The compliance checklist tells you what to do per system. The control library tells you which controls you operate as an organization – and, per AI system, how far their implementation has come. SimpleAct ships a fixed library of 19 controls along the EU AI Act; it is identical for every organization and therefore recognizable to auditors.

At a glance

Included from: Starter (core feature)
Where in the app: Open an AI system → Controls
Output: Control status per system with notes and evidence links
API: /api/v1/controls

How the library is structured

Every control has a stable key, a title, a description, a priority (HIGH or MEDIUM), and a reference to the Annex IV section its evidence belongs in. The key never changes – so you can reference it, carry it into your own reporting, and address it via the API.

The library itself contains no organization data. It is a template: only when you set a status for a control on a specific AI system does a record appear in your organization.

The 19 controls

Priority HIGH means: without this control, running a high-risk system is not defensible. MEDIUM means: important for auditability, but not a go-live blocker.

Control	What it covers	Priority
Prohibited practices screening	A mandatory Art. 5 screening gate before every release and material change.	High
AI literacy programme	Role-based training, reminders, attendance records and exports (Art. 4).	High
Risk management process	A continuous risk management process across design, development and operation.	High
Data governance controls	Document data quality, lineage, minimization and bias mitigation.	High
Technical documentation	Keep intended purpose, limits and model behaviour current.	High
Logging and traceability	Decision-relevant logs, retention and access accountability.	High
Human oversight	Define intervention and stop criteria, ensure trained oversight roles.	High
Fundamental rights impact assessment	Affected groups, rights risks, discrimination, mitigations and DPIA reuse before the first high-risk deployment.	High
Deployer obligations	Use per instructions, input-data checks, oversight assignment, operational monitoring, log retention, informing affected persons.	High
Accuracy, robustness and cybersecurity	Quality metrics, robustness tests and protective controls per release.	High
Post-market monitoring	Operate recurring monitoring tasks and trigger reassessments on changes or incidents.	High
Serious incident reporting	Separate AI Act incidents from privacy and security incidents; track reporting deadlines, root cause, corrective actions and stop/rollback decisions.	High
Incident and corrective action management	The full lifecycle: intake, triage, root cause, corrective action, closure.	High
User information and transparency	Provide user instructions, system limitations and complaint/feedback channels.	Medium
Art. 50 transparency and labeling	Disclosures, labels and machine-readable marking for chatbots, generated content, deepfakes and emotion recognition.	High
GPAI and vendor supply chain	Model provider, version, region, provider documentation, sub-processors, terms changes and evidence requests.	High
Change and release reassessment	Trigger reassessment when purpose, model, data basis, thresholds or deployment context materially change.	High
Authority request handling	Freeze evidence packs and track communication, owners, deadlines, submissions and approvals.	Medium
Standards and controls mapping	Map obligations to versioned internal controls and emerging harmonised standards.	Medium

Status model

The decisive difference is between the last two levels: "implemented" is a claim, "evidenced" is proof.

Status	Meaning
NOT_STARTED	Not started – the initial state of every control.
IN_PROGRESS	Being implemented, not yet complete.
IMPLEMENTED	Implemented, but without stored evidence. Fine internally – in an audit it is a statement without proof.
EVIDENCED	Implemented and backed by evidence links. This is the state an auditor wants to see.

What you store on a control

Status – one of the four levels above.
Notes – how the control is actually implemented at your organization. This is the text auditors read first.
Evidence links – references to policies, tickets, test reports or documents. Several links per control are possible.
Automatically: who last changed the status and when. Every change additionally lands in the audit trail.

Controls and Annex IV belong together

Every control points at the Annex IV section its evidence belongs in – for example "data governance" or "testing and validation". If you keep the controls current, you have already filled much of the Annex IV dossier instead of reconstructing it later from memory.