Evidence as code for the EU AI Act

Turn the EU AI Act into files your auditor can open.

Four open-source tools, each built for one main article of the Act. Run one and you get the evidence as a file you keep. Free under Apache 2.0, and they run on your machine.

Install command: pip install riskforge==2.0.0

Apache 2.0 · Python 3.11 or newer · runs locally · zero telemetry

Read the docsFor security and procurement teams
riskforge, terminal transcript
$ riskforge init --name 'Loan Scoring Model' --sys-version 2.1 --purpose 'Automated credit scoring for retail loan applications.' --provider 'Acme Financial Services (fictional)' --category essential_services
✓ Initialised RiskForge project: Loan Scoring Model v2.1
System ID: e8b348a2-eaf2-400d-a186-1b21ff8433f4
Project dir: /work/loan-scoring-model
Next: riskforge system classify e8b348a2-eaf2-400d-a186-1b21ff8433f4 --confirm, then riskforge
assess e8b348a2-eaf2-400d-a186-1b21ff8433f4 -a NAME -r ROLE
$ riskforge assess e8b348a2-eaf2-400d-a186-1b21ff8433f4 --assessor-name 'Alice Chen' --assessor-role 'AI Governance Lead' --answers answers.yaml
✓ Non-interactive assessment complete: 10 added, 0 updated, 0 unchanged, 1 knowledge-gap answer(s),
29 skipped. Total in register: 10.
Next: riskforge validate e8b348a2-eaf2-400d-a186-1b21ff8433f4
$ riskforge validate e8b348a2-eaf2-400d-a186-1b21ff8433f4
Validation Results
Gate, Description, Status, Details
G1, All 8 risk dimensions have entries, PASS
G2, Article 6(2) self-classification documented, PASS
G3, Every risk's residual score at or below the risk-appetite threshold,, PASS
or accepted
G4, Knowledge gaps have test requirements, PASS
G5, System metadata complete, PASS
G6, Assessor identity recorded, PASS
G7, Risk score distribution plausible, PASS
G8, No vague mitigations, PASS
✓ All gates passed. Ready to export.
$ riskforge export e8b348a2-eaf2-400d-a186-1b21ff8433f4 --format pdf --output rmf.pdf
✓ Exported: rmf.pdf
Content digest (SHA-256): 94198e2f884d37240af2c90f21990b3e2937e02fcf996fec35612638ecbe20c0
File SHA-256: efd6ff2e5c7661ad2e3e2bde47ce0050206b5e8aa6d758c48c19f4a6eefb12d2
$ riskforge export e8b348a2-eaf2-400d-a186-1b21ff8433f4 --format json --output rmf.json --sign ../keys/signing.pem
✓ Exported: rmf.json
Content digest (SHA-256): 94198e2f884d37240af2c90f21990b3e2937e02fcf996fec35612638ecbe20c0
File SHA-256: f869e1f40ff49fe0886bb9812c36589310363d0b5bee700898225c879e01939d
Signed by: ed25519:507cffa21e11060a
$ riskforge verify --file rmf.json --trusted-key ../keys/signing.pem.pub
✓ RMF integrity verified. It validates against RMF schema 1.1.0 and its SHA-256 matches (94198e2f884d...).
RMF signature 1 by ed25519:507cffa21e11060a verifies with a trusted key.
Chain proof: 20 entries, seq 0 to 19; its links and entry hashes check, and the last register fingerprint it records for the system is the register in this file.
The embedded receipt names the last chain proof entry (seq 19) and the register in this file, signed by ed25519:507cffa21e11060a (a trusted key).
$ riskforge verify
✓ Audit chain verified: no tampering detected.

Risk Management File

RiskForge · Art. 9

Risk Management File, first page: Article 9 Risk Management File from riskforge 2.0.0, captured 2026-10-26, on Loan Scoring Model v2.1, Acme Financial Services (fictional).

SHA-256 of the file as served (rmf.json): f869e1f40ff49fe0886bb9812c36589310363d0b5bee700898225c879e01939d

RiskForgeLicense Compliance CheckerRAG Benchmarking

riskforge 2.0.0, captured 2026-10-26, on Loan Scoring Model v2.1, Acme Financial Services (fictional). Trimmed for length; replay paced for display.

tools released on PyPI
4
outbound calls from the RiskForge CLI, blocked in CI
0
days since the latest release
8
licence on all four tools
Apache 2.0

How it works

How a run works

  1. Run one command

    Install from PyPI and point the tool at your repository or a description of your system.

  2. Answer what the article asks

    The checks follow the text of the article. Your inputs are plain files, so they sit in version control next to the code.

  3. Keep the file

    You get JSON, PDF, Markdown or SARIF, depending on the tool. The file is yours to keep, diff and hand over.

    Risk Management File, first page: Article 9 Risk Management File from riskforge 2.0.0, captured 2026-10-26, on Loan Scoring Model v2.1, Acme Financial Services (fictional).

    SHA-256 of the file as served

    rmf.jsonf869e1f40ff49fe0886bb9812c36589310363d0b5bee700898225c879e01939d

Coverage

Which article do you need to answer?

Pick a cell to see the command, the file it writes and where to read more.

See the roadmap

EU AI Act · Article 113

What applies when

Next: new prohibitions apply on 2 Dec 2026.

37 days until new Article 5 prohibitions

  1. 2 Feb 2025In force

    Bans and AI literacy apply

  2. 2 Aug 2025In force

    GPAI duties and governance apply

  3. 2 Aug 2026In force

    GPAI fining powers attach

  4. 2 Dec 2026Next

    New prohibitions apply

  5. 2 Dec 2027UpcomingMoved

    Annex III high-risk systems comply

  6. 2 Aug 2028UpcomingMoved

    Annex I high-risk systems comply

What changed: Regulation (EU) 2026/1744

Change in lawArticle 113, third paragraph, point (c)
It shall apply from 2 August 2026.
Removed: (c) Article 6(1) and the corresponding obligations in this Regulation shall apply from 2 August 2027.Added: (c) Chapter III, Sections 1, 2, and 3, with the exception of Article 6(5), shall apply from:Added: (i) 2 December 2027 as regards AI systems classified as high-risk pursuant to Article 6(2) and Annex III; andAdded: (ii) 2 August 2028 as regards AI systems classified as high-risk pursuant to Article 6(1) and Annex I;

The context line is the second paragraph of Article 113, which set the date for Annex III systems before the change. Removed and context lines quote Regulation (EU) 2024/1689 as adopted; added lines quote the amending Regulation.

Source: Regulation (EU) 2026/1744, Article 1, point (40), verified 4 Oct 2026

Dates as amended by Regulation (EU) 2026/1744, in force since 27 Jul 2026. See what changed.

For security and procurement teams

What you can hold us to

Read the trust pageTalk to us
Runs on your machine
You install from PyPI and run the tools where your code lives. There is no account to create and nothing to sign in to.
No network calls, tested in CI
RiskForge and LitmusAI run their test suites with network access switched off. The trust page lists which tools go online, and when.
Apache 2.0
Read the source, fork it and run it on your own terms. The file a tool writes is yours, and it stays free.

Advice from the same company

AskAjay.ai is the advisory arm of AI Exponent LLC, the company behind these tools. If you need help designing a compliance programme, start there.

Visit AskAjay.ai