AI governance infrastructure.
Always current.
Automated risk classification, regulation monitoring, and obligation mapping for AI systems deployed in the EU.
The regulation never stops changing
The EU AI Act is already law. Enforcement is phased, and the deadline for high-risk AI systems — the category most AI products fall into — is August 2026. Fines are calculated on global turnover. A static compliance report expires the moment it's signed.
Penalty Structure
Enforcement Timeline
See the platform in action
Connect your AI systems. The platform classifies risk, finds compliance gaps, and keeps everything current. This isn't a report — it's a working dashboard.
Classification result
High riskTriggered articles
Gap analysis
4 gaps foundSystems overview
Risk distribution
Systems
Recent webhook events
Connect. Analyze. Monitor. Update.
Connect
Connect your code repository. The platform reads your AI system architecture and begins ingestion automatically.
Analyze
The system analyzes your code repository and maps it to obligations across all 113 articles of the EU AI Act and its annexes. Every finding traces to a specific Article.
Monitor
Artifacts are generated for every gap: compliance documentation, risk classifications, and obligation maps you can review and act on.
Update
Risk is constantly reevaluated on every code change. Relevant artifacts are created automatically — you stay compliant without breaking a sweat.
Always current. Always in scope.
Always Current
The EU AI Act changes. Your compliance posture changes with it. Every code push triggers immediate re-analysis and artifact updates. A static report expires. The platform doesn't.
AI-Native by Design
The automated engine handles the document density: 113 Article checks across Annex III/IV. Every finding traces to a specific Article. Human experts review and sign every finding.
Human Accountable
A credentialed expert signs every deliverable — SANS/GIAC-certified, 12+ years GRC. Independent auditor provides methodology advisory and QC.
Inside EU jurisdiction
Registered in Tallinn. EU law governs our contracts. No US CLOUD Act exposure. Not a US firm retrofitting its playbook.
Built for teams that ship AI in the EU
Annex III High-Risk AI Providers
Building or deploying AI in biometrics, critical infrastructure, education, employment, essential services, law enforcement, migration, or justice. The platform maps your obligations and keeps them current as regulations evolve.
B2B SaaS with EU Enterprise Customers
Your EU enterprise buyer's RFP now includes AI Act compliance questions. The platform produces the evidence package — risk classification, gap analysis, compliance roadmap — ready for audit.
GPAI Model Providers
Building or fine-tuning general-purpose AI models. GPAI obligations started August 2025 — already enforceable with €15M+ fines. The platform builds and maintains your documentation continuously.
Latest on EU AI Act compliance
Guides, analysis, and practical advice for teams preparing for enforcement.
When Compliance Becomes a Cover-up
An agency failed a security assessment. Instead of fixing the gaps, they submitted a false all-passing survey. The remediation would have cost €35K. The cover-up cost them €7M in revenue.
Read → 2026-05-12EU AI Act: What Every Startup Needs to Know Before August 2026
The enforcement deadline is fixed. Most companies deploying AI in the EU are not ready. Here is what the regulation actually requires, and what happens if you ignore it.
Read → 2026-04-28Risk Classification Under the EU AI Act: A Practical Guide
Most companies get classification wrong. Here is why it matters, how to do it well, and what to expect at the edges.
Read →Common questions about EU AI Act compliance
What is the EU AI Act?
Regulation 2024/1689 — the world's first comprehensive AI regulation. It classifies AI systems by risk level and imposes obligations on providers and deployers across Articles 4–53 and Annexes I–IV. High-risk AI requirements take effect August 2026.
Does the EU AI Act apply to my company?
If you develop, deploy, or distribute AI systems in the EU market, yes. The regulation applies regardless of where your company is headquartered. Non-EU companies selling AI products into the EU are in scope.
What happens if we don't comply?
Fines are calculated on global turnover. For high-risk AI violations under Articles 4–49: up to €15M or 3% of global annual turnover. For prohibited AI practices: up to €35M or 7%. For incorrect information: up to €7.5M or 1.5%.
How does the platform work?
You connect your code repository. The platform analyzes it against 113 articles of the EU AI Act and generates compliance artifacts for every gap. Every code push triggers immediate re-analysis and artifact updates.
How is this different from a consultancy?
Consultancies deliver a report that goes stale the moment it's signed. Thorian's platform keeps your compliance posture current — every code push triggers immediate re-analysis, artifacts update automatically, and regulation changes are monitored continuously.
Why does being an EU-registered entity matter?
Registry code 16843232. VAT EE102868027. Registered in Tallinn since October 2023. EU buyers and their legal counsel can contract with us directly — we're inside EU jurisdiction.
What's included with the platform?
Full workspace access: risk heatmap, gap analysis, compliance roadmap, regulation monitoring, obligation mapping, and immediate artifact updates on every code push. Everything is live and continuously refreshed.
Can I export my data?
Yes. All artefacts, risk maps, and compliance data are available for download at any time. You own your data.
Is this like Vanta or Drata?
Different. Vanta and Drata are evidence-collection platforms for pre-existing controls. Thorian is built around EU AI Act-specific compliance — risk classification, Annex III obligations, gap analysis, regulation change tracking.
See the platform in action
Walk through the dashboard, see how CI/CD integration triggers continuous monitoring, and discuss your AI systems with our team.