EU AI Act · Software and AI vendors
When an enterprise RFP asks for proof the AI feature still matches what you classified, what do you hand them?
Not the classification you attached to the last RFP. The feature in production now.
RiskLine stores the classification of each AI feature, flags the model, prompt or vendor changes that make it stale, and exports a short customer pack on request.
Head of platform · Compliance · Founder
- 01Classified
- 02Prompt changed
- 03Tier stale
- 04Re-classified
- 05Classified
Proof
Walkthrough in production
No vendor systems are seeded yet. Ask for the walkthrough and we will use one of your AI features.
Request this walkthroughWhat your buyer asks
Three questions. Three things you should be able to hand over.
Is it still the system you classified?
What you hand over
The feature, the ruleset version, and the risk tier from the last classification.
Who reviews a material change?
What you hand over
A named owner when the model, prompt, or vendor behind the feature changes.
What do you send when they ask again?
What you hand over
A short pack: tier, changes since classification, and which controls are present.
Why now
Snapshot assurance does not survive a live system.
Features change weekly
A prompt edit or a swapped model provider changes what the feature does, often without a review.
Questionnaires repeat
Every enterprise customer asks the same AI questions, and the answer has to be current each time.
Classification is not a one-off
A tier assigned last year may no longer fit the feature that ships today.
What we verify
Selected obligations → controls → evidence
For vendors selling to enterprise buyers in the EU, the UK and the US.
| Obligation | Example control | Evidence |
|---|---|---|
| EU AI ActClassification of the feature your EU customers ask about | The feature, ruleset version and resulting tier are stored. | Classification output and ruleset version. |
| Change triggerModel, prompt or vendor change | A change triggers a review of the stored classification by a named owner. | Change log and re-classification decision. |
| Customer packSecurity and AI questionnaire | Current tier, changes and control status can be exported when a customer asks. | Timestamped pack, not a slide from the last RFP. |
Advisory classification support. Not a conformity assessment. RiskLine organises evidence for the questionnaire; it does not answer it for you. Not legal advice.
30-day pilot · optional
If you want to go further, start with one meaningful system.
1–3 AI applications or workflows · 5–15 agreed controls · continuous verification · exception and evidence review · executive findings. No promised legal outcome.
Scope and controls
Agree the systems, the control set, and what “verified” means for each.
Wire verification
Connect classification context and verification checks to the live estate.
Run and exceptions
Continuous checks surface exceptions; owners review and remediate.
Evidence pack
Hand over timestamped findings your buyers can actually read.
Request the walkthrough
Want to see this for Software and AI? Tell us who you are.
No pilot needed. Tick the box only if you want to talk about one.
FAQ
Straight answers
Does RiskLine fill in our security questionnaires?
No. It keeps the evidence current so the answers you give are true on the day you give them.
Is classification legal advice?
No. It is an advisory classification against a versioned ruleset, with a human owner for every decision.
Is there a vendor demo?
Not yet. Request the walkthrough below and name an AI feature to show.
Another industry?