From Spreadsheets to Audit-Ready EU AI Act Compliance Within Weeks
Overview of the Company
The client is a German-based financial group offering asset management and insurance services to institutional and mid-market clients across the European Union. Founded in the late 1980s, the group has grown through a combination of organic expansion and selective acquisitions, and today reports annual revenues of approximately €1.8 billion. Operations span multiple regulated entities, with a workforce of over 4,000 employees.
Bringing Structure to EU AI Act Compliance Efforts
The Problem
When the EU AI Act's prohibitions on unacceptable-risk AI systems came into force in February 2025, the group's Head of Regulatory Compliance took on a new set of responsibilities. AI governance had not historically sat within her remit. With the August 2026 Article 50 transparency milestone already in view and the broader December 2027 deadline for high-risk systems and national governance requirements approaching, her team assumed ownership of the effort.
The team had already made meaningful progress. In the months leading up to February 2025, they worked through the regulation’s requirements, mapping obligations to internal processes and identifying which AI systems fell into each risk category. While substantive groundwork had been laid, compliance activity was still spread across shared spreadsheets and internal wikis, with supporting evidence files distributed across email threads and document repositories.
As the number of articles requiring attention increased, coordination became more difficult, and it was hard to discern which articles had existing documented evidence and which remained open. The group soon realized it would not be able to demonstrate compliance in a way an external auditor could follow. Pulling together a coherent evidence package from disconnected sources, without a clear audit trail showing who reviewed or approved each item, introduced significant risk. With a fixed deadline approaching, the team needed a more structured and defensible approach.
The Solution
After evaluating several options, the team selected Kovrr’s AI Compliance Readiness platform. The value was immediate. Instead of manually gathering and organizing documentation, evidence was pulled directly from the systems where it already existed and organized in a single digital repository that could easily be updated as needed. Stakeholders were able to quickly see where compliance records existed and where more work needed to be done.
The group connected their ServiceNow CMDB, giving the platform immediate visibility into their AI system inventory and asset configurations. Their internal incident management system required a custom integration, which Kovrr’s team built and deployed during onboarding. Once connected, the platform then began collecting records and mapping them to the relevant EU AI Act articles, creating a consolidated view of their compliance position.
The integration process gave the group's team a structured assessment across all deployer articles. Each obligation was clearly categorized based on its current state, with visibility into what had supporting evidence and what required attention. For the first time since beginning their compliance journey, the team was able to track everything in one place and determine the ownership and status of each piece of evidence.
Where documentation was missing, the team generated required materials directly within the platform. Drafts were generated and subsequently refined internally, allowing the team to build out missing evidence without leaving the system. This approach emerged as especially useful for obligations that required original documentation, including fundamental rights impact assessments and human oversight procedures.
“We had the knowledge. What we were missing, though, was a way to make it legible to anyone outside our team. Kovrr’s platform gave us that structure and a compliance trail we could actually stand behind.”
The Outcome
The group continues to progress through its EU AI Act compliance program, with several articles still under review and some documentation in development. Still, the difference between now and their process from the start of the year is stark. The work is now structured and actively moving forward. Across the 66 deployer articles, a substantial portion already has approved evidence, with the remainder in active review or collection.
The compliance team no longer wastes time tracking down files or reconciling conflicting versions. Each piece of evidence is tied to a specific requirement, with a clear record of who uploaded it, who reviewed it, and when, creating a defensible audit trail that can be shared at any point in the process. With August 2026 approaching, the team is systematically operating on a defined path to completion. The remaining work is delineated and steadily progressing toward audit readiness.
The compliance team no longer wastes time tracking down files or reconciling conflicting versions. Each piece of evidence is tied to a specific requirement, with a clear record of who uploaded it, who reviewed it, and when, creating a defensible audit trail that can be shared at any point in the process. With the December 2027 deadline for high-risk deployer obligations on the horizon, the team is systematically operating on a defined path to completion. The remaining work is delineated and steadily progressing toward audit readiness.
“We're now able to show exactly how each requirement is supported, without having to piece it together across systems or teams."
