01What this assessment estimates
AI-ACT Comp turns your answers into two independent readings: an internal governance maturity score (how disciplined your organization's AI practices are, across 12 areas), and an indicative EU AI Act risk tier (driven purely by what you use AI for). Both are computed with plain arithmetic, entirely in your browser, from the answers you give in the three steps of the tool.
What it deliberately does not do:
- It is not a legal certification of EU AI Act compliance.
- It is not an official regulatory audit, and no authority reviews or endorses the output.
- It does not replace qualified legal review, particularly once a use case lands in the "high-risk" or "prohibited" tier below.
The full legal framing of that distinction lives in the Terms of Use. Everything on this page describes the arithmetic that produces the numbers you see, nothing more, nothing less.
02The inputs you provide
Step 1 collects context that personalizes the report but does not itself get scored: industry, company size, country/region, whether the company currently uses AI, whether it develops its own models, which third-party AI vendors are in use, and roughly how many AI systems are in production. These drive the industry-specific recommendations and the report header. They carry no numeric weight in the score.
Step 2 asks you to select every applicable AI use case (chatbots, recruitment, credit scoring, facial recognition, and so on). This selection is what determines the risk tier (see section 06) and is kept completely separate from Step 3.
Step 3 is the actual governance assessment: 24 questions across the 12 categories in section 03, answered on a 0–4 maturity scale or, for two of them, a 0–100% slider. This is the only input that feeds the category scores in section 04.
03The 12 governance categories being scored
Every one of the 24 questions in Step 3 is tagged to exactly one of these 12 categories, two questions per category. This is the real list, in the order it appears in the assessment:
04Step-by-step: how one category's score is built
Each answer is first normalized to a 0–1 scale, depending on the question's input type:
scale question (0–4 buttons) → answer / 4
slider question (0–100%) → answer / 100
yes/no question → 1 for yes, 0 for no
A category's score is simply the average of its two questions' normalized values, scaled back up to 0–100 and rounded:
categoryScore = round( average(normalized answers in this category) × 100 )
| Question | Raw answer | Normalized |
|---|---|---|
| Is there human oversight over AI-supported decisions? | 3 / 4 | 0.75 |
| Can a human review or override an AI decision? | 2 / 4 | 0.50 |
categoryScore(oversight) = round( (0.75 + 0.50) / 2 × 100 ) = 63
This same formula runs independently for all 12 categories, producing the 12 numbers (cs.governance, cs.inventory, etc.) that everything downstream is built from.
05Step-by-step: overall & composite scores
The headline overall readiness score is the plainest possible average, with no weighting at all:
overall = round( sum(all 12 category scores) / 12 )
Everything else on the results page is a composite: a different grouping or weighting of the same 12 category scores, built to answer a more specific question. Three composites are simple, unweighted averages of a handful of related categories:
aiGovernance = round( (governance + inventory + riskclass) / 3 )
operational = round( (monitoring + security + incident) / 3 )
riskMgmt = round( (riskclass + security + incident) / 3 )
documentation = cs.documentation (shown as-is)
literacy = cs.literacy (shown as-is)
vendor = cs.thirdparty (shown as-is)
responsibleAI = overall (same number, different label)
The fourth composite, EU AI Act readiness, is the only one that uses an explicit weight table. It leans harder on the categories that matter most for regulatory exposure specifically (risk classification, human oversight, transparency, data governance, documentation), and less on the ones that matter for general operational hygiene:
euReadiness = round( sum(categoryScore × weight) / sum(weights) )
Only these 8 of the 12 categories feed euReadiness; Inventory, Security's siblings (Monitoring, Literacy, Incident) are covered by the other composites instead, not by this one.
| Category | Score | Weight | Score × Weight |
|---|---|---|---|
| AI Risk Classification | 40 | 1.2 | 48.0 |
| Human Oversight | 63 | 1.2 | 75.6 |
| Transparency | 50 | 1.1 | 55.0 |
| Data Governance | 75 | 1.1 | 82.5 |
| Documentation | 25 | 1.0 | 25.0 |
| AI Governance | 63 | 1.0 | 63.0 |
| Security & Robustness | 50 | 0.9 | 45.0 |
| Third-party AI Governance | 38 | 0.9 | 34.2 |
Sum of weights = 8.4. Sum of (score × weight) = 428.3. euReadiness = round(428.3 / 8.4) = 51.
06Step-by-step: how the risk tier is derived
The EU AI Act risk tier is computed entirely from the use cases you selected in Step 2. It never looks at any governance score. Each use case in the tool carries a fixed indicative tier:
The tier assigned to your company is the single highest tier among every use case you selected. One sensitive use case is enough to move the whole result, no matter how many low-risk use cases sit alongside it. Selecting nothing defaults to minimal.
tierOrder = [minimal, limited, high, prohibited]
tier = "minimal"
for each selected use case:
if that use case's tier ranks higher than the current tier → tier = that use case's tier
return tier
07Step-by-step: the risk exposure band
The colored badge on the results page ("Low / Medium / High risk exposure") is a third, practical signal: it combines the risk tier from section 06 with the EU AI Act readiness score from section 05, so a single glance tells you both what's at stake and how prepared you are for it.
tierWeight = { minimal: 0, limited: 1, high: 2, prohibited: 3 }[tier]
exposureBasis = tierWeight × 22 + (100 - euReadiness) × 0.5
riskId = "high" if exposureBasis ≥ 70
riskId = "medium" if exposureBasis ≥ 38
riskId = "low" otherwise
Continuing from section 05: tier = "high" (tierWeight = 2), euReadiness = 51.
exposureBasis = 2 × 22 + (100 − 51) × 0.5 = 44 + 24.5 = 68.5 → below 70, at or above 38 → riskId = "medium".
08Strengths, priority gaps & the obligations checklist
The 12 category scores from section 04 are sorted from highest to lowest. The top 3 become your reported "strengths"; the bottom 3 (reversed so the weakest appears first) become your "priority gaps." Both lists are recomputed every time. They are never templated.
The obligations checklist maps 11 of the 12 categories (every one except Security & Robustness, which is folded into the operational composite instead) onto a plain-language status, purely from that category's score:
score ≥ 75 → Strong
score ≥ 50 → Partial
score ≥ 25 → Needs improvement
otherwise → Missing
09The 30/60/90-day roadmap
The roadmap is not a generic template. It is assembled directly from your 3 priority gaps identified in section 08. Each of the 12 categories has a fixed set of three suggested actions (one for the first 30 days, one for days 30–60, one for days 60–90). The roadmap simply pulls those three actions for your 3 lowest-scoring categories and lays them out in three columns.
Change your answers, and different categories will fall into the bottom 3. The roadmap changes with them.
10The optional AI-written notes layer
Everything above runs with plain JavaScript, in your browser, before this step. Once the report is rendered, the page optionally sends a small, already-computed summary (your industry, company size, country, the overall and EU AI Act readiness scores, your risk tier and exposure band, your maturity level label, and the names, not the details, of your 3 strengths and 3 gaps) to a Humane Theory serverless endpoint, which forwards it to a free-tier third-party language model to write a short diagnosis and, occasionally, flag something genuinely notable at the top of the page.
Two things are true of this step by design: it only ever receives labels and numbers that were already computed above, never your raw answers to the 24 questions; and it can only add commentary text and, rarely, an alert banner. It has no path back into the scores, tier, exposure band, or roadmap you've already seen. A top-of-page alert is added only when the tier is "high" or "prohibited" combined with a weak result, or when a result is unusually strong and consistent across every category. Most reports get no alert at all. For the full data-handling explanation, see the Privacy Policy.
11Limitations and honest caveats
- This is a self-assessment aid built on general AI-governance best practice and publicly available EU AI Act material. It is not a certified audit and carries no legal weight.
- The use-case → tier mapping in section 06 is indicative and simplified; the actual EU AI Act text applies more nuanced criteria that a specialist should evaluate for borderline cases.
- Every number depends entirely on the honesty and accuracy of your own answers. There is no external verification of anything you enter.
- The optional AI notes layer in section 10 can occasionally be wrong or generic, like any language model output; treat it as commentary, not as an authoritative finding.
For the full legal terms governing use of this tool, see the Terms of Use. For how your data is handled end to end, see the Privacy Policy.