Reach EU AI Act readiness by 2 August 2026
EU AI Act compliance software covering Articles 9-15 for high-risk AI systems, Article 27 fundamental rights impact assessments, the Annex IV technical file, conformity assessment routing, CE marking, EU database registration, and post-market monitoring. Cross-mapped to ISO/IEC 42001:2023, NIST AI RMF 1.0, ISO 27001:2022, and GDPR so existing evidence carries forward.
- AI inventory + Article 6 risk tier classifier across Annex I + Annex III
- Articles 9-15 + Article 27 FRIA + Annex IV technical file builder
- Article 43 conformity assessment routing + Article 49 EU database
- Cross-mapped to ISO 42001, NIST AI RMF, GDPR, ISO 27001
Trusted by chief compliance officers, AI governance leads, and DPOs at enterprises and AI vendors selling into the European Union
What is EU AI Act compliance software?
EU AI Act compliance software automates the obligations set by the Regulation (EU) 2024/1689. RiskWatch covers Article 6 risk classification across the four tiers (prohibited, high-risk, limited, minimal), Articles 9-15 for high-risk providers, Article 27 fundamental rights impact assessments for deployers, Article 11 plus Annex IV technical documentation, Article 43 conformity assessment, Article 49 EU database registration, and Article 72 post-market monitoring with Article 73 incident reporting. Cross-mapped to ISO/IEC 42001:2023, NIST AI RMF 1.0, ISO 27001:2022, and GDPR.
The Articles are the framework. The inventory is what is missing.
Compliance teams face the same four pains heading into August 2026. No AI inventory so risk classification is impossible. Annex IV technical files no agile team has the source material for. Article 9 lifecycle that never closes. And board-level penalty exposure that scales with global turnover, not deal size.
No AI inventory. Risk classification is impossible.
Over half of enterprises lack a systematic inventory of AI systems already in production. Without knowing every model, training set, and downstream deployer, you cannot assign risk tiers under Article 6, and you cannot scope the obligations that follow. The AI Inventory module captures every system, vendor model, and shadow deployment with provider + deployer roles per Article 25.
Annex IV technical documentation will not write itself.
Article 11 plus Annex IV demands design choices, data lineage, test methodologies, and post-market monitoring evidence per high-risk system. Teams shipping with agile process and minimal docs cannot retrofit it weeks before audit. The Technical File Builder pulls evidence already collected for ISO 27001 + ISO 42001 into the AI Act format.
Article 9 risk management never closes.
Article 9 requires a risk management system across the entire lifecycle: identify foreseeable risks, evaluate residual risk, treat, monitor in deployment. ISO 42001 Clause 6 + Clause 8 deliver roughly 80 percent of the technical work. RiskWatch runs the lifecycle continuously, not as a one-off project, so the Article 9 file is current the day the auditor opens it.
Penalty math wakes up the board.
Article 99 caps administrative fines at €35M or 7% of worldwide annual turnover, whichever is higher, for prohibited-practice violations. Provider + deployer obligation breaches reach €15M or 3%. False or misleading information to notified bodies reaches €7.5M or 1%. The Penalty Exposure dashboard shows board-ready euro values per high-risk system per day of non-compliance.
Regulation (EU) 2024/1689. In force 1 Aug 2024, phased through 2027.
The EU AI Act is the first comprehensive horizontal regulation of AI. It applies to providers placing AI on the EU market, deployers using AI in the Union, and a chain of importers, distributors, product manufacturers, and authorised representatives. See the consolidated text at EUR-Lex and the Commission's regulatory framework page. Application is phased: prohibitions enforce first, general-purpose AI rules next, then the bulk of high-risk obligations on 2 August 2026, with safety-component high-risk extending to 2 August 2027 and a 2026 Commission proposal moving parts of the Annex III regime to 2 December 2027.
Four tiers, four different obligation stacks. Tier sets the duty.
The EU AI Act is risk-based. Article 5 prohibits eight practices outright. Article 6 plus Annex I plus Annex III pull high-risk AI into Articles 9-15. Article 50 applies transparency to limited-risk AI. Minimal-risk AI gets no obligation beyond Article 4 AI literacy. Classification is the first decision and the most consequential.
Prohibited
Article 5Examples: Social scoring · subliminal manipulation · workplace + education emotion recognition · untargeted facial scraping · real-time biometric ID in public spaces (narrow exceptions)
Obligation: Banned. €35M / 7% turnover penalty cap.
High-risk
Articles 6-49Examples: AI as safety components in regulated products (Annex I) · Annex III use cases: biometrics, critical infrastructure, education, employment, essential services, law enforcement, migration, justice + democracy
Obligation: Full Articles 9-15 stack: risk management, data governance, technical docs, logging, transparency, human oversight, accuracy + cybersecurity. Conformity assessment + CE marking + EU database registration. Post-market monitoring + incident reporting.
Limited
Article 50Examples: Chatbots disclosing AI interaction · emotion recognition + biometric categorization with consent · deepfake + AI-generated content disclosure · synthetic media labelling
Obligation: Transparency obligations under Article 50. Inform natural persons they are interacting with AI. Mark synthetic content machine-readable.
Minimal
Article 4 + voluntaryExamples: AI spam filters · video game NPCs · inventory optimization · recommender systems below systemic risk threshold
Obligation: No mandatory rules. Voluntary codes of conduct encouraged. AI literacy obligation under Article 4 still applies for staff.
Six actor roles. Each carries a different stack.
Article 3 defines provider, deployer, importer, distributor, product manufacturer, and authorised representative. Article 25 distributes obligations across the chain. The Regulation has extra-territorial reach: non-EU entities whose AI output is used in the Union are in scope and may need to appoint an authorised representative under Article 22.
Provider
An entity that develops an AI system or has it developed and places it on the EU market or puts it into service under its own name or trademark. Carries the bulk of Articles 9-15 + conformity assessment + post-market monitoring duties.
Deployer
Any natural or legal person using an AI system under its authority, except where used in a personal non-professional activity. Owns Article 26 deployer obligations: instruction adherence, human oversight, input data, logging retention, and Article 27 FRIA where required.
Importer
An EU-established entity placing an AI system from a non-EU provider on the Union market. Verifies the provider has carried out conformity assessment, technical documentation is available, and the CE marking is affixed before import.
Distributor
Any actor in the supply chain other than provider or importer that makes the AI system available on the Union market. Verifies CE marking, conformity declaration, instructions for use, and provider + importer identification before distribution.
Authorised representative
When a provider is established outside the Union, an EU-established representative must be appointed under Article 22 to interact with national competent authorities on behalf of the provider.
Product manufacturer
Where a high-risk AI system is a safety component of a product covered by Annex I Union harmonisation legislation, the product manufacturer becomes the provider for the AI Act obligations.
Every module an AI governance program needs, in one platform.
Sixteen modules sharing the AI inventory, evidence vault, and audit trail. Built around the Article 9 lifecycle so risk classification, conformity assessment, CE marking, EU database registration, and post-market monitoring all read from the same source of truth.
Article-by-article coverage at a glance
Per-system risk tier, Article 9-15 coverage percentages, open conformity gaps, post-market monitoring health, penalty exposure totals in euros.
Every model, every deployer, every role
Capture every AI system in production, training, or vendor-supplied. Provider / deployer / importer / distributor role tagged per Article 25 obligations.
Annex III + Article 6 walkthrough
Decision tree maps each system to Prohibited / High-risk / Limited / Minimal under Article 6, Annex I, Annex III. Reclassification audit trail every release.
Lifecycle, not point-in-time
Identify foreseeable risks, estimate, evaluate, treat, monitor. Risks link to Annex IV technical documentation and FRIA, scoped to health, safety, and fundamental rights.
Training, validation, testing sets
Data quality, relevance, representativeness, completeness, bias examination. Annex IV § 2(d) datasheet auto-built from each training run.
Builder, not blank-page editor
Annex IV §§ 1-9: system description, design choices, hardware + software, validation procedures, change log, accuracy metrics, cybersecurity measures, EU declaration of conformity.
Automatic event capture
System operation logs retained per Article 12 + Article 19. Provider receives deployer logs for post-market monitoring per Article 72. Tamper-evident chain.
Instructions for deployers
Deployer-facing instructions per Article 13 § 3: intended purpose, accuracy levels, foreseeable misuse, human oversight measures, computational resources, expected lifetime.
Effectiveness + measure tracking
Article 14 measures designed into the system or implemented by the deployer. Override + stop controls + interpretability + sufficient training tracked per role.
KPIs + cybersecurity attestations
Accuracy thresholds declared, robustness against adversarial inputs, cybersecurity per Article 15 § 5. Annex IV § 2(g) auto-fills from observability data.
Article 27 fundamental rights impact assessment
Required for deployers of high-risk AI as defined in Article 27. Walks intended purpose, affected persons, risks to fundamental rights, mitigations, complaint mechanism.
Internal control + notified body track
Article 43 routes by Annex III use case. Internal control for Annex III §§ 2-8, notified body for biometrics + safety components. Conformity declaration + CE marking per Article 48.
Article 49 high-risk register
Annex VIII registration record kept current per release. Provider + product + intended-purpose + member state filings tracked.
ISO 42001 + NIST AI RMF + GDPR + ISO 27001
Article 9 ↔ ISO 42001 Cl 6 + 8 ↔ NIST AI RMF GOVERN + MAP + MEASURE + MANAGE. Score one control, satisfy four frameworks.
Article 72 plan + Article 73 incident reporting
Post-market monitoring plan per high-risk system. Serious-incident reporting timelines (Article 73): 72 hours basic, 2 days widespread, 15 days general.
Who changed risk tier, answered instantly
Timestamped log of every classification change, evidence upload, FRIA decision, conformity declaration. Admissible to notified bodies and national market surveillance authorities.
Seven Articles. One lifecycle.
Articles 9-15 carry the technical heart of the Regulation for high-risk AI providers. The Commission's AI Act Service Desk walks the obligations article by article. Each one links to Annex IV technical documentation sections, and each one operates continuously across the lifecycle rather than as a one-off project. Article 17 wraps them in a quality management system. RiskWatch ships the templated control set and pulls existing evidence from ISO 27001 + ISO 42001 so the technical file does not start blank.
Score one control. Satisfy three regimes.
Per Cloud Security Alliance + GLACIS 2026 crosswalks, a mature ISO 42001 implementation covers roughly 80 percent of the Article 9 technical burden plus significant portions of Articles 10-15. NIST AI RMF 1.0 adds an outcome-based control language preferred by US enterprises. RiskWatch maps the three so a single evidence answer satisfies all of them, with the AI Act delta (Article 27 FRIA, Article 43 conformity assessment, Article 48 CE marking, Article 49 EU database registration) layered on.
| EU AI Act | Duty | ISO/IEC 42001:2023 | NIST AI RMF 1.0 |
|---|---|---|---|
| Article 9 | Risk management system across the AI lifecycle | Clause 6 (Planning) + Clause 8 (Operation) + Annex A 6.1 AI risk assessment | MAP 1-5 · MEASURE 1-4 · MANAGE 1-4 |
| Article 10 | Data governance, training + validation + testing sets | Annex A 7.2 Data resources + 7.3 Data quality | MAP 2.3 · MEASURE 2.6 · 2.10 |
| Article 11 | Technical documentation per Annex IV | Clause 7.5 Documented information + Annex A 8.2 Documentation | GOVERN 1.5 · MAP 4.1 · MEASURE 3.2 |
| Article 12 | Automatic recording of events (logging) | Annex A 9.2 Monitoring + measurement + analysis | MEASURE 2.3 · 2.4 · 2.5 |
| Article 13 | Transparency + instructions for deployers | Annex A 8.3 Reporting concerns + 8.4 Communication | GOVERN 4.1 · MAP 3.3 · MEASURE 2.8 |
| Article 14 | Human oversight by design + by deployer | Annex A 9.3 Internal audit + Annex A 6.2 AI objectives | GOVERN 3.2 · MAP 3.5 · MANAGE 3.2 |
| Article 15 | Accuracy, robustness, cybersecurity | Annex A 8.5 Operational planning + control + ISO 27001 Annex A.8 Technological | MEASURE 2.7 · 2.9 · 2.11 |
| Article 17 | Quality management system for providers | Clause 4 Context + Clause 5 Leadership + Clause 9 Performance evaluation | GOVERN 1.1 · 1.2 · 1.3 · 1.6 |
| Article 27 | Fundamental rights impact assessment by deployers | Annex A 6.1.4 AI system impact assessment | MAP 5.1 · 5.2 · MEASURE 2.11 |
| Article 72 | Post-market monitoring system + plan | Clause 9.1 Monitoring + Clause 10.1 Continual improvement | MANAGE 4.1 · 4.2 · 4.3 |
Sources: ISO/IEC 42001:2023 Annex A control catalog, NIST AI RMF 1.0, Cloud Security Alliance research note on prEN 18286 + ISO 42001 + EU AI Act (April 2026), GLACIS crosswalk guide 2026.
Answer once. Satisfy EU AI Act + ISO 42001 + NIST AI RMF + GDPR.
Organizations placing AI on the EU market typically run four regimes in parallel: the AI Act for product obligations, ISO/IEC 42001:2023 for the management system, NIST AI RMF 1.0 for US enterprise procurement, and GDPR for personal data. RiskWatch maps the Article 9 risk assessment, Annex IV technical documentation, Article 14 human oversight, and Article 27 FRIA to their ISO 42001 + NIST AI RMF + GDPR counterparts so a single evidence set satisfies all four. Customers running the four in parallel reduce combined audit prep by 55-65 percent.
From AI inventory to Article 49 registration, in eight ordered steps.
The order matters. Inventory before classification, classification before FRIA, FRIA before the Article 9 lifecycle, lifecycle before the Annex IV technical file, technical file before conformity assessment, conformity before deployment, deployment before post-market monitoring. RiskWatch enforces the order so nothing skips ahead and nothing gets left behind.
Inventory every AI system
Models in production, in development, vendor-supplied, shadow AI. Tag provider + deployer + importer + distributor roles per Article 25.
Classify under Article 6, Annex I, Annex III
Prohibited, high-risk, limited, minimal. Document Article 6 (3) derogation reasoning where applied. Reclassify on every material change.
Run Article 27 FRIA for every high-risk deployer use case
Affected persons, fundamental rights at stake, mitigations, complaint mechanism. File with national supervisory authority where required.
Stand up the Article 9 risk management system
Identify foreseeable risks, evaluate residual risk in intended use + reasonably foreseeable misuse, treat, retest, document. Lifecycle, not project.
Build the Annex IV technical file
Annex IV §§ 1-9 per high-risk system. Pull existing ISO 27001 + ISO 42001 evidence to avoid net-new authoring.
Pass conformity assessment + affix CE marking
Article 43 chooses internal control vs notified body by use case. EU declaration of conformity per Article 47. Register the system in the EU database (Article 49).
Deploy with Article 14 human oversight + Article 13 transparency
Train deployers, embed override + stop controls, label outputs as AI where Article 50 applies, retain logs per Article 12 + Article 19.
Run Article 72 post-market monitoring + Article 73 incident reporting
Active monitoring plan, serious-incident reporting in 72 hours / 2 days / 15 days depending on severity, corrective action, Article 20 + 21 information duties.
Up to €35M or 7% of worldwide turnover, whichever is higher.
Article 99 sets three penalty tiers. Member states implement enforcement at national level under designated competent authorities, with the European AI Office coordinating consistency. SMEs and startups pay the lower of the two figures, not the higher. The penalty math is what wakes boards up: the calculation runs on global turnover, not EU revenue, so the exposure can dwarf the deal that triggered it.
Article 5 prohibitions. Social scoring, real-time remote biometric ID in public spaces, subliminal manipulation, exploitation of vulnerabilities, workplace + education emotion recognition, untargeted facial scraping. Highest fine of €35M or 7 percent of worldwide annual turnover.
Provider, deployer, importer, distributor, notified body, or Article 50 transparency breaches. Most Article 9-15 non-conformities sit here. €15M or 3 percent of worldwide annual turnover, whichever is higher. Per high-risk system, not per organization.
Supplying incorrect, incomplete, or misleading information to notified bodies or national competent authorities. €7.5M or 1 percent of worldwide annual turnover. SMEs and startups: lower of the two, per Article 99 § 6.
Source: Article 99 of Regulation (EU) 2024/1689 and AI Act Service Desk.
How RiskWatch compares to Drata, Vanta, and ModelOp
Public feature comparison drawn from each vendor's own AI governance product pages (audited 2026-05-15) plus aggregated G2 and Capterra commentary. EU AI Act software covers three different jobs: GRC-style governance (Vanta + Drata), enterprise AI governance (RiskWatch + ModelOp), and developer runtime control (ModelOp + observability tools). Many teams need more than one. The right buying decision usually starts with identifying your system of record.
| Capability | RiskWatch | Drata | Vanta | ModelOp |
|---|---|---|---|---|
| AI inventory with provider / deployer role tagging (Article 25) | Yes, native + auto-discovery via integrations + vendor questionnaires | Partial, via ISO 42001 module | Partial, via AI governance add-on | Yes, runtime + model registry focus |
| Risk tier classifier walkthrough (Article 6 + Annex I + Annex III) | Yes, decision tree with audit trail per release | Partial | Partial | Yes, model card based |
| Article 9 lifecycle risk management system | Yes, lifecycle continuous, not point-in-time | Yes, ISO 42001 mapped | Yes, ISO 42001 mapped | Yes, observability based |
| Annex IV technical file builder | Yes, §§ 1-9 templated, pulls ISO 27001 + ISO 42001 evidence | Template-assisted | Template-assisted | Partial |
| Article 27 FRIA module | Yes, dedicated, with affected-person registry | Template | Template | No |
| ISO 42001 + NIST AI RMF + EU AI Act cross-mapping | Yes, configurable, score-once-satisfy-four | Yes, 30+ framework Common Controls | Yes, AI Governance + ISO 42001 add-on | Yes, NIST AI RMF aligned |
| Conformity assessment routing (internal vs notified body) | Yes, Article 43 routing logic by Annex III use case | Manual | Manual | Manual |
| Article 72 post-market monitoring plan + Article 73 incident reporting | Yes, 72h / 2d / 15d incident escalation built in | Partial | Partial | Yes, runtime drift + bias monitoring |
| Pricing transparency | Quote per scope + framework count, no surprise renewal jumps | Quote-only, scales with org size | Quote-only, criticised for renewal jumps | Enterprise quote-only |
AI governance that does not require a separate platform
Real CCOs, AI governance leads, and DPOs running EU AI Act + ISO 42001 in parallel. Composite benchmarks from RiskWatch customers. The biggest win: existing ISO 27001 + ISO 42001 evidence carries forward, so the AI Act delta is the only net-new work.
Six ICPs running the AI Act on the same platform.
Provider, deployer, or both. AI vendor or AI buyer. Public sector or private. The Articles are universal; the actor role and risk tier set the work.
AI vendors selling to EU customers
Providers under Article 3 (3). High-risk classification on most B2B AI plus full Articles 9-15 stack plus CE marking plus EU database registration. RiskWatch is provider-mode by default.
Enterprises deploying AI in EU operations
Deployers under Article 26. FRIA per Article 27, Article 14 human oversight, log retention. Cross-mapped to ISO 27001 + GDPR + ISO 42001 already running.
Financial services + insurance
Annex III § 5(b) credit scoring + § 5(c) life + health insurance pricing fall in high-risk. Cross-mapped to DORA + ISO 27001 + EBA Guidelines on outsourcing.
Healthcare + medical-device AI
Medical devices with AI as safety components fall under Annex I via MDR + IVDR. CE marking already in place; AI Act extends the technical file and FRIA layer.
Government + public-sector AI
Annex III § 5(a) public assistance, § 6 law enforcement, § 7 migration, § 8 justice + democracy. FRIA mandatory under Article 27. Member-state notifications tracked.
Manufacturing + critical infrastructure
Annex III § 2 critical infrastructure (water, gas, electricity, traffic, ICT). Annex I safety components in regulated machinery. Cross-mapped to ISO 27001 + NIST 800-53.
Plus every framework you run with the AI Act, cross-mapped.
Score one Article 9 risk assessment. Satisfy ISO 42001, NIST AI RMF, GDPR, and ISO 27001 simultaneously.
EU AI Act Compliance Roadmap (Articles 9-15 + Article 27 FRIA)
A 38-page PDF walking the eight-step compliance roadmap, the Annex IV technical file template, the Article 27 FRIA worksheet, and the ISO 42001 + NIST AI RMF cross-mapping reference. Updated with 2026 Commission guidance.
- Articles 9-15 obligation checklist per high-risk system
- Annex IV §§ 1-9 technical file template with field-by-field guidance
- Article 27 FRIA worksheet + affected-person registry
- ISO 42001 + NIST AI RMF cross-mapping reference table
What CCOs and AI governance leads ask before they buy
About Regulation (EU) 2024/1689, the four risk tiers, Articles 9-15, Article 27 FRIA, ISO 42001 cross-mapping, conformity assessment, penalties under Article 99, and how RiskWatch covers all of them.
Build your AI inventory this week
Start a 30-day free trial. Full AI inventory, Article 6 risk classifier, Articles 9-15 control library, Article 27 FRIA builder, Annex IV technical file templates, conformity assessment routing, EU database registration, post-market monitoring, and cross-mapping to ISO 42001, NIST AI RMF, GDPR, and ISO 27001. No credit card.
No credit card required · 30-day free trial · Cancel anytime