February 2, 2025 · Prohibitions and AI literacy
Unacceptable-risk practices are banned. Organizations must support AI literacy among the people who use AI systems.
Regulation (EU) 2024/1689 · AI Act
The whole AI Act, based on your role and your AI systems.
Your team already uses ChatGPT, Copilot or Gemini. With Audexa you answer the AI Act questionnaire at organization level and, with the AI Governance module, register and classify each use with its obligations and evidence. What you already have in the module arrives as proposed answers, with human review always as the final step.
- 93 controls in 10 sections
- Profile by role and system type
- Connected to AI Governance
93 AI Act questionnaire controls in 10 sections
41 obligations and good practices with dates in AI Governance
113 mappings to ISO/IEC 42001, plus 35 to the GDPR
24 use templates: 21 AI products and 3 generic
What the AI Act requires
The AI Act applies in phases, and some have already arrived.
Regulation (EU) 2024/1689 regulates AI according to its risk. The Digital Omnibus (Regulation (EU) 2026/1744), in force since July 27, 2026, postponed the high-risk obligations but kept those that already applied. Even if you don't develop AI, using it in your business makes you a “deployer”.
August 2, 2025 · General-purpose AI models
Obligations for providers of general-purpose AI models, and the governance and penalties regime takes effect.
August 2, 2026 · Transparency
Article 50 obligations: inform people when they interact with AI and label generated or manipulated content.
December 2, 2027 · Annex III high-risk
High-risk systems in areas such as employment, education, credit or critical infrastructure, following the Omnibus postponement.
August 2, 2028 · Annex I high-risk
AI built into already-regulated products, such as medical devices, machinery or toys.
Penalties
The regulation provides for fines of up to €35 million or 7% of worldwide annual turnover for prohibited practices, with lower amounts for other infringements.
Sources: Regulation (EU) 2024/1689 (EUR-Lex) · AI Digital Omnibus, Regulation (EU) 2026/1744 (Cuatrecasas)
How Audexa helps
Two pieces that feed each other.
The EU AI Act questionnaire measures your organization against the whole regulation. The AI Governance module goes down to each tool. You can use the questionnaire on its own, or both together.
Assess the organization
The EU AI Act questionnaire.
The whole regulation, consolidated
93 controls in 10 sections, from inventory and AI literacy to general-purpose models and internal governance, with Regulation (EU) 2026/1744 already built in.
Prior profile
State your role (deployer, provider, importer, distributor, authorized representative or general-purpose model provider) and your system types. You only see what applies to you.
How to assess and how to comply
Each control comes with steps, expected evidence, a suggested owner, a closure criterion and when to review it.
Govern each use
The AI Governance module.
Guided registration
Add each use from 24 templates with what the provider declares, and get an alert when the software inventory has AI with no registered use.
Indicative classification
Scope, prohibited practices, Annexes I and III, the Article 6(3) exception and transparency, with the articles cited and validation by an accountable person.
Obligations with evidence
Each obligation has a date and an owner, and it closes only with approved evidence.
AI governance across the group
With Sites and group, a read-only inventory of the AI uses of every site, with filters and Excel. Branches see the group's uses in their register, and subsidiaries adopt them with their own assessment.
Prove
Internal proof and external transparency.
AI literacy
Staff surveys with no account required, plus coverage of the signed AI use policy. In a group, the survey is launched to every site, and results per site are only shown with 5 or more responses.
AI incidents
An incident register with the Article 73 reporting deadlines and alerts before they expire. In a group, a serious incident at one site immediately alerts the people in the group who have access.
Transparency page
A public page with your logo and colors, embeddable on your website, with a QR code and PDF.
Some features depend on your plan and active modules.
EU AI Act questionnaire
Answer only what your role requires.
Before you start, you mark your role and the type of systems you use or build: high-risk, transparency, a model with systemic risk, or others. The questionnaire adjusts and walks through the regulation at organization level, control by control, with Yes, Partial, No or Not applicable answers.
- Ten sections, from Article 5 prohibited practices to Articles 53–56 general-purpose models
- Article 27 fundamental rights impact assessment for deployers
- 113 mappings to ISO/IEC 42001 and 35 to the GDPR: a coverage aid, not a legal equivalence
- With Focus mode, each question comes with What they ask of you, Explain it to me and the exact article of the regulation when there is a reliable reference
- Indicative score, findings, task plan and PDF and Excel report
EU AI Act · 10 sectionsPrior profile
- Scope, roles and inventory9 controls
- Prohibited practices (Art. 5)Always answered by a person
- High-risk provider (Arts. 9–21, 43, 47–49, 72–73)24 controls
- Deployer (Arts. 26, 27, 86)13 controls
- Transparency (Art. 50)8 controls
Questionnaire and AI Governance
What you've already registered isn't answered twice.
If you use the AI Governance module, the obligations you've already registered arrive in the questionnaire as proposed answers, with the data that supports them and the approved evidence. You review and confirm them. Without the module, the questionnaire works the same way and you answer it yourself.
- Proposed answers, never confirmed automatically
- Each proposal shows which use and which evidence it comes from
- Prohibited practices are never proposed: a person always answers them
- Questionnaire findings become tasks with an owner
Proposed answersFrom AI Governance
- AI literacy (Art. 4)Proposed with approved evidence
- Chatbot transparency (Art. 50)To review
- Deployer human oversight (Art. 26)To review
- Prohibited practices (Art. 5)Answered by a person
Risk classification
Classify every AI use and understand why.
The module's wizard walks through the regulation's scope, prohibited practices, the high-risk annexes, the Article 6(3) exception and transparency obligations. Each result shows the articles that support it and remains pending human validation. The legal catalogue was updated on October 20, 2026, and uses already assessed are flagged for review.
- New prohibited practice: real-time remote biometric identification for law enforcement, Art. 5(1)(h)
- Article 50(3) biometric categorisation is handled separately from emotion recognition
- New obligations for high-risk providers: Arts. 4a, 25(2) and 25(4)
- Reminders 90, 30 and 7 days before each legal milestone
Transparency
Publish how you use AI, under your own brand.
Generate a public transparency page listing your AI uses, designed with your logo and colors. Only what an accountable person approves is published, and never prohibited or out-of-scope uses.
- Four designs and eight sections you can enable and reorder
- Embeddable on your website, with a badge, QR code and PDF
- Option to keep it out of search engines
- Only owners and administrators can publish
Transparency pagePublished
- How we use AIVisible
- Tools and providersVisible
- Human oversightVisible
- Contact and complaintsVisible
How it works
Three steps to bring order to AI use.
Register and classify
Add tools from templates, get an indicative classification and have an accountable person validate it.
Answer the questionnaire
Choose your role and systems, review the answers proposed from the module and complete the rest with the article for each question in view.
Close and prove
Turn findings into tasks, close obligations with evidence and publish your transparency page.
Frequently asked questions
What people usually ask us about AI Act.
We only use ChatGPT or Copilot. Does the AI Act affect us?
Yes. By using AI in your business you are a deployer: you must support AI literacy among the people who use it and, depending on the use, meet transparency obligations or, if the use is high-risk (for example, recruitment), the specific obligations that will apply from December 2027.
When do the high-risk obligations apply?
Following the Digital Omnibus (Regulation (EU) 2026/1744), the rules for Annex III high-risk systems apply from December 2, 2027 and those for Annex I systems from August 2, 2028. The prohibitions, AI literacy and Article 50 transparency obligations were not postponed.
Does Audexa assess my conformity with the AI Act?
No. The questionnaire and the classification are guidance: they don't replace a conformity assessment or legal advice. They help you prepare the work, show the articles behind each result and are always validated by a person. For complex decisions we recommend legal support.
Do I need the AI Governance module to use the questionnaire?
No. Without the module, the questionnaire works the same way. With it, the obligations you've already registered arrive as proposed answers with their data and approved evidence. Prohibited practices are never proposed.
How does it relate to ISO/IEC 42001 and the GDPR?
The questionnaire has 113 mappings to ISO/IEC 42001, which Audexa includes as a 94-control audit, and 35 to the GDPR. They propose reviewable answers so you can see how much your existing work covers, but they are not a legal equivalence.
Do national AI laws also apply?
The AI Act is an EU regulation, so it applies directly in every Member State. Each Member State designates its own supervisory authorities and sets the rules on penalties, and the status of those national measures varies by country. Check the situation in the countries where you operate.
We are a group with several sites. How is AI governed?
With Sites and group, which Audexa activates on request on Premium (3 sites) and Diamond (5), extendable, you see the AI uses of every site in a read-only inventory. Group uses appear in the branches' register, and subsidiaries adopt them with their own assessment. A serious incident at one site immediately alerts the people in the group who have access, and the AI literacy survey can be launched to the whole group.
Which plan do I need?
The EU AI Act questionnaire and the AI Governance module are available on the Premium and Diamond plans.
Request a demo
Find out how much AI your company uses and what it requires.
In a 30-minute demo we register a couple of real uses, classify them and see how they feed the AI Act questionnaire for your role.
- We identify the most common AI uses in your sector.
- We show you the classification and the obligations it triggers.
- We walk through the questionnaire with your role and systems.