How it works
An honest scan, explained.
No tool can certify AI Act compliance from a URL. What we do is narrower and more useful: collect evidence, apply a curated rule catalog, and show our work.
- 01
What can I submit for a scan?
You give us a public URL, a screenshot, a PDF or plain text, and confirm you may share it.
URLs are validated against private networks (SSRF guard), files are type- and size-checked, and everything is stored in EU object storage with a 30-day retention.
- 02
What does the scan read on my website?
A headless browser renders the page like a visitor would, so client-side chat widgets, banners and footers count.
We extract visible text, links to legal pages, chat vendors, AI notices, content labels, provenance standards and automated-decision disclosures. PDFs become text; images go to a vision model.
- 03
How does evidence become a finding?
Deterministic detectors turn signals into findings. A language model may add observations, but only with verbatim quotes, and only for rules that content can show.
Every finding carries a status (pass / partial / fail), a confidence and evidence. Low-confidence automatic findings are treated as unknown, never asserted. Keyword hits for prohibited practices become hints for you to confirm, not verdicts.
- 04
How is my risk class decided?
Up to nine questions settle what a website cannot: your role, the use case, whether you provide a general-purpose model.
The decision tree mirrors the Act: Article 5 → Article 6 with Annexes I and III → Article 50 → everything else. Each conclusion lists its legal basis.
- 05
Which rules count towards my score?
Only the rules that apply to you count. Unknowns lower coverage, not the score. A prohibited practice caps the result at zero.
Recommendations are ordered by severity, then weight, then status. Each links to the article, shows the evidence and maps to a package.
The catalog
What can the scan check on my website?
Observable means that what you submit can show whether a rule is met. That holds for 28 of the 46 rules, 23 of them on a public website and 5 only in uploaded documents; the other 18 are settled by your answers alone. Each rule cites the articles, annexes or recitals it derives from; a test in our pipeline fails if a citation does not resolve in the official text. The Article 5 rules follow the Commission's July 2025 guidelines chapter by chapter.
Read the law- 8
Prohibited practices
- 1
AI literacy
- 9
Transparency
- 4
Risk management
- 2
Data governance
- 12
Documentation
- 3
Human oversight
- 1
Accuracy & robustness
- 1
Registration & conformity
- 5
General-purpose AI
How is the score calculated?
- Applicable rules
- Determined by role, risk tier and capability flags. Nothing else is counted.
- Weighted status
- pass = 1, partial = 0.5, fail = 0, multiplied by the rule's weight (1–5).
- Coverage
- Share of applicable rules with a known status. Self-assessment raises it.
- Rating
- Letter bands on the weighted score; any failed Article 5 rule is rated critical.
A ≥ 90 · B ≥ 75 · C ≥ 60 · D ≥ 40 · E < 40 · Art. 5 hit = 0