Compliance can see which AI systems the company uses, who owns them, and what evidence is still missing.
Instead of searching contracts, spreadsheets, and department notes, compliance works from one register. Rules select the documentation scope from an approved role and risk status. A person approves the classification and final entry.
Verified demonstration scope
The demonstration contains 14 synthetic entries, 9 owners, 6 documents, and 11 named gaps. The checks confirmed that only requirements from the approved scope enter the record.
- Recorded test
- Verified demonstration scope
- What we tested
- AI system register
- Measurement data
- test data
Problem, solution, and result
Why a spreadsheet stops working
AI system information is scattered across departments, contracts, and purchasing accounts. A manually maintained register quickly loses owners, deadlines, and supporting evidence.
What the system does
The operator provides an approved organizational role and risk status. Rules select the applicable scope from six supported articles. The system drafts a rationale and gap list, then the process owner approves the entry.
What we tested
The demonstration contains 14 synthetic entries, 9 owners, 6 documents, and 11 named gaps. The checks confirmed that only requirements from the approved scope enter the record.
For whom
This fits an organization where departments buy AI tools independently, inventory is assembled through interviews, and compliance evidence is collected only when a review approaches.
AI system → requirements → evidence → approval
- 01Rules select the scope before the model runs
- 02Every gap has an owner and due date
- 03A person approves the risk classification
- Best for
- Organizations buying or building multiple AI systems
- Input data
- The approved operator role, the risk status, and the system's source material
- Human decision
- The process owner approves risk status, classification, and the final register entry
- Cost
- USD 0.087602 for the recorded control run.
- Security
- Only requirements from the approved scope enter the register. A person approves the risk classification.
- Test duration
- We measure entry preparation time in a pilot using the client’s documents and approval path.
- Audit trail
- The history shows sources, identified gaps, owner decisions, and the approved entry.
- Similar system build
- from €6,000 net (approx. $6,500) · 4–10 weeks
Reference exchange rates: USD 1 = PLN 3.72; EUR 1 = PLN 4.30. PLN amounts are rounded, with the measurement currency retained in parentheses.
Compliance decisions
What a person approves
The system covers Articles 12, 13, 14, 17, 26, and 72. It prepares working material and identifies gaps. Legal advice, case-specific analysis, and risk classification remain with accountable people in the organization.
- Cost
- USD 0.087602 for the recorded control run.
- Security
- Only requirements from the approved scope enter the register. A person approves the risk classification.
A failed run stays in the record
A later attempt failed inside the SDK before producing a result, and the failure remained visible in the history. Production monitoring must cover SDK availability and refresh the legal dataset after changes to laws or guidance.
Estimated impact
Calculate the impact at your volume
This estimate uses the stated volume. Enter your own numbers to assess the possible impact in your company. The result is confirmed only during a pilot.
Today
240 h
With the system
96 h
Time or cost saved
105-175 h/quarter, base 144 h
- Volume
- 24 systems/quarter
- Formula
- 24 x 6 h
- Calculation status
- low-medium
Data in the screenshots. The names, amounts, and documents shown in the screenshots are synthetic. Client data remains private. Measurements describe the demonstrator and are kept separate from production outcomes.
Working views
The process owner approves classification. The register tracks owners, evidence, deadlines, and gaps.
The register owner sees systems, requirements, evidence, deadlines, and accountable people in one place. Unowned items form a separate queue for compliance, IT, and business teams. Rationale quality and throughput still need testing on the client's full inventory.
Inventory, obligations, and working rationales.
System inventory
AI systems with role, risk status, and accountable owner.
Obligation list
Each requirement links to evidence, an owner, and a deadline.
Working rationales
Draft material limited to the approved set of articles.
System screens
See how the system works in practice
These desktop and mobile screenshots come from the running application. They show the process and the points where a person makes the decision.
- Screens
- 11
- px
- 1440 · 390
- 021440×2015
Article 14 record with document, deadline, and owner. - 031440×1100
Mobile inventory view.
Open the remaining screen archive (8)
- 041440×1100
A system card - 051440×1100
Documentation gaps - 061440×1100
Local gap-assignment preview - 071440×1100
Evidence documents - 081440×1100
Questionnaires - 091440×1100
Local questionnaire draft in the queue - 101440×1100
Scope checks - 111440×1100
Register settings
Technology stack
The guarantees a compliance register needs stand in types, schema, and the database; the model gets the narrow role of drafting reasoning.
This process needs guarantees a prompt cannot give, so the guarantees stand in code: a deterministic scope gate, a domain type, an output schema, and a PostgreSQL relation. We use the Claude Agent SDK narrowly, through a native call with a turn limit and no system tools, because the model's only job is a working draft. An audit therefore reads the rules in code and in the trace, and maintenance is that of an ordinary application with a database.
- Claude Agent SDK
- a native call with a turn limit and schema-forced JSON output, no system tools
- FastAPI + Pydantic
- the typed record model and the pre-storage check of output against the selected scope
- PostgreSQL 17
- the closed six-article vocabulary in a relation, plus versions, decisions, and audit
- Next.js
- the documentation canvas and the read-only reference view
The client owns the code, prompts, evaluation data, and documentation. The runtime is three services: postgres, api, and web; web is the only host port, the API and database run on an internal network, and the reference view reads a frozen set and writes nothing.
Technical details and measurements
How the system works
Rules set the scope. The model drafts the rationale.
The process starts from an approved role and risk decision. It then selects the applicable articles, drafts the material, and validates it before saving. The process owner makes the final decision.
Approved role and risk status
Rules select the supported articles
The system drafts a rationale and gap list
Out-of-scope entries are rejected
The owner approves classification and documentation
System architecture
A policy gate, a narrow agent, a pre-storage check, a trace.
Deterministic scope selection before the model, the Claude Agent SDK in a narrow role, an application check before storage, and a closed six-article vocabulary in the schema and database.
- 01
Gate
Code picks the article scope.
The operator role and the risk status lead through a deterministic policy gate to the closed article set. The model takes no part in that choice.
- 02
SDK
An agent with a turn limit and an output schema.
The Claude Agent SDK runs through a native query call with output_format as a JSON Schema and no system tools. A result outside the schema does not exist.
- 03
Rejection
The check guards the scope before storage.
The application checks the output for exact agreement with the scope selected by role and risk status. The domain type, the schema, and the PostgreSQL relation restrict the record to the product's six articles.
- 04
Ownership
The inventory and the decisions have owners.
Evidence, gaps, and closure decisions belong to people. The operating API route records runs, steps, decisions, and tool calls; the recorded sanity check calls the workflow directly, so it confirms the model contract while the route's trace remains a separate record.
Why there is no more machinery here
Everything that must be certain lives in code: the scope gate, domain type, output schema and database relation. The model reasons within a supplied set and receives no tools, memory or loop. Each rule is visible in the code and documented test run.
- The scope gate runs before the model, deterministically
- The model's result exists only inside the schema
- An out-of-set article is rejected by type, schema, and database
- The process owner approves risk classification
Want to assess a similar process in your company?
- A 30-minute call with the engineer who would lead the work.
- A review of the processes that cost you the most time and money.
- A written summary of what to automate first and the likely cost range.
Times are shown in your own time zone. We work with clients across time zones.
The scan is free and creates no obligation. If automation is unlikely to pay off, the written recommendation will say so.