requires it.