EU AI Act for Compliance Officers
For compliance officers: the EU AI Act duties your organisation must evidence and how Scanara records them. Next step: open the sample report.
Duties your organisation must evidence
Providers carry the Article 16 list
Providers of high-risk AI systems run a quality management system (Article 17) and keep technical documentation (Article 11). They also draw up an EU declaration of conformity and register the system (Articles 16 and 49).
Deployers carry the Article 26 list
Deployers use the system as instructed, assign human oversight, monitor it and keep the logs under their control for at least six months, unless other law provides otherwise (Article 26). Some must also assess fundamental rights impact first (Article 27).
Providers and deployers train their staff
Since 2 February 2025, providers and deployers of AI systems must take measures to support the AI literacy of their staff (Article 4). The Act does not require any specific level of AI literacy of an individual.
What Scanara structures and records
Guided assessments
Guided assessments cover prohibited practices, risk management, fundamental rights, deployer duties, quality management, AI literacy and the GDPR DPIA. You answer the questions; Scanara stores the results as evidence.
Evidence trail
Scanara versions your compliance records and keeps a write-once audit log of scans, assessments and exports. How far back you can view the audit trail depends on your plan.
Dossier exports
Scanara generates drafts of the Annex IV technical documentation, the EU declaration of conformity and assessment reports, and exports them as PDF, DOCX or Markdown. Review each draft before you use it.
One list of AI systems
You register each AI system once. Scanara records its risk classification and keeps its scans, assessments and documents together.
Two retention periods to plan for
6 months
Minimum retention for logs under the control of providers (Article 19) and deployers (Article 26(6)), unless other Union or national law provides otherwise.
10 years
Providers keep the technical documentation, the quality management documentation and the EU declaration of conformity for authorities. The period is 10 years after placing on the market or putting into service (Article 18).
Questions compliance officers ask
Does Scanara produce documents I can send to a regulator?
Scanara generates drafts that follow the Act’s templates, such as the Annex IV documentation, from your inputs and assessment answers. The drafts are not automatically accurate or complete, and Scanara does not certify them. Your team reviews them.
How does the audit trail work?
Scanara writes scans, assessment changes and exports to a write-once audit log with timestamps. You can view it for 90 days on the Team plan and for 1 year on the Business plan. The Free plan has no audit trail.
Which export formats are available?
Dossiers export as PDF, DOCX or Markdown. A bundled one-click regulatory export package is not available yet.
Can one organisation manage several AI systems?
Yes. Each AI system is registered in your organisation with its own classification, scans, assessments and documents. Plan limits apply: 1 system on Free, 10 on Team, 50 on Business.
Does Scanara keep the documentation up to date?
No. Scanara does not update documents on its own. Re-run scans and refresh the generated drafts when a system changes. Article 11 requires technical documentation to be kept up to date.
Read next
Check the workflow with a sample report
The demo shows an anonymised compliance report and the product walkthrough.
Scanara prepares evidence from your repositories
Scanara reads your connected GitHub repositories and runs rule-based scans for standard AI and machine-learning patterns. It can miss non-standard code. Separately, it generates draft documentation from templates and your assessment answers as evidence for your compliance work. You make the classification decisions.