Prove what your AI did against the EU AI Act, gaps and all.
AYA Conformity Pack runs real verification gates over your system and renders an evidence report that maps each of Articles 9 through 15 to a check that actually ran, and tells you plainly which articles you cover and which you do not. Not a green checklist you have to defend, a report an auditor can read (including the parts that are still gaps).
Request a pack on your own system See a sample Art. 9-15 report
THE PROBLEM
The EU AI Act does not care about your slide deck. As of August 2, 2026, the high-risk obligations in Articles 9 through 15 (risk management, data governance, technical documentation, record-keeping, transparency, human oversight, and accuracy plus resilience plus cybersecurity) become live requirements with a date on them, not future homework. And the usual response, a GRC checklist tool that lets you tick a box green and self-attest, is exactly the artifact that dies in diligence, because the moment an auditor asks "which check produced that green, and when did it run," the checklist has no answer. A green you cannot trace is worse than an honest gap, it is a liability you have written down and signed.
HOW IT WORKS
Conformity Pack does not issue a certificate, and it does not pretend to (we are not a notified body, and this is not a conformity assessment or legal advice, we say that on the tin). What it does is point AYA's real verification engine at your target, the same gates AYA runs on itself (the PII and secret linters, the fail-closed auth checks, the tenant-isolation linter, the no-overclaim claim gate), and then map each of Art. 9-15 to the check that actually executed. For every article you get one of three honest verdicts, COVERED (a static enforcing check ran, here is its evidence path), RUNTIME-OVERLAY (runtime enforcement evidence exists), or DECLARED-GAP (no check enforces this, and we are telling you so instead of coloring it green). Nothing is fabricated, nothing is rounded up.
WHAT YOU GET (the evidence report)
One auditable report over your target, in the same EXECUTED / DECLARED / PARTIAL grammar AYA uses on itself: - one row per article across Art. 9 through 15, each carrying its coverage status and, where covered, the concrete evidence path (a real file under the verification reports directory), - an explicit gap ledger, the articles with no enforcing check surfaced as uncovered rows, not quietly omitted, - the covered slices named precisely, so a partial control (say, the cybersecurity slice of Art. 15) is never rendered as whole-article conformity, - a certification disclaimer, in writing, so nobody downstream mistakes an honest posture for an assessment we did not perform.
A report that survives diligence precisely because it refuses to overclaim.
WHO IT'S FOR
Teams placing or operating a high-risk AI system in the EU who face the Art. 9-15 obligations and want defensible evidence instead of compliance theater, first, then RegTech and GRC platforms that want to embed a per-framework evidence engine. If a wrong claim about your AI's compliance can end up in front of an auditor, a regulator, or a board, this is for you. If you want a certificate, we cannot and will not issue one, and that is not what this is.
PRICING (the ladder)
We price the ladder, not a single number, and every number below is a hypothesis we validate with you, not a commitment. - Pack, a fixed-price EU AI Act Art. 9-15 evidence report on your own system. You see the covered slices, the declared gaps, and the evidence paths before you commit to anything. - Per-framework subscription, recurring, one rulepack per framework (EU AI Act today, more named regs as they land), regenerating the report as your gates and evidence refresh. - Platform, license the compliance-evidence engine and the rulepack authoring surface into your own GRC or RegTech stack.
IP is licensed, never assigned. The engine stays ours, the evidence is yours. Any step that takes your money is gated and confirmed before it runs, nothing charges silently.
THE PROOF (dogfood)
We run this on ourselves before we sell it. The engine that renders your Conformity Pack is the exact engine that produces AYA's own internal gate reports, and the EU AI Act rulepack maps AYA's own executing checks (the DAT linter, the fail-closed Bouncer, the RLS tenant-isolation linter, the claim gate that blocks us from overclaiming) onto Articles 9 through 15. So the first target this pack can honestly grade is AYA's own codebase, and when it does, it returns three covered controls, one runtime-overlay, and six declared gaps, the same honest shape you would receive. The rulepack itself was validated and scored before this page was written, and every pattern it leans on was confirmed to resolve on disk.
Design partner zero is a regulatory-compliance platform, the integration conversation is dated (the week of July 20, 2026). case study to follow
HONEST NOTE
We would rather under-promise. Six of the ten controls this pack maps are declared gaps today (the risk-management process of Art. 9, the technical documentation of Art. 11, enforcement of the record-keeping in Art. 12, proof of the human oversight in Art. 14, and the data-quality slice of Art. 10 and the accuracy-and-resilience slice of Art. 15), because AYA has no gate that enforces them, and we surface every one as an explicit uncovered row rather than imply a coverage we do not have. What the pack has NOT done yet is run end to end against a live target, the engine composes on disk and the rulepack is valid, but no mesh was booted and no dated report was rendered for this release, and that first live run is the natural next step once the environment is up. This is not a conformity certificate, and where a control is a gap we tell you, we never manufacture a green. That refusal to fake certainty is the whole product.
Request a pack on your own system
*This page is a specification. The capability it describes is not built yet, and nothing here is a claim that it runs today.*