Governance & evidence
Conformity Assessment Room
EU Declarations of Conformity, CE Marking, Conformity Records, EU Database Registration confirmations and Substantial Change Notifications are the five document types that require a conformity lock (ComplianceChecklist overall_status locked) before they can be generated. The Conformity Assessment Room exposes only those five plus the audit chain to an external reviewer, without an admin seat.
Transcript
EU declarations, CE marking, conformity records, database registrations and change notifications are the five types that require a conformity lock.
A notified body should not need a full admin account. A time-limited token room with a one to sixty day expiry is the least-privilege shape.
Create a conformity link with a label like Notified Body XYZ and copy it once. It is not shown again in the list.
The reviewer opens the portal with no login and sees per-system locked versus not locked, the five gated document types, and the hash-chain badge.
One click produces a ZIP with manifest, systems conformity CSV, documents CSV and evidence index, with the chain tip hash pinned inside.
Why this is required
An auditor who needs to see conformity evidence should not need a full admin account, and should not see every draft document, every vendor name, or every team member's email. A token-scoped read-only room with a 1–60 day expiry is the least-privilege shape for this review.
Conformity assessment is also where a hash-chain break matters most: a notified body needs to verify the audit trail is still internally consistent independently of the app that generated it, not just that the documents exist.
What EuroCompliant does
ConformityInvite (models.py:556) mirrors AuditorInvite's shape (token_urlsafe 48, 1–60 days, used_at) but is a separate table so auditor-workspace invites and conformity-room invites have independent retention and do not co-mingle in listings.
POST/GET /conformity/invites and DELETE /conformity/invites/{id} are the admin surface (JWT). GET /conformity/portal/dashboard|export|verify are the public token surface: the dashboard shows per-system conformity_locked via _checklist_is_conformity_locked, the five gated doc types, and the audit chain tip + fingerprint; the ZIP export contains manifest.json (chain tip, chain verified, workspace conformity) plus systems_conformity.csv, documents.csv and evidence_index.csv.
Frontend /settings/conformity manages invites (shown once, copy now) and the public /(public)/conformity/portal?token= is the read-only room with a one-click ZIP export.
Walking through it
Create a conformity link
Choose a label like 'Notified Body XYZ, Q4 audit' and a 7/14/30/60-day expiry. Copy the link once, it is not shown again in the list.
Open /settings/conformity →Share the link with the notified body
The reviewer opens /conformity/portal?token=… with no login. They see per-system locked vs not locked, the five gated document types, and the chain verification badge.
Open /settings/conformity →Export the conformity package
One click in the room produces a ZIP with manifest, systems conformity CSV, documents CSV and evidence index CSV, with the chain tip hash pinned inside the manifest.
Open /settings/conformity →The law
Conformity assessment
Assessment route decision and procedure tracking for high-risk AI systems.
EU declaration of conformity
Drawn up and signed per Annex V, gated behind a conformity lock.
CRA conformity module
Provider self or third-party assessment, tracked via the same conformity room.
Frequently asked
How is this different from the Auditor Workspace?
Different invite table, different expiry (60 days vs 30), different doc filter (5 locked types only vs auditors' broader posture/sampled evidence), and different manifest workspace tag (conformity vs audit). Same token entropy and tenant isolation otherwise.
What does conformity_locked mean per system?
Whether that system's ComplianceChecklist overall_status is locked via _checklist_is_conformity_locked, i.e. 100% items completed and the lock hash verified. Only then can the five gated documents be generated for that system.
Related guides
Automated document generation and cryptographic signing
Generate regulator-ready documents from your own data, then download a signed PDF an auditor can verify independently.
Evidence vault & audit trail
Turning completed checklist items into artefacts a regulator can inspect, and the logging duties behind Articles 12 and 26.
Compliance checklists
How Articles 9 to 15 become tracked, owned, evidenced work rather than a document nobody reads.
Try it on your own systems
Everything in this guide runs in the live product. Start a free trial and follow along with your own data.
Start free trial