Open source · MIT licensed · Built in Europe

Turn EU AI Act obligations into work you can prove.

AssureCtrl gives teams one connected place to inventory AI systems, classify their role and risk, scope applicable obligations, and keep the reasoning, evidence, risks, actions, incidents, and monitoring behind every decision.

Explore the platform View on GitHub
Rules stay inspectable Self-hostable Built on Frappe
AI-SYS-2026-004 Customer credit decisioning
High-risk
System registered Purpose, owner and vendor recorded 01
Operator role confirmed Provider duties selected 02
Risk tier classified High-risk · Annex III 03
Obligations scoped Applicable work areas generated 04
Evidence connected Documents and decisions linked 05
Monitoring live Controls healthy · next review scheduled 06
Workflow mapped 0%
Built for transparent governance
MIT licensed Self-hostable EU AI Act first Frappe + Vue Versioned decisions

One connected control loop

From “what AI do we use?” to
“show me the record.”

AssureCtrl turns a changing regulation into an operational workflow. Each step produces structured work that stays connected to the system it governs.

01

Inventory

Know which AI systems exist, what they do, who owns them, and where they are in their lifecycle.

02

Classify

Assess operator role, prohibited practices, high-risk triggers, derogations, and transparency duties.

03

Operationalize

Generate applicable work areas with owners, progress, evidence, risks, and corrective actions.

04

Document

Adapt structured policies and technical-documentation templates without losing their history.

05

Monitor

Track controls, KPIs, incidents, deadlines, and the work needed when something moves off track.

5operator roles
4classification tiers
26mapped obligations
11starter risks
4document templates

Workflow · Classification

Classify the system.
Keep the reasoning.

Step 01 · Scope

One guided path through role, risk, and transparency.

The classifier asks the questions that determine what happens next—from your organisation’s operator role to Article 5, Annex I and III, Article 6(3), and Article 50 triggers.

  • Five operator roles supported
  • Versioned assessments with article references
  • Documented reasoning, including derogations
Classification assessment · v3 Customer credit decisioning
In progress
High-risk indicators · Annex III

Where is the AI system used?

Select the area that best matches the system’s intended purpose.

Essential private and public services
Step 3 of 4

Step 02 · Execute

Turn the outcome into work areas automatically.

Classification generates an additive obligation plan for each AI system. Teams can assign work, change status, link notes and documents, and see progress without rebuilding a spreadsheet every time the assessment changes.

  • Obligations scoped by role and tier
  • Evidence stays attached to the requirement
  • Progress visible per system and portfolio
Obligation workspace Customer credit decisioning
0/4 done
Selected work complete0%
Article 9Risk management system Pending
Article 10Data and data governance Pending
Article 14Human oversight Pending
Article 15Accuracy, robustness and cybersecurity Pending

Connected capabilities

Compliance work should not live in separate tabs.

Every module shares the same AI-system record, so the connection between a rule, a risk, an action, and the proof behind it stays visible.

Foundation

AI system registry

A single inventory for purpose, vendor, ownership, lifecycle, operator role, and classification.

  • System-level workspaces
  • Lifecycle and portfolio views
  • Structured accountability
02

Classification & obligations

Versioned classification reasoning that generates role- and tier-specific compliance work.

  • Article-aware decision trail
  • 26 mapped obligations
  • Status and progress tracking
03

Headstart content

Editable working templates that move through review and approval without losing their baseline.

  • AI policy and Annex IV
  • FRIA and oversight SOP
  • Branded PDF export
04

Risk management

Starter and custom risks, live scoring, treatment plans, review history, and a dynamic 5×5 map.

  • Annex III suggestions
  • Risk movement history
  • Officer-gated acceptance
05

Actions & incidents

Track corrective work and serious incidents with owners, due dates, reporting windows, and escalation.

  • Kanban action queues
  • 2, 10, and 15-day deadlines
  • Linked corrective actions
06

Controls & monitoring

Follow KPI trends, receive threshold states, and ingest signed metrics from external systems.

  • KPI history and sparklines
  • Healthy, breached, and stale states
  • HMAC-signed webhook

Open source by design

Compliance infrastructure you can inspect.

The classification rules, obligation matrix, domain model, and application code live in the open. Run AssureCtrl on your own infrastructure, adapt it to your organisation, and contribute improvements back under the MIT license.

MIT licensed Docker development stack Domain-driven architecture Officer, contributor & auditor roles

AssureCtrl is working compliance tooling, not legal advice. Its regulatory mappings and templates should be independently reviewed for your use case.

Open-source repository AssureCtrl / assurectrl
MIT
assurectrl/Frappe application
classificationrules + reasoning
complianceobligations + evidence
riskassessment + treatment
monitoringKPIs + control metrics
frontend/Vue 3 + TypeScript
tests/domain + integration
Public repository MIT · Contributions welcome
Explore the repository

Start in the open

Build a compliance record
your team can actually use.

Explore the code, run the platform locally, and help shape practical open-source infrastructure for responsible AI in Europe.

View on GitHub Contribute an idea
No licence fee · Self-hostable · Contributions welcome