AI decisionsyour board can defend.With the evidence attached.

No. TRACE is a middleware layer that sits between your existing AI platform and your outputs. Your systems continue running exactly as today. TRACE intercepts outputs, wraps them with the compliance layer, generates the audit trail, and returns the result with its audit record. Three integration patterns: (1) API Gateway - route AI outputs through the TRACE endpoint, zero code changes to your existing system, live in 2 days. (2) SDK wrapper - 3 lines of code around your existing LLM client, live in 1 week. (3) Async audit pipeline - your AI runs normally and TRACE processes outputs asynchronously, live in 2 weeks. No vendor lock-in. Works with any AI system that produces text output.

Plug-and-play

No. Hyperscalers provide infrastructure compliance - SOC 2, ISO 27001, GDPR data processing agreements. They do not provide EU AI Act compliance. Microsoft Responsible AI Toolkit is a framework, not a conformity system. AWS AI compliance covers data security. Google Vertex AI has no EU AI Act conformity output. None of them produce Art 13 audit logs, Art 17 quality management system evidence, conformity assessment documentation, or a TRACE score. TRACE fills the gap that every hyperscaler leaves open - because it is a regulatory problem, not an infrastructure problem.

Myth busted

Under Article 6, the following are classified HIGH-RISK by default: AI used in financial services (credit scoring, fraud detection, AML monitoring), HR (CV screening, performance management, workforce planning), legal (contract review, compliance checking), healthcare (diagnostic support, triage), and any AI influencing access to essential services. If you use Copilot, Bedrock, or any LLM for any of these use cases, you are in scope. Annex III conformity assessment obligations apply to you from 2 December 2027 (Regulation (EU) 2026/1744, Digital Omnibus on AI, in force 27 July 2026). GPAI obligations - which cover any general-purpose AI model - are already active since August 2025, and Article 50 transparency obligations since 2 August 2026.

High-risk check

TRACE runs entirely in AWS eu-central-1 (Frankfurt). Your data never leaves the EU. Critically, TRACE processes AI OUTPUTS - the text responses from your AI system - not the personal data that generated those outputs. This means GDPR data subject rights do not apply to the compliance processing layer. We provide: a Data Processing Agreement (Art 28 GDPR), EU Standard Contractual Clauses, explicit data residency commitments, and a right-to-audit clause. For organisations with sovereign cloud requirements, we also support deployment into your own AWS EU account.

EU data residency

TRACE generates a board-ready TRACE score report in 6 hours - showing your current compliance gap across all five TRACE properties, the exact EUR fine exposure you face based on your AI system inventory, and the ROI case for remediation. We have seen this compress board approval cycles from months to weeks because the report makes the risk concrete, quantified, and boardroom-legible. We offer this as a pre-approval diagnostic: no commitment, no cost, just evidence. You walk into the board meeting with a EUR-quantified risk assessment rather than an abstract regulatory summary.

6-hr board report

Weeks 1-2: Discovery and TRACE baseline - we inventory your AI systems, classify risk, run the first TRACE score. Weeks 3-6: TAMR+ integration - regulatory corpus ingested, multi-agent reasoning live, first benchmark validated. Weeks 7-10: GraQle live - real-time gap detection active, knowledge graph populated, audit trail running. Weeks 11-13: Evidence pack ready - documentation designed to support an ISO 42001 audit and EU AI Act conformity assessment, board presentation prepared. First evidence output: 14 days. Whether you are compliant, and any certification, is decided by your own assessment, your auditors or a notified body - not by TRACE. GPAI obligations (active since August 2025) addressed in the first 2-week sprint.

14 days first output

The cost of non-compliance is EUR 35 million or 7% of global annual turnover - whichever is higher - plus reputational damage, forced system shutdowns, and operational disruption. The average TRACE implementation saves EUR 570K in Year 1 through eliminated external compliance consultancy, faster regulatory change response (8.5x), and avoided fines. ROI is 4.6x in Year 1. If your annual global turnover is above EUR 100M, your maximum exposure is EUR 7M+. The question is not whether you can afford TRACE. It is whether you can afford the EUR 35M alternative.

4.6x ROI Year 1

Regulators request five things: (1) Evidence that your AI systems were correctly classified under Article 6 - high-risk vs limited-risk vs minimal-risk. (2) Logs of every AI decision with human oversight records per Article 13. (3) A conformity assessment or technical documentation demonstrating the system meets Act requirements. (4) A quality management system showing ongoing monitoring, as required by Article 17. (5) Post-market surveillance data. Without TRACE, producing this takes 3-6 weeks and typically surfaces gaps. With TRACE, you export the full evidence pack in under 6 hours. The TRACE score is your pre-audit readiness indicator - if it is above 0.75, you are audit-ready.

Audit-ready in 6hrs

Manual compliance processing takes 23 hours per regulatory change event. The EU AI Act has already generated hundreds of guidance updates, national transpositions, and GPAI Code of Practice iterations since its entry into force - and enforcement has not yet started. TRACE does not replace your compliance team. It makes them 8.5x more effective by automating evidence collection, gap detection, and report generation. Your team focuses on judgment calls, stakeholder management, and remediation decisions. TRACE handles the evidence chain, the regulatory mapping, and the audit trail that would otherwise consume weeks of their time.

8.5x team efficiency

Yes - and we recommend it. Standard POC: 2 weeks, one AI system, full TRACE score report delivered at the end. You see exactly where your gaps are across all five TRACE properties, what the remediation roadmap looks like, and what your projected timeline to full compliance is. No commitment required after the POC. Most organisations convert because the TRACE score report creates internal urgency that abstract risk assessments never do - it shows the gap in a board-legible, EUR-quantified, deadline-mapped format. The POC itself typically produces enough evidence to secure budget approval internally.

2-week no-commitment POC