Nine questions. Honest dates. Your gaps.

Everything runs in your browser - no email wall, nothing stored. Dates reflect the June 2026 Digital Omnibus (ST 9247/26). This is a readiness sketch, not legal advice.

Q1 What is your relationship to the AI system?

We build and sell it (provider)We use someone else's system (deployer)Both - we build on a model and deploy it

Q2 Where does it touch the EU?

We are established in the EUNo EU entity, but our system's output is used in the EUNo EU users or customers at all

Q3 Does it operate in a high-risk area (Annex III): employment, credit or insurance decisions, education, essential services, law enforcement, migration, justice?

YesNoNot sure

Q4 Do people interact with it directly (chat, voice, agent)?

YesNo - it runs behind the scenes

Q5 Does it generate synthetic content (text for publication, images, audio, video)?

YesNo

Q6 How are agent events logged today?

Tamper-evident audit trail (append-only, verifiable)Ordinary logs / observability toolingNot systematically logged

Q7 How long are those logs kept?

Six months or more, enforcedLess than six months, or plan-dependentNo retention policy

Q8 When a human approves, overrides, or reviews the AI, is that recorded as evidence?

Yes, systematicallyNo, or only in tickets and chat

Q9 Are users told they are interacting with AI, and is that disclosure recorded?

Disclosed and recordedDisclosed, but not recorded anywhereNot disclosedNot applicable - no direct interaction

AttestAI - the audit ledger for AI agents.Contact / hello@attestai.example