按需开通
AI Act 罗盘
你的系统落在风险金字塔的哪一层？
描述你如何使用 AI：集群会逐块拆解，将其定位到《欧盟条例 2024/1689》的风险金字塔上，并输出带日期、可回溯到官方条文的义务清单。第 4 条已经生效，第 50 条为 2026 年 8 月 2 日，附件三为 2027 年 12 月 2 日。
申请演示当有人问起这个系统是怎么决定的，那一天必须答得出来。
AI Act 要求对人工智能系统进行记录、追溯与监督，尤其是涉及招聘、信贷、健康、教育或任何影响个人之决策的系统。我们提供相应的技术组件与配套文档。
- 可用的审计日志
- 配备工具的人工监督
- 技术文档
What is missing is almost never the model
The systems that fail an audit are not the worst-performing ones. They are the ones that cannot explain themselves.
01
No usable trace
Technical logs exist, but they were built for debugging, not for inspection. Reconstructing who asked what, on which data, with what result takes days.
02
Human oversight is theoretical
The principle is written in the procedure: a human validates. In practice the human approves a hundred cases in a row with no means of contesting any of them, which is not oversight.
03
The error rate is not measured
It was estimated once, at launch, on a favourable test set. The data has changed since, and nobody knows where the system stands.
What we put in place
Technical components, not legal advice. The final qualification of your system rests with your counsel.
End-to-end audit log
Every request, every source consulted, every action triggered, with its author, timestamp and result. Readable by a non-technical person.
Source traceability
Every answer links back to the documents and data that produced it. That is what makes a decision contestable rather than something to accept.
Tooled human oversight
Sign-off points placed where they matter, with the context needed to actually decide — not an “approve” button at the bottom of a list.
Continuous error-rate measurement
The gap between the system's output and ground truth is tracked over time, not frozen at launch. Drift is visible before it becomes an incident.
Technical documentation
Description of the system, the data used, known limits, excluded use cases and control measures — the basis of what the regulation asks for.
Register and data governance
Processing register, retention periods, personal-data handling and the data processing agreement, addressed at scoping.
How a compliance engagement runs
The order matters: qualifying before tooling avoids instrumenting a system that should not exist in that form.
01 / 05
Inventory of systems
Which AI systems actually run in the organisation, including those a team set up without going through IT. This step almost always surfaces unrecorded uses — that is its main value.
02 / 05
Risk qualification
Each use is placed on the regulation's risk pyramid according to what it decides and whom it affects. We prepare the technical file; the final legal qualification belongs to your counsel, and we say so plainly.
03 / 05
Gap analysis
What the regulation requires at that risk level, what is already in place, what is missing. The output is a list of actions ordered by criticality, not a hundred-page report.
04 / 05
Putting the components in place
Logging, source traceability, human oversight points, error-rate measurement, technical documentation. Each component is wired into the real system, not described in a procedure.
05 / 05
Continuous oversight
The system is monitored in production: performance drift, escalated cases, incidents, changes in the scope of use. Compliance is not a state reached once, it is a way of operating.
What you receive
Documents and mechanisms usable in an inspection, not a certificate.
- An inventory of the AI systems actually in use across the organisation
- A risk-level qualification for each use, documented and justified
- A gap analysis with an action plan ordered by criticality
- Audit logs readable by a non-technical person
- Technical documentation per system: data, limits, excluded uses, controls
- The processing register, the data processing agreement and retention periods
- An error-rate measurement mechanism tracked over time
Three situations, three levels of requirement
01 · 背景
A CV screening tool was put in place by the recruitment team. Nobody can explain why an application is ranked low.
02 · 我们实施的内容
Qualification of the use, full logging of decisions and criteria, a human oversight point with access to the complete file, measurement of the gap between automated and human screening.
03 · 结果
Every ranking is explainable and contestable. The use is documented before a candidate or an inspector asks.
01 · 背景
A model assists case analysis. The error rate was measured once, eighteen months ago.
02 · 我们实施的内容
Continuous measurement against ground truth, drift alerting, documentation of known limits and excluded cases.
03 · 结果
Drift is visible within the month it appears, with the data needed to analyse its cause.
01 · 背景
Each subsidiary has launched its own AI experiments. Head office has no overall view.
02 · 我们实施的内容
Cross-group inventory, consistent qualification of uses, shared logging foundation and harmonised documentation.
03 · 结果
Head office knows what is running, at what risk level, and where to put the effort first.
现在就能看到运行的产品
这些产品已经构建完成。部分可在线访问，其余可按需演示。
常见问题
Probably, as soon as AI touches recruitment, credit, health, education, access to an essential service, or any decision affecting people. The first job is the inventory: it almost always surfaces unrecorded uses.
No, and nobody should claim to at this stage. We provide the technical components, the documentation and the gap analysis. Legal qualification belongs to your counsel.
Rarely in full. Most often what is missing is usable logging, source traceability and documentation — three additions to the existing system.
That a human has the real means to contest a decision: the context, the sources, the time, and the authority to say no. An “approve” button on a hundred-line list is not that.
The use matters as much as the tool. A general assistant used to prepare an HR decision falls inside the scope. That is often the inventory's most useful finding.
Yes, and that is what we recommend: the most exposed one first. The full inventory can follow.
本方案不做什么
We provide the technical components and the accompanying documentation. We do not issue a certificate of compliance and we do not replace your legal counsel: the final qualification of your system under the regulation is theirs. Be wary of any technical supplier who promises otherwise — compliance is not bought like software.
Do you know how many AI systems are running in your organisation?
The answer is almost always higher than IT has recorded. Thirty minutes is enough to ask the question properly.