Create an AI Deployment Compliance Profile

Written by Jakub Rusinowski · Last updated 2026-09-13 · Assessment logic is deterministic and runs in your browser

This section is practitioner guidance on deployment and governance mechanics, not legal advice. Regulatory classification turns on facts about intended purpose and real-world use that a questionnaire cannot establish — involve your counsel or DPO for decisions about your specific obligations.

The assessment asks about six things — your deployment, its intended purpose, the data it touches, the decisions it affects, the human oversight around it, and your organisation’s role in the value chain. It then works through the EU AI Act as a precedence ladder and produces a structured readiness profile.

What it asks

  1. Deployment — model, hardware, hosting mode, region, production status, who uses it.
  2. Intended purpose — the field the Act actually classifies on.
  3. Data — personal, special-category, biometric, health, financial, employment, criminal, children’s, confidential.
  4. Decisions — whether the system makes, recommends or materially influences decisions about people, and whether it profiles them.
  5. Human oversight — whether review exists, whether it can override, and whether it is written down.
  6. Your role — provider, deployer, importer, distributor, and the Article 25 routes between them.

Every question has three answers

Yes, no, and not sure. That third one is a real answer that propagates: an unanswered profiling question produces MANUAL REVIEW REQUIRED, while an explicit "no" can open the Article 6(3) derogation. A tool that collapsed those into a checkbox would silently convert every unanswered question into "no", which is how uncertainty gets rounded down into false reassurance.

Privacy

The assessment runs entirely in your browser. Nothing you enter is sent to a server, written to a log, or processed by a language model. The result link encodes your answers into the URL itself, so there is nothing stored on our side — and anyone holding that link can read it, so treat it as you would the document it describes. Do not enter credentials, API keys or passwords; free-text fields are screened for credential-shaped strings and those are redacted before anything is encoded.

Engine 1.0.0 · ruleset 2026.09.13 · rule data last verified 2026-09-13

Automated assessment based on the information you provide. Not legal advice, certification or an audit.

Keep going