EU AI Act Tooling: How to Evaluate Compliance Software

This section is for anyone who has been handed a deadline and a budget line and now has to choose software. The guides here are evaluation frameworks, not rankings. They start from what Regulation (EU) 2024/1689 obliges you to produce, then work backwards to the questions you should put to any vendor — including us.

A disclosure first, because it should change how you read everything below. Confir publishes these guides, and Confir makes an EU AI Act compliance tool. You will not find another vendor named, scored, or ranked anywhere in this section. That is deliberate: a league table written by a participant is worth very little, and the criteria are more useful to you than our opinion of who meets them. Apply the questions below to Confir with exactly the scepticism you would apply to anyone else.

Start from the deadline and the artefact, not the feature list

Work out what you must be able to hand a market surveillance authority, and by when. Under the Digital Omnibus adopted in June 2026 (European Parliament 16 June, Council 29 June; it enters into force on publication in the Official Journal), stand-alone high-risk systems on the Annex III list must comply by 2 December 2027. High-risk AI embedded as a safety component in an Annex I regulated product has until 2 August 2028. The Article 5 prohibitions and the Article 4 AI literacy duty have applied since 2 February 2025. GPAI obligations have applied since 2 August 2025. General Article 50 transparency applies from 2 August 2026, and the Article 50(2) content-marking duty from 2 December 2026 — a different date, and one frequently conflated with the Annex III deadline.

Those dates set the shape of the decision. If you are high-risk under Annex III, the deliverable is a complete Annex IV technical file, an Article 43 conformity assessment, a signed Article 47 EU Declaration of Conformity, and registration under Article 49. A tool that cannot end at those artefacts is a workflow tracker, whatever its category label says.

The questions worth asking

Does the tool encode the Regulation itself, or a generic control framework? There is a real difference between software that implements Article 6 and the eight Annex III headings as explicit logic — including the Article 6(3) filter and its hard limit, that any system profiling natural persons is high-risk regardless — and software that hands you a configurable questionnaire to populate yourself. The second is a spreadsheet with permissions.

Does every output trace to an Article? Ask to see a finding. It should read as a citation: high-risk under Article 6(2) / Annex III point 4(a), because the system screens job applicants. A classification you cannot trace back to a provision is not defensible when a regulator asks how you reached it.

Is the output reproducible? Put the same intake in twice. A rule-based engine returns the same tier, the same role, and the same fired rule every time. If the output moves with phrasing, you cannot reconstruct the reasoning behind a declaration you have already signed.

Can it actually produce the artefacts? Annex IV technical documentation across all nine areas — not a PDF summary. The Article 27 Fundamental Rights Impact Assessment, for the deployers who genuinely owe one: public bodies, and deployers of Annex III creditworthiness (point 5(b)) or life and health insurance (point 5(c)) systems. The Article 47 Declaration of Conformity as a document someone can sign.

Does it survive market placement? Compliance does not end at CE marking. Article 72 requires a post-market monitoring plan that tracks real-world performance against the technical file, and Article 73 requires serious incidents to be reported to the market surveillance authority. Article 12 logging matters here, and so does the Article 25 role shift: put your brand on a high-risk system, or substantially modify it, and you become the provider with the full obligation stack.

Where is the data hosted, and who can reach it? You are putting system descriptions, training-data provenance, and incident records into this tool. Ask where it sits and which sub-processors are involved.

Does it cover both roles? Most companies are a provider of one thing and a deployer of another. Provider duties (Articles 9–15, 17, 43, 47, 49) and deployer duties (Article 26, plus Article 27 where it applies) are different obligation sets. A tool that handles only one leaves a gap.

What these guides deliberately do not do

They do not rank vendors, and they do not compare Confir against named competitors. They also do not treat every question as one software can answer. Counsel is the right instrument for genuine edge cases — whether a use case lands in Annex III at all, whether an Article 6(3) exemption will hold. Tooling is the right instrument for the repeatable work: classification, the register, the technical file, the monitoring loop. Most organisations need both.

How Confir helps

Confir is a rule-based, deterministic EU AI Act tool. Guided intake, automatic classification against Article 6 and Annex III, auto-scoped controls, the Annex IV documentation pack, the Article 27 FRIA, the Article 47 Declaration of Conformity, Article 50 transparency, an AI Model Register (Article 25), a roles register, an immutable audit log (Article 12), post-market monitoring (Article 72), and Article 73 incident reporting — surfaced in a Risk Cockpit, EU-hosted. The same intake produces the same output, with the rule that fired shown in plain language.

And the honest disqualification: Confir covers the EU AI Act, and only the EU AI Act. If what you need is multi-framework consolidation — ISO/IEC 42001, NIST AI RMF, SOC 2, and the AI Act in a single register — Confir is the wrong tool, and you should buy something built for that. The GPAI provider workflow (Articles 51–55) is partial and remains on the roadmap; if you train foundation models yourself, that is a gap you should weigh before choosing.