SimpleAct · Features & pricing
Status: 4 October 2026
SimpleAct for the EU AI Act: AI Compliance from Inventory to Evidence
Which platform do you need for the EU AI Act – and what does it really have to do? This page maps every key obligation of the AI Act to a function, compares spreadsheets, GRC tools and specialised solutions, and the plan finder shows which SimpleAct plan fits your needs – with transparent prices.
- Every obligation mapped to a function
- Spreadsheet, GRC or specialist tool?
- Plan finder with prices
- AI Act and GDPR in one system
AI inventory
Demo Organisation Ltd · 4 AI systems
Systems by risk class
- Applicant screeningHigh-risk62%
- Customer service chatbotTransparency85%
- Translation toolMinimal100%
- Copilot in OfficeMinimal90%
Sample data · compliance checklist progress per system
In short
SimpleAct helps organisations implement the AI Act’s obligations in a way they can demonstrate: record AI systems, classify them by risk, work through obligations by role, keep documentation and evidence, and log changes. It pays off once several AI systems are in use or high-risk cases arise. It starts at €159 per month (billed annually).
Basics
What an AI compliance platform has to do – and why spreadsheets eventually fall short
The AI Act (Regulation (EU) 2024/1689) does not require software. It requires results: organisations must know which AI systems they use or provide, which risk class they fall into and which obligations follow – and they must be able to demonstrate this to authorities, customers and auditors. An AI compliance platform is the tool that keeps these results current instead of having them pieced together for every request.
The core is always the same process. It starts with the AI inventory: all systems with purpose, provider, role and owner – including AI features in software you have used for years. Then comes classification: is a system prohibited under Art. 5, high-risk under Art. 6 with Annex I or III, subject to transparency obligations under Art. 50, or minimal risk? Role and risk class determine the obligations that have to be worked through, documented and evidenced.
Your role matters too. Providers that develop an AI system or place it on the market under their own name carry most high-risk obligations – from risk management and technical documentation to the conformity assessment. Deployers that use a system under their own authority must use it as instructed, ensure human oversight, keep logs and inform staff and affected persons (Art. 26). Many organisations are both: deployers of purchased tools and providers of their own AI features. Software should therefore reflect the role per system and show the matching obligations.
The obligations apply in stages. Since 2 February 2025 the prohibitions under Art. 5 and the duty to take AI literacy measures under Art. 4 apply. Since 2 August 2025 the rules for general-purpose AI models apply, and since 2 August 2026 general application including the transparency obligations under Art. 50. After the Digital Omnibus (Regulation (EU) 2026/1744), obligations for high-risk AI under Annex III apply from 2 December 2027, for Annex I from 2 August 2028.
A spreadsheet gets you a long way for the first inventory – our free AI inventory template is made for exactly that. It gets difficult when several people maintain it, systems change and evidence is requested: who classified what, when and on what grounds? Which version of the documentation applied in March? Which checklist points are still open for the high-risk system? Software answers these questions with versioning, roles, logging and export, without anyone reconciling files.
For mid-sized companies there is a second point: the AI Act and the GDPR interlock. An AI system processing personal data needs an entry in the record of processing activities, often a data protection impact assessment, technical and organisational measures and a DPA with the provider. Maintaining both in separate tools means maintaining twice. Software that connects the AI inventory with GDPR documentation saves that work.
How to compare AI Act software vendors systematically is covered in our software comparison with six criteria and a list of questions. This page goes one step further: it maps obligations to concrete functions, shows when which approach fits, and is transparent about what SimpleAct costs and which plan includes which function.
- per month billed annually: entry with the Starter plan (excl. VAT)
- €159
- per month billed annually: entry with the Starter plan (excl. VAT)
- trial (credit card required), cancel during the trial
- 7 days
- trial (credit card required), cancel during the trial
- obligations for high-risk AI under Annex III apply (Digital Omnibus)
- 2 Dec 2027
- obligations for high-risk AI under Annex III apply (Digital Omnibus)
Obligation by obligation
Which function covers which EU AI Act obligation
The table maps the key obligations of the AI Act to the functions software should provide – and shows how SimpleAct implements them and from which plan. Software does not fulfil an obligation by itself: it structures the work and records the evidence.
Scroll the table sideways →
| Obligation | Reference | What the software should cover | In SimpleAct |
|---|---|---|---|
| Overview of all AI systems | Basis for Art. 5, 6, 26, 50 | Central inventory with purpose, provider, role (provider/deployer), owner and area of use. | AI inventory – from Starter |
| Detect shadow AI | Basis for the inventory | Match findings from identity, device or network data against a vendor catalogue and adopt them into the inventory. | AI Discovery via Entra ID, optionally Intune, network logs (CSV) – from Professional |
| Rule out prohibited practices | Art. 5 | Check per system before introduction and on substantial changes, with reasons. | Control “Prohibited practices screening” – from Starter |
| Determine the risk class | Art. 6, Annex I, Annex III | Guided classification with reasons and versioning; documentation of an Art. 6(3) exemption. | Risk classification – from Starter |
| Work through obligations per risk class | Chapter III, Art. 50 | Checklist per system matching risk class and role, with status and evidence. | Compliance checklists and 19 controls with evidence links – from Starter |
| Technical documentation (providers) | Art. 11, Annex IV | Structured along Annex IV, versioned, exportable. | Annex IV documentation – from Professional |
| Deployer obligations and FRIA | Art. 26, 27 | Document oversight, logs, information to staff and affected persons; FRIA where required. | Deployer obligations under Art. 26, FRIA under Art. 27 where relevant – from Professional |
| AI literacy of staff | Art. 4 | Plan training per role and evidence participation. | SimpleAct Academy (training and e-learning) – Enterprise |
| Approvals and accountability | Art. 26(2), Art. 17 (providers) | Workflows with owner, reviewer, due date and approval; roles and permissions. | Roles in every plan; governance workflows – from Professional |
| Traceability | Art. 5(2) GDPR, evidence for authorities | Log of all changes, versioned reports, export. | Audit log in every plan; reporting (PDF, DOCX) from Starter; register export from Professional |
| Data protection for AI systems | Art. 26(9) AI Act, Art. 30, 32, 35 GDPR | Link RoPA entry, DPIA, TOMs and DPA to the AI system. | GDPR module: RoPA, DPIA, TOMs, DPA – from Professional |
| Vendors and models in view | Art. 25, 26(5) | Record providers, models and contracts per system; store provider documents. | Vendor register and model register – from Professional |
Plan details per the current pricing page. “From Starter” means also included in Professional and Enterprise; “from Professional” means also included in Enterprise. Mapping obligations to functions is a simplified overview.
Module · AI inventory
Every AI system sits in one list – with its risk class, responsible person and latest status.
AI Inventory
3 systems registered
AI-based Application Screening
OpenAI · HR & Recruiting
Service Chatbot "Lia"
Microsoft · Customer Support
Marketing Copy Generator
OpenAI · Marketing
Website Translation Plugin
DeepL
Classify now →- 01
One row per system
Provider, department, responsible person and the date of the last change at a glance.
- 02
Risk class visible
High, limited, minimal or not yet assessed – every class doubles as a filter.
- 03
Gaps stand out
Systems without a classification are flagged at the top instead of disappearing into the list.
Approaches compared
Spreadsheet, GRC tool or specialised AI Act software?
There are three typical ways to organise AI Act compliance. None is wrong per se – what matters is the number of systems, the risk classes and how many people contribute.
Scroll the table sideways →
| Criterion | Spreadsheet (Excel, Sheets) | General GRC tool | Specialised AI Act software |
|---|---|---|---|
| Getting started | Immediately, with a template | After configuring your own questionnaires and workflows | With a predefined structure for inventory, classification and obligations |
| Risk classification | Free text or own formulas | Model it yourself as a questionnaire | Guided along Art. 5, 6 and 50 |
| Obligations by role | Maintain manually | Build your own control catalogue | Checklists for providers and deployers included |
| Traceability | Versions hard to prove | Usually good | Log and versioned reports |
| Legal changes (e.g. Omnibus) | Update yourself | Update yourself | Maintained by the vendor |
| Data protection | Separate files | Depends on the tool | In the same system for some solutions |
| Good fit for | First inventory, few systems without high-risk | Groups with existing GRC and their own modelling team | Mid-sized companies with several AI systems, high-risk cases or customer requests |
General assessment by the editorial team, not a rating of individual products. A structured vendor comparison is on the comparison page. EU AI Act software compared →
What no software does for you
Whichever route you take, part of the work stays in-house. Business units have to say which AI systems they use and what for. Someone has to decide whether a use case falls under Annex III or whether an exemption applies, and take responsibility for the reasoning. High-risk systems need people who can actually exercise oversight, and all staff need AI literacy measures.
Software moves the effort to where it belongs: away from reconciling files and hunting for versions, towards the professional decisions. So with any solution, plan internal time for recording systems and aligning with business units – and plan for one responsible person who keeps the overview.
Plan finder
Which SimpleAct plan fits you?
Enter how many AI systems and users you have and what you need. The plan finder shows the matching plan, the price and why – based on the current pricing page.
Recommendation
Matching plan
Starter
€199/monthexcl. VAT
€159 per month billed annually
Why
- AI inventory, risk classification, compliance checklists and reporting are included from Starter.
Guidance based on the pricing page (status 4 October 2026). The offer and contract are binding.
Pricing
What SimpleAct costs
We publish our prices. Every plan includes the AI Act core; Professional adds governance, discovery and the GDPR module, Enterprise adds integrations, the Academy and individual agreements.
Starter
For small businesses and first AI governance processes
€199/month
€159 per month billed annually
- Up to 5 AI systems and 3 users
- AI inventory and risk classification
- Compliance checklists
- Reporting
Professional
For multiple teams and real governance requirements
€349/month
€279 per month billed annually
- Everything in Starter
- Unlimited AI systems and users
- Annex IV documentation or deployer obligations under Art. 26, FRIA where relevant
- Vendor register and model register
- AI Discovery: find shadow AI
- Governance workflows and audit readiness score
- Single sign-on: OIDC, SAML, LDAP
- Register export
- GDPR module: RoPA, DPIA, TOMs, DPA, data subject requests, data breaches, retention periods
Enterprise
For complex compliance, governance and security requirements
On request
- Everything in Professional
- SCIM provisioning, REST API and webhooks
- GDPR: DPO management, third-country transfers, authority packages
- Escalation workflows
- SimpleAct Academy
- Onboarding workshops and individual SLAs
All prices excl. VAT. 7 days free with the full Starter scope. The trial requires a credit card: unless you cancel, the Starter subscription continues afterwards, and we remind you of the amount due 3 days before. Cancel any time during the trial. You can upgrade to Professional at any time.
Rollout
How to introduce SimpleAct
Introduction is not a major IT project. More important than the technology is that business units know their AI systems and someone takes ownership. The process is a recommendation.
- 1
Clarify ownership
One person who steers the rollout – often data protection, compliance or IT – and contacts in the business units.
- 2
Collect systems
Record known AI systems plus AI features in existing software. Add shadow AI with AI Discovery (from Professional).
- 3
Classify
Classify each system with guidance and record the reasons. High-risk and transparency cases first.
- 4
Work through obligations
Go through the checklist per system, set owners and dates, store evidence.
- 5
Maintain continuously
Record new systems before introduction, follow up changes, export reports for management and auditors.
In a pilot project, six AI systems – one of them high-risk – were recorded and assessed in around four hours.
Security and hosting
Security, hosting and data ownership
PDF: EU AI Act Compliance Guide
Obligations and typical software requirements at a glance – as a PDF.
Hosting in Germany
Application and database run at Hetzner in Nuremberg, backups in Falkenstein, in an ISO 27001-certified data centre. The certification refers to the data centre.
DPA and sub-processors disclosed
The data processing agreement under Art. 28 GDPR can be read in advance. Sub-processors such as Hetzner, Stripe (payments), Brevo and Anthropic (AI assistant, only if switched on) are listed with seat, purpose and processing location.
Roles and sign-in
Admin, Editor and Viewer roles with separate rights, two-factor sign-in for admins, single sign-on via OIDC, SAML and LDAP from Professional.
Your data stays yours
After the contract ends, the terms make the data available for 30 days in a common format, such as CSV, JSON or PDF.
Who it is for
Who works with SimpleAct in an organisation
AI Act compliance is teamwork. Good software gives each role the view it needs instead of sending everyone to the same spreadsheet.
Data protection officers
Many AI systems process personal data. The DPO wants to see which systems need a RoPA entry, a DPIA or a DPA – and where something is missing. The AI Act expressly refers to the provider’s information for this (Art. 26(9)).
- AI systems without a RoPA entry or DPIA at a glance
- GDPR module from Professional
Compliance and legal
This is where classifications and the reasons behind them are decided – and they have to stand up to scrutiny later. What matters are traceable decisions, versions and a report you can hand to management or a customer.
- Guided classification with reasons
- Reports as PDF and DOCX with versioning
IT and information security
IT knows best which services are actually used – and which AI features arrive with the next update. It needs a way to find shadow AI, control access centrally and have new features reviewed before activation.
- AI Discovery and single sign-on from Professional
- SCIM, REST API and webhooks in Enterprise
Management
Management carries the responsibility and wants to know where the organisation stands. Infringements of the prohibitions under Art. 5 can cost up to €35 million or 7% of worldwide annual turnover, many other obligations up to €15 million or 3% (Art. 99).
- Overview of systems and risk classes
- Audit readiness score from Professional
Read on
The right page for each question
EU AI Act software compared
Six criteria and a list of questions for comparing AI Act software vendors.
AI inventory software
What an AI inventory must do, with real product views and a vendor checklist.
Free AI inventory template
Excel template for the first inventory – no software needed.
High-risk AI checklist
Every obligation for providers and deployers to tick off.
FAQ
Frequently asked questions about SimpleAct and AI compliance
More questions? We're happy to help. Send email · Try 7 days (credit card required)
Sources and status
Last reviewed on · SimpleAct editorial team
- Regulation (EU) 2024/1689 (AI Act), EUR-Lex
- Regulation (EU) 2026/1744 (Digital Omnibus), EUR-Lex
- Art. 4 AI Act – AI literacy (German)
- Art. 6 AI Act – Classification as high-risk (German)
- Art. 26 AI Act – Obligations of deployers (German)
- Art. 50 AI Act – Transparency obligations (German)
- Art. 99 AI Act – Penalties (German)
This page is for guidance and does not constitute legal advice. The text of Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744 is authoritative. Plan and price details per the pricing page; the offer and contract are binding.
Changes to this page
- 4 October 2026 – Rebuilt: obligation → function → plan mapping, approaches compared, plan finder, pricing, rollout, security and hosting, status after the Digital Omnibus. Unsupported statements (set-up time, integration list) removed.
- 16 June 2026 – First version.
Try SimpleAct for yourself
Create an inventory, classify your first system, open the checklist – try 7 days (credit card required).