SimpleAct connects the EU AI Act and GDPR in one platform: capture, assess, and document AI systems – with governance workflows, incident management, runtime monitoring, and integrations for Jira, Teams, or ServiceNow. AI governance and data protection in one system, audit-ready.
✓ No credit card required · ✓ Cancel anytime
Three steps. No legal knowledge required. No chaos.
Inventory
4 AI systems
GPT-4 Assistant
OpenAI
Candidate Matching
Internal
Document Analysis
Microsoft
Support-Chatbot
No more spreadsheets. Every AI system, every provider, every risk level — central, current and auditable.
Does the system make HR decisions?
Are people automatically assessed?
Is there human oversight?
Risk Result
Risk Level
HIGH
Assessment Details
System falls under Annex III, Art. 6 EU AI Act.
Action required
No legal expertise needed. The guided questionnaire translates the AI Act into clear risk decisions.
Dashboard
AI Act 20264
Systems
1
High Risk
3/4
Assessed
0%
Compliance
Risk distribution
4 systemsCompliance checklist
6 / 6100% completed ✓
No stress before audits. Your dashboard shows in real time where you stand — and what to do next.
The AI Act requires companies to demonstrate where and how AI is used, whether use is permitted, and whether sensitive data is processed – or face significant penalties.
The AI Act tiers fines by severity: up to 7% of global annual turnover or €35M applies to prohibited practices (Art. 5); most other violations cap at up to 3% or €15M. SMEs get the lower of the applicable thresholds. Proper documentation shows you meet your obligations.
The Digital Omnibus (May 2026) shifts Annex III high-risk obligations to 2 December 2027. Start now — building governance structures takes months, not days.
According to the Software AG Shadow AI Study (2024), 50% of knowledge workers use AI tools without IT approval. What is not captured cannot be documented – and without documentation there is no compliance.
Capturing AI use without a system means: unstructured Excel lists, no systematic risk assessment, no version control. With SimpleAct you avoid these risks.
* Software AG Shadow AI Study 2024, n=6.000 Wissensarbeiter (USA, UK, DE)
Answer 5 short questions in under 1 minute and find out whether your company needs AI documentation.
This lets us tailor the results to your situation.
→ Create an AI inventory and document your high-risk systems.
Which systems count as high-risk (Annex III) →⚖️ This check is not legal advice. If in doubt we recommend legal review.
Most tools do either AI governance or data protection. With SimpleAct, one captured AI system triggers both sides automatically – all tied to a single audit trail.
Name, vendor, purpose, affected areas, responsible person – entered once.
Owners, reviews, approvals, and a gap-free audit log span both sides – one body of evidence instead of two separate stacks.
That is the difference: competitors document AI or data protection. SimpleAct shows the link between the two – exactly where authorities and audits look.
See how the platform worksOne platform instead of two tools: Starter covers the EU AI Act, and from Professional onwards GDPR is included. Enterprise adds security, integrations, and organisational rollouts.
For smaller companies and first AI governance processes
billed annually
Start with EU AI ActGDPR can be added later
For multiple teams and real governance requirements
billed annually
Start ProfessionalGDPR included from here
For complex compliance, governance, and security requirements
Starter can later be expanded to Professional or Enterprise. GDPR is included from Professional onwards.
For a fast product check
Pilot projects are enabled individually and after the period either transition into a regular subscription or end cleanly.
See pilot projectAs a German company we take data protection and security seriously. Made in Germany means the highest standards with no compromise.
Security & InfrastructureGerman quality
All your data is stored exclusively on German servers in Nuremberg. Backups are held in Falkenstein (Hetzner). No cloud providers outside the EU.
Encryption at rest and in transit, plus regular security reviews for the highest data security.
Our team has experience in data protection (GDPR) and AI governance.
Developed and hosted in Germany with a focus on data protection and reliability.
Fresh updates on the EU AI Act, AI compliance, and practical implementation guidance.
KI-Telefonassistenten können Anrufe automatisieren, Termine koordinieren und Informationen an CRM-, Kalender- oder Ticketsysteme übergeben. Gleichzeitig entstehen Fragen zu Artikel 50 des EU AI Acts, Datenschutz, Risikoklassifizierung und Verantwortlichkeiten. Wir zeigen, worauf Unternehmen bei Einführung und Betrieb achten sollten.
Jedes KI-System, das personenbezogene Daten verarbeitet, muss in zwei Verzeichnissen auftauchen: im KI-Inventar nach EU AI Act und im Verarbeitungsverzeichnis nach Art. 30 DSGVO. In der Praxis pflegen Unternehmen beide getrennt, oft in unterschiedlichen Abteilungen und in unterschiedlichen Tabellen. Das Ergebnis sind doppelte Erfassung, widersprüchliche Angaben und ein Datenschutzbeauftragter, der von der Hälfte der eingesetzten Systeme nichts weiß.
Seit Februar 2025 verpflichtet Artikel 4 Anbieter und Betreiber zur KI-Kompetenz ihrer Mitarbeitenden. Seit August 2026 kontrollieren die Marktüberwachungsbehörden das. Was der Digital Omnibus wirklich geändert hat, wen die Pflicht trifft und was ausdrücklich nicht verlangt wird.
Der Digital Omnibus hat die Hochrisiko-Fristen verschoben, Artikel 50 aber nicht. Ab dem 2. August 2026 müssen Unternehmen offenlegen, wenn Menschen mit einer KI sprechen oder KI-erzeugte Inhalte vor sich haben. Welche vier Konstellationen betroffen sind, welche Ausnahmen tatsächlich tragen und was die schmale Übergangsfrist bis Dezember wirklich abdeckt.
"Wir dokumentieren das, wenn es so weit ist" ist im Ernstfall keine gute Antwort. Welche Nachweise Unternehmen nach EU AI Act typischerweise vorlegen müssen — und wie sich das vorbereiten lässt, ohne ein monatelanges Projekt daraus zu machen.
Marketing nutzt ChatGPT, Entwickler nutzen Cursor, der Vertrieb nutzt Claude, HR nutzt Copilot, der Support nutzt Perplexity — und niemand im Unternehmen hat den Überblick. Warum Shadow AI 2026 zum zentralen Compliance-Risiko wird und wie Unternehmen wieder Transparenz herstellen.
The most important questions on the documentation obligation, AI capture, and SimpleAct answered.
More questions? We're happy to help.
Pick a slot right here – we’ll confirm by email with a calendar invite.
