The EU AI Act assigns obligations by risk tier and by the role you play — provider, deployer, or both. The hard part is not reading the regulation; it is knowing which of your AI systems land in which tier, and proving the resulting obligations are met. UrNammu ships a seeded catalog of the articles that carry concrete provider and deployer duties, and a classification wizard that derives each system’s tier and narrows the list to what actually applies.
The classification wizard derives a system’s tier and the articles that apply to it
Seeded articles, by chapter
Chapter I — General provisions
1Art. 4 AI literacy.
Chapter II — Prohibited practices
1Art. 5, which hard-blocks approval when a system classifies as prohibited.
Chapter III — High-risk requirements
7Arts. 9–15: risk management, data governance, technical documentation, record-keeping, transparency, human oversight, accuracy and cybersecurity.
Chapter III — Provider obligations
2Arts. 16–17, including the quality management system.
Chapter III — Deployer obligations
2Art. 26 and the Art. 27 fundamental rights impact assessment.
Chapter III — Conformity
2Art. 43 conformity assessment and Art. 49 registration in the EU database.
Chapter IV — Transparency
1Art. 50 obligations for certain AI systems.
Chapter V — General-purpose AI models
1Art. 53 obligations for GPAI providers.
Chapter IX — Post-market monitoring
2Art. 72 monitoring and Art. 73 serious incident reporting.
How UrNammu covers it
Classification wizard
Answer a structured set of questions per system and UrNammu derives the risk tier — prohibited, high-risk, limited or minimal — along with your role as provider, deployer, or both. The derived tier narrows the obligation list to the articles that actually bind you.
Prohibited outcomes block approval
A system that classifies as prohibited under Art. 5 cannot be approved: the staged Owner / Security / Legal / Compliance workflow hard-blocks it rather than leaving the judgement to whoever clicks approve. Unclassified systems and missing evidence raise warnings.
Evidence next to the obligation
Attach model cards, DPIAs, conformity records and contracts as evidence artifacts on the system they belong to, assess each article as met, partial or gap, and watch coverage roll up per system and across the estate.
Post-market monitoring that is already running
Arts. 72 and 73 ask for monitoring and serious-incident reporting. The proxy already records every model call, policy denial and DLP finding, and governance incidents link to the alerts and investigations that produced them.
Frequently asked questions
When do EU AI Act obligations start applying?
The regulation phases in: prohibited practices applied from February 2025, general-purpose AI model obligations from August 2025, and most high-risk requirements from August 2026. UrNammu tracks obligations per system rather than per date, so a system reclassified later picks up the articles that follow from its new tier.
Does UrNammu decide my risk tier for me?
It derives a proposed tier from your answers in the classification wizard and shows the reasoning. The classification is recorded against the system, is editable, and is part of the audit trail — it is an input to your legal review, not a substitute for it.
What if I am a deployer rather than a provider?
Role is captured per system — provider, deployer, or both — and the obligation list changes accordingly. Deployers see Art. 26 and the Art. 27 fundamental rights impact assessment; providers see the Chapter III requirements and conformity duties.
Can EU AI Act work count toward other frameworks?
Yes. The seeded catalog carries 107 curated crosswalk links, so evidence recorded against an EU AI Act article can inherit to the matching NIST AI RMF, ISO/IEC 42001 and SOC 2 controls instead of being assessed from scratch.
UrNammu is governance software, not legal advice. Control mappings and derived risk tiers are inputs to your own legal and compliance review.
Other frameworks
NIST AI RMF
Operationalise the NIST AI Risk Management Framework: 19 seeded controls across Govern, Map, Measure and Manage, assessed per system with evidence.
NIST AI RMF Software →ISO/IEC 42001
Run an ISO/IEC 42001 AI management system on real data: 38 seeded Annex A controls assessed per system, with evidence, coverage roll-ups and an audit trail.
ISO 42001 Compliance Software →SOC 2
Bring the AI estate into SOC 2 scope: 20 seeded Trust Services Criteria per system, with access, change and monitoring evidence produced by the proxy.
SOC 2 Compliance for AI Systems →