The team behind your EU AI Act compliance

The AI Act requires companies to demonstrate which AI systems they use, whether sensitive data is processed, and whether AI makes or supports decisions. Art. 50 transparency obligations have applied since 2 August 2026, full high-risk documentation under Annex III from 2 December 2027 (Digital Omnibus) – building the inventory early means you are ready when authorities request evidence.

The AI Act sets tiered fines (Art. 99): up to €35M or 7% of global annual turnover for prohibited practices, up to €15M or 3% for breaches of other obligations, and up to €7.5M or 1% for supplying incorrect or incomplete information to authorities – whichever is higher, for SMEs whichever is lower. On top come regulatory audits and reputational risk. SimpleAct helps you maintain the required evidence in a structured way.

With SimpleAct: a few hours for the first capture – in a pilot project, six AI systems – one of them high-risk – were captured and assessed in about four hours – then continuous maintenance. Without a tool: weeks or months with unstructured Excel lists. Time savings come from structured capture and rule-based assessment.

The EU AI Act defines four categories: Prohibited – AI systems that are fundamentally prohibited (e.g. social scoring, manipulative AI); High Risk – full documentation required including risk management, data governance, technical documentation, and human oversight (Art. 9–15); Limited Risk – transparency obligations and content labelling (Art. 50); Minimal Risk – no statutory obligations, but a documented baseline is recommended. SimpleAct classifies each system rule-based via a structured questionnaire.

Platform data is stored in Germany: servers in Nuremberg, backups in Falkenstein (Hetzner). We do not use US or non-European cloud providers to host platform data; payments are processed via Stripe, and if the AI assistant is switched on, Anthropic also processes the texts submitted to it in the USA (subprocessors and safeguards: see DPA). GDPR-oriented hosting from day one, encryption at rest and in transit for all data.