El AI Act obliga a documentar, trazar y supervisar los sistemas de IA, en particular los que afectan a la selección de personal, el crédito, la salud, la educación o cualquier decisión sobre personas. Aportamos los componentes técnicos y la documentación asociada.
The systems that fail an audit are not the worst-performing ones. They are the ones that cannot explain themselves.
Technical logs exist, but they were built for debugging, not for inspection. Reconstructing who asked what, on which data, with what result takes days.
The principle is written in the procedure: a human validates. In practice the human approves a hundred cases in a row with no means of contesting any of them, which is not oversight.
It was estimated once, at launch, on a favourable test set. The data has changed since, and nobody knows where the system stands.
Technical components, not legal advice. The final qualification of your system rests with your counsel.
Every request, every source consulted, every action triggered, with its author, timestamp and result. Readable by a non-technical person.
Every answer links back to the documents and data that produced it. That is what makes a decision contestable rather than something to accept.
Sign-off points placed where they matter, with the context needed to actually decide — not an “approve” button at the bottom of a list.
The gap between the system's output and ground truth is tracked over time, not frozen at launch. Drift is visible before it becomes an incident.
Description of the system, the data used, known limits, excluded use cases and control measures — the basis of what the regulation asks for.
Processing register, retention periods, personal-data handling and the data processing agreement, addressed at scoping.
The order matters: qualifying before tooling avoids instrumenting a system that should not exist in that form.
Which AI systems actually run in the organisation, including those a team set up without going through IT. This step almost always surfaces unrecorded uses — that is its main value.
Each use is placed on the regulation's risk pyramid according to what it decides and whom it affects. We prepare the technical file; the final legal qualification belongs to your counsel, and we say so plainly.
What the regulation requires at that risk level, what is already in place, what is missing. The output is a list of actions ordered by criticality, not a hundred-page report.
Logging, source traceability, human oversight points, error-rate measurement, technical documentation. Each component is wired into the real system, not described in a procedure.
The system is monitored in production: performance drift, escalated cases, incidents, changes in the scope of use. Compliance is not a state reached once, it is a way of operating.
Documents and mechanisms usable in an inspection, not a certificate.
A CV screening tool was put in place by the recruitment team. Nobody can explain why an application is ranked low.
Qualification of the use, full logging of decisions and criteria, a human oversight point with access to the complete file, measurement of the gap between automated and human screening.
Every ranking is explainable and contestable. The use is documented before a candidate or an inspector asks.
A model assists case analysis. The error rate was measured once, eighteen months ago.
Continuous measurement against ground truth, drift alerting, documentation of known limits and excluded cases.
Drift is visible within the month it appears, with the data needed to analyse its cause.
Each subsidiary has launched its own AI experiments. Head office has no overall view.
Cross-group inventory, consistent qualification of uses, shared logging foundation and harmonised documentation.
Head office knows what is running, at what risk level, and where to put the effort first.
Estos productos ya están construidos. Algunos están disponibles en línea, los demás se muestran en demostración bajo petición.
¿Dónde se sitúa tu sistema en la pirámide de riesgo?
Describe tu uso de la IA: el enjambre lo descompone pieza a pieza, lo sitúa en la pirámide del Reglamento (UE) 2024/1689 y extrae tus obligaciones con fechas, referenciadas al texto oficial. El artículo 4 ya es exigible, el artículo 50 llega el 2 de agosto de 2026 y el anexo III el 2 de diciembre de 2027.
Solicitar una demoProbably, as soon as AI touches recruitment, credit, health, education, access to an essential service, or any decision affecting people. The first job is the inventory: it almost always surfaces unrecorded uses.
No, and nobody should claim to at this stage. We provide the technical components, the documentation and the gap analysis. Legal qualification belongs to your counsel.
Rarely in full. Most often what is missing is usable logging, source traceability and documentation — three additions to the existing system.
That a human has the real means to contest a decision: the context, the sources, the time, and the authority to say no. An “approve” button on a hundred-line list is not that.
The use matters as much as the tool. A general assistant used to prepare an HR decision falls inside the scope. That is often the inventory's most useful finding.
Yes, and that is what we recommend: the most exposed one first. The full inventory can follow.
We provide the technical components and the accompanying documentation. We do not issue a certificate of compliance and we do not replace your legal counsel: the final qualification of your system under the regulation is theirs. Be wary of any technical supplier who promises otherwise — compliance is not bought like software.
The answer is almost always higher than IT has recorded. Thirty minutes is enough to ask the question properly.