FAQ

Setup & Organisation

How does NADOVO work? What is the compliance journey?

NADOVO guides you through EU AI Act compliance in 5 phases. You work through the phases in order:

Phase 1 — Discover: Capture all AI systems in your company (e.g. ChatGPT, Microsoft Copilot, AI-powered HR tools).

Phase 2 — Define: For each AI system, create one or more AI processes — the concrete use case (intended purpose and application area). Based on this intended purpose, NADOVO automatically determines the risk class (under EU AI Act Annex I and III).

Phase 3 — Assess: Evaluate the risks of your AI processes and plan measures for risk mitigation.

Phase 4 — Implement: Foster and document your employees' AI competence (Art. 4 EU AI Act) and implement the necessary measures.

Phase 5 — Monitor: Capture and report AI incidents when something goes wrong.

Important — the core of the NADOVO approach: It is not the AI system that is classified, but the individual AI process (the use case). The intended purpose determines the risk level — the same AI system can be classified differently depending on the application. This is why EU AI Act compliance in NADOVO starts with the process, not the system.

Tip: You do not have to complete all phases at once. Start with Phase 1 and work your way forward step by step. The dashboard shows you at all times where action is needed.

In what order should I proceed?

The recommended order for getting started:

Add an AI model ("AI Models" module) — first add the models you use to "My models" (select from the catalog or create a custom model). Important: when creating an AI system you can only choose from models you have already added — you cannot add a model from within the AI system wizard. If the model you need is missing, briefly leave the wizard (your draft is preserved), add it in the "AI Models" module and return.
Create AI system (Phase 1) — enter your AI system and link the model(s). If the model is not yet known, select the entry "Unknown"; if the system uses no AI model in the catalogue's sense, select "Not applicable". The wizard guides you through 5 steps.
Release AI system — set the status to "In operation".
Create AI process (Phase 2) — describe the intended purpose and select the application area from the list. NADOVO classifies the process automatically.
Release AI process — if the risk class is "High-Risk"/"Unacceptable" or the assessment status is "Required", the route runs through "Submit for review" and an approved assessment first (see below).
Training & measures (Phase 4) — document your employees' AI competence and implement the measures.
Document AI content (AI Content Register) — capture AI-generated content as evidence and document review and marking under Art. 50 (see AI Content Register).

Important: An AI process can only be released once the linked AI system has the status "In operation". NADOVO will notify you if anything is missing.

What is the difference between AI system, AI process and assessment?

These three elements form the core of NADOVO:

AI system (Phase 1): This is the technology itself — for example "ChatGPT" or "Microsoft Copilot". Here you capture which AI model you are using, how you procure the system, where model and data operate, and who is responsible for it.

AI process (Phase 2): This is the concrete use case of an AI system — for example "Customer support via ChatGPT" or "Application pre-screening with an AI HR tool". An AI system can have multiple processes. Key point: it is the process that is classified, not the system — the same AI system can have different risk levels depending on the use case.

Assessment (Phase 3): This is the risk evaluation for a specific AI process. Here you identify risks, define measures, and document how you keep those risks under control.

Relationship: An AI system has one or more AI processes. Each AI process can have an assessment. The three elements are linked — changes to one element can affect the others.

How do I manage my users and roles?

In the "Organisation" module (visible to company admins), the "User management" tab is where you manage your company's user accounts:

Add user: you invite by email, first and last name; the person receives an email with a sign-up link. New users automatically get the "User" role. The "Invitation language" field sets the language the email is sent in — prefilled with your own interface language. Resending uses the same language as the original invitation.
Status: Active, Inactive, Pending (open invitation) or Expired. You can deactivate/activate users and resend or revoke invitations.
Address already taken: the notice names the specific case:
- "There is already a user with this email address in this organisation." — the person is already there.
- "The user with this email address is deactivated. Activate the existing account instead of inviting again." — activate rather than invite.
- "This email address already belongs to a user account of another organisation." — a person can currently belong to only one organisation.
An archived person of the same organisation, by contrast, can be invited again (see below). Anyone who does open an outdated invitation is told to sign in instead, or to use "Forgot password"; the existing access stays untouched.

Deactivating, archiving and why there is no deletion: user accounts have three states:

State	Meaning
Active	Sign-in possible
Inactive	Sign-in blocked, can be reactivated at any time — during parental leave, for instance
Archived	Membership of your organisation ended; not recoverable via "Activate", but recoverable through a new invitation to the same address

Archiving is deliberately a two-step action: deactivate first, then archive; a confirmation dialog spells out the consequences beforehand. Archived accounts are hidden by default — the "Show archived" toggle next to the search brings them back into view with an "Archived" badge and no actions. There is no delete: NADOVO is an evidence product, and approvals, qualifications and responsibilities have to stay attributable to a person. That is exactly why archiving retains all evidence and assignments.

If someone returns later, simply invite the same email address again: they come back with the same user account and set a new password when accepting. Everything previously assigned to them — approvals, qualifications, responsibilities — belongs to them again. The name of the existing account prevails; if the new invitation carries a different one, the person changes it themselves in their profile. "Archived" therefore refers to the membership of your organisation, not to the person.

Roles:

Company Admin — full access including the Organisation and user management
User — standard access to the company features

An entry with no action menu? If your organisation is looked after by an external consulting partner, the person in charge appears once in the list — marked as a Partner Consultant, with the Company Admin role and active status, but without an action menu: they are not a user account of your organisation, take up no seat against your limit, and are managed by your partner. If the partner assigns a different person, the list shows the new one. More on this under Consulting Partners.

What counts against the user limit: only active users. Deactivating and archiving free the seat immediately — so you can invite a stand-in during parental leave, for example. Reactivating checks whether the limit still has room. Open invitations also reserve a seat, so that no more commitments go out than the plan allows; if an invitation expires or you revoke it, the seat is freed again.

Users and the employee directory: a user is an account with a login and counts against your plan limit. The employee directory in the AI Literacy module holds everyone who can be assigned — every user of your organisation automatically, plus the employees you enter by hand who have no account.

You do not have to create a user as an employee as well for them to attend a qualification or own a measure.
By hand you only add people without their own user account.
A directory entry grants no access to the application and does not count against the user limit — only active user accounts do.
A newly invited user appears once they have accepted the invitation; a pending invitation does not yet.
If you rename a user, the name also changes in the selection lists, in existing qualifications and in reports. Audit entries already written keep the name used at the time.

In the "Company" tab you also maintain your company profile and the AI Compliance Officer — the person responsible for EU AI Act compliance. Also select your company's country from the list there: it determines which reporting authority is pre-filled for AI incidents (see AI Incidents).

Why can't I sign in?

The sign-in screen names the reason. Four cases occur:

Message	Meaning	What to do
Email address or password is incorrect	One of the two is wrong. For security reasons NADOVO deliberately does not say which — otherwise it could be used to check who has an account	Check your entry; if in doubt use "Forgot password"
"Your access is temporarily deactivated. Please contact your administrator."	Your account is set to "Inactive" — it can be reactivated at any time	Contact your company admin
"Your access no longer exists. Please contact your administrator."	The account is archived, that is, closed for good	Contact your company admin; a new invitation can be sent if needed
A notice about too many attempts	After five failed attempts NADOVO temporarily blocks sign-in	Wait about 15 minutes, then try again

I was signed in and suddenly see a lock notice: if your account is deactivated or archived during the session, NADOVO shows a dedicated page with the explanation — "Your access is temporarily blocked. Please contact your administrator or NADOVO support.", or for an archived account "Your access has been deactivated. …" —, a countdown ("You will be logged out in 10 seconds.") and the "Log out" button. The page stays put even after a reload; you are never signed out without an explanation.

If your entire organisation's account is blocked, every account of that organisation is blocked — company admins included. Contact NADOVO support in that case. When the block is lifted, each account returns to exactly the state it had before: whoever was deactivated stays deactivated, whoever was archived stays archived.

More on the account states under "How do I manage my users and roles?".

I forgot my password — how do I reset it?

On the sign-in page, via "Forgot password?". Here is how it goes:

Enter your email address and click "Send Reset Link" — "Email Sent" appears. "Back to Login" takes you to the sign-in form.
The link in the email opens the page "Set new password" — even when you are not signed in. You do not have to log in anywhere first.
The new password must meet all five requirements, shown with ticks below the field: at least 8 characters, an uppercase letter, a lowercase letter, a number and a special character (e.g. !@#$%&*-_.,?). The "password strength" indicator only turns green once all five are met.
After "Set password" the page "Password changed" appears: "Your password has been changed. For security reasons all sessions have been ended – this one included. Please sign in with your new password." "Go to sign-in" takes you onward. All existing sessions end — on other devices too.

When you sign out, NADOVO confirms it with the notice "You have been successfully signed out." If you have the application open in a second window, that one moves to the sign-in page by itself too — on signing out as well as on changing your password.

The link works once and expires after about an hour. After that the page shows "Link no longer valid" with a pointer to request a new one via "Forgot password?". Requesting a new link invalidates the previous one — always use the most recent one in your inbox.

Not to be confused with "Change password" under Settings → Security: that is the route for signed-in users, where you enter your current password. The same five requirements apply there too — just as when accepting an invitation. One rule on all three routes.

Where do I see my plan and my limits?

Right below the heading in the "Organisation" module, an info box shows your current plan and how much of the plan limits you use: the number of users and AI systems, each as "current of max" (or "unlimited" if your plan has no limit).

If a limit no longer suffices, contact your administrator or support for an upgrade. What happens when a limit is reached is covered under "Why can't I create a new AI system?".

Which company profile details matter?

Company admins maintain the company profile in the "Organisation" module on the "Company" tab. Several details have a direct effect in the platform:

Country (selection list): determines which reporting authority is pre-filled for AI incidents (see AI Incidents).
Public body or provider of public services (switch): controls whether the fundamental rights impact assessment (FRIA) is mandatory for high-risk processes (Art. 27(1), see Assessment) — the setting affects all high-risk assessments.
AI Compliance Officer: the section for the person responsible for compliance with the EU AI Act. Under "Designated person" you select them as an Internal person (employed by the company) or an External person (a consultant/service provider). Not to be confused with the responsible persons for human oversight (per AI process in the assessment, chosen from the qualification register) or the responsible persons for measures (per task, chosen from the employee directory) — those are different roles.
Four-eyes principle on release: optional governance setting for the AI Content Register — when enabled, the release approver must be a different person than the creator.
Company logo: appears on the cover pages of all PDF reports (see its own question below).

Can I put my company logo on the PDF reports?

Yes. Administrators upload the logo in the "Organisation" module → "Company" tab (the "Company logo (reports)" field). It then appears on the cover pages of all PDF reports — qualification proofs, AI content proofs and audit-trail exports — above the NADOVO logo.

Format: PNG or JPEG, max. 1 MB. NADOVO checks the actual file content, not just the file extension — a renamed or corrupted file is rejected.
Immediate effect: upload, replace and remove take effect immediately, independently of the company settings' "Save" button. Reports already generated do not pick up a changed logo — regenerate the report.
Remove: via "Remove" (with confirmation); the reports then use the default cover page again.

Not white-label: the NADOVO branding stays on all reports. Your logo appears additionally above it — as the sender of the document.

Where do I change the language, password or appearance (light/dark)?

The "Settings" module is where you manage your personal preferences — in three tabs:

Profile: first and last name, editable via "Save changes". Your email address can only be changed by support; your role can only be adjusted by administrators.
Appearance: choose the theme — Light, Dark or System (follows your operating system setting) — and the language of the application (German/English). This is also where you control whether the welcome overview (the 5-phase summary) is shown on every login.
Security: change your password — the same five requirements apply as everywhere else: at least 8 characters, an uppercase and a lowercase letter, a number and a special character (e.g. !@#$%&*-_.,?). The card says upfront what follows: "Set a new password for your account. After the change you will be signed out and sign in with the new password; all other sessions are ended as well." Afterwards the page "Password changed" appears with the button "Go to sign-in" — the same page that ends the "Forgot password" route.

Do I have to confirm the theme or language with "Save"? No. Everything in the "Appearance" tab is saved automatically as soon as you switch it. Only the name change in the "Profile" tab needs the "Save changes" button.

These settings only apply to your own account. Company-wide details (team, company profile) are maintained by company admins in the "Organisation" module (see above).

A colleague sees a different theme than I do on the same computer — is that correct?

Yes. Light/dark is stored per user account, not per device or browser. When several people share the same computer, each logged-in person sees their own setting — it is applied automatically on login.

New accounts start with "System": the application then follows your operating system's light/dark setting until you make your own choice under "Settings" → "Appearance".

Where do I find the help for a field — and its legal basis?

In all three wizards (AI system, AI process, assessment) the card "Help & notes" sits to the right of the form. Until you address a field, it invites you in: "Hover over a field or click into it to see its help."

Triggering it: hovering with the mouse or clicking into the field — both act on the whole field box, identically for every field type.
The text stays when you leave the field; only the next field replaces it. The card travels along as you scroll.
Content: what the field is for, details, tips and examples — and, where there is one, a dedicated "Legal basis" block.

The legal basis is linked. Every entry (for example "Art. 27(1) AI Act" or "Art. 9 GDPR") opens the official text on EUR-Lex in a new tab and jumps straight to the article. That way you can check a statement at the source without leaving the wizard.

Not every step has help. In the assessment, steps 1 and 4 carry a help card; steps 2, 3, 5 and 6 (Art. 5 check, risk identification, oversight, completion) deliberately do without — there the step itself walks you through the questions.

Dashboard

What does the dashboard show?

The dashboard is the start page. At the top NADOVO greets you by name according to the time of day; below that stand your company and your role. Then follow — depending on your role — three areas.

1. Compliance monitor (administrators and consulting partners only). The headline tells you in one sentence where you stand: "Action needed — N open check points" or "No open check points". Below it sits the caveat "Assessment based on the documented information, not a legal opinion" — your documentation is counted, not judged. Five cards summarise it:

Card	What it counts
Systems	AI systems whose model the provider deprecated, and inactive systems with suspended processes
Assessments	processes that require an assessment and have none approved ("pending"), and assessments that must be reviewed after a change ("to review")
Measures	overdue measures
Incidents	open AI incidents; the card states how many are reportable
Deadlines	dates in the next 30 days — "Upcoming · no violation"

Clicking a card filters the list below it; clicking again clears the filter. The list of open check points names type, object, reason, deadline and the matching action; columns are sortable and a type filter narrows it further. The footline counts implemented and in-progress measures. A timestamp ("As of …") says how current the figures are.

2. "For me" (all roles). On the left "My tasks" — what you personally have to do: releases of submitted processes and assessments (administrators only), four-eyes releases in the AI Content Register (when the rule is active), and, for processes you are responsible for: perform an assessment, start a recommended assessment, review an assessment, work on open measures. Critical items sit on top. On the right "My responsibility" — your AI systems and processes with status and hints ("Model deprecated", "Assessment pending", "2 open measures"); clicking the row opens the detail page.

3. "Latest changes" (all roles). Who did what and when: creation, submission, release and new versions of AI systems, processes and assessments; AI incidents captured and resolved; released entries in the AI Content Register; plus new models in the catalogue. Five rows, "Show all N" expands to the most recent 25. The feed shows events, not field changes — the full history is in the change report.

Long lists everywhere show 10 rows with "Show all N" and "Show less".

What is the difference between a check point and a deadline?

A check point is an open item that needs action — a process without an approved assessment, an assessment due for review, an open AI incident, an overdue measure, a system with a deprecated model, or an inactive system with suspended processes. Check points are counted and appear in the monitor's headline.

A deadline is a date in the next 30 days: a measure falling due, the reporting deadline under Art. 73, an assessment's review date, or a planned training. Deadlines are informational — so nothing runs out unnoticed — and are not counted. Overdue dates appear in red.

Why don't I see a compliance monitor as a user?

The monitor bundles the action needed across the whole company and is reserved for administrators and consulting partners. As a user you see "For me" and "Latest changes" — everything that concerns you personally, and what has happened in the company.

My process is listed under "Assessments" although I have already started one — why?

What counts is an approved assessment. An assessment that has been started, completed or submitted remains a check point until it is released — the release is a separate step (see risk assessment). Administrators find the pending release under "My tasks".

Can I move or hide the dashboard areas?

No, the order is fixed. The dashboard is personalised through the "For me" area: it shows exactly the systems, processes and tasks assigned to you. The orientation along the five phases lives in the sidebar.

AI Models

What is the difference between AI models and AI systems?

AI models are the underlying models (e.g. GPT-4, Claude, Gemini) — a library you choose from. In the "AI Models" module you define under "My models" which models are used in your company.

AI systems (Phase 1) are the concrete AI systems you actually deploy and must document under the EU AI Act. An AI system references one or more AI models: when creating it, you select the models used in the "AI model and procurement" step — from the models you have already added — and specify each model's "role in the system" (e.g. classifier, generator). One of the models is the primary model; NADOVO derives the model provider and model version from it and pre-fills the system type. If the model is not known yet, choose the entry "Unknown"; if the system uses no AI model in the catalogue's sense (e.g. a rule-based specialised system), choose "Not applicable".

In short: the AI model is the underlying technology, the AI system is your specific use of it.

How do I add AI models? Can I import my own?

The "AI Models" module has two areas:

Model catalog: a central library of known models curated by NADOVO. With "Select" you add a model to "My models" (or "Select all from {provider}" for all of a provider's models).
My models: your selected models, grouped by provider.

Using a model that isn't in the catalog? With "Add custom model" you create a company-specific model (name, provider, version, category, description) — it gets the "Custom model" badge.

No matching model yet? If you don't yet know which model is used — or forgot to add it — you can still create the AI system and select the "Unknown" entry when linking, then add the specific model later. For systems without an AI model in the catalogue's sense (e.g. rule-based specialised systems) there is the entry "Not applicable".

Note: There is no file import (e.g. JSON) for end users — the catalog is maintained centrally. So you either select from the catalog or add your own models.

AI Systems (Phase 1)

What do the different AI system statuses mean?

Status	Meaning	What you can do
Draft	The system is still being edited	Edit, delete or release
In operation	The system is active and released	Deactivate or create new version
Out of operation	The system is temporarily not in operation	Reactivate
Superseded	The system was replaced by a new version	View only, no further editing

Why can't I create a new AI system — the button is greyed out?

Every plan includes a maximum number of AI systems. Once you reach it, NADOVO disables the "New AI system" button in the overview. Hovering over it shows your current usage: "Limit reached (X of Y AI systems)".

What to do? Either delete an AI system you no longer need — or contact your administrator to upgrade the plan. You can see how many systems your plan allows and how many are in use in the "Organisation" module.

Careful when going via the Compliance Journey: If you open the form through the "Register AI System" menu item (sidebar, DISCOVER phase), the block does not apply upfront — the menu item stays clickable. You can fill in the entire form and the "Limit reached" message only appears when you save; your entries are not kept. It is therefore best to always create new AI systems from the overview, where you can see the limit in advance.

Applies to users too: The same plan limit exists for the number of user accounts, with the same behaviour in the "Organisation" module. Plans without a cap show no limit. Only active users and open invitations are counted there (see User management).

Why can't I release my AI system?

Because a required detail is missing — and the message tells you which one. Instead of a generic "Release failed", NADOVO names the specific fields along with the terms they appear under in the wizard: "Release not possible. Please complete in the wizard: …" (these server messages are shown in German). Before the release, the following must be set:

the procurement type and the system type (step "AI model and procurement"),
at least one AI model — "Unknown" or "Not applicable" is a valid entry too,
the three locations — model location, data storage location, system provider's domicile (step "Locations"; "Unknown" is allowed there),
for purchased systems (SaaS/API, on-premise, embedded), the answer to the question "Is the system operated under your own name or brand?" (step "AI model and procurement"),
for a purpose-built specialised system, the intended purpose according to the provider (step "Documentation").

In addition, the AI definition under Art. 3(1) must be answered with yes or no. If it is "Unclear" or still open, the message reads: "Release not possible: the AI definition under Art. 3(1) has not been decided yet." — "Unclear" can be saved but not released (see the next question).

Add the details named, save, and release again.

This applies throughout the app: when an action fails — release, status change, deletion, invitation — NADOVO shows the server's specific reason rather than only the fact that something went wrong.

What does the question "Is this an AI system within the meaning of the AI Act?" mean?

In the "Documentation" step of the AI system wizard you document the AI definition under Art. 3(1): does the system derive outputs from inputs, does it operate with a certain degree of autonomy, is the result variable beyond fixed rules? Three answers are available:

"Yes, AI system within the meaning of the AI Act" — the normal case. The system goes through the compliance journey as usual.
"No, not an AI system" — with a short justification. That is your documented evidence that you checked: the system stays in the inventory and goes through the normal release, but carries the badge "Not an AI system" in the overview and is not selectable in the AI process wizard — intended purpose and excluded uses are skipped.
"Unclear" — can be saved but not released. Clarify the question using the provider's documentation and answer it with yes or no.

The detail page starts with the result of this check and then follows the wizard's steps (basic data · AI model and procurement · locations · documentation). Systems whose AI definition has never been asked show "Not checked yet — the AI definition is asked with the system's next version." there — they remain fully usable until then.

I don't know one of my AI system's locations — what do I enter?

Choose "Unknown". The "Locations" step asks for three entries — model location (operation / hosting), data storage location and the system provider's domicile — each with the values "EU / EEA", "Third country" and "Unknown" (data storage additionally offers "None").

"Unknown" is saved and listed as an open point in the review and on the detail page; it does not block the release. Clarify the entry with the provider (server location according to the provider or the data processing agreement) and add it in the next version.

How do I store provider documentation as files on the AI system?

In the "Documentation" step of the AI system wizard, the "Documentation" card has two tabs: "Files" and "Links". In the "Files" tab you store the documents you used to evaluate the system — operating instructions, product documentation, terms and conditions, usage policy — optionally with a description (e.g. "Operating instructions v3.2, as of 05/2026"). The "Links" tab still takes URLs to living sources (provider portal, internal wiki).

The rules:

Formats: PDF, PNG, JPG, WebP up to 5 MB. The file's content is checked, not its extension. A file name can only appear once per version.
For a new system, the first upload saves the draft automatically (message "Draft has been saved.").
Clicking a file opens the preview in a dialog; the detail page only displays the files under "Documentation".
Files can only be changed in a draft — the documents of a released version are frozen evidence (Art. 26(1) can only be evidenced with the operating instructions of that time). To add more, create a new version: it takes over the files of the previous version; removing them in the new draft does not touch the old version.
Removing is restricted to company administrators. Every addition and removal appears in the audit trail as a "Document" row.
The files are stored in the platform's EU hosting (private storage, accessible only through the application via short-lived links).

Where does the suggestion for "Excluded uses" come from?

From a summary of the model provider's official usage policy maintained by NADOVO — with source and date. In the "Documentation" step, the "Excluded uses" field then shows a suggestion box: "Suggestion from the model catalogue: usage policy {provider} (as of {date})" with the link "Open source", a short preview and the button "Apply".

Applying it fills in the text and the source reference (URL with its date); both remain freely editable and freeze with the release. Applying is your self-declaration — review the text and adjust it if needed. If NADOVO updates the stored policy later, your system does not change: the applied text is a copy, and released states are never touched.

The box only appears when everything lines up: the primary model's provider has a stored policy, the procurement type is "SaaS / API" (or the system provider is the model provider), the system is not embedded in a business application — and the field is still empty. Text you have typed is never overwritten; after applying, the box disappears. For embedded systems, the documentation of the business application's manufacturer applies instead.

In the detail view, URLs in the source references (intended purpose and excluded uses) are clickable links — they open in a new tab.

What is the meaning of the "Put into service in your organisation" date?

The date is the only input in the "Review & approval" step and optional: if you enter nothing, NADOVO automatically sets the release date as the date put into service.

If the system has been running in your organisation for longer, enter the actual date — it decides the grandfathering under Art. 111(2) EU AI Act: high-risk systems put into service before Chapter III starts to apply only fall under the regulation after substantial design changes. In addition, NADOVO records the legal status at every release (the version of the AI regulation at the time of release).

What happens when I deactivate an AI system?

When you deactivate an AI system, NADOVO automatically updates all linked elements:

AI processes connected to this system are set to "Paused"
Assessments connected to these processes receive the status "Review required"

The dialog shows you all affected processes up front with name, ID and risk class — with no options to choose from: all of them are paused. That is not a setting but the necessary consequence, because an AI process may only stay released while its AI system is ready for deployment. The success message names the number of processes and assessments affected. The reverse holds too: because a process is paused solely by its system being taken out of operation, putting the system back into operation fully restores the previous state.

If you want to retire a single process for good, do that in the "AI processes" module via Archive — not through the AI system.

Why? When an AI system is no longer in operation, the associated processes cannot continue to run. The EU AI Act regulation requires you to keep your risk assessments up to date — when something on the system changes, the assessments must be reviewed.

What do you need to do?

If the deactivation is temporary: reactivate the system later. Doing so releases all paused processes of that system again; the associated assessments remain at "Review required" and must be checked again.
If the deactivation is permanent: archive the processes and, if applicable, create new ones for a replacement system.

What does "Create new version" mean for an AI system?

When something substantial changes on an AI system — for example a different AI model, a different location (model, data storage, provider's domicile) or the result of the AI definition — you create a new version instead of overwriting the existing system.

Why a new version instead of just editing? The EU AI Act requires that changes are documented traceably (Art. 12). With versioning, the old state is preserved and the change is verifiable at any time — including for auditors and supervisory authorities.

What happens when you create a new version?

NADOVO copies all data of the current version into a new draft
You edit the changed fields in the wizard
In the last step you see a summary of the changes
After release, the old version is superseded and the new version becomes active. In the AI system's version history the latest version carries the badge "Current"; you recognise the superseded one by its status "Superseded"

Where do I find the version history? On the detail page in the "Version history" tab; from the overview, the entry of the same name in the three-dot menu takes you straight there. Each row names the ID and version, the status, date and person — for processes also the approver and the release comment. "View" opens a single version, "Compare" puts two versions side by side (for AI systems and processes).

Looking at an old version? Then a "Superseded version" notice sits at the top with the "Go to current version" button. The breadcrumb navigation above the title ("Overview → ID · Name · version") also takes you back. 5. Linked AI processes are paused and must also be updated

Tip: You do not have to manage version numbers yourself. NADOVO automatically detects what has changed and suggests a suitable version.

AI Processes (Phase 2)

What are the mandatory entries in the "Purpose & Use" tab?

Besides the Intended Purpose and the application area, the "Purpose & Use" tab (step "Purpose & Scope") requires:

Intended Purpose — your own deployment, under Art. 3(12) of the AI Act. Not to be confused with the "Intended purpose per provider" on the AI system (step "Documentation"): that is the manufacturer's statement, which NADOVO compares your deployment against. In the summary (step "Review") the field appears as "Intended Purpose:".
Affected persons — multi-select; "None" excludes the other values.
Impact on affected persons.
Autonomy level — three levels: "Assists", "Suggests", "Decides".
Deviation from the provider's intended purpose — Yes / No / "Not assessable", with the AI system's intended purpose shown next to it for comparison. "Not assessable" makes an assessment required.
"What does the system do in this use case?" — five capability entries (dialogue, synthetic content, emotion recognition, biometric processing, profiling/scoring) or "None of these apply". The fields start empty; if the same AI system already has a process, a suggestion appears above them ("Suggestion from PROC-000012: profiling, dialogue"). You tick the boxes yourself — so nothing ends up on the process that nobody checked.
For systems of the type "Purpose-built specialised system", additionally the Annex I product relation: three staged questions (product under EU product safety law section A/B, safety risk on failure, conformity assessment by a notified body). "Unknown" blocks the release, not saving.

The optional functional area (selection of the 16 areas or free text) sits in step 1; there is no learning-capability entry on the process — it lives on the AI system as "fine-tuned".

Why can't I create a process for my AI system?

There are three possible reasons — all of them sit on the system itself:

The system is not deployment-ready: an AI process needs a released AI system "In operation". If there is none, step 1 of the process wizard shows the notice "No approved AI system available" with the button "Create AI system".
The system carries the badge "Not an AI system": the AI definition was answered with "no" — the system is documented evidence in the inventory, but without AI processes (see AI Systems).
The system carries the badge "Provider role": it is an in-house development or is operated under your own name or brand. That triggers the provider obligations under Art. 25 EU AI Act; NADOVO currently maps the deployer obligations, so there is no "Create process" step for such systems — release and inventory management remain possible, and the detail page explains this in the process card.

Whether a purchased system is operated under your own brand is answered in the AI system wizard (step "AI model and procurement") with the mandatory question "Is the system operated under your own name or brand?" — it appears for the procurement types SaaS/API, on-premise and embedded.

Why can't I release my AI process?

Because it needs an approved assessment. That applies to two cases, and both take the same route:

risk class "High-Risk" or "Unacceptable", or
assessment status "Required" from the deepening — including the classes "Limited" and "Minimal", for example for activities with a deepening need or the application area "Other" (see assessment status).

In both cases NADOVO offers "Submit for review" instead of "Release" in the overview, the action menu and the detail page; the phase chain on the detail page names the deepening as the reason. Release is a multi-stage process:

Step 1: Complete the process in the wizard (finish all 5 steps). When you edit it, the wizard opens where you last saved — you don't start over at step 1.

Step 2: Submit the process "For review" — This signals that the process is ready for a risk assessment. The action only appears once you have been through all five wizard steps; before that it reads "Edit" — in the overview as well as on the detail page. If the linked AI system is not ready for deployment, submitting is rejected; the message names the current status and the values allowed for it. (So this surfaces immediately instead of only at release.)

Step 3: Perform the assessment — Go to the "Risk Assessments" area and perform a risk assessment for this process. The assessment includes:

Identifying risks
Evaluating likelihood and impact
Defining measures for risk mitigation
Creating a Human Oversight Plan
Carrying out a Fundamental Rights Impact Assessment (FRIA) (when the FRIA is mandatory; otherwise optional — see Assessment)

Step 4: Approve the assessment — Make sure all mandatory fields are filled in (at least 1 risk, at least 1 measure per risk, Human Oversight Level, all FRIA categories rated when the FRIA is mandatory).

Step 5: Release the process — Only when the assessment has the status "Approved" can you release the process.

Why so many steps? Art. 26 of the EU AI Act regulation imposes documented duties on deployers of high-risk AI — among them suitable measures, human oversight and monitoring of operation — BEFORE the AI is deployed. The multi-stage release ensures that you can demonstrably meet these requirements.

Processes with low risk (Limited/Minimal): Here a direct release without an assessment is sufficient — provided the assessment status is not "Required". NADOVO computes the risk level and assessment status automatically and adjusts the release process accordingly. An assessment cannot be created while the process is a draft, which is why the route here, too, starts with "Submit for review".

What does the status "Paused" mean for an AI process?

A process is paused automatically when something changes on the linked AI system:

Reason 1 — AI system deactivated: The system was temporarily taken out of operation. As soon as the system is reactivated, you can reactivate the process as well.

Reason 2 — New version of the AI system: A new version of the AI system was released. The old version has been archived, and the process still points to the old version. You need to create a new process version and link the new AI system.

If the process is still a draft, it is simpler: there the AI system field is not locked. When you edit it, NADOVO inserts the current version itself and reports "AI system updated to current version" with the ID and version number; the selection list names the version for every system (e.g. AIS-000004 · Chatbot F (v2.1)). Only for a released process does the field stay locked — there the route is a new process version, so that the basis of the release is not swapped out after the fact.

How do I find out why my process is paused? NADOVO shows you the next step directly in the process overview:

"Reactivate" — the AI system is in operation again, the process can be reactivated directly
"Create new version" — the AI system has been superseded by a new version
"Activate the AI system first" — the AI system is still deactivated
"New version exists" — a successor version of this process already exists; review and approval happen there

Why can't I click "Activate the AI system first"? This is not a button but a hint: as long as the linked AI system is deactivated, "Reactivate" is not the next step. Activate the AI system first — "Reactivate" then appears as a clickable action.

The state of the AI system at a glance: A marker sits before the name of the linked AI system, in the "AI system" column:

Marker	Meaning
Green dot	"AI system in operation"
Red dot	"AI system out of operation" — usually the reason the process is paused
"Outdated" tag	The AI system has been superseded by a new version

The markers describe the AI system, not the process — the process status is in the "Status" column. Hover over a dot to see its meaning.

What happens to my assessment when the process is changed?

When you substantially change an AI process, the associated assessment must be reviewed. NADOVO automatically sets the assessment status to "Review required" in the following cases:

The risk class has changed (e.g. from "Limited" to "High-Risk")
The linked AI system has been swapped
The linked AI system was deactivated — the process is paused and the assessment must be reviewed

What do you need to do? Open the assessment, check whether the risk evaluation is still up to date, and approve it again. If the risk class has changed, you may need to identify additional risks or perform the FRIA.

Note: Assessments still in progress ("In progress") are not changed automatically — they still need to be completed anyway.

If the process is archived, NADOVO archives all assessments of that process too, whatever their previous status. They remain viewable as evidence; editing and approval are no longer possible there. That way no assessment is left in a state it cannot get out of.

Risk Classification

How does NADOVO classify AI processes — the overview?

The classification follows five core principles:

The AI process is classified, not the AI system. The system (Phase 1) supplies facts — system type, procurement type, fine-tuning, locations; the risk class arises on the process (Phase 2) from the concrete use.
The chosen activity decides. The core of the classification is a curated, versioned selection of application areas and activities (16 areas, 82 activities); every activity carries a stored rating including its legal reference.
Free texts never change the risk class — they only lead to suggestions and queries (see "cross-check" below).
The server computes, not the browser. On saving, the platform bindingly computes the risk class, derivation, transparency obligations, assessment need, DPIA hint and role hints; what the wizard shows while you type is a live preview of the same logic.
One application area = one process. If an initiative covers two activities, you create two processes.

The check runs in three stages: the structured selection of the application area, the deepening questions for activities that need closer examination, and the risk assessment as the binding second check (see the following questions and Assessment).

Which risk classes are there?

The EU AI Act distinguishes four risk levels. In NADOVO the risk class applies to the AI process (the use case), not to the AI system as such. Hovering over a risk class badge shows the full name with its article reference:

Risk class	Meaning	Examples	Consequence
Unacceptable	Prohibited AI practices (Art. 5)	Social scoring, manipulative systems	Must not be used
High-Risk	High-risk AI in sensitive areas (Art. 6)	Application pre-screening, credit scoring, biometric identification	Strict requirements, mandatory assessment
Limited	AI with transparency obligations (Art. 50)	Chatbots, deepfake detection	Transparency requirements
Minimal	Low risk	Spam filters, AI-supported search	No special requirements

Transparency obligations (Art. 50): Regardless of the risk class, transparency obligations apply to AI-generated content (texts, images, chatbots) from 2 August 2026 — you document checking and labelling in the AI Content Register.

Disclaimer (risk classification): This risk class is an automatically generated suggestion intended to support the assessment. It does not constitute a legally binding classification. The binding classification and the responsibility for it lie with the provider or deployer of the assessed AI system. A professional and legal review of the result is recommended.

How does NADOVO determine the risk class?

Automatically — per process. In the process wizard's "Purpose & Use" tab you select the application area from a curated list: 16 areas with 82 activities, searchable; if nothing fits, choose "Other (free-text description)" with your own description. Every activity is pre-classified according to the official criteria of the EU AI Act regulation (Annex I and III); NADOVO derives the risk class from it server-side. The "Risk classification" step shows the "Classification derivation" for it: chosen area and activity, pre-classification and the assessment rating. Below it stands the numbered "Reasoning for the risk class" — the chain of the server logic up to the result: the activity's pre-classification, Art. 5 and Annex I hits, the deepening answer V1 including the Art. 6(3) derogation, every transparency duty triggered under Art. 50 with its source (capability, activity mapping or deepening answer), the result ("Result (automatic): …") and any manual override with its reason. Activities that require closer examination lead to deepening questions in the "Deep dive" tab (see below); until they are answered, high-risk applies as a precaution, after that the class follows the answers. One rule applies: one application area per process — for another area, create another process.

Three aids speed up the selection: As long as no application area is chosen, the wizard analyses the intended purpose (after a short typing pause) and shows up to two matching activities above the area field as a "Suggestion from the intended purpose" — "Clicking adopts the activity as the application area"; nothing is ever filled in automatically. The search in the area field also understands everyday terms and synonyms ("chatbot", "KYC", "proctoring"), not just the activity names. And an X on the field clears the selection along with the associated deepening answers. The free texts (purpose, refinement, description, scope) never change the risk class — they only lead to suggestions and queries (see "cross-check" below); the chosen activity remains decisive.

Where do I see this again later? The process detail view (tab "Information") starts with the cards "Basic data" (including the functional area) and "AI system" (with a link to the system detail page); the application area shows the chosen activity as the chain "area → activity". The classification card contains the same derivation and "Reasoning for the risk class" as the wizard and, below it, "Duties and recommendations"; a dedicated "Risk assessment" card states the status with an explanatory sentence and the triggers ("Triggered by:").

Every trigger names the concrete input — following the pattern tier: input in step N (field): value → consequence. The tier is either "Required" (makes the assessment mandatory) or "Recommended". Example: "Required: Input in step 2 (application area): Activity "…" is classified as a deepening case → binding second check in the assessment". The same sentences appear in the wizard's "Summary" step and on the assessment pages.

My application area is missing from the list — what do I choose?

Choose "Other (free-text description)" and describe the activity in the required field "Description of the application area". "Other" is the defined doubt case: NADOVO classifies the process cautiously as high-risk; in the "Deep dive" tab you clarify the case via the Annex III confirmation (V1) and the Art. 50 detail questions (V4). An assessment always stays required for "Other" — it checks bindingly. The list of application areas is curated and maintained.

In addition, you can record an optional refinement for the chosen activity; scope and detailed description sit collapsed under "Further details (optional)".

"The stored activity is no longer available"? The activity list is curated; very rarely an activity is disabled or removed in a newer version. Existing processes keep their display, but the next time you edit one, a red note appears on the selection field and "Next" stays locked ("Open: application area (select again)"). Select the matching activity again — the deepening answers are reset in the process, because they belonged to the old activity.

What does the "Deep dive" tab ask for?

In the process wizard (step "Purpose & Scope"), the "Purpose & Use" tab is accompanied by the tabs "Personal Data (GDPR)" and "Deep dive"; a red dot on the tab marks open mandatory entries. When "Next" is locked, the reason stands beside it: a line "Open: …" with the names of the missing mandatory fields, for example "Open: Intended Purpose, application area". In this step it names only the fields of the currently open tab; the red dots on the other tabs show where something is still missing. Every box in the deep dive also has its own help card with a legal basis (see "Where do I find the help for a field?").

Before "Next", the deep dive requires:

Art. 5 self-confirmation: "I confirm that this AI process does not pursue any of the prohibited practices of Art. 5 EU AI Act." The list of the ten practices can be expanded for reference (including the "applies from" badges of the two most recent entries); the binding check happens in the risk assessment (step 2).
For activities with deepening need: the Annex III confirmation (V1) — does the use fall into one of the high-risk areas of Annex III? A documented "No" is recorded on the process. On a hit, the derogation check under Art. 6(3) (V2) follows: if profiling takes place, no derogation is available (the process stays high-risk); otherwise you select the applicable derogation and justify it (mandatory for derogations a–d). Without an applicable derogation the process stays high-risk. If you switch profiling to "Yes" afterwards, NADOVO clears a previously chosen derogation along with its justification — otherwise a justification requirement would hang on a field you can no longer see and would block "Next".
For activities close to Art. 5: the targeted prohibition question (V3). For emotion recognition, a follow-up asks whether the recognition serves exclusively medical or safety purposes — then the exception under Art. 5(1)(f) applies; the high-risk path and the assessment requirement remain.
For synthetic content: the card "Deepening V3 — Synthetic depictions" with the deepfake purpose question (Art. 5, marked "from 02/12/2026") — a hit makes the use impermissible.
For the application area "Other": the Art. 50 detail questions (V4) — four checkboxes for paragraphs 1–4 (interaction, synthetic content, emotion recognition/biometrics, deepfakes/texts of public interest).
For the high-risk use of a GPAI system: the role-check question under Art. 25(2) — "Do the documented excluded uses of the system rule out exactly this high-risk use?", with the system's excluded uses shown for comparison. A "Yes" blocks submission and release; the message names the ways out: procure a dedicated purpose-built system, limit the use case to non-evaluating tasks, or discontinue the initiative.
For certain activities, an Art. 50 individual question on the transparency obligation: with "Yes", the concrete obligation follows from the affirmed question and appears in the obligations list; with "No", the process is kept without a transparency obligation (as minimal) — the denial is documented.
For certain activities, a care check for the chosen activity — a confirmation of due care for this use. The confirmation applies per version of the activity list: when the list is updated, you confirm once more the next time you edit, because the wording of the check may have changed.

Once the questions are answered, the risk class follows the answers — the precautionary high-risk classification is lifted. The "Risk classification" step shows the card "Duties and recommendations" below the derivation (transparency and labelling obligations split into your own duty and "ensure with the provider", the DPIA hint, and where applicable a role-check hint). The "Summary" step lists all deepening answers and derives the card "Derived duties" — the full deployer duty list for high-risk (Art. 26/27/73/86/49), the transparency obligations by addressee for limited, and always the Art. 4 note on AI literacy.

As long as the deep dive has open mandatory questions, a blue note at the top of the "Purpose & Use" tab stays visible even while scrolling.

What is the cross-check?

A comparison of your free texts with the deepening-relevant activities of the list. If purpose, refinement, description or scope point to a deepening-relevant activity that is not chosen, an orange warning card appears immediately in the "Deep dive" tab: "Cross-check: hint at a deepening-relevant activity" — with the recognised terms. You have two options:

"Adopt activity" — adopts the activity as the application area and resolves the hint immediately.
"Does not apply" — with an optional justification. The denial is only noted at first ("Take back" is possible) and is recorded with person and timestamp only on the next regular save; after that, a blue confirmation with the date remains. The audit trail shows it as "Cross-check denied" with the recognised terms.

While a hint is open, Next, Submit and Release are blocked. A denial applies to the hit list of that moment — if changed texts produce new terms, a new hint appears. Denials and "Other" cases feed into the curated maintenance of the suggestions and synonyms.

Can I override the automatic classification?

Yes — within limits. In the "Risk classification" step you can manually override the automatically determined class if you consider it professionally inaccurate. The justification is mandatory (at least 20 characters) and is documented in the audit trail.

Three limits apply:

Downgrading only with a derogation: moving a class down is only admissible when the derogation under Art. 6(3) applies — for example a narrowly limited preparatory task with no influence on the decision. That reasoning belongs in the justification. Upgrading is always possible when the concrete deployment context carries more risk than the chosen activity reflects.
Never towards "Unacceptable": only high-risk, limited and minimal are available for selection.
"Unacceptable" cannot be overridden: if a prohibition question of the deep dive or a confirmed Art. 5 practice in the assessment leads to the class "Unacceptable", it stands — an override has no effect.

The override changes the risk class; the assessment status is then recomputed server-side — triggers such as deepening need or Art. 5 proximity remain, independent of the class.

Why is an assessment required although the risk class is minimal?

Because the assessment status is computed independently of the risk class. An activity with deepening need, the application area "Other", Art. 5 proximity, emotion recognition in the workplace or in educational institutions, and a deviation from the provider's intended purpose that is "Not assessable" make the assessment the binding second check — even when the class is minimal or limited.

The process release stays blocked until the assessment is approved. The full trigger table sits in the question "What is an assessment and when do I need one?" under Risk Evaluation & Assessment.

How are existing processes without an activity selection classified?

Processes whose application area is still captured as free text are classified by NADOVO via term recognition: terms recognised from purpose and scope are matched against the same criteria (Annex I and III). The risk class and the previous display of these processes remain — there is no silent reclassification.

On the next edit, the activity selection becomes mandatory; from then on the activity logic applies to this process too.

What does NADOVO record as evidence when a process is released?

With the release, NADOVO freezes the classification state: the version of the activity list used, the system facts of the linked AI system, the legal status (version of the AI regulation), plus person and time. An activity list updated later only affects new or newly saved processes — released states never change.

All classification fields appear as readable change rows in the audit trail; special events — a risk class change, a denied cross-check, an Art. 5 hit from the assessment — are dedicated entries.

Risk Evaluation & Assessment (Phase 3)

What is an assessment and when do I need one?

An assessment is a systematic risk evaluation for an AI process. The assessment status is computed server-side from the process entries and stored on the process — so it can be "Required" even when the risk class is minimal:

Indicator	Triggers	Action
"Required"	Risk class high-risk or unacceptable · activity with deepening need or application area "Other" · activity close to Art. 5 · emotion recognition in the workplace or in educational institutions · deviation from the provider's intended purpose "Not assessable"	Perform and approve the assessment — the process release is blocked until an approved assessment exists
"Recommended"	Annex I product relation "Unknown" · an applicable derogation under Art. 6(3) · vulnerable groups affected · the capabilities biometrics, profiling/scoring or emotion recognition	Assessment is recommended but not mandatory for release
"Not required"	None of the triggers above	No assessment needed

The GDPR relation does not trigger an AI-Act assessment. If the process handles personal data with special categories, a third-country location of the AI system or profiling, NADOVO instead shows the separate hint to check a data protection impact assessment (DPIA) under Art. 35 GDPR — a distinct GDPR instrument that neither replaces nor is replaced by the AI-Act assessment.

Step 1 of the assessment shows the card "Affected persons and impact" with the groups of people you selected in the process wizard (step "Purpose & Use") — so "applicants", for example, instead of an empty card. Next to it stands the occasion (card "Occasion of the assessment" with the concrete triggers in plain language — each with its tier, the input including wizard step and field, the value and the consequence) as well as the classification derivation from the process wizard (area → activity, pre-classification, deepening answers, capability entries, vulnerability) with the "Reasoning for the risk class".

The assessment detail view bundles everything substantive in the "Information" tab: basic data, AI process, derivation, risks, measures, Art. 5 check (with the origin "X manual · Y taken over") and FRIA (with the mandatory-status derivation); at the bottom, the occasion appears as a blue note. Besides it there are only the tabs "GDPR" and "Version history". Older assessments keep the previous display.

My assessment shows "Review required" but I cannot edit it — why?

Reviewing an assessment requires the linked AI process to be up to date. If the process is paused, still a draft or archived, the assessment overview shows the non-clickable hint "Update the process first" in the "Next step" column — with the explanation: "Review or approval becomes possible once the linked process has been updated and submitted for review as a new version."

What to do? First create a new version of the process (typically after updating the AI system) and submit it for review. The assessment then becomes editable again.

The "Next step" column tells you what is due in every situation:

Display	Meaning
"Continue"	The assessment is in progress — the wizard opens
"Start review"	The assessment needs to be reviewed
"Update the process first"	A hint, not a button — the process is blocking the review
"Approve"	The assessment is complete and can be approved
"Approve process"	The assessment is approved — the process approval is missing
"Conformity documented"	Process and risk assessment are approved, all documentation steps are done

For archived assessments the column stays empty — the status is enough there.

The notice banner on the assessment detail page names the state of the process:

Process	Notice title	What applies
suspended	"Process suspended"	Once it is approved again, you can continue working
archived	"Process archived"	The assessment can only be viewed
superseded	"Process version superseded"	Continue with the assessment of the current process version

So archived assessments can still be opened and read as evidence. The hint "Update the process first" appears only for a suspended process — for an archived one there is nothing left to update.

Deleting is possible only for assessments with the status "In progress" and is reserved for company admins; whether the linked process is suspended makes no difference. Completed, approved and archived assessments are retained as evidence.

About "Conformity documented": The completion badge also appears in the process overview, likewise for approved processes with no assessment obligation (evaluation "Not required") — their documentation is complete once the process is approved — and in the AI Content Register for released entries. It confirms only that the documentation steps in NADOVO are finished, and does not replace legal advice.

What must be included in an assessment for high-risk processes?

The EU AI Act sets clear requirements for risk management of high-risk AI. NADOVO guides you through the assessment in 6 steps:

Step 1 — Select process: Choose the AI process for which you want to perform the assessment. The process context shown also names the process owner — the same detail appears in the closing summary.

Step 2 — Prohibited practices check (Art. 5): Check whether your AI use falls under one of the ten prohibited practices in Art. 5 of the EU AI Act. For high-risk processes you answer the mandatory entries individually (see also the next question).

The last two entries in the list — "Intimate Deepfakes" (Intimate or Sexual Depictions Without Consent, Art. 5 (1)(ba)) and "Abuse Material" (Child Sexual Abuse Material, Art. 5 (1)(bb)) — come from the amending Regulation (EU) 2026/1744 and apply from 2 December 2026. Until then they carry the badge "from 02/12/2026", answering them is voluntary, and they do not count in the header counter ("x/8 checked", "x/10" from that date). Two things matter here:

The check question targets the purpose of use: an image generator that could technically produce such content is not affected — for deployers, only using the system for that purpose is prohibited.
Anyone who answers "Yes, applies" for one of these two entries is stopped like with any prohibited practice (risk class "Unacceptable") — regardless of the date.

A confirmed hit acts back on the process: NADOVO permanently sets the AI process to "Unacceptable" (with an audit entry) — later process edits never lower the class again. For released processes, the process detail view shows the guidance to cease the use and archive the process.

Assessments that are already completed remain valid unchanged; whoever reopens one sees the two entries and answers them along the way.

Step 3 — Identify risks: Capture all relevant risks for your AI use (e.g. discrimination, data protection breach, faulty decisions).

Step 4 — Evaluation and measures: Evaluate each risk by likelihood and impact. Define at least one mitigation measure for each risk.

Step 5 — Human Oversight and FRIA:

Human Oversight: Set the oversight level (human-in-the-loop / on-the-loop / in-command, Art. 14) and name a responsible person — optionally also a deputy. Only employees with a completed qualification documented in the AI Literacy module can be selected (so the competence of the oversight person required by Art. 26(2) is structurally evidenced). For high-risk processes the responsible person is mandatory. Use the "Notes" field for execution details (e.g. escalation path, how to act on anomalies).
FRIA (Fundamental Rights Impact Assessment): Evaluate the impact on fundamental rights across 6 categories. The FRIA tab shows whether the FRIA is mandatory or optional for this process — including the reason (see the separate question below).

Step 6 — Summary: Review the overall evaluation and accept the residual risk. If something is missing, "Complete Assessment" is locked and "Open: …" stands beside it naming what is left (e.g. "Open: residual risk acceptance") — you no longer click into the void. The "Next review" field is pre-filled: 12 months for high-risk, otherwise 24 months from today, with a note that this is a suggestion based on the risk class and can be changed. The summary also states the occasion of the assessment, the origin of the Art. 5 answers ("X manual · Y taken over") and the FRIA derivation. "Complete Assessment" ends the wizard. Approval is a separate step and happens afterwards via the overview or the detail page — the "Next step" column offers it there. Capturing and approving are deliberately two distinct actions.

Mandatory fields for approval:

At least 1 risk identified
For each risk, at least 1 measure defined
Human Oversight Level set
When the FRIA is mandatory: all 6 FRIA categories rated

When is the fundamental rights impact assessment (FRIA) mandatory?

The FRIA is not mandatory for every high-risk process. Under Art. 27(1) it is mandatory only when the process is high-risk and one of the two applies:

your organisation is a public body or provider of public services — controlled via the switch of the same name in the organisation profile; or
the activity belongs to Annex III 5(b)/(c) (creditworthiness assessment/scoring or pricing in life and health insurance).

The same rule applies in both places where you meet it: in the assessment and already in the review step of the process wizard. If no FRIA note appears there, the FRIA is not mandatory in the assessment either. The FRIA tab shows this as the badge "FRIA mandatory" (with the reason) or "FRIA optional" — in which case: "Art. 27 does not oblige you here — the FRIA is recommended as evidence of due care." Filling it in always remains possible. When the FRIA is mandatory, completion requires all six categories; the error message states the derivation.

Three notes accompany the tab: a FRIA already carried out can be reused in comparable cases (Art. 27(2)), when the FRIA is mandatory the result must be reported to the market surveillance authority (Art. 27(3)), and an existing DPIA can complement the FRIA (Art. 27(4)).

Do I have to complete the whole assessment for a process that is not high-risk?

No. Below high-risk, the EU AI Act requires neither an individual check of the prohibited practices nor a risk assessment — so NADOVO takes you through the same six steps in a shorter form:

Step 2 (prohibited practices) is already filled in and read-only for the practices under Art. 5(1)(a) to (h). A note explains: "Already checked during classification" — these practices were evaluated during the AI process's risk classification (Art. 5 self-confirmation and deepening answers from the process wizard), and none apply. The two entries from the amending regulation ("Intimate Deepfakes" and "Abuse Material") are not taken over and remain open for you to answer yourself — the note names them. Until 2 December 2026 answering them is voluntary, so you can go straight to "Next".
No take-over when close to Art. 5: with a deepening activity, the application area "Other" or a relevant capability (emotion recognition, biometrics, profiling), a warning card "Manual second check required" explains the reason (including your answer to the targeted Art. 5 question from the process wizard) — then all mandatory practices must be answered manually, even below high-risk; completion enforces this.
Step 3 (identify risks) is optional: "Capturing risks is optional here". You can move on without an entry. Adding one still makes sense if you want to document something — for example regarding data protection where personal data is processed.
Step 4 reports "No risks captured — that is fine" when the list is empty and offers the way back to step 3 without demanding it.

For high-risk processes both stay mandatory: the prohibited practices are asked individually, and without at least one evaluated risk with a measure you cannot continue.

Two details: Answers you have already recorded are never overwritten — if you filled in step 2 manually, your input stays. And if a process is later reclassified as high-risk, step 2 asks for all mandatory answers again; results taken over automatically no longer count.

Why can't I select a responsible person for human oversight in the assessment?

Only employees with a documented, completed qualification (Art. 4 EU AI Act) can be selected. First create a qualification in the AI Literacy module — internal measure, external proof or experience assessment — and complete it. The person then appears in the selection for the responsible person and the deputy.

You do not have to find the way yourself: when the selection is empty, the button "Create qualification in AI Literacy" takes you straight there (below a populated selection there is the link "Employee missing? Create qualification in AI Literacy" instead). NADOVO saves your draft first and shows a note at the top of AI Literacy: "You came from the assessment. Create the qualification and confirm its completion, then you can continue there." — with the button "Back to assessment", which returns you to step 5.

If there is no qualified employee yet, Step 5 shows a corresponding hint. This is how NADOVO ensures the oversight person demonstrably has the competence required by Art. 26(2). (This does not apply to measure owners in the "Measures" module — no qualification is needed there.)

What does "Review required" mean for an assessment?

This status means that something has changed in the context and you need to check whether your risk evaluation is still current.

Possible triggers:

The linked AI system was deactivated (the process is paused)
The linked AI system was swapped
The risk class of the process has changed

What do you need to do?

Open the assessment
Check whether the identified risks and measures still apply
Adjust the evaluation if needed
Approve the assessment again

The review starts at step 1, not at the end: because the context has changed, the Art. 5 check and the evaluations have to be confirmed in the new context — so you go through the wizard again from the beginning.

Versioning

Why are there versions, and what do the numbers mean?

NADOVO uses version numbers (e.g. 1.0.0, 1.1.0, 2.0.0) to document changes to AI systems and AI processes traceably. This matters because the EU AI Act requires changes to AI systems to be documented and retained for at least 10 years (Art. 12).

You do not need to worry about the version numbers. NADOVO automatically detects what has changed and suggests a suitable version number. You can simply accept the suggestion.

If you're curious — here's how the logic works:

Change	Example	Version number
Substantial change	Different AI model, different role, different location, changed AI definition	1.0.0 → 2.0.0
Minor change	New responsible person, different procurement type, updated description	1.0.0 → 1.1.0
Minimal change	Correction in the name, notes updated	1.0.0 → 1.0.1

Can I still edit a released AI system or process?

No — and that is by design. A released element represents a reviewed and documented state. If you want to make changes, create a new version:

Click "Create new version" in the action menu
NADOVO creates a copy as a draft
Edit the desired fields
In the last wizard step you see a summary of the changes
Release the new version

The old version is archived automatically. All changes are documented in the audit trail.

Why can't I just overwrite? If an auditor or supervisory authority wants to trace how your AI system was configured 2 years ago, the old state must be available. Versioning makes that possible at any time.

I started a new version and don't want it after all — how do I get rid of the draft?

"Cancel" in the wizard deletes nothing. It only leaves the wizard; the draft is kept with the state you last saved in between. The confirmation dialog reads "Cancel asset registration?" ("Back to form" / "Yes, cancel") for AI systems and "Cancel Process?" ("Continue Editing" / "Cancel") for AI processes. The first draft of an element behaves exactly like the draft of a new version — one button, one meaning.

Discarding happens via the action menu: in the overview, choose "Delete" from the draft's three-dot menu — company admins only. The previously released version is the current one again afterwards.

What cancelling does cost you: only the entries made since the last intermediate save — cancelling does not save. Everything before that is in the draft.

Why does NADOVO ask whether I want to leave the wizard?

Because there are entries that have not been saved since your last save. If you leave a wizard in that state via the sidebar, the breadcrumbs or the tenant switcher, the dialog "Leave wizard?" asks first: "Unsaved changes will be lost. Do you really want to leave the wizard?" — "Continue Editing" keeps your entries, "Leave" discards them. The last saved draft survives either way.

When reloading or closing the browser tab, the browser adds its own warning — the same check, just outside the application.

If you changed nothing, or have just saved, NADOVO does not ask. Not covered are the browser's back button and logging out — save in between before using those.

Why does an older version of my AI system show different model details than the catalogue?

Because the details of a released version are the state at the time of release — that is the evidence "evaluated with model X, version Y". On release, NADOVO freezes the model name, model provider and model version for each linked model; the detail page shows "State at approval (date)" for them. Later catalogue maintenance (new model version, renaming) no longer changes these details.

In a draft the opposite applies: the display shows the current catalogue state with the note "Current catalogue state — frozen on approval." A new version therefore starts with the current state and freezes it again at its own release.

If a released version shows the catalogue-state note, no state has been frozen for it yet — the next release of a new version takes care of that; no evidence is fabricated retroactively.

Phase 4 — AI Literacy & Measures

Is training mandatory? What does the EU AI Act require?

A specific training course is not legally required. Article 4 of the EU AI Act expects companies to foster their employees' AI competence ("AI literacy") — the 2026 Digital Omnibus amendment softened the originally stricter wording ("ensure a sufficient level of AI competence"). So it is about demonstrably fostered competence, not a mandatory training.

In NADOVO you document this competence in the "AI Literacy" module (IMPLEMENT phase) — an evidence register under Art. 4. You record qualifications via three equivalent routes (internal measure, external proof or experience assessment); the AI Act prescribes no particular format — neither certificates nor exams. What matters is that you can evidence the competence — from 2 August 2026 supervisory authorities can request proof.

What you should do:

Foster the AI competence of everyone who works with AI systems — e.g. via training, briefings or guidelines
Document this in the "AI Literacy" module
Evidence it, depending on the route, through the entry itself, an uploaded document or a substantiated assessment

How do I manage my employees' AI competence?

You document and evidence your employees' AI competence in the "AI Literacy" module. Each entry is a qualification and is recorded via one of three equivalent routes — the input fields adapt to the chosen qualification type:

Internal Measure — a training, briefing or e-learning your company conducts itself. The entry is the evidence; optionally with a format (e.g. in-person, online). Can be planned and marked completed afterwards. Documenting something that has already taken place? Tick "Already conducted" when creating it (it only appears for an internal measure with a date up to today). The note below says what follows: "After saving, the completion dialog opens. Only the confirmation sets the measure to completed." That way the entry does not first land in the list as "Overdue" — but completion remains a confirmation, not an inference: you choose in the dialog who attended.
External Proof — a document issued by a third party (certificate, attestation, degree). Applies to exactly one employee, and the proof file is mandatory — it is the evidence. Counts as completed immediately.
Experience Assessment — a qualified person in your company assesses the competence from practical work, with a function and a reason (self-assessment is not possible). Counts as completed immediately.

Attaching a document: You can upload a file with every entry — PDF, PNG, JPG or WebP, max. 5 MB (mandatory for an external proof, optional otherwise). NADOVO checks the actual file content, not just the file extension: a renamed or corrupted file is rejected with a message and not stored — upload the original file in that case, or export it again. Entry and document are created together: if the file is rejected, no entry is created either.

Who can be selected here: the employee directory holds everyone who can be assigned — every user of your organisation automatically (including yourself), plus the employees you add by hand. A NADOVO account is therefore not required, but it is no obstacle either: you do not have to create users as employees as well. When recording, you type the name — existing entries are suggested, and new people without an account you create with first and last name directly in the dialog. Directory entries grant no access to the application and do not count against the user limit (see user management).

Status: "Planned" and "Completed" follow from how you record the entry; "Overdue" is calculated automatically when the date of a planned internal measure has passed. Completed entries can additionally be archived (status "Archived" — see its own question below).

Overview, completing and editing: the overview has a filter row — search plus the Qualification, Type, Employee and Status filters — and sortable columns. A paperclip icon next to the title shows that an entry has a document attached; clicking it opens the document directly in the preview ("Open document"). The actions are available via the menu at the end of the row. Administrators complete a planned internal measure via the action menu with "Quick complete": there you choose which employees attended; anyone missing can optionally be removed from the entry (if people remain open, the entry stays "Planned"). Without administrator rights you instead mark participants individually in the detail dialog (the "Participants" tab). The employees of an entry can also be edited there afterwards. You can reuse an existing entry as a template.

What is an experience assessment?

When a person is demonstrably competent without a training course or certificate (e.g. years of practical work with AI systems), a qualified person in your company — such as a manager or the compliance lead — can assess that competence. You provide the function of the assessing person and a reason; this makes the assessment robust towards authorities. Self-assessment is not possible — the assessing and the assessed person must be different.

Why is my external proof immediately "Completed"?

External proofs and experience assessments document an already existing qualification — there is nothing left to carry out. Their date (issue or assessment date) therefore cannot lie in the future. Only the internal measure has a "Planned" state, because it still has to take place.

How do I create a proof (PDF) of AI competence?

Two ways — both produce a PDF under Art. 4:

Single entry: for a completed qualification, via the action menu "Report (PDF)" — with all the entry's details, the participating employees and the audit trail.
Overall proof: via the "Qualification proof (PDF)" entry in the three-dot menu at the top right of the overview (administrators only, and only when the list is not empty). Beforehand you choose the scope — all or selected employees; the chosen scope is stated in the PDF. The report lists the records per employee with their respective status ("Completed on …" / "Open"). It covers only active entries — archived ones are not included (use the single-entry report for those).

This lets you evidence AI competence to an authority, customer or auditor in one place.

Can I delete or archive a completed qualification?

Delete: no. Completed qualifications are compliance evidence under Art. 4 EU AI Act — to keep your register complete, they cannot be deleted, only archived. Planned entries (not yet carried out) can be deleted by administrators.

Archiving (administrators only, via the action menu or the detail dialog):

A confirmation dialog points out that the action cannot be undone — there is no restore. So check the entry for completeness beforehand.
An archived entry is read-only: it can no longer be edited, completed or deleted.
The single proof (PDF) is available; archived entries are not included in the overall proof.

Where do I find archived qualifications? They are hidden in the overview by default — select "Archived" in the status filter to show them.

How do I document risk-mitigation measures (Phase 4)?

In the "Measures" module you track the risk-mitigation measures — i.e. implementing the measures defined in the assessment (Phase 3).

Origin: measures are derived automatically from risk assessments or created manually ("New measure"). Measures derived from assessments are linked to the corresponding risk and process; manually created measures are not linked to any process.
Fields: title, type (technical, organizational, human oversight), description, responsible person, due date.
Responsible person: chosen from the employee directory (maintained in the AI Literacy module) — the person needs no user account of their own and no documented qualification (unlike human oversight in the assessment). The field is optional.
Status: each measure moves through Planned → Active → Completed. "Active" covers both — currently being introduced and running continuously (e.g. a measure that applies as long as the process is active). You change the status via the action menu (⋮) — for manual and assessment measures; every change is recorded in the audit trail.
Overview: sortable columns (default: nearest due date on top, overdue in red) and multi-select filters (measure, process, responsible, due date, status). The measure type is shown in the detail dialog and the export.
Archive instead of delete: completed measures can be archived by administrators (final, read-only); after that they cannot be deleted. Planned and active measures remain deletable. Archived measures are hidden by default — select "Archived" in the status filter to show them.
Export: measures can be exported as CSV/JSON or to tools such as Trello, Teams Planner or Jira.

AI Incidents (Phase 5)

What is an AI incident and when do I have to report it?

An AI incident is an event in which an AI system leads to harm or malfunction — for example discriminatory decisions, data protection breaches, or faulty outcomes with real-world effects.

Reporting deadlines under EU AI Act (Art. 73) — each from discovery of the AI incident:

Severity	Reporting deadline	Example
Critical	2 days	AI system causes significant harm to health or safety
Serious	15 days	AI system systematically makes discriminatory decisions
Minor	No reporting obligation	Isolated error without larger effects

NADOVO shows the remaining reporting deadline as a color-coded indicator so you don't miss a deadline.

How do I report an AI incident to the authority?

For reportable AI incidents (serious/critical), NADOVO supports you with the reporting workflow in the AI incident detail:

Responsible authority pre-filled: based on your company's country, NADOVO automatically suggests the responsible market surveillance authority (e.g. the Bundesnetzagentur for Germany) — with name, website, reporting portal, email, phone and, where applicable, a note. Prerequisite: the country is selected from the list in the "Organisation" module ("Company" tab) — if it is missing, the AI incident report points this out and links directly to the settings.
The place of the AI incident is decisive (Art. 73): the pre-fill follows the company's registered office as a practical starting point. What matters, however, is the authority of the member state where the AI incident occurred — which is why the "Authority / Recipient" field can be freely overwritten (see the next question).
Prepare the report: choose a reporting method (e.g. email, reporting portal, phone) — the authority's contact details are filled in accordingly. You can copy the prepared notification text or open it as an .eml file; you record the authority's case number in the AI incident.
Report first, then resolve: a reportable AI incident (serious/critical) must be reported before it can be resolved — the "Resolution" tab is locked until then.
Optional "Provider informed on": in addition to the authority, you can record when you informed the provider of the AI system (Art. 26(5)).

AI incidents with the "Minor" severity generally have no reporting obligation.

What statuses does an AI incident have — and how do I close it?

An AI incident moves through a simple model: New → Resolved → Archived, plus Cancelled for an abort.

Reporting is a marker, not a status. Once the authority has been notified, the deadline column shows "Authority notified" instead of the countdown (the notification date appears on hover). The AI incident stays in the "New" status until you resolve it.

How to close an AI incident:

Resolve: in the "Resolution" tab you choose "With measures" (root cause plus corrective and preventive actions) or "Without measures" (e.g. a false alarm — with a mandatory reason). For reportable AI incidents this is only possible after reporting (see the previous question).
Archive: resolved AI incidents can be archived. They then disappear from the default overview but remain reachable via the "Archived" status filter.

How do I delete an AI incident? You can't — AI incidents are evidence and cannot be deleted. Instead of deleting, you cancel an AI incident that has not yet been reported and is unresolved (with a mandatory reason). It receives the "Cancelled" status, is retained as a record, and the action is documented in the audit trail.

Where does the authority data come from — and can I change the suggested authority?

The authority data (name, website, reporting portal, email, phone) comes from a directory of market surveillance authorities per country maintained centrally by NADOVO. It is continuously updated — treat the pre-fill as a vetted starting point, not as conclusive legal advice. If there is no dedicated entry for your country (yet), NADOVO shows an EU fallback ("national market surveillance authority") — so reporting is never blocked, and you can add the recipient manually.

Change it? Yes. The "Authority / Recipient" field can be freely overwritten — important when the AI incident occurred in a different member state than your registered office (Art. 73).

Good to know: the recipient saved with a report is a snapshot. Later updates to the directory do not change reports that have already been documented.

AI Content Register

What is the AI Content Register and why do I need it?

From 2 August 2026, the transparency obligations of Art. 50 EU AI Act apply: AI-generated content must be marked under certain conditions — and anyone relying on an exemption must be able to prove it if challenged.

The AI Content Register (its own item in the main navigation) is where you capture every relevant AI-generated piece of content as audit-proof evidence — linked to the generating AI process, reviewed by a human, documented in the immutable audit trail (10 years).

Depending on the content type, an entry serves one of two purposes:

Review evidence (text only): AI-generated texts on matters of public interest must be marked — unless a human has reviewed them and takes editorial responsibility (Art. 50(4)). The register entry proves exactly that: who reviewed, when, and who is accountable.
Marking evidence (image, audio, video, dialogue): Here the entry documents that and how you fulfilled the marking obligation — or why an exemption applies.

Important: The register is precautionary evidence — there is no legal obligation to keep such a register. But when an authority, competitor or customer asks "Is this AI? And where does it say you reviewed it?", you have the proof at the click of a button.

When does AI content have to be marked — and when not?

That depends on the content type. The release dialog ("Review & release") guides you through the decision per type and explains the legal situation at the moment of the decision:

Text: First the classification: does the text inform the public about a matter of public interest? If "No" (e.g. product copy, internal memo), there is no marking obligation — your classification is documented as evidence. If "Yes": with confirmed content review and editorial responsibility taken, the review exemption under Art. 50(4) applies — no marking needed, the entry is your proof. Without human review, marking is mandatory.

Image / audio / video: The deepfake question: could the content appear real to viewers (persons, places or events depicted realistically)? Yes → marking is mandatory (label text and placement are documented). No (obviously artificial) → no marking obligation, the choice is documented.

Dialogue (chatbots, voice/phone assistants): must generally be marked — users or callers must recognise they are interacting with an AI (Art. 50(1)). Exception only where the AI use is obvious.

Where marking is required, you must confirm before release: "The marking is applied to the content." This confirmation is logged as its own audit-trail event — the evidence that marking actually happened.

Note: Violations of Art. 50 carry fines (up to EUR 15 million or 3% of global turnover). The register does not take the marking obligation off your hands — it documents your decisions so you can prove them at any time.

How do I create an AI content entry?

Via "New AI content entry" in the AI Content Register. Three required fields are enough: content type (text, image, audio, video or dialogue), title and the generating AI process. Everything else is optional: type of use (fully AI-generated, AI-assisted, AI-edited), reference (URL or storage location — can be added until release) and notes.

Two ways:

Manually: fill in the form — always available.
Metadata upload (JSON): paste the metadata block returned by your AI tool or drop it as a file — the fields fill in automatically (see the next question).

The entry is saved as a draft. Review, release and marking are deliberately not part of capture — they happen together via "Review & release" in the list.

AI process not inventoried yet? Then select the option "AI process not inventoried". The entry documents this fact, the release is not blocked — and via the process filter such inventory gaps stay visible, so you keep track of which processes you should still inventory in Phases 1 and 2.

What is the metadata prompt and how does the JSON upload work?

The fastest way into the register — tool-independent, without a plugin or API connection:

Copy the prompt: In the capture dialog, select the AI process under "Metadata prompt" and click "Copy prompt".
Append it to the generation: Attach the prompt to your request in the AI tool (e.g. ChatGPT, Claude, Copilot) — the tool returns the content plus a structured metadata block (JSON).
Upload: Drag the JSON block into the capture dialog, paste it, or choose the file — the fields fill in automatically. Validation is rule-based; if something is wrong you get a specific list of errors.

Important — the review stays human: The upload only fills in the capture data (content and AI use); uploaded details are marked as "self-declared" by the AI tool. Review, classification, editorial responsibility and marking arise exclusively through your action in the platform — no AI evaluates anything automatically here. That is exactly what makes the evidence credible.

Can I change or delete a released AI content entry?

No — and that is by design. An entry moves through the lifecycle Draft → Released → Archived. On release it becomes an immutable evidence snapshot; the reference (URL/storage location) is also fixed at that point — release is the last chance to add or correct it.

If the content changes: Use "Duplicate". NADOVO creates a new draft with the capture data — classification, review, marking and release are deliberately not carried over; each version goes through its own release process. With the option "Replaces the original", the original entry is automatically archived when the new one is released ("superseded by") — without a gap in the chain of evidence.

Deleting: Released and archived entries cannot be deleted (only archived) — they are evidence. Company admins can delete drafts; this too is logged in the audit trail.

What if the linked AI process changes? If the process is archived or a newer version exists, the entry shows an info badge — the released entry stays valid as a snapshot; there is no retroactive effect.

What is the four-eyes principle on release?

Optionally, you can require that the release approver is a different person than the creator of the entry. Company admins enable the setting "Four-eyes principle on release" in the "Organisation" module on the "Company" tab.

Default: off — small teams are not slowed down. Enable the principle if your internal governance requires a separate review or you want to further harden the evidence.

How do I prove, if challenged, that content was reviewed and marked?

In two ways:

Audit trail (10 years): Every relevant event — capture, JSON upload (self-declared), editing, release, marking confirmation, reference change, duplication, archiving — is logged immutably with person and timestamp.

AI Content Evidence Report (PDF): For every released or archived entry, the action menu ("Report (PDF)") generates a password-protected PDF report (AES-256) with the entry data and the audit-trail excerpt — ideal for providing clean proof to an authority, customer or auditor. For the whole register, the "Full register proof (PDF)" entry in the three-dot menu at the top right of the overview produces a report over all entries with an overview by status and marking.

Thanks to the link to the AI process, a single document can prove: which system generated the content, in which use case, and who reviewed it.

Audit Trail & Documentation

What does NADOVO document automatically?

NADOVO automatically logs all changes to your AI systems, processes, assessments, training, AI incidents, and AI content entries. You don't have to document anything manually.

What is recorded:

Who changed what, and when
Which fields were changed (old and new value)
Releases and approvals
Status changes (including automatic ones, e.g. through cascading)
Risk classifications and changes to them

Retention: 10 years, as required by EU AI Act Art. 12.

No entry is lost — not even during an outage. The audit trail lives in a database of its own. If that database is temporarily unreachable, the entry is queued and delivered as soon as it responds again (delivery runs every minute, oldest entries first). For you that means:

You can keep working. An audit trail outage does not block your actions.
An entry may appear with a delay. If an entry is missing right after a change, it is not lost — it will be added.
There is no state in which your data is saved and the evidence is silently missing. The queue sits in the same database that has just stored your business record; if the queue write fails, the action itself fails too — with a message.

Export: You can export the audit trail as PDF (read-only), CSV or JSON at any time.

Where do I find the audit trail?

You find the audit trail directly on each element — there is no separate audit module. Open an AI system, a process, an assessment, a training or an AI incident and choose "Audit trail" from the three-dot menu at the top right. All the other actions of the detail page live there too (edit, release, status changes, delete) — the title row stays clear. The dialog shows the full change history (who, what, when; old and new value) and can be exported as PDF (read-only), CSV or JSON.

From the overview as well — via the same three-dot menu, sitting at the far right behind the main action. Six modules have it: AI System Inventory, AI Processes, Risk Assessments, AI Incidents, AI Literacy and the AI Content Register. In the last two, the same menu also holds the respective register proof. Measures are the only module without an audit trail — neither in the overview nor as a choice in the change report.

Inside the dialog, clicking a row opens the entry's detail view — the same target as the eye icon at the end of the row. Both show the details of the entry, not the object's page.

The object filter lists only objects that have entries — in every module as "ID · label" (for measures the label alone, as they have no readable ID). An object without a single logged action is not in the list; as soon as something is changed on it, it appears. So the selection cannot produce an empty result list. Deleted objects remain selectable — for example in the AI Content Register or in AI Literacy: their history is evidence and ends with the "deleted" entry.

Note: The "Audit trail" entry is only visible to company admins. The three-dot menu appears at all only when there are actions available for the current status and role.

What an entry "Released" shows: besides the status rows, the inputs from the release dialog as readable rows — for an AI system and an AI process the "Approval responsible" (the person chosen there) and, if entered, the "Approval comment"; for a risk assessment "Approved by" and "Approval notes". For an AI process, the entries "Submitted for review" and "Submission withdrawn" also carry the entered comment as its own row. This applies retroactively — older entries show these rows too. The same details appear in the change report (PDF and CSV).

Do not confuse the terms: the "Approval responsible" is the person chosen in the release dialog (Art. 17). The "Responsible person", by contrast, is the field on the AI process itself. "Approved by" on an assessment is the name from the assessment's own release dialog.

Names instead of identifiers: the name appears in these rows even for people who no longer belong to the company. The collapsed block "Technical raw data (JSON)" still shows the stored values including technical identifiers — it is the raw evidence, not the reading view.

As a PDF this becomes the change report — see Reports & Evidence.

Reports & Evidence

Where do I find my reports again?

The "Reports & Evidence" menu item (at the top of the navigation, administrators only) gathers all reports in one place: change report, AI content proof and qualification proof. Before generating, you see how many entries the report will cover.

The log is not a download archive. The page records which report was generated when and by whom — number, type, subject, time and person. The documents themselves are not stored: save a generated PDF wherever you want to keep it. You can generate it again at any time, which produces a new report number.

Do I have to generate reports through this module? No. The entry points in the specialist modules remain, and both routes produce the same document. The only difference is context: in the specialist module the subject is already set, in the reports module you choose it in the dialog.

Why don't I see the menu item? Only users with the administrator role may generate reports and view the audit trail.

What is in the change report (audit trail)?

The change report is the PDF version of the audit trail — the full change history of an element with person, time, and old and new value.

Report number: every report carries a number in the form CHG-PROC-000021 — on the cover page, in every page header and in the end marker. That makes it citable towards an authority or auditor.
Always complete: the report contains all entries of the chosen selection, not just the ones currently on screen. Page 2 states this explicitly as "all N of N".
Narrow it down via object and period: the search in the dialog is only a screen aid and does not shrink the report. The object list names ID and label, with the most recent entry on top; long labels are truncated and shown in full when you hover over them. It holds the same objects as the filter in the audit trail dialog — only those with entries, deleted ones included.
Six modules are available: AI System Inventory, AI Processes, Risk Assessments, AI Incidents, AI Literacy and the AI Content Register. Measures are missing because that module keeps no audit trail.

Besides PDF, CSV and JSON are available.

What are the downloaded files called?

All reports and exports follow the same pattern: a name, the ID for single-entry reports, then date and time.

qualification-proof-TRN-000012-2026-07-30-1042.pdf

Which name a download carries:

Download	File name starts with
Change report (audit trail)	`audit-trail-` plus the module, e.g. `audit-trail-process`, `audit-trail-asset`, `audit-trail-ai-content`
Qualification proof, single / register	`qualification-proof-` / `qualification-register-`
AI content proof, single / register	`ai-content-proof-` / `ai-content-register-`
Measure export	`measures-`, and for the tool formats `measures-trello-`, `measures-planner-`, `measures-jira-`

The change report's file is still called audit-trail-… — the report title inside the PDF reads "Change report (audit trail)", the file name is independent of it.

Thanks to the timestamp, two exports of the same data never overwrite each other and stay clearly identifiable in your file storage. The identifiers are deliberately English and independent of your interface language — so the same report is named identically for everyone in a shared folder.

Can I put my company logo on the reports?

Yes — see company logo on the PDF reports in the Setup & Organisation section. The logo appears on the cover pages of all PDF reports, above the NADOVO logo.

Relationships & Automations

Why do status values change automatically?

NADOVO ensures that your compliance documentation stays consistent. When something changes on an AI system, the linked processes and assessments must be reviewed — this follows from the deployer obligations of the EU AI Act (Art. 26, including monitoring of operation).

Overview of automatic status changes:

What you do	What NADOVO does automatically	Why
Deactivate AI system	Processes → Paused, Assessments → Review required	System no longer in operation, processes cannot continue
Archive process	All assessments of the process → Archived	The process is at the end of its lifecycle; the evaluations stay viewable as evidence
Reactivate AI system	All paused processes → Released again	System is in operation again
Release new version of AI system	Old processes → Paused	Old system was replaced, processes must be moved to the new version
Risk class of a process changes	Assessment → Review required	Risk evaluation was based on the old risk class
Link a new AI system in the process	Assessment → Review required	Risk evaluation was based on the old system
Confirm an Art. 5 practice in the assessment	Process → risk class "Unacceptable" (permanent)	Prohibited practice documented — later edits never lower the class again

Rule of thumb: When NADOVO changes a status automatically, the platform shows you the next step directly in the overview. Just follow the hints.

How do I filter the overviews — and why don't I see archived entries?

The overviews for AI systems, AI processes, Risk Assessments, the AI Content Register, the AI incidents, AI Literacy and the measures share the same filter bar. All filters start empty so their labels stay readable; only your selection narrows the list. The order of the filters mirrors the overview's columns.

The "Next step" filter (AI systems, AI processes, Risk Assessments, AI Content Register) turns the overview into a work queue: you filter by what is actually due — such as "Edit", "Submit", "Approve", "Start review", "Review & release" in the content register, or "Conformity documented". The options adapt dynamically: only steps that actually occur in your list are offered. The AI incident overview has a "Reporting obligation" filter instead (Reported / Required / None); AI Literacy filters by Type, Employee and Status; the measures by Process, Responsible, Due date and Status.

Waiting hints are deliberately not filter values. States such as "Update the process first", "Activate the AI system first" or "New version exists" appear in the column but cannot be filtered — they describe waiting on something else, not a step you can work through.

Why are archived entries missing? With no selection in the status filter, the overview shows everything except the respective end state:

Overview	Hidden by default	How to show them
AI processes	"Archived"	Select "Archived" in the status filter
Risk Assessments	"Archived"	Select "Archived" in the status filter
AI Content Register	"Archived"	Select "Archived" in the status filter
AI systems	"Superseded"	Select "Superseded" in the status filter
AI incidents	"Cancelled" and "Archived"	Select the respective value in the status filter
AI Literacy	"Archived"	Select "Archived" in the status filter
Measures	"Archived"	Select "Archived" in the status filter

Deactivated AI systems, by contrast, are visible by default — they are not an end state but await a decision. Likewise resolved AI incidents stay visible by default; only "Cancelled" and "Archived" are hidden.

In what order are entries shown — and can I sort them myself?

Default order: without your own sorting, the most recently created entries appear at the top — usually by creation date, in the "AI Literacy" module by the date of the qualification, and for AI incidents by the discovery date.

Sort them yourself: click a column header to sort by that column; a second click reverses the direction. An arrow icon next to the header shows the active sort.

Computed columns such as "Next step", "Reporting obligation", "Deadline" or "Models", as well as the actions column, cannot be sorted.

Adjusting the column width: In all seven overviews the name column can be made wider or narrower. Hover over the column divider to the right of the heading — a double-line symbol appears and the cursor turns into a double arrow — then drag. A double-click on it fits the column to the longest entry automatically. The width you set is remembered per overview on this device.

Note for the Risk Assessments: for a new version of an assessment, the order counts the creation date of the new version — which is why an assessment with an older ID can appear at the top. Use the "Assessment ID" column header to sort by ID instead.

How do AI system, process and assessment relate to each other?

The three elements are linked hierarchically:

AI system (e.g. "ChatGPT")
  |
  |-- In operation, v1.2.0
  |
  +-- AI process (e.g. "Customer support")
  |     |
  |     |-- Released, v1.0.0
  |     |
  |     +-- Assessment (risk evaluation)
  |           |-- Approved
  |
  +-- AI process (e.g. "Content creation")
        |
        |-- Draft, v1.0.0

Rule: An AI system must be "In operation" before linked processes can be released. When the assessment status is "Required" (always the case for high-risk, see Assessment), an approved assessment must additionally exist before the process can be released.

Changes flow top-down: When the AI system changes, processes and assessments are updated automatically. The reverse is not true — a change to the assessment has no impact on the AI system.

Help & Support

What are "Known issues" and where do I find them?

Under Help & Support, the "Documentation" section shows four tiles: Getting started, Modules, FAQ and "Known issues" (slightly highlighted in red). Clicking "Known issues" opens a window listing all currently known problems — each entry with a title, the affected area, a date, a short description, a status and, where available, a workaround.

We maintain this list so you can immediately see whether a behaviour is already known and being worked on — no need to report it separately.

What do the statuses mean?

In analysis — we're currently analysing the cause; no workaround yet.
Workaround — a workaround is available that you can use until the fix is released (see the entry).
Once an issue is resolved, the entry disappears from the list.

My problem is listed — what should I do? Nothing further — we know about it and are working on it. If a workaround is shown, you can use it until the fix is released. No need to report it again.

My problem is NOT listed? Please report it via Help & Support → "Report bug" so we can look into it.

Note: If the list is empty, you'll see "There are no known issues at the moment." — nothing is currently known.

How do I send feedback or a suggestion?

On the Help & Support page, below the documentation tiles, there are two tabs: "Feedback" (selected by default) and "Report bug". For ideas, requests and suggestions, use the "Feedback" tab.

How to fill in the form:

Category (required) — Improvement suggestion, New feature, Usability or Other.
Subject (required) — a short headline (at least 3 characters).
Description (required) — what we should improve, as precisely as possible (at least 10 characters).
Affected module (optional) — e.g. Discover, Assess, Implement, Monitor, Dashboard or Settings.
Priority — Low, Medium (default) or High.
Screenshot (optional) — PNG, JPG or WebP, max. 5 MB.

Click "Send feedback" and your message goes straight to our team; a short confirmation appears. "Cancel" clears the form again.

How do I report a bug?

If something doesn't work as expected, first check the "Known issues" (see above) — if your problem is already listed, we're aware of it. Otherwise, report it on the Help & Support page via the "Report bug" tab.

How to fill in the form:

Error category (required) — Display error, Functional error, Data loss, Performance or Other.
Subject (required) — a short headline (at least 3 characters).
Steps to reproduce (required) — what you did, step by step (at least 10 characters).
Expected behavior (optional) — what should have happened instead.
Affected module (required) — which area the error occurs in.
Severity (required) — Cosmetic, Functional (default) or Critical.
Screenshot / Screen recording (optional) — PNG, JPG or WebP, max. 5 MB.
Browser / Device (optional) — e.g. "Chrome 120, macOS".

Click "Report bug" to send the report to our team; a short confirmation appears. The more precise the steps and screenshot, the faster we can reproduce and fix the issue.

As of July 2026

FAQ ​

Setup & Organisation ​

Dashboard ​

AI Models ​

AI Systems (Phase 1) ​

AI Processes (Phase 2) ​

Risk Classification ​

Risk Evaluation & Assessment (Phase 3) ​

Versioning ​

Phase 4 — AI Literacy & Measures ​

AI Incidents (Phase 5) ​

AI Content Register ​

Audit Trail & Documentation ​

Reports & Evidence ​

Relationships & Automations ​

Help & Support ​

FAQ