AI governance
Every AI tool in use, with an owner and a class.
Eurus keeps an AI-use register: each AI system with its provider, owner, purpose, class under the AI Act, the data going in, its oversight and its next review. An AI tool newly given access through a connected directory is raised, with a fix that leads to the register.
Finding the AI in use
A connected directory is read again on its schedule. An app given access since the read before is raised, and a known AI product is named as one.
From the directory
A directory read that finds an app given access since the read before raises an alert naming the app and its publisher. Okta's directory is read this way today.
Named as AI
ChatGPT, Claude, Gemini, Copilot, meeting note-takers and other known AI products are named as AI tools, by the app's name or its publisher.
The fix
Find who added it and what it reads. Then add it to the register and work out its class, or remove it in the directory and read again.
Cleared when it goes
An app that loses access clears its alert at the next read.
The AI-use register
Each system
Its provider, whether the business provides or deploys it, its purpose, who uses it, the model in use, the data going in and where its documentation is kept.
An owner and a review date
The person accountable for it is someone in the business. A review past its date is raised.
Approved again after a change
A change of model or provider is kept with its date, and asks for the system to be reviewed and approved again.
Try this in a copy of your own, for two hours, with nothing to sign up for.
Open your own copyIts class under the AI Act
The guided check reads Article 5's prohibited practices, Article 6 and Annex III for high-risk uses, and Article 50 for transparency, and names the provisions behind the class it gives.
What the Act and the GDPR ask, system by system
A prohibited practice
A system recorded as one is raised to stop (Article 5).
Human oversight
A high-risk system the business deploys needs people named to oversee it, and its instructions for use recorded (Article 26).
Telling people
Where people deal with an AI system, the provider's duty to tell them (Article 50(1)) and a deployer's narrower duties are named.
AI literacy
Measures recorded for the people who use each system (Article 4).
Personal data
Personal data reaching a provider needs a processing agreement, or a record of why none is needed (GDPR Article 28).
Want this on your own systems? It starts with an audit of how your business really runs.
Book an auditWhere Eurus itself uses a model
Ask answers questions from a business's records with Claude, from Anthropic, through tools that change nothing. It is off until an admin switches it on.
Want it on your own systems?
We start with an audit: how your operations really run, mapped to the controls you keep.