Automatic mapping
Inventory your AI systems — internal, third-party, embedded. Catch Shadow AI before regulators and auditors do. Live map updated as your stack evolves.
Governance · Compliance · Proof · Verifiability
ACF Compliance.Governance, proof and verifiability — for your AI systems.
From inventory to verifiable proof. ACF classifies your AI systems against the AI Act, GDPR and ISO 42001 across 13 jurisdictions, produces the required regulatory artefacts (FRIA, DPIA, Art. 30 register), cryptographically signs every decision (Ed25519 + Ed25519-signed timestamp) and generates defensible board reports. Lawyer Console for your law firm, à-la-carte expert services.
Ou explorer une démo live avec données simulées →
Free auditNo commitmentEU hosting
Built for compliance teams in finance, retail, SaaS, healthcare and industrial groups.
AI Act sanctions if uncontrolled
up to €35M or 7% of revenue
ACF Compliance Console
Agentic compliance score
12/ 100
EU AI Act — Art. 12 traceability, Art. 26 oversightArt. 12, 26(6)
GDPR — Art. 22 automated decisions + DPIAArt. 22, DPIA
ISO/IEC 42001 — AI management systemISO 42001:2023
DORA — financial operational resilienceRTS-ICT 2024
NIS2 — essential entities cybersecurityAnnex I
Scanning regulations...0/5
The platform in practice
Four operational deliverables, one subscription.
ACF Compliance turns the AI governance spec sheet into something your DPO, your CISO and your board can actually use.
Multi-regulator classification
Each system classified against the EU AI Act, GDPR, DORA, NIS2, ISO 42001 and 13 AI jurisdictions (EU, UK, US, Canada, Brazil, Switzerland, Japan...). You see what applies where, subsidiary by subsidiary.
Ready-to-submit documentation
AI policy, DPIA, high-risk system registry, Article 49 register, vendor clauses, due-diligence — generated, versioned and signed. Audit-ready.
Lawyer Console
Your law firm — or an ACF partner firm — accesses your file from the console: enforceable legal opinion, contractual structuring, negotiation, defence in case of audit or litigation. ACF never takes any fees: RIN-compatible model.
Nouveau · Exclusif ACF
Recevez votre plan compliance IA personnalisé
Frameworks applicables, calendrier 90 jours, top 5 obligations, sanctions max, articulation AI Act. PDF complet par email. 5 questions, 2 minutes, gratuit.
Regulatory deadlines
The deadlines that will cost you if you're not ready
Two texts already in force (AI literacy, DORA) and two critical AI Act deadlines over 18 months: enforcement live August 2, 2026, high-risk Annex III deferred to December 2, 2027 by the Digital Omnibus. ACF covers classification, documentation and audit trail for each.
EU AI Act — Enforcement
GPAI sanctions (art. 101) + art. 50 transparency + art. 4 AI literacy + art. 99 general sanctions regime
August 2, 2026
ALREADY APPLICABLE
Sanction max
EUR 15M or 3% of global turnover (GPAI art. 101)
See ACF coverageALREADY APPLICABLE
AI Act — Art. 4
AI literacy — mandatory training for staff using AI
February 2, 2025
ALREADY APPLICABLE
Sanction max
Regulator inspections + CNIL/DPA disciplinary actions
See ACF coverageALREADY APPLICABLE
DORA
Digital operational resilience — financial sector
January 17, 2025
ALREADY APPLICABLE
Sanction max
EUR 10M or 5% of turnover
See ACF coverageEU AI Act — High-risk Annex III
HR, credit scoring, biometrics, justice, education — deferred by the Digital Omnibus (May 2026)
December 2, 2027
J−397
Days left
Sanction max
EUR 15M or 3% of global turnover (art. 99(4))
See ACF coverageThe reality
Your GDPR tools don't cover the AI Act. Your US tools surface-map it.
Historic French GDPR vendors bolt on a thin "AI Act v2" module. US compliance automation leaders resell an ISO 42001 cross-mapping under the AI Act label. The result: you stack 3 to 5 tools, and on audit day, none produces the article 27 the regulator asks for.
60% of companies are in Shadow AI
Your teams use ChatGPT, Copilot, Midjourney and SaaS tools that embed AI. Often with no inventory and no governance. AI Act article 11 demands a complete registry — the regulator does not tolerate a partial inventory.
Stacking 3 tools (GDPR + ISO + AI Act) costs EUR 60K to 250K/year
A French specialist GDPR tool, an ISO 42001 module from a US leader, ad-hoc consulting for the AI Act. Manual re-integration at every audit. ACF covers the 3 cores (GDPR, AI Act, ISO 42001) in a single platform, with 12 transverse frameworks mapped and 13 mapped AI jurisdictions.
ACF — 3 solid cores, 1 platform, 1 cryptographic audit trail
AI Act-native (not a cross-mapping). Ed25519-signed audit trail, third-party verifiable without the platform and admissible as written evidence under French Civil Code art. 1362 and 1366. RIN-compatible Lawyer Console architecture (partner network rolling out). European hosting, Vercel EU by default.
For whom
Four roles. One platform.
ACF Compliance answers the concrete questions of the functions carrying AI responsibility in the enterprise — not a marketing promise, a deliverable per persona.
DPO
GDPR Art. 22 + DPIA
You drive DPIAs, automated decisions and the relationship with data protection authorities. ACF maps all your AI systems, triggers DPIAs at the right time and produces Art. 30 registers ready to present.
Compliance Officer
AI Act + DORA + NIS2
You track 14 regulations in parallel. ACF covers 3 cores in depth (GDPR, AI Act, ISO 42001) and 12 transverse frameworks to give you a unified view — one dashboard, multiple reportings.
CIO / CISO
Independently verifiable audit trail
You need to prove your AI agents did nothing wrong. ACF timestamps each decision with an Ed25519 signature and produces a cryptographic chain that any third party can verify independently — regulator, auditor, insurer or court.
Board / Comex
Quarterly executive view
You want to know whether the company is exposed. ACF produces the signed quarterly report you present without needing an external auditor to certify it — one deliverable, one signature, ten years of probative archiving.
Your deliverables
What you get from day one
Four concrete deliverables, from day one of use.
01
A 3-minute diagnostic
8 plain-language questions. Maturity score, risk level, and an estimate of your financial exposure. No signup needed.
02
A live AI inventory
Automatic scan of your GitHub repos and SaaS exports. Mapped to your EU AI Act obligations. Shadow AI detected.
03
Your documents, ready to hand over
AI policy, DPIA, system fiche, Art. 49 register. PDF and DOCX, timestamped and cryptographically signed.
04
A partner law firm one click away
Pre-filled submission file, conflict check, custom quote. You pay the firm directly, never through us.
Board-ready
The quarterly report your Comex can sign without an external auditor.
ACF Compliance produces a quarterly governance report Ed25519-signed, Ed25519-timestamped, verifiable by any third party with openssl. No more expensive annual audit to reassure the board: the cryptographic proof speaks for itself.
- Executive summary: AI systems inventoried, risk classification, open actions, global score.
- Ed25519 signature + SHA-256 hash chain independently verifiable, without access to your ACF instance.
- Downloadable PDF/A format, ready to archive for 10 years in your probative digital vault.
Q2 2026Ref. ACF-Q2-2026-072
AI Governance Report
Governance Committee — July 15, 2026
AI systems inventoried47systems
AI Act high-risk9to document
Open remediation actions3in progress
ACF Sovereignty Score72/100
Cryptographic signature verified
Ed25519: a2c8…f93e · SHA-256: 4f7b…91d2 · RFC 3161 (option Enterprise) · 07.15.2026 09:42 UTC
The journey
How it works
From diagnostic to action plan, in 4 steps.
- 1
Step 1
You run the diagnostic
8 questions, 3 minutes. You leave with a first score and your top 3 priorities — no signup.
- 2
Step 2
You map your AI systems
Scan repos, SaaS exports, or enter manually. Automatic EU AI Act classification with a confidence level.
- 3
Step 3
You document in one click
The platform generates the required documents. Every artifact is timestamped and signed so it counts as defensible technical evidence (subject to the court's appreciation).
- 4
Step 4
You escalate if needed
3-click submission to a partner law firm. Custom quote, direct payment to the firm.
Platform
Three capabilities, one standard of rigour
From automatic discovery of tools to cryptographic proof of every action — every layer is built to hold up under regulatory scrutiny.
AI Inventory
Mes systèmes IA
Inventaire et classification de votre stack IA
NomClassificationMis à jour
Chatbot service client (ChatGPT-4o)
eu_ai_act
RISQUE LIMITÉ (Art. 50)
05/06/202684/100 — Bonne confiance
Classifier catalogue produits
eu_ai_act
RISQUE MINIMAL (Art. 95)
18/05/202692/100 — Haute confiance
Moteur de recommandation produits
eu_ai_act
RISQUE LIMITÉ (Art. 50)
09/06/202678/100 — Bonne confiance
Détection de fraude paiement
eu_ai_act
HAUT RISQUE (Annexe III)
13/06/202681/100 — Bonne confiance
6 systèmes inventoriés · 1 haut risque+ Nouveau système
Automatic inventory of AI tools deployed in your stack
No more chasing teams to find out what is deployed. The platform scans your environment on demand and keeps the registry up to date.
- SSO connectors for Google Workspace and Microsoft 365: pulls activated apps
- Browser probes (enterprise extension): detects tools opened via the web
- Detection of the main AI tools on the market: ChatGPT, Claude, Gemini, Mistral, Copilot, internal agents, custom RAGs — registry continuously extended
- Automatic dedup and merge for a clean registry
- Shadow AI tagging: any undeclared tool shows up in the table
GDPR Art. 6, 9 and 49 documentation prepared for your team
AI policy, DPIA, Art. 49 register, transparency notices: generated from your inventory, scoped to the right jurisdiction, in under 30 minutes.
- Coverage of Art. 6 (lawful basis), Art. 9 (special categories), Art. 49 (non-EU transfers)
- Lawyer-vetted ACF Standard templates that take CNIL and EDPB guidance into account
- PDF and DOCX export, integrated e-signature
- Versioning: every change is tracked and timestamped
- Multi-jurisdiction: automatic adaptation EU / UK / US / CA / BR / CH / JP
Documents
AIPD, registres, politiques — générés depuis votre inventaire
DocumentTypeStatusGénéré le
AIPD — Détection de fraude paiement
aipd🔒 verrouillé03 mai 2026AIPD — Moteur de recommandation produits
aipd🔒 verrouillé20 mai 2026Registre des traitements RGPD Art. 30
registre_art30🔒 verrouillé02 juin 2026Politique IA interne (Art. 4 AI Act)
ai_policy✏ brouillon11 juin 2026Export par document :
PDF·DOCX
Decision Engine
Journal d'audit cryptographique
Toutes vos décisions de conformité, hachées et signées. Vérifiable en 1 clic.
✓ Vérifier intégrité↓ Exporter PDF certifié
DateActionHash chaîneSignature
11 juin 2026, 22:43a84dcf46302c02...● Signé Ed25519
Document généré
Documents
07 juin 2026, 22:43df9d450eb225f3...● Signé Ed25519
Document verrouillé
Documents
03 juin 2026, 22:439f1e868480e75e...● Signé Ed25519
Création
Systèmes IA
28 mai 2026, 22:43d619e5d7bcc246...● Signé Ed25519
Document verrouillé
Documents
Hash chain SHA-256 + signature Ed25519. Vérifiable indépendamment d'ACF.
Ed25519 audit chain, designed to be admissible under scrutiny (art. 1362 and 1366)
Every event (classification, validation, modification, export) is hashed and signed. The cryptographic chain is verifiable independently — your asset #1.
- SHA-256 hash chain: integrity of the event sequence
- Ed25519 signature per event, key specific to your organisation
- Standalone verification: a third party (auditor, judge, authority) can validate the chain with your public key, without the platform
- Certified signed PDF export downloadable from the dashboard
- Ed25519-signed timestamp
What sets us apart
5 reasons ACF holds where other SaaS bends
Not marketing — code, a cryptographic signature you can verify yourself, and a law firm network. Verifiable on our detailed coverage page.
Our #1 moat
Independently verifiable crypto audit trail — without us
Every AI decision is SHA-256 hashed, Ed25519 signed, chained into a tamper-proof structure and exported as a certified signed PDF. An auditor, judge or regulator verifies your audit trail with any standard Ed25519 verification tool — without installing ACF® or calling us. Ed25519-signed timestamp. Most GRC tools ship an evidence store; ACF ships technical proof designed to be admissible (Civil Code art. 1362 and 1366, subject to the court's appreciation).
Ed25519SHA-256RFC 3161PDF certifié
AI Act-native (not an add-on)
US compliance automation leaders resell an AI Act module mounted on their SOC 2 / ISO 42001 engine. ACF hardcodes AI Act articles 5, 27, 50 + GPAI obligations (art. 53-55) + FRIA art. 27 directly into its engine, with the consolidated post-Digital Omnibus timeline (enforcement Aug 2026, Annex III Dec 2027, Annex I Aug 2028). No ISO 42001 cross-mapping: the real obligation, article by article.
Included in every plan
RIN-compatible Lawyer Console
Compliance platform architecture compatible with the French Bar Association rules (Articles 11.3 / 11.4 RIN). You click "I need an AI Act lawyer" — the request is routed to our partner network, currently being built across European jurisdictions.
Included in every plan
3 cores in depth + 12 transverse frameworks + 13 AI jurisdictions
Three cores coded in depth in the ACF engine today: GDPR (EU Regulation 2016/679), AI Act (EU Regulation 2024/1689, articles 5/27/50 + GPAI + FRIA) and ISO 42001 (AIMS). Every article mapped, D1-D6 scoring wired, Ed25519 audit trail tailored. 12 transverse frameworks mapped: DORA, NIS2, ISO 27001/27701, LGPD, CCPA-CPRA, PIPEDA, CRA, APPI, ISO 23894/42005/5338. Plus 13 non-EU AI jurisdictions (UK, US-Fed/CO/CA/NY, CA, BR, CH, JP, CN, KR, AU, IN) mapped and usable today in the multi-jurisdiction engine. Narrow and deep beats wide and shallow.
Included in every plan
AI Act art. 14 human oversight — every AI decision traced and signed
AI Act art. 14 demands effective human oversight. Other SaaS audit POST-execution and ship logs after the fact, hard to defend. ACF records every classification, validation and escalation in an Ed25519 + SHA-256 signed chain, independently verifiable, designed to demonstrate due diligence in a CNIL or AI Office inspection.
Included in every plan
Credibility
Why ACF Compliance over a US tool
Four pillars that US leaders and historical GDPR specialists do not cover at the same time. Here is the factual verification.
4 principes · 18 KPIs
Proprietary ACF® methodology
4 founding principles, 18 sovereignty KPIs, 17 methodological cards mapped onto EU AI Act, ISO 42001, NIST AI RMF, GDPR.
Ed25519 · RFC 3161
Verifiable cryptographic proof
Open stack Ed25519 + SHA-256 + Ed25519-signed timestamp. A third party verifies your audit trail without accessing your instance — your public key is enough.
3 cœurs + 12 frameworks
Deep coverage, not wide
3 cores in depth (GDPR, AI Act, ISO 42001) instead of 50 frameworks skimmed. 12 transverse frameworks mapped to extend. 13 non-EU AI jurisdictions mapped.
Vercel EU · OVHcloud option
European hosting
Vercel EU region by default (Frankfurt). OVHcloud Gravelines available as an Enterprise option for organizations requiring an exclusively French host.
Comparison
Why AI Act-native beats ISO 42001 cross-mapping
Synthetic comparison vs three competing approaches (without naming vendors publicly).
| Criterion | ACF Compliance | US compliance leaders | French GDPR specialists | Consulting + Excel |
|---|---|---|---|---|
| AI Act art. 5/27/50 + GPAI + FRIA hardcoded (not an ISO 42001 cross-mapping) | ||||
| Independently verifiable crypto audit trail (Ed25519 + SHA-256) — third-party verifiable signature | ||||
| RIN-compatible Lawyer Console architecture (partner network rolling out) | ||||
| 3 cores in depth (GDPR, AI Act, ISO 42001) + 12 transverse frameworks mapped + 13 AI jurisdictions | ||||
| EU sovereign hosting (no CLOUD Act exposure) |
Natively coveredPartial or via cross-mappingNot covered
Sources: product audit of the top 5 AI / GDPR compliance SaaS, May 2026. Detailed table available on the product page.
Pricing
The right plan for your AI compliance level
Free Flash Diagnostic in 3 minutes (no signup required). Guided 30-min demo on request for Business plans and above.
Pro
SMEs, startups, e-commerce (€5M–€50M)
On request
- 25 AI systems
- 3 users
- Auto-inventory: 10 scans / month
- No commitment
Most popular
Business
Structured SMEs and mid-market (€50M–€200M)
On request
- Unlimited systems
- 10 users
- API + ACF Pulse widget
- Guided demo included
Enterprise
Large groups 5,000+ employees or > €1.5B revenue
On request
- SAML SSO + multi-organizations
- White-label
- Sovereign hosting
- Premium SLA (99.9% + 4h support)
Free resources
Download our expert guides
Three practical resources for DPOs, CISOs and Compliance teams. PDFs delivered by email, no commitment.
Free
AI Act for mid-market: 30-point checklist
Step-by-step mapping of your obligations art. 6-49 — 12 pages
Free
DPO and AI compliance: 10 obligations for 2026
GDPR × AI Act alignment for DPOs — 8 pages
Free
The hidden cost of AI non-compliance in Europe
2024-2026 sanctions benchmarks + compliance ROI — 16 pages
FAQ
Your questions, our answers
Everything DPOs and Compliance Officers ask us before signing.
Calculator
Calculate your financial exposure in case of non-compliance
Indicative, based on the AI Act regulation + effective 2024-2026 sanctions. Inputs are processed in your browser, nothing is sent until you submit.
Step 1
Estimated financial exposure
Calculating...
Indicative estimate — based on regulatory caps for AI Act (7% turnover), GDPR (4% turnover), DORA and sector amplifiers.
ACF Compliance delivers your regulatory documentation ready for signature in 4 weeks. Internal adoption remains your own timeline.
The AI Act doesn't cross-map. It applies.
Prohibited practices art. 5 already applicable since February 2025, GPAI since August 2025. On August 2, 2026, enforcement goes live (GPAI sanctions, art. 50, art. 4). By December 2, 2027, your high-risk Annex III systems must be ready — 18 months to map, classify, document and audit. ACF was born AI Act-first: articles 5, 27, 50 + GPAI + FRIA hardcoded, independently verifiable Ed25519 crypto audit trail. Free 3-minute diagnostic, no signup.