Skip to content
SimpleAct Logo

Documentation

Structured product documentation covering all SimpleAct capabilities, workflows, and outcomes.

What SimpleAct covers in day-to-day compliance operations

This overview goes beyond feature lists. It explains the full operating flow: from AI system inventory and risk assessment to governance execution and audit-ready reporting.

Note: All content is available in German and English. Use the language switcher in the header.

What this documentation helps you achieve

Features in context
Every module explains when to use it, what input it requires, and what output it produces.
Clear working sequence
You get a recommended implementation order to move from an empty workspace to evidence-ready operations.
Built for operational teams
The content is written for Compliance, Legal, IT Security, and Product teams working together on EU AI Act obligations.

Platform capabilities at a glance

SimpleAct combines the key building blocks so your compliance operations do not rely on disconnected spreadsheets, emails, and isolated documents.

1) Inventory and classify

From complete AI system visibility to defensible risk classification.

  • AI inventory with ownership, use case context, and system details
  • Shadow AI discovery via Entra ID, Intune, and network logs
  • Rule-based risk assessment (rule set V3.0): prohibited, high, limited, minimal
  • AI intake for requests for new AI tools, with review per section
  • Checklist logic aligned to the assigned risk class
  • 19 EU AI Act controls with status and evidence per system

2) Build evidence and govern execution

Documentation, action tracking, and governance in one continuous process.

  • Technical evidence and supporting documentation per AI system
  • Annex IV dossier support for high-risk AI systems
  • Assurance file: classification, FRIA, risk register, QMS, authority pack
  • Incident management with status flow and reassessment triggers
  • Runtime signals from Grafana, Prometheus, Datadog, MLflow, and CI/CD
  • Audit playbook for action planning and execution control
  • Legal review cycle with cadence, reminders, and escalation paths

3) Scale safely in operations

Auditability, collaboration, and integrations for growing organizations.

  • Dashboard for metrics, open gaps, and activity visibility
  • Hash-chained audit trail with verifiable integrity
  • User and role model (Admin, Editor, Viewer)
  • 2FA for admins plus OIDC/SSO and SCIM provisioning
  • Group governance across linked organizations
  • API keys, webhooks, the MCP interface, and white-label capabilities for Enterprise
  • Multi-stage approvals, review campaigns, and sites with AI officers
  • Academy with certificates and a competence score (Art. 4)
  • PDF/DOCX export and versioning for reviews and audits

4) Carry data protection along instead of catching up

The GDPR duties of the same systems – in one system and linked to each other.

  • Records of processing (Art. 30), linked directly to AI systems
  • TOMs (Art. 32) with implementation status and evidence
  • DPIA (Art. 35) including the list of systems that need one
  • Data subject requests with the one-month deadline (Art. 12(3)) and response package
  • Data breaches with an automatically calculated 72-hour deadline
  • Consent, retention, third country transfers, and privacy notices
  • Full GDPR export as ZIP for supervisory authorities and internal audit

Recommended operating flow

The biggest value appears when modules are used as one connected operating model. This sequence helps teams build a sustainable compliance system.

  1. 1

    Set up workspace and governance ownership

    Create the workspace, store organizational context, assign roles, and establish your governance baseline.

    Outcome: A working foundation with clear responsibilities.

  2. 2

    Capture the full AI landscape

    Inventory all production and experimental AI systems, including shadow-AI usage patterns.

    Outcome: End-to-end transparency on real AI usage.

  3. 3

    Assess risk and map obligations

    Run the structured risk assessment per system and derive matching compliance tasks.

    Outcome: Prioritized obligations by system and risk class.

  4. 4

    Operate evidence, incidents, and reviews

    Maintain documentation, track incidents, execute actions via playbooks, and run legal review cadence.

    Outcome: A continuous and auditable improvement loop.

  5. 5

    Export and communicate audit-ready outputs

    Generate PDF/DOCX reports for internal approvals, external audits, and stakeholder reviews.

    Outcome: Defensible, presentation-ready compliance evidence.

Role-based starting points

Different teams can start in different modules while still staying aligned with one shared process model.

Compliance lead
Start with inventory, risk assessment, and checklist execution. Then focus on dashboards and report readiness.
Legal / privacy
Start with legal review cycles and evidencing, then align findings with risk class and Annex IV expectations.
IT / security / platform
Start with role model, 2FA/SSO, and integrations. Then harden incident flow, auditability, and team handoffs.

Modules and documentation areas

Data protection (GDPR)

GDPR suite

Overview of all 14 data protection modules and their AI Act links

Records of processing

Art. 30 – linked to AI systems and processors

TOMs

Art. 32 – nine categories with implementation status and evidence

DPIA

Art. 35 – risks, mitigations, residual risk, and approval

Data subject requests

Art. 15–22 with the one-month deadline, extension, and response package

Data breaches

Art. 33/34 with an automatically calculated 72-hour deadline

Consent

Purposes, cookie banner, and consent receipts as CSV

Retention & deletion

Deadlines from the register, deletion runs as evidence

Third country transfers

Art. 44–49 with legal basis incl. DPF and TIA assistant

Privacy notices

Generate and version Art. 13/14 notices from the register

Data protection officer

Mandatory check under Art. 37 and Sec. 38 BDSG, profile, EU representative

Awareness

Evidence training and awareness measures

Authorities & escalations

Enquiries, complaints, and proceedings with deadlines and response packs

Quick start

If you are starting from scratch, use this compact sequence:

  1. 1Create your workspace and define roles/ownership
  2. 2Capture all AI systems, including shadow AI
  3. 3Run and prioritize risk assessments per system
  4. 4Execute checklists, evidence tasks, and action plans
  5. 5Export audit-ready reports and run internal approval
Open getting started

Why this structure works

  • One connected operating model instead of isolated feature usage
  • Traceable decision and change history
  • Clear accountability across functions
  • Audit-ready evidence without fragmented manual documentation

Additional resources