Governance & evidence
Conformity Assessment Room
Before placing a high-risk AI system on the EU market, you need a conformity assessment. The Conformity Assessment Room gives an external reviewer time-limited, read-only access to the five key conformity documents (EU Declaration of Conformity, CE Marking, Conformity Record, EU Database Registration, and Change Notification) without needing a full admin account.
Transcript
EU declarations, CE marking, conformity records, database registrations and change notifications are the five types that require a conformity lock.
A notified body should not need a full admin account. A time-limited token room with a one to sixty day expiry is the least-privilege shape.
Create a conformity link with a label like Notified Body XYZ and copy it once. It is not shown again in the list.
The reviewer opens the portal with no login and sees per-system locked versus not locked, the five gated document types, and the hash-chain badge.
One click produces a ZIP with manifest, systems conformity CSV, documents CSV and evidence index, with the chain tip hash pinned inside.
Why this is required
An auditor who needs to see conformity evidence should not need a full admin account, and should not see draft documents, vendor details or team emails. A token-scoped read-only room with a limited expiry is the least-privilege approach.
Conformity assessment is also where the audit trail matters most: a notified body needs to verify the evidence chain is internally consistent.
What EuroCompliant does
Create a time-limited link with a label and expiry. The reviewer opens it with no login and sees per-system conformity status, the five gated document types, and the audit chain.
One click produces a ZIP export with a manifest, systems conformity data, documents list and evidence index.
Walking through it
Create a conformity link
Choose a label like 'Notified Body XYZ, Q4 audit' and a 7/14/30/60-day expiry. Copy the link once, it is not shown again in the list.
Open /settings/conformity →Share the link with the notified body
The reviewer opens /conformity/portal?token=… with no login. They see per-system locked vs not locked, the five gated document types, and the chain verification badge.
Open /settings/conformity →Export the conformity package
One click in the room produces a ZIP with manifest, systems conformity CSV, documents CSV and evidence index CSV, with the chain tip hash pinned inside the manifest.
Open /settings/conformity →The law
Conformity assessment
Assessment route decision and procedure tracking for high-risk AI systems.
EU declaration of conformity
Drawn up and signed per Annex V, gated behind a conformity lock.
CRA conformity module
Provider self or third-party assessment, tracked via the same conformity room.
Frequently asked
How is this different from the Auditor Workspace?
Different invite table, different expiry (60 days vs 30), different doc filter (5 locked types only vs auditors' broader posture/sampled evidence), and different manifest workspace tag (conformity vs audit). Same token entropy and tenant isolation otherwise.
What does conformity_locked mean per system?
Whether that system's ComplianceChecklist overall_status is locked via _checklist_is_conformity_locked, i.e. 100% items completed and the lock hash verified. Only then can the five gated documents be generated for that system.
Related guides
Automated document generation and cryptographic signing
Generate regulator-ready documents from your own data, then download a signed PDF an auditor can verify independently.
Evidence vault & audit trail
Turning completed checklist items into artefacts a regulator can inspect, and the logging duties behind Articles 12 and 26.
Compliance checklists
How Articles 9 to 15 become tracked, owned, evidenced work rather than a document nobody reads.
Try it on your own systems
Everything in this guide runs in the live product. Start a free trial and follow along with your own data.
Start free trial