EU AI Act compliance

The Act's obligations follow the role a party takes for a given system — provider, deployer, importer, distributor — and the risk tier that system falls into. The same model can place an organisation in different positions across two deployments.

Numé records each system in a register with its role, risk tier, determination status and jurisdictions, so the position taken is explicit and attributable rather than assumed.

Intake runs a prohibition screen across the practices the Act rules out — emotion inference in work and education settings, untargeted facial scraping, social scoring, and related categories. A flagged submission cannot be routed into the register until the flag is dealt with.

The Act phases in over several years. Numé keeps an obligation register driven by rules matched to each system's role, tier and jurisdiction, sorted by effective date and exportable to a calendar so deadlines sit where the work is planned.

Risk management, data governance, technical documentation, logging, human oversight and post-market monitoring all need to be demonstrable. Numé holds each control's state, owner and severity, mapped across the Numé control set, NIST AI RMF and ISO/IEC 42001 as well as the Act, with evidence records attributed and dated.

Every classification change, control assessment, artifact approval, referral and committee decision is written to an immutable audit log. Model, data and system cards are versioned and locked on approval.