- Home
- Suite features
- AI Act cockpit
EU AI Act compliance, organised by role, risk tier and date
The AI Act cockpit (in the suite: the AI Act twin) is the EU AI Act compliance software of the Regingada Compliance Suite. Three questions — role, establishment, system types — seed a portfolio that gives each AI system a draft risk tier and lists the obligations it triggers, without testing whether Art. 6(3) lifts a system out of high-risk.
- Art. 5, 6 + Annex III
- Art. 50 transparency
- GPAI · Art. 51, 53, 55, 56
- Art. 6(3) test · not modelled
- Importer, distributor · not triggered
What should EU AI Act compliance software ask first?
Three things, in this order: which role you hold, which risk tier each AI system may fall into, and from when the resulting duties apply under Regulation (EU) 2026/1744. The software can ask the first, draft the second and date the third; whether the answers hold for your company is a legal assessment.
A fixed EU AI Act compliance checklist for 2026 is too long for a chatbot deployer and too short for a hiring-system provider preparing for 2 December 2027: the Act attaches duties to roles and tiers, not to companies. The EU AI Act for US companies starts with scope under Art. 2 (second question below).
Annex III lists high-risk uses in eight areas, such as hiring and credit scoring; Annex I lists EU product-safety laws, such as the rules on medical devices. GPAI is a general-purpose AI model (Art. 3(63)). The Digital Omnibus, Regulation (EU) 2026/1744, moved the high-risk dates to 2 December 2027 (Annex III) and 2 August 2028 (Annex I): EU AI Act timeline.
From three answers to the obligation list
Open the EU AI Act compliance software at /suite/#ai-act. Then:
- Confirm the legal notice, then pick the AI Act card. First visit only: “Open AI Act twin →” on the welcome screen.
- Answer the quick check. Role (“Other role” and “Unsure” included), establishment and twelve system types; eleven seed a German-named portfolio row, “Minors as target group” none. Closing it unsaved drops you on Home; open the link again.
- Complete the portfolio. In AI Portfolio, add each system with a name, role, Annex III area or “generic”, and characteristics; “+ Add System” assigns a draft tier.
- Open Obligations. Each card shows article, effort and phase badges, tasks and a “Show legal basis” toggle; ticks are saved.
- Work down the sidebar. Annex IV and GPAI Cockpit show a gate note until your profile qualifies; the Art. 11 to 14 items and Template Preview stay empty unless you are a high-risk provider (or both).
No sub-section has its own URL. After adding or removing a system, the other sections update only after a reload or once you leave the twin and return.
Six sections, and the law behind each
| Capability | Legal basis | Output |
|---|---|---|
| AI Portfolio | Art. 5, 6, 50, 51 · Annex III | One of six draft tier chips per system |
| Obligations | Art. 3(1) to 111 · 38 cards, 153 tasks | Triggered cards, effort and phase badges, saved ticks |
| Annex IV | Art. 11 + Annex IV · Art. 9, 12, 13, 14 | 29-item checklist, notes, Art. 13(3) fields as JSON |
| GPAI Cockpit | Art. 51, 53, 55, 56 | Duty stack by tier, Code of Practice link |
| Roadmap | Art. 113 · Regulation (EU) 2026/1744 | Four phases, prohibitions to Annex I products |
| Engagement Packages | Handover to counsel (§ 2(1) RDG, German Legal Services Act) | Two email drafts to the law firm with a portfolio snapshot, sent only by you (see limits) |
AI Act obligations by role, not by company
The quick-check role applies to the whole profile, and only the high-risk cards follow it. Established in the EU, one Annex III system and a chatbot give a provider 21 cards and a deployer 8, with Art. 25, 26 and 86 in place of the provider track. Roles: AI Act role quick-check.
A rule cascade, not a model
Draft tiers come from a fixed cascade of seven rules, from two prohibited-practice checks down to minimal risk. No language model is involved; the same inputs give the same tier. Details: risk classification.
Every profile gets the Art. 3(1) AI-system check and Art. 4 AI literacy. Annex IV in detail: Annex IV documentation.
Answers, portfolio and ticks stay in your browser's local storage; there is no account. Details: Trust Center.
A US lender that only deploys
A hypothetical lender in Charlotte, North Carolina, with no EU establishment, scores loan applicants in Ireland with a licensed credit model and runs a bought-in chatbot. Quick check: deployer, outside the EU, Annex III high-risk area, chatbot. It then adds the credit model under “Essential private / public services” and reloads.
- Obligations10 cards, 46 tasks; Art. 25, 26, 27, 50 and 86 come in, the provider track stays out, and the representative card appears though the lender is no provider. Art. 27 fits: credit-scoring deployers (Annex III, point 5(b)) owe a fundamental rights impact assessment. Art. 26 and 27 apply from 2 December 2027; the Art. 26 card still shows Phase 1, ‘Active today’.
- ChatbotThe Art. 50 card lists disclosure and marking tasks that Art. 50(1) and (2) put on providers; its Phase 2 badge, dated ‘Dez 2027’ in the Roadmap, is too late: Art. 50(1) has applied since 2 August 2026.
Answered as “Provider”, the same profile gives 22 cards and 88 tasks — both computed with the suite's own trigger functions; reconcile them. Fictional demo profiles: DeepHelm AI, a non-EU GPAI provider; TalentSync, an EU provider of recruiting AI.
Six gaps, in plain terms
- Importers and distributors have no answer of their own: “Other role” triggers no role-specific card, so Art. 23 and 24 never appear and a profile with one high-risk system shows four cards (five outside the EU). “Unsure” counts as provider, an unsure establishment as EU; per-system roles are display only.
- The GPAI cards (Art. 53, 89(2), 101, 111) and the GPAI Cockpit ignore the role: a deployer that ticks “GPAI / foundation model” for a third-party model sees provider duties.
- The Art. 27 card fires for any deployer in the essential-services area; beyond public bodies and public-service providers, Art. 27(1) covers only credit scoring and life or health insurance pricing (Annex III, point 5(b), (c)).
- Engagement Packages shows every profile an Option B that names the law firm as representative under Art. 22 — applicable only from 2 December 2027 (Annex III) and 2 August 2028 (Annex I), Regulation (EU) 2026/1744 — and omits Art. 54. Regingada UG takes on the role: appointment.
- Classification is coarse: no Art. 6(3) test, one tier per system, and Prohibited is flagged without the purpose tests of Art. 5(1)(f) and (h).
- Checklists and Annex IV notes are portfolio-wide; the obligations list has no export, the compliance score its subtitle mentions never appears, and the Art. 4 and 111 cards keep pre-Omnibus wording; the Annex IV report (DOCX) needs a deep-analysis engine that is not part of the browser edition.
Frequently asked questions
Which EU AI Act obligations apply to my company?
That turns first on your role and each system's risk tier. A high-risk provider carries, among others, Art. 9 to 17, 43 and 49; a high-risk deployer, Art. 26; chatbots and generated content add Art. 50. The cockpit shows the cards your answers trigger, out of 38 — a DRAFT; whether each binds you is a legal assessment.
Does the EU AI Act apply to US companies?
It can. Art. 2(1)(a) AI Act reaches providers that place AI systems or general-purpose AI models on the Union market, or put systems into service there, wherever established; Art. 2(1)(c) adds third-country providers and deployers whose system output is used in the Union. Whether you are caught is a legal question for the law firm Theo Funk under a separate mandate.
Does the suite cover GPAI model providers?
Yes: the GPAI Cockpit opens once your portfolio holds a general-purpose model, whatever your role. It lists the Art. 53 duties, the Art. 55 layer for models with systemic risk (high-impact capabilities are presumed above 10²⁵ training FLOPs, Art. 51(2)) and links the GPAI Code of Practice. The compute bar is illustrative, not an input; there is no Art. 52 notification workflow.
Can the suite tell me whether I need an authorised representative?
It flags the question, too broadly: every non-EU profile with a high-risk system or GPAI model gets a banner, “Authorised Representative required (Art. 22 AI Act)”, deployers too, though Art. 22 and 54 bind providers. Art. 54 has applied since 2 August 2025; Art. 22 applies from 2 December 2027 (Annex III) and 2 August 2028 (Annex I), Regulation (EU) 2026/1744: authorised representative.
Is the AI Act cockpit legal advice?
No. This EU AI Act compliance tool is structured self-assessment and decision support — orientation, not legal advice under the German Legal Services Act (RDG). Every tier, card and note is a DRAFT; advice on your systems comes only from the law firm Theo Funk under a separate mandate.
The tier is a draft; the judgement is legal
As AI governance software for the EU AI Act, the cockpit stops where the Act turns on judgement: whether Art. 6(3) takes an Annex III system out of high-risk, whether a rebrand or substantial modification makes you a provider (Art. 25), whether your output is used in the Union. The law firm Theo Funk can assess these under a separate mandate, starting from your DRAFT portfolio.
Outside the Union, a provider must as a rule appoint a representative inside it — for a GPAI model under Art. 54 since 2 August 2025, for a high-risk system under Art. 22 from 2 December 2027 (Annex III) or 2 August 2028 (Annex I), Regulation (EU) 2026/1744. Regingada UG (haftungsbeschränkt) takes on that role by written mandate: AI Act authorised representative service · representative fees.