EU AI Act Scanner

The euaigap.co home screen: a banner reading "Hosted in EU — GDPR + Schrems II compliant. Data stays in Germany", the headline "EU AI Act Compliance, Automated", and a Start Free Scan call to action. — euaigap, running from the product’s own Docker stack. Captured 2026-10-31.

How it works

Three steps from description to documents.

01
Describe the system
Describe what it does, pick your role in the supply chain, and answer three screening questions.
- Provider, deployer, importer or distributor — the role sets the tier
- Free text, not a questionnaire: describe the system in your own words
- Re-run any answer without starting the whole assessment over
02
Get the tier and its articles
A risk tier with the articles it comes from and the reasoning attached. Rule-based, not a model guess.
- Five tiers, from prohibited down to no risk
- The articles the tier comes from, named
- The reasoning written out, so it can be challenged
03
Size the exposure, then document it
The penalty calculator prices the gap, and the documents follow from the same answers.
- Fine exposure per Article 99, from the company size, sector and risk tier
- Remediation cost next to the maximum exposure
- Technical Report, Annex V Declaration, FRIA and Post-Market Monitoring Plan

Closed beta. Early access is by list.

Tell us which AI system you are about to ship, and the role you sit in the supply chain.

Join the early-access list →

Who it is for

Built for three kinds of team.

01

Providers

You build an AI system or place it on the EU market under your name. Articles 9 to 15 and 16 are yours.

02

Deployers

You use a third-party system in a high-risk context such as hiring or credit. Article 26 applies to you.

03

Consultants

You run assessments for several client organisations and need the same method and output each time.

Capabilities

What it does.

01

5-tier risk classification

Rule-based classifier maps a system's purpose, affected populations, and data types to one of five risk categories: prohibited, unacceptable, high, limited, minimal — per Article 5 + Annex III.

02

8-area scoring

Risk management (Art. 9), data governance (Art. 10), technical docs (Art. 11), record-keeping (Art. 12), transparency (Art. 13), human oversight (Art. 14), accuracy (Art. 15(1)), robustness (Art. 15(2)).

03

4 compliance documents

Technical Report, Annex V Declaration of Conformity, Fundamental Rights Impact Assessment (Art. 27), Post-Market Monitoring Plan (Art. 72). Generated as markdown, exportable to PDF/DOCX.

04

Org role branching

Different obligations for provider, deployer, importer, distributor (Art. 16-27). The questionnaire and dashboard adapt to your role in the supply chain.

05

Jurisdictional language

Per Art. 47(2), generated documents default to the language of the organization's jurisdiction. Cross-border deployments stay compliant.

06

Audit trail

WORM-anchored record-keeping. Every assessment, every score, every version of every document is timestamped and tamper-evident.

Deadline

2 December 2026.

The hard deadline for Article 50(2) synthetic-content labeling. Article 72 (Post-Market Monitoring) follows on 2 December 2027 for Annex III systems. The Omnibus amendments through Dec 2027 are reflected in the scope.

Case study

How this product came about, and where it actually stands.

Problem. Operators of high-risk AI systems face Regulation 2024/1689 with Article 50(2) synthetic-content labeling in force from 2 Aug 2026 (no grace period for systems placed on the EU market on or after that date; a 4-month grace period ending 2 Dec 2026 applies only to systems already on the EU market before 2 Aug 2026), and 2 Dec 2027 for Annex III high-risk obligations including Article 72 Post-Market Monitoring. Most companies have no inventory of their AI systems, no per-system classification, and no audit-ready documentation.

Approach. Rule-based 5-tier risk classifier mapping purpose + affected populations + data types to Articles 5 + Annex III. Role-branched questionnaire (provider / deployer / importer / distributor) scoring 8 obligation areas. Generation of 4 document types: Technical Report, Annex V Declaration, FRIA, Post-Market Monitoring Plan. WORM-anchored audit trail.

Status as of October 2026. Production infrastructure live since 24 June 2026 on our own EU infrastructure behind Cloudflare, and in closed beta since then — join the early-access list. The free risk classifier is publicly usable at euaigap.co/classify. Jurisdictional language support per Article 47(2) wired. Notifier-body integration planned for Q1 2027.

Trust signals

Proof close to the decision.

Three signals buyers can verify before they start a conversation.

01

EU data residency by default

Product runtimes on our own infrastructure across the EU (Germany, France) and North America (Canada). See our security posture.

02

Founder-led delivery

The person you contact stays close to the work, from written scope through operation. See how we work.

03

Live since June 2026

The EU AI Act Scanner classifies a system against Articles 5 and Annex III and writes the Technical Report, Annex V Declaration, FRIA and Post-Market Monitoring Plan. The free classifier is public: run it on your own system at euaigap.co.

Questions

EU AI Act: what applies, and when.

Which parts of the EU AI Act are already in force?

Most of it. Regulation (EU) 2024/1689 became generally applicable on 2 August 2026, bringing Article 50 transparency duties, Article 49 registration and national market surveillance powers into effect. Article 5 prohibitions and the Article 4 AI-literacy duty have applied since 2 February 2025, and general-purpose AI model obligations since 2 August 2025.

Were the high-risk obligations delayed?

Yes. The Digital Omnibus on AI — Regulation (EU) 2026/1744, in force 27 July 2026 — deferred Chapter III Sections 1 to 3, which cover high-risk classification, requirements and provider obligations. Stand-alone Annex III systems now apply from 2 December 2027, and Annex I embedded systems from 2 August 2028.

What is the next deadline?

2 December 2026. Two new Article 5 prohibitions take effect, covering non-consensual intimate imagery and child sexual abuse material generation, alongside the Article 50(2) machine-readable marking duty for generative systems already placed on the market before 2 August 2026.

Does a deferral mean there is nothing to do until 2027?

No. The deferral moved the compliance date, not the work. Classification is the prerequisite for everything else, and an organisation cannot know which Annex III obligations it will owe in December 2027 without first establishing whether its systems fall into that category at all.

What does the scanner check?

It classifies a system into one of five risk tiers using Article 5 and Annex III, then scores eight areas against Articles 9 to 15: risk management, data governance, technical documentation, record-keeping, transparency, human oversight, accuracy and robustness. Four compliance documents are generated from the result.

Can I try the classifier before joining the early-access list?

Yes. The free risk classifier is publicly usable at euaigap.co/classify, and it returns a risk tier with the articles the tier comes from and the reasoning written out. The rest of the scanner is in closed beta, so early access to the 8-area scoring and the 4 compliance documents is by list.