An EU AI Act scanner, before the 2 Dec 2027 obligations land.
An Annex III high-risk system has to be classified against duties that apply from 2 Dec 2027. The scanner does that today, in closed beta. The same founder-led studio has three more products in development and one open-source project with 320 stars and 120 forks.
Four anchors. Every product and every contract is tested against them.
01
Real products, not decks.
Every status on this site is one you can check: a public URL, a public repository, or a plain “in development”.
euaigap.co has been open to the public since June 2026
OpenStore is MIT-licensed, and the repository is public to clone
A product is marked “in development” until it is not
02
EU-first data residency.
Product runtimes on our own infrastructure — EU (Germany, France) for EU products, North America (Canada) for the North-America ones. Brevo for transactional email. Full posture on the security page.
Every subprocessor is named in public, with its processing location
TLS in transit, and every backup encrypted at rest
The hosting region is stated per product, not per marketing line
03
Stack you own.
Well-understood, widely used technology. No vendor lock-in. Our customers can migrate off without rewriting.
One codebase serves all four products, so no client forks it
A customer can migrate off without a rewrite
The open-source sibling runs on your own machine, not ours
04
AI scoped to measurable hours.
We add LLM calls where they save a documented hour, not for show. Every AI feature has a measurable ROI.
Every AI feature carries a documented hours-saved figure
Evaluation and cost limits are set before the build, not after
No LLM call anywhere that does not earn its place
What you get
What is in the box.
Every engagement ends in things you can point at, not a slide about them.
A written scope
Success criteria, a fixed first milestone and an explicit out-of-scope list, signed off before any code ships.
Code you own
Well-understood technology, no vendor lock-in. You can migrate off without a rewrite.
A production slice in four weeks
One deployed feature path with auth, one core flow and one durable surface, end to end.
CI/CD from day one
Wired on day one, not bolted on at the end.
Monitoring and a dashboard
Uptime monitoring and host metrics. We hand off the operational dashboard, not just the code.
Encrypted backups
Daily encrypted backups with a monthly restore drill.
EU data residency
Product runtimes in the EU (Germany, France) by default; every subprocessor named in public.
A weekly demo, a monthly report
A 30-minute call to demo what shipped, and one operational report: uptime, errors, cost.
Services
What we do, and who it is for.
Four ways to work with us. Each one names the buyer it is built for.
A production-ready first slice in four weeks: auth, one core flow, deployment, monitoring and backups wired from day one.
Who buys it Teams that need one core flow in production first.
Auth, deployment, monitoring and backups wired from day one
Pricing written into the scope before kickoff
Not sure which of the four to start with? What to automate first is the checklist we run before scoping anything.
Planning for the EU AI Act? What applies to you is the checklist we run before scoping compliance work.
Flagship products
Two you can check today.
One has a public site, one has a public repository. The three below have neither yet, and say so.
EU AI Act Scanner
Closed beta · euaigap.co
For teams shipping an Annex III system.
Automated compliance assessment for the EU AI Act (Reg 2024/1689). Five-tier risk classification, gap analysis against Articles 9-15, four compliance documents generated.
5-tier classification (prohibited → minimal)
8-area scoring (risk mgmt, data gov, technical docs, record-keeping, transparency, human oversight, accuracy, robustness)
4 doc types: Technical Report, Annex V Declaration, FRIA, Post-Market Monitoring Plan
Org role branching: provider, deployer, importer, distributor
Product runtimes sit on our own EU infrastructure, not a shared platform.
TLS in transit, and every backup encrypted at rest
Every subprocessor listed publicly
Founder-led, no agency layer.
One operator runs the whole studio, and runs the products it ships.
One product in closed beta, three in development
One public open-source project
Engagements use the same stack as the products
Open by default, and priced before kickoff.
The posture and the price are both public before you sign anything.
Track record, security posture and subprocessor list are public
Pricing is written into the scope and does not move once signed
Six steps, every engagement, and the process is published too
Questions
Before you ask.
What does NestLab actually do?
NestLab is a founder-led AI studio, operating from Poland (EU) since January 2025. It builds and runs its own products — four flagship SaaS products plus one public open-source project — and takes on a limited number of client engagements using the same stack. Everything shipped here is also operated in production.
How does an engagement work?
Fixed scope and fixed price, written down before kickoff. The first milestone is scoped and priced before work begins, and the figure does not move once signed. Six steps, in order, every time.
Where does the data live?
Product runtimes run on dedicated infrastructure in the EU (Germany and France) and North America (Canada), with TLS in transit and backups encrypted at rest. This marketing site itself runs on Cloudflare Workers, a global anycast edge. Every subprocessor is listed publicly.
What technology do you build on?
Deliberately boring, well-understood technology, chosen so a system stays operable and portable years after launch. The specific components are shared with clients under the engagement, not published here. No vendor lock-in: your stack stays yours.
Who writes the code?
The person you email. No juniors, no handoffs. The work is done on boring, well-understood technology with no vendor lock-in, so the result stays maintainable by someone other than us.
What happens after launch?
You get the operational dashboard, not just the repository: uptime monitoring, daily encrypted backups with a monthly restore drill, and host metrics. Then weekly-to-monthly tune cycles against the metrics that matter to the business.
Start with a free 30-minute call.
We take on a limited number of contracts each year. Bring a process that is done by hand today, or a project you want to start — in half an hour we work out what it would take, and you leave with a written next step, whether that next step is with us or not.
The process What is done by hand today, and by whom.
The metric The one number that will say it worked.
