EU AI Act Cockpit: Prove Obligations Automatically
A central AI registry, an immutable audit trail, a human-in-the-loop gate and Article 50 transparency notices. Demo reference architecture.
- Industry
- Compliance · Mid-market · AI operations
- Build, estimated
- 5–7 weeks
At a glance
- It starts with
- Platform scan
- The machine handles
- 9 of 11 steps
- A person keeps
- Approval queue · DPO approval
- Bottom line
- 100%Explainable Decisions
The problem
Real talk: nobody enjoys maintaining compliance documentation. It's one of those tasks that exists because a regulation demands it — not because anyone finds it fun.
Then an authority asks: which AI are you actually using, in which workflow, with what data flow? Who approved that automated rejection? Show me the log. In most mid-sized companies, what follows is a frantic scramble across Make scenarios, n8n workflows, and three different people's heads.
The Hamburg case — a €492,000 fine in September 2025 — shows where that leads: an algorithmic rejection nobody could explain.
The obligations are rule-based, recurring, and documentation-heavy. Which is exactly what automates well. Here's the pipeline.
The EU AI Act explicitly binds users of AI, not just developers — run Make, n8n, or Zapier with AI steps and you're a deployer under the regulation. The obligations run in parallel with GDPR and stack: Art. 4 (AI literacy, since February 2025), Art. 50 (transparency, from 2 August 2026), Art. 22 GDPR (no solely automated decision with significant effect without human review — regardless of company size), and Art. 86 AI Act (right to explanation, from August 2026).
In practice, no mid-sized company fully knows which AI building blocks run where, who approved which automated decision, or can explain a single rejection in an understandable way. The AI steps hide across dozens of scenarios on multiple platforms, the only "registry" is a spreadsheet nobody updates, and audit trails exist — if at all — as scattered log lines with no context.
Regulators are already acting, even before the high-risk obligations bite: Hamburg's Data Protection Commissioner imposed €492,000 primarily for breached information and transparency obligations on an algorithmic rejection. A company with nothing to show rebuilds that same case in its own house — and, in the worst case, pays an AI Act fine and a GDPR fine side by side.
The process, step by step
Scroll through. The diagram stays put and highlights the step you are on.
- 01
Platform scan
Make / n8n / Zapier
A scan regularly goes through the connected platforms (Make, n8n, Zapier) and finds every step that calls an AI model.
- 02
AI register
Model, data flow, risk class
Each find goes into the AI register: which workflow uses which model, with which data flow and in which risk class under the AI Act. The register keeps itself current.
- 03Branch
Significant effect?
- 04Human decides
Approval queue
a person decides
Decisions with legal or significant effect, such as rejections, credit checks or job applications, go into an approval queue. A person decides; the workflow documents.
- 05
Runs through
no approval needed
Anything without significant effect runs on without approval, but is logged just the same.
- 06
Audit log
Input, model, output, override
Every AI step writes an unchangeable entry: input, model, output, timestamp and, if there was one, the person's override. Explainability becomes a database entry.
- 07Branch
Publicly visible?
- 08
Art. 50 notice
inserted automatically
Chatbots, AI content and synthetic media get the Art. 50 transparency notice automatically, instead of someone maintaining it by hand.
- 09
DPIA/FRIA draft
from a template
For affected systems a template produces drafts of the DPIA (Art. 35 GDPR) and the FRIA (Art. 27 AI Act), with reusable content.
- 10Human decides
DPO approval
data protection officer
The drafts are drafts: the data protection officer has to approve them. The cockpit does not replace legal advice.
- 11
Deadline cockpit
status per AI system
The cockpit shows open obligations, upcoming deadlines and the status per AI system, so no deadline gets lost in an inbox.
What changes
Possible setup, not a packaged product
The figures are modelled target values for a possible setup, derived from industry benchmarks and our own tests. They do not come from a customer project; real values depend on your business. We do not sell this setup as a finished product: we measure where your bottleneck is, then build with your team. For systems that require certification (e.g. HIS, gematik, DATEV-certified) we work with specialised partners.
Before vs. After
| Aspect | Before | After |
|---|---|---|
| Overview of AI in use | Before: A spreadsheet nobody updates | After: Self-updating AI registry |
| Automated rejections | Before: Pass through unchecked | After: Human-in-the-loop gate + log |
| Explaining a decision | Before: Nobody can state the reasons | After: Audit-trail entry in seconds |
| Article 50 transparency notice | Before: Forgotten or hand-maintained | After: Injected automatically |
| DPIA / FRIA | Before: Copy-paste from old documents | After: Template draft, DPO signs off |
| Responding to an authority request | Before: Days of scrambling | After: One-click export from the registry |
Technology
Technology Stack
Integrations
Systems this setup can connect to
- n8n (self-hosted)Orchestration
- Central workflow engine: scan, registry, audit trail, approval gates, and dashboard
- Make / ZapierAI Inventory
- Scanned via webhook/API to pull hidden AI steps into the registry
- PostgreSQLAudit Log
- Immutable record of all AI steps and approvals, archivable in an audit-proof way
- Claude / GPT (EU endpoint)Document Drafting
- Generates DPIA/FRIA drafts and explanation texts via DPA-compliant EU endpoints
- Slack / Microsoft TeamsApproval Workflow
- Human-in-the-loop notifications with one-click sign-off for the DPO and business owners
- S3-compatible storageArchiving
- Audit-proof storage of DPIA/FRIA, logs, and transparency evidence
Security & Compliance
What the setup takes care of
- Data Sovereignty via Self-Hosting
- The entire workflow runs self-hosted (n8n) in your own data center or EU hosting. Sensitive compliance metadata never leaves the house — no data flowing to external clouds.
- Immutable Audit Trail
- Every AI step and every approval is logged tamper-evident with timestamp, actor, and content. Auditable toward regulators, defensible in later disputes.
- GDPR & AI Act Considered in Parallel
- Human-in-the-loop (Art. 22 GDPR / Art. 14 AI Act), transparency (Art. 50), explainability (Art. 86), and DPIA/FRIA are built as separate, combinable blocks — because compliance with one regime doesn't satisfy the other.
- EU Endpoints for AI Calls
- Model calls run either via local open-source models or DPA-compliant EU endpoints of commercial LLMs — matched to the data protection level of each use case.
Frequently Asked Questions
What would this look like at your company?
This workflow is a demo. Whether it pays off for you depends on where things get stuck at your company. The method page shows how to find out. To place a workflow of your own, use the free assessment. No call needed.