EU AI Act compliance software connected to your GDPR records

AI risk classification software structures the EU AI Act questions that decide whether a system is prohibited, high-risk, limited-risk or minimal-risk: role, Annex III category, GPAI status, Article 6(3) reasoning and transparency scope. Acompli can draft and surface evidence, but a human approves the final classification.

The register records which role you hold for each system, because the duties differ: providers carry conformity assessment, technical documentation and Article 49 EU-database registration for Annex III high-risk systems; deployers carry human oversight, monitoring and - for certain high-risk uses - an Article 27 FRIA. Acompli's assessments record which role you hold and the duties that follow from it.

No. Acompli can suggest a classification and surface relevant evidence, but a human approves the final classification.

The trail behind every decision: where each AI system was found (file, line, branch and commit for code-detected systems), the drafted answers and their sources, reviewer decisions and approvals, classification fields, conformity references and exportable records. Acompli keeps that evidence on the system record, alongside the Article 30 and DPIA records the DPC and ICO still expect for AI that processes personal data.

Acompli supports EU AI Act documentation with code-level AI evidence available today through Code Scan AI Governance mode — which surfaces AI SDK, model artefact, automated-decision, and high-risk pattern signals from connected GitHub repositories with file, line, branch, and commit provenance for human review. Additional capabilities available on opt-in (early access) include an AI System Register (a multi-framework analogue of Article 30), 30 Member-State conformity assessment templates with conditional gating for prohibited, high-risk, GPAI, and transparency paths, AI-assisted answer drafting grounded in your organisation's own knowledge base, and user-entered crosswalks to ISO 42001 and NIST AI RMF controls — with the four EU AI Act classification fields (risk tier, Annex III category, Article 6(3) flag, GPAI flag) copied deterministically from human-approved assessments, and a full audit history.

A GDPR Article 30 Record of Processing Activities documents personal-data processing across an organisation. An AI System Register is the multi-framework analogue for AI systems: each entry carries the EU AI Act role and risk tier, Annex III category, GPAI flag, Article 6(3) exemption flag and reasoning, conformity status, Annex VIII record (CE marking, EU-database registration status, Annex IV technical-documentation reference), and crosswalks to ISO 42001 and NIST AI RMF controls. The two registers join on the per-system data register, so an AI system that processes personal data links to the relevant RoPA activity.

Code scanning can produce reviewable engineering evidence of which AI SDKs, model artefacts, automated-decision patterns, biometric or emotion-classification libraries, and Annex III–relevant components are actually present in a codebase, each finding carrying file, line, branch, and commit provenance and a provisional EU AI Act risk-tier hint with article citations. These are signals for human review by a DPO or AI governance lead — they support, but do not replace, the deployer's legal determination of risk tier, conformity, or FRIA scope.

A provider develops an AI system or general-purpose AI model and places it on the EU market or puts it into service under its own name. A deployer uses an AI system under its authority (other than in a personal non-professional activity). Providers carry the bulk of pre-market obligations: risk management, technical documentation, conformity assessment, CE marking, and EU-database registration for Annex III high-risk systems. Deployers carry use-time obligations: human oversight, monitoring, log retention, and — for certain high-risk uses — a Fundamental Rights Impact Assessment under Article 27.

A formal "AI System Register" is not itself a named statutory artefact in Irish or UK law — but the underlying obligations that fill one are. Under the EU AI Act (Regulation (EU) 2024/1689), providers of high-risk AI systems must keep technical documentation under Article 11 and Annex IV; providers of Annex III high-risk systems must register them in the EU database under Article 49, with public-authority deployers also registering where applicable; and Annex III deployers in scope of Article 27 must produce and notify a FRIA. A company that merely uses a high-risk tool does not register it in the EU database unless it falls into that public-authority deployer category. For any AI system that processes personal data, the Data Protection Commission (DPC) expects a current Article 30 RoPA, a DPIA where Article 35 thresholds are met, and Schrems II–compliant transfer documentation. In the UK, the ICO sets parallel expectations under the Data Protection Act 2018 alongside the government's pro-innovation principles framework. An AI System Register is the practical way to keep that evidence in one place. Acompli makes the AI System Register available on opt-in (early access); Code Scan AI Governance mode is live in the platform now and contributes the engineering evidence.