EU AI Act + GDPR
AI compliance, as a system.
SimpleAct links AI inventory, risk assessment and evidence in one record – for the EU AI Act and GDPR. Every change lands in the audit history.
Hosted in Germany · Complete audit history · GDPR + EU AI Act
AI Inventory
3 systems registered
AI-based Application Screening
OpenAI · HR & Recruiting
Service Chatbot "Lia"
Microsoft · Customer Support
Marketing Copy Generator
OpenAI · Marketing
Website Translation Plugin
DeepL
Classify now →Free quick check
Are you affected by the EU AI Act?
Six questions on scope, role and area of use – the result gives you the likely risk class along with obligations and deadlines.
Which systems count as high-risk (Annex III) →About 2 minutes · No sign-up · Instant result
The path to evidence
From first entry to declaration of conformity
Four steps, one record: each AI system keeps its risk assessment, owners and evidence linked – all the way to export.
Capture
Every AI system gets a record
Name, provider, purpose, department and responsible person – captured once, the system stays visible in the inventory, including shadow-AI candidates.
- Capture takes minutes per system
- Filter by risk class, provider and status
- Unassessed systems are flagged
Add AI system
New inventory record
Master data
Step 1 of 2Assess
The questionnaire leads to the risk class
The guided questionnaire checks prohibited practices, Annex III high-risk triggers and transparency obligations. Classification follows rule-based from the answers.
- Ruleset per Art. 5–7 and Annex III
- Every answer is stored versioned
- Requirements with article reference per class
Risk Classification
AI-based Application Screening
Section A: High-risk triggers
18/21 answeredDoes the system make or influence decisions about natural persons?
Does the outcome have legal or similarly significant effect?
Are special categories of personal data processed?
Risk level
High
Annex III · Employment & workforce management
Requirements
- Risk management systemArt. 9 EU AI ActFulfilled
- Data governanceArt. 10 EU AI ActPartial
- Human oversightArt. 14 EU AI ActMissing
Govern
Owners, reviews and due dates per object
Risk assessments, Annex IV dossiers and checklists pass through defined approvals: owner, reviewer, due date and approval are set per object.
- Status from DRAFT to FINAL
- Evidence as file, link or note
- Overdue objects are escalated
Governance Hub
Owners, reviews and evidence per object
12
3
1
28
RISK_ASSESSMENT
AI-based Application Screening
ANNEX_IV_DOSSIER
Service Chatbot "Lia"
COMPLIANCE_CHECKLIST
Marketing Copy Generator
Prove
Exports contain status and history
Reports contain the current state, open items, approvals and stored evidence. The audit history logs every change with user and timestamp.
- PDF and Word export, DE and EN
- Declaration of conformity per Art. 47
- Complete audit log per record
Audit Log & Export
247 of 312 entries
Audit readiness
Audit-readyComplete
Partial
Missing
EU Declaration of Conformity (Art. 47)
PDF · DE/EN · incl. audit history
| Action | Entity | Event | ||
|---|---|---|---|---|
| UPDATE | Risk Assessment | Re-assessment completed | A. Schmidt | 2026-08-18 |
| CREATE | Evidence | Evidence "DPIA report" added | T. Müller | 2026-08-15 |
| UPDATE | Governance | Approved by reviewer | L. Weber | 2026-08-11 |
| CREATE | AI System | System "Chatbot Lia" created | A. Schmidt | 2026-08-02 |
Why SimpleAct
EU AI Act and GDPR in one system – not in two projects
Most tools do either AI governance or data protection. With SimpleAct, one captured AI system triggers both sides – all tied to a single audit trail.
Capture one AI system
Name, vendor, purpose, affected areas, responsible person – entered once.
- Rule-based risk class
- Compliance checklist per class
- Annex IV documentation
- DPIA relevance detected
- Entry in the record of processing
- TOMs & data subject rights linked
Connected through governance
Audit-readyOwners, reviews, approvals, and a gap-free audit log span both sides – one body of evidence instead of two separate stacks.
One captured AI system produces both evidence chains: the AI Act side and the GDPR side hang off the same record and the same audit history.
See how the platform worksIntegrations
Compliance events land where your team already works
Escalations, approvals and deadlines reach Jira, ServiceNow, Teams, Slack, GitHub and GitLab as tickets or messages – triggered straight from the record in SimpleAct.
Runtime signal escalated
Service chatbot "Lia"
Incident recorded
AI-based application screening
Evidence approval requested
DPIA report
Governance approval blocked
Marketing copy generator
Change register updated
Model update, application screening
SimpleAct
Event routing
Jira
Issues
ServiceNow
Incident & change records
Microsoft Teams
Channel messages
Slack
Channel messages
GitHub
Issues
GitLab
Issues
SimpleAct Academy
AI literacy under Article 4 – trained inside the system
Since 2 February 2025, Art. 4 EU AI Act requires measures on AI literacy across the company. The SimpleAct Academy trains employees where the inventory and evidence already live – with courses, final tests and certificates.
- Courses on the EU AI Act (EU AI Act Officer) and information security (phishing and social engineering)
- Knowledge checks and final tests per course
- Downloadable certificates – as training evidence per employee
E-Learning Academy
Training on the EU AI Act and information security – at your own pace.
Your courses
EU AI Act Officer
Certificate course for management, compliance, data protection and legal teams: 8 modules on deadlines, roles, risk categories, high-risk obligations, transparency, governance and Article 4.
Defending against phishing and social engineering
Practical training on recognising and defending against phishing, social engineering and CEO fraud – with video cases and a reporting guide.
My certificates
Final tests you have already passed.
Security & Operations
Built for regulated environments
The technical facts that security and procurement reviews check first.
Your team
Browser · API · TLS 1.2+
Identity provider
SSO · OIDC, SAML, LDAP
Germany · Hetzner · platform data in DE only
SimpleAct
Tenant isolation · roles
PostgreSQL
encrypted at rest
Backups
daily · Falkenstein
Audit log
append-only · every change with user and timestamp
- Data residency
- Germany – servers in Nuremberg, backups in Falkenstein (Hetzner)
- Hosting
- Hetzner, Germany. No cloud providers outside the EU
- Encryption
- At rest and in transit
- Authentication
- OIDC / SSO, two-factor authentication
- Audit history
- Every change logged with user and timestamp, exportable
- Access control
- Role-based (admin, editor, viewer), tenant isolation
Pricing
Choose your starting point
EU AI Act and GDPR in one system – the GDPR module is included from Professional.
Starter
For smaller companies and first AI governance processes
billed annually · excl. VAT
You save €480 per year
7 days free · cancel during the trial
- Up to 5 AI systems & 3 users
- AI inventory
- Risk classification
- Compliance checklists
- Reporting
GDPR module from Professional
Professional
For multiple teams and real governance requirements
billed annually · excl. VAT
You save €840 per year
7 days free · cancel during the trial
- Everything in Starter
- Unlimited AI systems and users
- Annex IV documentation (providers) or deployer obligations under Art. 26, FRIA where required (Art. 27)
- Vendor register and model registry
- AI Discovery: find shadow AI
- Governance workflows and audit readiness score
- Single sign-on: OIDC, SAML and LDAP
- Register export
- GDPR module: record of processing, DPIA, TOMs and DPA
- Data subject requests, data breaches and retention periods
GDPR included
Enterprise
For complex compliance, governance and security requirements
7 days free · cancel during the trial
- Everything in Professional
- SCIM provisioning
- REST API and webhooks
- GDPR: DPO management, third-country transfers and authority packages
- Escalation workflows
- Custom integrations and priority support
- SimpleAct Academy: training & e-learning
- Onboarding workshops and custom SLAs
–
For your procurement
The documents for security and procurement reviews are publicly available.
7 days free with the full Starter scope. The trial requires a credit card: unless you cancel, the Starter subscription continues afterwards, and we remind you of the amount due 3 days before. Cancel any time during the trial. You can upgrade to Professional at any time.
Try free for 7 daysEnterprise, custom requirements or procurement questions? We walk you through SimpleAct in 30 minutes. Book a demo
Frequently asked questions
Questions that come up before rollout
More questions? We're happy to help. Send email · Get started
Who is behind it
A founding team of software developers and a systems integrator
SimpleAct is built and operated in Germany. In demos, onboarding and support you talk to the same people who build the platform.
Kamill David Jarzebowski
Founder · CEO & Managing Director
Management, systems integration & AI
Timo Weiß
Co-Founder · Head of Engineering
Application logic, Academy & AI management
Robin Wilting
Co-Founder · Head of Data
Databases & data architecture
See SimpleAct with your own compliance processes.
In 30 minutes we walk through inventory, risk assessment, governance and export – guided by your questions.
Rather try it yourself first? Try free for 7 days
Hosted in Germany · 7 days free · Cancel any time during the trial