AI vendors publish Article 13 and Annex IV-aligned records once into a neutral registry. Enterprise buyers retrieve them instantly by API — with versioning, identity, and audit-grade evidence built in.
Procurement teams wait for stale PDFs. Vendor compliance teams answer the same questionnaire forty times. Neither side has machine-readable evidence. Under the EU AI Act, that's no longer just inefficient — it's a legal liability.
AI vendors with enterprise pipelines answer the same questions dozens of times a year. Every buyer sends a different format. Every deal repeats the manual effort. There is no publish once — until now.
Procurement teams assess a growing roster of AI vendors a year: send spreadsheet, wait two weeks, receive a stale PDF, repeat at every renewal. "The vendor said it was compliant" is not an audit trail under the EU AI Act.
Every schema field traces back to specific regulatory articles. The schema is published openly so any tool, GRC platform, or auditor can integrate. No black box.
Same model as SPDX, OpenAPI, OAuth. Vendors publish once. Any buyer, any tool, any auditor can subscribe and verify. An open registry everyone can read is worth more than a locked one.
Vendor identity verified at the organisation level. Every disclosure change logged and tamper-evident. Auditors get the cryptographic proof they need without chasing PDFs.
Every feature traces back to one of these five. Anything that doesn't is out of scope.
A schema-validated disclosure record — once, not per buyer.
Every change indexed and timestamped. Full audit trail.
Pull records via API into existing GRC or procurement workflows.
Material change — risk class, conformity, training data — propagates instantly.
Structured evidence export. No PDFs. No emails. No chasing.
The bulk of Article 50 transparency duties apply 2 August 2026, as originally scheduled. A May 2026 proposal would push the high-risk deadlines back — but it is not yet law. Building the evidence early is the only safe assumption. Mapped to 15+ EU AI Act articles plus NIST AI RMF and ISO 42001 →
The 7 May 2026 Digital Omnibus reached only a provisional agreement to defer high-risk deadlines — Parliament and Council still have to formally adopt it. The August 2026 transparency obligations were never part of that deferral. Credible compliance evidence takes 12–18 months to build, so starting now is the only position that holds either way.
Concrete, machine-readable, predictable. The API is the product surface — every disclosure record is reachable in one call, and every material change emits a signed webhook.
# Buyer: retrieve a vendor's current disclosure record GET /v1/disclosures/acme-fraud-v3 { "slug": "dsc_01J6X4M9", "publisher": "acme.ai", "publisher_role": "provider", "model_id": "acme-fraud-v3", "risk_class": "high", "lifecycle_status": "production", "version": 12, "schema_version": "0.1.0", "updated_at": "2026-05-08T14:32Z", "training_data_cutoff": "2025-12-31", "intended_purpose": "Card-not-present fraud detection...", "conformity_assessment": "third_party_notified_body", "attestation": { "attestor": "chief_compliance_officer@acme.ai", "attested_at": "2026-05-08T14:31Z" } } # Subscribe: webhooks fire on disclosure.updated, # risk_class.changed, training_data.changed, incident.critical_alert POST /v1/subscriptions
The first 5 vendors and 5 buyers set the schema direction before public launch. Direct founder access, no platform fee, schema input on the record. After this cohort, the schema is locked and we iterate around it.
Working with vendors actively preparing for EU AI Act obligations, and buyers actively doing AI vendor due diligence. We meet weekly. You feed schema input directly to the founder. Records you publish in this phase become reference implementations.
AI vendor with enterprise clients drowning in questionnaires? Help shape the schema.
Compliance, procurement, or legal lead assessing AI vendors? Help shape the schema.