The questions people actually ask

Almost nobody who needs this builds AI. The Act puts a separate set of obligations on the deployer — the company that uses an AI system — under Article 26, and deployers far outnumber the companies that build AI.

In practice you become one without deciding to: an applicant-tracking system ships ranking in a point release, a helpdesk adds sentiment scoring, somebody wires a model to a spreadsheet. The free check is the fastest way to find out.

No, and it never will. Whether an obligation is met is a legal conclusion about a specific deployment in a specific member state. No scanner reaches it.

There is no status called compliant anywhere in this product — not in the reports, not in the interface, not in the database schema. What it can show is which duties are engaged and which evidence exists, and both of those are checkable.

The register your auditor asks for, and the evidence behind it: a list of the AI in your estate you did not have, each line carrying the clause that puts it there, with the duties derived from the classification and the evidence recorded against each one. The thing that takes a compliance team months of asking around, including the bundled systems they would have missed. Downloaded as a PDF report, a one-page brief for the board, and Excel.

Vendors’ own public material — product pages, documentation, their AI disclosures. More than 200 products and APIs, each citing its source. A verification script fetches every source page and records whether it answered, named the product and described an AI capability; rows that pass show the date of that check, and rows that do not are shown to you as unverified, with the reason.

That check is automated: it confirms the vendor still describes the feature, not every word of our rationale. A catalogue that goes quietly stale while continuing to look authoritative is the failure mode of this whole business, so the check date is a field rather than something inferred, and every match stays a proposal until your own person accepts it.

No. Matching works on names and domains — vendors and applications. There is no agent, no integration and no access to the data your AI systems operate on. On the free check nothing is stored at all: the names you paste in are a map of your software estate, and keeping them would make that page a liability rather than a lead.

Reject it. Every classification arrives marked proposed and stays visibly so until a person at your organisation accepts or rejects it, and the register records which of the two happened. Each one carries its reasoning and its clause precisely so your counsel can disagree with a specific line rather than with the tool.

Correct, and that is why the catalogue only ever makes a suggestion. The same applicant-tracking system is high-risk when it ranks candidates and minimal when it drafts job adverts. The use decides, and only you know the use — so the product asks rather than assumes.

Then you have somewhere to put the answer and no way to produce it. A GRC tool asks what AI you run; this one finds it in the lists you already keep. Export the register as Excel, CSV or a full JSON archive and put it wherever your evidence already lives.

No. Scopecanon is software, not a law firm. Nothing it produces is advice, and no output of it is a statement that you comply with any obligation.