The All-in-One EU AI Act Compliance & Audit Toolkit

Yes. One of our core features is the Automated Document Generator (F06). By pulling data from your initial onboarding and risk assessments, Unorma pre-populates draft Technical Documentation, Risk Management Records, and Model Cards. This reduces manual drafting time by up to 80%, allowing your team to review and approve professionally formatted, audit-ready PDFs.

Absolutely. Unorma is built with role-aware logic. During setup, the platform identifies whether you are a Provider (building AI) or a Deployer (using 3rd-party AI). It then filters the dashboard to show only the articles that apply to you—such as Articles 9-17 for Providers or Article 26 for Deployers—ensuring you don't waste time on irrelevant compliance tasks.

The Audit Simulation (F08) is a "mock audit" tool designed to find weaknesses before a regulator does. It scans your Evidence Vault to check for logical contradictions or missing documentation. It provides a Readiness Score and a prioritized remediation roadmap, showing you exactly which areas of your compliance framework need more evidence to meet the high standards of a National Competent Authority.

Compliance isn't a one-time event. Our Operate (F05) and Train (F09) modules help you manage the long-term lifecycle of your AI. You can log system anomalies, manage human oversight attestations, and track staff AI literacy training. The platform sends automated alerts when periodic reviews are due, ensuring your "Audit-Ready" status is maintained year-round.

Security is our priority. The Evidence Vault (F07) acts as a centralized, encrypted repository for all your compliance materials. Every action—from file uploads to document approvals—is timestamped and logged with full version control. This creates an immutable audit trail that provides transparency and proof of "Continuous Compliance" to stakeholders and regulators alike.

The core requirements are centered on risk management and transparency. For high-risk AI systems, mandatory obligations include establishing a robust Risk Management System (Article 9), ensuring data governance and testing, and maintaining comprehensive Technical Documentation (Article 11). Additionally, operators must implement human oversight procedures and achieve specific levels of accuracy, robustness, and cybersecurity before deployment.

It depends on who develops the technology and who uses it. An AI Provider (or Builder) is an entity that develops an AI system (or has it developed) and places it on the market under its own name. A AI Deployer (or Operator) is an entity using an AI system under its authority in a professional context (e.g., a bank using 3rd-party credit scoring software). Unorma provides distinct workflows tailored to both of these specific roles.

The transition period follows a staggered timeline. Most general-purpose AI (GPAI) model rules will apply beginning August 2025. However, the vast majority of obligations for high-risk AI systems (Annex III) become mandatory and enforceable on August 2, 2026. Some requirements for AI embedded in other regulated products have an extended deadline to 2027.

The penalties are severe and designed to deter negligence. Violations of prohibited AI practices can result in administrative fines of up to €35 million or 7% of total worldwide annual turnover, whichever is higher. Non-compliance with other core requirements, such as data governance rules, can lead to fines of up to €15 million or 3% of total turnover.