How can we help?

A short overview of Veillo: who it is for, the inventory to classification to documents loop, and what it does not do.

What it means that Veillo is software rather than a law firm: where the legal judgment comes from, and when you still need your own lawyer.

Six steps to an audit-ready starting point: create your workspace, set your profile, add your tools, confirm high-risk, generate a document, invite your team.

What each part of Veillo is for: the dashboard, risk register, roadmap, documents, updates, quarterly review, audit log, and the beta connectors.

How the free, no-signup inventory tool differs from a Veillo workspace, and what carries over when you start a trial.

How to build your risk register with the add-systems wizard: pick tools from the library or add your own, then say what you use each one for.

What to do when an AI tool you use does not appear in Veillo's library: add it as a custom system and classify the use.

The two ways Veillo decides a risk tier: the counsel-reviewed catalog and AI-assisted suggestions you confirm. Plus the four tiers and why the basis is always shown.

High-risk and prohibited classifications wait for human sign-off. How to review the reasoning, confirm a system, or reclassify it if it is wrong.

The pending counsel review label explained: what it is, why Veillo shows it honestly, and what you can do with an entry that carries it.

How to change a system's use, reclassify it, or remove it from your register, and what happens to your obligations when you do.

The Catalog screen, for Owners and Admins, holds the reviewed classifications behind your register. What it is and how reviewed and pending entries differ.

How the roadmap derives your duties from your register, how the weighted health score is calculated, and how to work through it.

Generate a compliance document from your register: pick a template, choose the system if needed, then edit, export to PDF or DOCX, and keep versions.

Why some Veillo documents are generated once for the whole company and others once per high-risk system, and what that means when your register changes.

What the quarterly review is, the three statements you confirm, who can sign it off, and how it keeps your register honest.

How to edit a generated document, how version history works, and how to export to PDF or DOCX.

How to get a generated document to your own counsel for sign-off, and what to ask them to look at.

What the AI Literacy Policy is, why it applies to every organisation under Article 4, and how to generate it in Veillo.

The Article 50 transparency disclosure: when you have to tell people they are dealing with AI or AI-generated content, and how to generate it.

The Article 9 risk management procedure for high-risk systems: what it covers and how to generate it in Veillo.

The Annex IV technical documentation memo for a high-risk system: what to hold, and how to generate one per system.

The human oversight protocol for a high-risk system under Articles 14 and 26: who oversees it, when they step in, and how to generate one per system.

The incident response procedure for high-risk systems under Articles 26 and 73: what to do if a system causes serious harm, and how to generate one per system.

The data governance procedure for high-risk inputs under Article 26: keeping input data fit for purpose, and how to generate one per system.

The record-keeping duty for high-risk systems under Article 26: switch on logging, retain it, and mark the step done on your roadmap.

Before a high-risk system is used on your own staff, you have to inform the affected workers and their representatives. How Veillo tracks this duty.

When a high-risk system helps make decisions about individuals, those people generally have a right to be told. How this conditional duty works in Veillo.

High-risk AI usually involves personal data, which can trigger a data protection impact assessment under GDPR Article 35. How Veillo tracks the DPIA duty.

Some deployers must assess a high-risk system's impact on fundamental rights under Article 27. Who this applies to and how Veillo tracks it.

Certain deployers, mainly public authorities, must register their use of a high-risk system in the EU's public database under Article 49.

Auto-discovery connects to the systems you already run and surfaces the AI tools your team uses. What it reads, what it never touches, and its beta status.

How to connect Google Workspace, Microsoft Entra, Okta, or an expense tool, what access it asks for, and how to disconnect.

The discovery queue lists AI tools found across your connected sources. How to import the real ones into your register and dismiss the rest.

The Updates feed carries curated guidance from the AI Office and national regulators, flagged to your sector and systems. How relevance is decided and what changes when guidance does.

Veillo records every change to your compliance posture in an append-only audit log. What it records, how to read it, and how to export it or give an auditor access.

The five roles in Veillo (Owner, Admin, Editor, Reviewer, Auditor), what each can do, and how to invite teammates or give an external auditor read-only access.

Veillo's plans compared, monthly vs annual billing, how to upgrade or downgrade, what happens at your limits, and how EU VAT and invoices work.

How to export your register, documents, and audit log out of Veillo, how to cancel, and what happens to your data afterward.

On the Scale plan you can manage more than one legal entity from one account and switch between them. How multi-entity works and who it is for.

How to make someone else an Owner of your workspace, and why you might, for a handoff or when a founder moves on.

The emails Veillo sends, from account messages to quarterly review reminders, and how to manage what you receive.

How to sign in to Veillo with email or Google, and how single sign-on works on the Scale plan.

Veillo stores data in the EU by design. Where your data lives, how GDPR and the DPA work, who can see your records, and what we do not do with them.

A realistic week-long plan to go from nothing to an audit-ready posture: inventory, classify, generate documents, handle operational duties, and record a review.

Shadow AI is the tools teams adopt without telling anyone. How to surface it with connectors, expense data, and a few questions to your team.

Classification is driven by how you use a tool, not the tool itself. How to describe a use so the tier is accurate.

AI Act compliance needs an owner, even in a company without a compliance team. How to assign it and use roles so it does not fall through the cracks.

What an audit-ready posture looks like if an authority asks: a current register, generated documents, handled duties, and a complete audit trail.

The EU AI Act phases in over several years. The key dates for deployers, from the AI literacy duty to the high-risk obligations.

Plain definitions of the EU AI Act and Veillo terms you will run into: deployer, provider, Annex III, risk tiers, DPIA, FRIA, and more.

Where to read up on the EU AI Act itself: the plain-English guides, the Annex III explorer, the deadlines, and the FAQ.

Where AI tends to be high-risk varies by industry. Where to find Veillo's sector guidance for healthcare, finance, recruitment, and more.

Fixes for sign-in problems: password reset, missing verification or invite emails, Google sign-in, and SSO.

Generated documents are a snapshot. If you change your register afterward, regenerate the document so it reflects the current systems and details.

Fixes for auto-discovery connections: the Connect button is disabled, a connection shows an error, or a sync returns no tools.

Why a system shows as awaiting review or needing confirmation, and how to clear it by confirming or reclassifying.