Your EU AI Act compliance file, from inventory to EU declaration of conformity

AiTacora registers your AI systems, classifies them by risk level and generates only the requirements that apply to you.

AiTacora executive dashboard: registered systems, high-risk systems, open incidents, overall compliance score and inventory distribution by risk category, with an overdue Art. 73 deadline alert

The problem

AI Act compliance on spreadsheets does not scale

What counts as high-risk?

Art. 5, Art. 6, Annexes I and III, exceptions… classification is the first bottleneck.

Scattered information

Inventories in Excel, evidence in folders and unversioned policies in emails.

Unforgiving deadlines

A serious incident must be reported within 2, 10 or 15 days depending on its severity (Art. 73).

The clock is already ticking

  1. Prohibited practices (Art. 5) and AI literacy (Art. 4)

  2. GPAI obligations (Arts. 51-55), governance and penalties

  3. Transparency (Art. 50)

  4. Annex III high-risk systems

  5. High-risk AI in regulated products (Annex I)

The solution

Everything the AI Act asks for, in one compliance file

Modules built article by article on the text of the Regulation.

Risk classification wizard

Dynamic checklist and evidence

Serious incidents with countdown

Operation and monitoring

Governance and quality management system

Reports ready to submit

AiTacora risk classification wizard at the Article 5 prohibited practices step, showing the provisional classification
The wizard walks through the Annex III use cases and generates the requirements that apply.

How it works

From unclassified system to complete compliance file in four steps

  1. Register your AI systems

    Add each system with its intended purpose, your role (provider or deployer) and its lifecycle stage.

  2. Classify them with the wizard

    Answer the guided questions and get the risk level: prohibited, high, limited, minimal or GPAI.

  3. Complete requirements and evidence

    Work through the generated checklist, attach evidence, manage risks and approve policies with your team.

  4. Export and keep it up to date

    Download the compliance report, the EU declaration of conformity and Annex VIII, and track incidents, deadlines and versions.

Who it is for

Designed for every role defined by the Regulation

Providers of high-risk AI systems

Companies using AI (deployers)

Providers of GPAI models

Compliance, DPOs and auditors

Security and trust

Built by security specialists

Your compliance file contains sensitive information. AiTacora protects it by design.

  • Immutable audit log
  • Isolation between organisations
  • MFA and SSO
  • Roles and permissions
  • Access protection
  • Transparent support

Frequently asked questions

What people usually ask us

Does the EU AI Act apply to me?

It applies to anyone who develops, places on the market or uses AI systems in the EU, including companies outside the EU whose AI output is used here. The AiTacora wizard starts with the scope (Art. 2) precisely to rule out what falls outside it.

When do I need to comply?

It depends on the obligation. The prohibitions and AI literacy have applied since February 2025, the GPAI obligations since August 2025 and the transparency obligations since August 2026. Following the Digital Omnibus, the Annex III high-risk rules apply from 2 December 2027 and the Annex I rules from 2 August 2028.

Does AiTacora certify my systems?

No. AiTacora organises and generates the documentation needed for the conformity assessment (Art. 43), the EU declaration of conformity (Art. 47) and registration in the EU database (Art. 49). It does not replace a notified body where one is required, nor legal advice.

We only use third-party AI. Is it for us?

Yes. The wizard distinguishes between provider and deployer, and only generates the obligations for your role. For example, the quality management system (Arts. 17-21) only appears if you are the provider of a high-risk AI system.

Where is my data stored?

Hosting provider, region and encryption at rest. Each organisation is isolated from the others, and the relationship is formalised in a data processing agreement (DPA).

How do we get started?

Request a demo. Once the contract and DPA are signed, Wildebit sets up your organisation and your administrator. From there, your team invites its users, who can sign in with email and password or with their Microsoft account.

Request a demo

Bring order to your AI Act compliance

Tell us which AI systems you use and we will show you AiTacora with a case similar to yours.

Prefer to email us? info@wildebit.com

Request a demo

We will reply within 1 business day.