A
Build it in-house
200–350 hours of engineering + legal time. No structured Annex IV, no provenance trail, no audit-ready output.
We read your repo, model registry, wiki, and monitoring, then produce one PDF across EU AI Act, GDPR, DORA, and NIS2 — structured, evidenced, and ready for your compliance officer to sign. In five business days.
The four binding regulations sit at the centre. Around them, the standards your auditor, your insurer, and your board increasingly expect — all cross-referenced in one dossier.
No regulator publishes a Word file labelled Annex IV. The regulation names the headings and leaves the structure, the evidence, the prose, and the cross-references to you — and the same is true of GDPR Art. 35, DORA Arts. 5–14, and NIS2 Arts. 20–23. So how do you actually produce one?
200–350 hours of engineering + legal time. No structured Annex IV, no provenance trail, no audit-ready output.
€150k+ and 12–16 weeks for a slide deck and a Word document — not a structured technical-documentation file.
€20–80k/year. Useful for inventory, but the platform doesn't write your Annex IV. You still type it into a dashboard, and no one verifies it.
A platform is a dashboard you fill in. Annexo does the work for you.
Click a step to expand it. We do the work end to end and hand you an audit-ready dossier; your compliance officer reviews and signs.
GitHub or GitLab deploy key. A scoped API token for your model registry. Viewer access to one wiki space and your monitoring dashboard. Read-only throughout — we never write to your systems.
A combined PDF for human reading and machine-readable JSON for your GRC pipeline. A provenance pointer on every claim, all the way back to the source you control.
Enforcement begins 2 August 2026, and Big-4 engagement queues are already filling for Q1 2026. Your dossier needs to be drafted now to be ready then.
A governance platform makes your team do the work inside a tool. Annexo does the work itself and hands you an audit-ready document — structured, evidenced, and ready to sign.
The AI Act (Art. 47 / Annex VI), GDPR (Art. 35), DORA, and NIS2 all make the provider or controller the signer. We make that signature defensible with structure and provenance; an independent legal review is available as an add-on.
We confirm your Annex III category, the regulations in scope, and your four sources. You decide whether to proceed. No commitment until you sign the engagement letter.