Know which AI you use
Keep a documented record of who you work with on AI and what documentation each provider has given you.
VIS-4 records the providers of your AI systems and the documentation they have given you. Each system in the inventory is linked to its provider, so you can see which provider stands behind which system and what is still to be requested.
For a deployer, reviewing the provider's documentation is, in Alethexis, an internal methodological control (IM): diligence of your own, not a provider obligation that becomes yours. If the provider offers a general-purpose AI model, filing the documentation it publishes is internal documentary diligence for you.
Each provider's score is not a legal compliance rating, but a tool to help you manage your relationship with each provider and decide which one to ask for documentation first.
Identification: name, product, website and country of origin. Nature: whether the product is or embeds a general-purpose AI model, whether that model is one considered systemic, and whether it carries CE marking. Documentation: whether there is a data processing agreement (DPA) and its date, and what you have received —instructions for use, model card or technical sheet, the provider's impact assessment, transparency report, general-purpose model documentation—.
The platform calculates a score from 0 to 100 from the answers in the record: it adds for the documentation and items recorded, such as the DPA, the instructions for use or a provider in the EU or the EEA, and subtracts when critical items are missing, such as processing personal data without a DPA or a general-purpose model without its documentation. The “Score breakdown” shows line by line where the figure comes from, and the colour (red, amber, green) shows whom to chase first. It is recalculated when the record is saved.
Alongside the score, you can answer a 12-question questionnaire about the provider —technical documentation, where data is processed, incident reporting, configurable human oversight, model changelog…—. It is an internal due-diligence criterion: it informs, but changes neither the score nor the closing of the section. The date of the last assessment only changes when its answers change.
From the inventory you link each system to its provider; unlinking asks for confirmation. The section can be finalised when every system has a provider linked and every score is at 40 or above; until then, the screen lists the systems with no provider and the providers below 40.
The Owner, the AI Officer, the DPO and Contributors record and edit providers. Only the Owner deletes a provider.
The controls in the Alethexis catalogue that this feature helps to document, with their legal basis where they have one, and their nature.
Collect and file the documentation the GPAI model provider publishes in support of Articles 53 to 55 (model card, copyright policy, training-data summary, DPA). For the deployer this is internal documentary due diligence; it is not a substantive obligation arising from Articles 53 to 55.
Legal basis
No direct basis in law.
For each system, identify whether it uses or embeds a general-purpose AI model (ChatGPT, Claude, Gemini, Llama, Mistral and the like) and record the provider and the model version. This enables GPAI documentary due diligence for the deployer and the assessment of downstream obligations.
Legal basis
No direct basis in law.
Data from the controls catalogue. The labels show the regulatory nature of each control; they are not a statement of compliance.