AI governance software for European companies
An inventory of the AI your company uses, AI risk assessment and audit-ready evidence, in one platform with your data hosted in the EU. For SMEs and mid-sized companies that use third-party AI or build their own.
Inventory and control of the AI your employees and providers use
AI comes into a company through two doors: the tools someone on the team starts using, and the AI features that arrive with the software you already pay for. Alethexis gives you one place to record them, review them and decide.
AI inventory
Each system with its provider, its purpose, the department that uses it and its deployment date; your role in relation to it, whether you use it or build it; whether it processes personal data and which categories; whether it takes automated decisions and with what human oversight; and whether it affects workers. It is the foundation of module M1 (VIS-1).
AI provider due diligence
A record for each provider —country, role, whether it offers general-purpose AI models, CE marking, data processing agreement and documentation received— and a twelve-question scored questionnaire that records what you asked and what you were told. It is preliminary due diligence: it does not verify the provider for you (VIS-4, M1).
AI use requests: a path for unauthorised AI
Unauthorised AI is not solved by banning alone: people need a path. Anyone with an account in your organisation asks to use a tool from within the platform, the DPO can review the request and the owner or the AI Officer decides. Once the go-ahead is recorded, the system is added to the inventory with what the request declared. Alethexis does not detect tools on its own: it organises the ones your team declares. With M2 or M3.
Evidence for audits and customer questionnaires
When a customer sends you a supplier questionnaire or an auditor asks for proof, what counts is being able to show what was decided, who decided it, when and with which document.
SHA-256 integrity fingerprint
When you upload a file to the evidence repository, its SHA-256 fingerprint is noted in the account's audit log. With it you can check later that the file you show is the same one that was uploaded (HRA-3, M3).
Decision log
Every governance decision with its context, its author and its date (GOB-4, M2). After 30 days it is consolidated and can then only be replaced by a new decision. Approvals and reviews in each section are kept in a history, and the account's audit log can be exported as CSV or as a PDF with an integrity check.
PDFs with a fingerprint
The AI use policy, the AI committee charter, the RACI matrix, the FRIA, the DPIA, the board status report and the provider documents are generated as PDFs, and each one is recorded with its SHA-256 fingerprint, calculated on the file as downloaded. If anyone changes the PDF afterwards, its fingerprint no longer matches.
What is included
Start with the module you need today and expand when you need to: each module includes the previous one.
M1 · Visibility
AI inventory, P0–P6 risk classification (Alethexis's internal taxonomy, not the Regulation's nomenclature), an AI use policy with read acknowledgements, and provider due diligence. It also lets you document the AI literacy measures under Article 4, which requires taking measures without requiring any specific level of AI literacy of each individual.
M2 · Governance
Everything in M1, plus the AI committee, the RACI matrix, the risk register, the decision log, change management, the incident register and AI use requests.
M3 · High-Risk Ready
Everything in M2, plus the FRIA —the fundamental rights impact assessment under Article 27 of the AI Act— and the DPIA —the data protection impact assessment under Article 35 GDPR—, which are two separate assessments, the evidence repository with fingerprints and the legal framework explorer.
Agentic Add-on
For AI agents: agent inventory, scope and permissions, human oversight with a documented stop procedure, what is logged of each agent's reasoning, technical controls, identity and a test plan. Requires M2 or M3.
If you also build AI
If your company is the provider of any system, the role is recorded system by system. With M2, versions, changes and the sheet for deployers; with M3, the documentation, conformity and post-market work of the provider of a high-risk system. Alethexis generates documents and drafts; the EU declaration of conformity is signed by the provider.
We are our own customer zero
We do not show you logos or testimonials: we show you our own. Alethexis governs its own AI with Alethexis, and its public Trust Center is generated with the same platform you would subscribe to.
Questions before you buy
- How much does it cost?
- M1 from €165 a month, M2 from €250 and M3 from €330; the Agentic Add-on adds €165 a month. Monthly price with annual billing, excl. VAT; monthly billing is also available. Included and additional users are on the pricing page.
- Is the trial really free and without a card?
- Yes. 14 days of full access to M1, M2 or M3, with no card. When the period ends, if you do not subscribe your account is paused and your data is kept for 30 days.
- Where is my data stored?
- In Supabase, hosted in Frankfurt (EU). The platform follows privacy by design (Art. 25 GDPR) and your business data is hosted in the EU. The providers we rely on that process personal data do so in the EU or under the transfer safeguards provided for in the GDPR (standard contractual clauses and adequacy frameworks); you can see each provider and processor, and where it operates, on our providers and processors page.
- Does having Alethexis mean we meet the EU AI Act?
- No. Alethexis helps you document the governance of your AI and keep the evidence: the statuses you will see in the platform are “documented”, “reviewed” or “evidence available”, and none of them is a seal of conformity. The platform does not issue legal conformity seals and does not replace legal advice.
Start with the inventory
Fourteen days of full access to record your AI systems, review your providers and see which evidence you are missing.
This page describes the product and cites Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744. It does not constitute legal advice.