REGISTER / 01
Which AI systems touch our data?
A current register records purpose, provider, owner, role, data use and affected groups.
Registered evidenceCustomer review
Customer-ready
AI proof packs.
Turn each AI system into a current, cited evidence record your customers can review, then export a scoped pack without exposing drafts or internal activity.
Customer requestEvidence response
The customer question
The review arrives before the evidence is assembled.
“Please list the AI systems used in your service, their risk classification, transparency controls, and supporting documentation.”
Typical customer security and procurement request
DECISION / 02
How did you assess each use?
Each role, risk and transparency decision retains the answers, reasoning and legal references.
EVIDENCE / 03
What can we review today?
A dated manifest contains selected systems and completed evidence, with internal work excluded.
One maintained record
Register once. Answer the review without rebuilding the answer.
The customer pack is a controlled view of the governance record your team already maintains, not another spreadsheet created under deadline pressure.
- 01Register
- 02Triage
- 03Maintain
- 04Export
Give every AI system an accountable record.
Capture the system, provider, purpose, owner, organisational role, data use and affected groups before evidence gets scattered.
KONFORMIS / SYS-0042 / ACTIVE
Support reply assistant
Customer operations / Deployer record
- Owner
- Mara Klein
- Customer Operations
- Provider
- Acme AI Cloud
- Vendor assessment linked
- Purpose
- Draft support responses
- Human sends final reply
- Personal data
- Customer ticket content
- EU tenant configured
Last reviewed 18 July 2026 · next review 18 October 2026
Customer-safe by scope
Publish the answer. Keep the working record private.
A proof pack is a dated external snapshot, not a mirror of your workspace. You choose the systems; Konformis includes current, completed material and records the contents in a manifest.
Inspect the example packThe separate internal audit package retains the deeper activity and decision record for internal assurance work.
Northstar Labs proof pack
PACK-2026-0718 · GENERATED 18 JUL 2026
northstar-ai-proof-pack.zip
00_scope-and-cover.pdf
Prepared by, snapshot date and selected systems
01_ai-system-register.csv
Purpose, provider, owner, role and status
02_risk-classification.pdf
Results, reasoning and legal references
03_transparency-summary.pdf
Article 50 checks and evidence links
04_governance-documents/
Completed versions selected for this review
05_customer-explanation.pdf
Plain-language scope and limitations
Remains inside the workspace
- Draft and in-review documents
- User activity and change history
- Internal audit log
- Billing and workspace settings
Ongoing readiness
Evidence ages. The record tells you where.
Reviews, expiry dates and document versions keep the workspace useful between customer requests. Generate a new external snapshot from the current state when needed.
Evidence review register
4 RECORDS
RecordStateReview detailOwner
Provider information
Current
Source captured 08 Jul 2026
Security
Transparency notice
Review due
Due 28 Jul 2026
Product
Human oversight procedure
Final · v1.4
Approved 18 Jul 2026
Operations
Risk classification
Reviewed
Decision version 3 retained
Legal
The internal audit package preserves activity and versions for assurance work; the customer pack includes only the selected completed state.
Staged enforcement
Prepare the evidence in the order it becomes useful.
The AI Act is active and applies in stages. The operational task is to know what applies now, prepare the next evidence set, and keep a roadmap for later high-risk requirements.
Now
AppliesNext
PrepareThe Council gave final approval to the AI Omnibus on 29 June 2026. Official Journal publication and entry into force are the remaining formal steps. Confirm publication and the legally operative text before relying on amended dates. This overview is operational guidance, not legal advice.
Article 50 Code of PracticeTwo ways to start
Build it with the workspace, or structure the first pack together.
Self-serve workspace
14-day Scale trial
Use the complete workflow for up to 30 AI systems. Inventory, triage, evidence, versioned documents and both export types are available from day one.
- No credit card
- Full Scale workflow
- Keep records in one workspace
Focused setup engagement
EUR 1,250 Proof Pack Sprint
A focused working engagement to structure your initial inventory, triage the records and assemble a first procurement-ready evidence pack with your team.
- Initial system register
- Role and risk triage
- First pack scope and evidence gaps
Questions buyers and owners ask.
Is a Konformis proof pack a legal certification?
No. It is a structured, point-in-time export of the records and evidence in your workspace. It supports customer review, but it is not legal advice, an audit opinion, or a certificate of compliance.
What is excluded from the customer proof pack?
Draft and in-review documents, user activity, billing details, internal change history, and the internal audit log are excluded. A separate internal audit package is available for assurance work.
Who is Konformis for?
The current workflow is designed for EU and UK B2B SaaS companies with roughly 20–200 staff, especially teams where security, product, legal, and operations share AI governance work.
Can we classify a system before signing up?
Yes. The public classifier produces a preliminary, shareable result without an account. A workspace adds inventory, evidence tracking, documents, reviews, and exports.
Does the AI Omnibus make this unnecessary?
No. Some high-risk application dates moved, while prohibited-practice, AI literacy, GPAI, and transparency duties follow their own stages. Procurement reviews can still require inventory, ownership, risk decisions, and supporting evidence.
The next customer review