Does this make us compliant with the EU AI Act?

No. It gives you the traces and controls compliance asks for, but your legal adviser establishes compliance, not us.

Does our data reach the model provider?

Only what we explicitly define as sent. Where data must not leave, we use locally hosted models, with the cost stated upfront.

How long are the logs kept?

As long as you decide. We propose twelve months by default, but the period is a business decision, not a technical one.

Who is responsible if the model gets it wrong?

You are, as the operator of the process. This layer exists to reduce how often it happens and make it explainable, not to shift responsibility.

Is it needed from the start or added later?

Thresholds and logging, from the start — they are cheap then and expensive retrofitted. The rest can grow with usage.

AI governance: being able to explain every automated decision

Rules and written traces for whatever a model decides on your behalf

You can answer why the system decided that, not only what it decided

The hard question does not come from a customer. It comes from your own accountant, asking why the system filed that invoice that way.

What you get

Every decision leaves a trace

What went in, which model answered, what came out and what happened next — kept, not reconstructed.

Explicit boundaries

What the model may decide alone and what must pass a person is written down, not assumed.

Costs are visible

Consumption per flow is measured, with caps. You do not discover at month end that a flow ran in a loop.

Data does not leave uncontrolled

What is sent to an external model is explicitly defined, and what must not leave does not leave.

How it works

The flow, step by step

1. The inventory
We establish exactly where in your systems a model decides, and what each decision affects.
2
2. Thresholds
Each decision gets a boundary: below what confidence or what value it must pass a person.
- PostgreSQL
3
3. The log
Input, output and model version are retained for the period you set.
- PostgreSQL
4
4. Caps
Consumption is capped per flow. A flow that exceeds its limit stops and reports, instead of carrying on.
- n8n

Where it works well

Flows where a model makes decisions with financial effect
Processing that touches personal data
Situations where a decision must be explained to an auditor or a client
Systems with several flows using different models

Where it does not

We are not legal advisers — we document what the system does, not what the law requires
We hold no ISO 27001 or SOC 2; where you need a certification, we say so plainly
One simple flow that decides nothing does not need this layer

What we use

PostgreSQL
n8n

Frequently asked questions

Does this make us compliant with the EU AI Act?: No. It gives you the traces and controls compliance asks for, but your legal adviser establishes compliance, not us.
Does our data reach the model provider?: Only what we explicitly define as sent. Where data must not leave, we use locally hosted models, with the cost stated upfront.
How long are the logs kept?: As long as you decide. We propose twelve months by default, but the period is a business decision, not a technical one.
Who is responsible if the model gets it wrong?: You are, as the operator of the process. This layer exists to reduce how often it happens and make it explainable, not to shift responsibility.
Is it needed from the start or added later?: Thresholds and logging, from the start — they are cheap then and expensive retrofitted. The rest can grow with usage.

Can you explain why your system decided that?

Claim a free audit