Annex turns how your company uses AI into an ISO 42001-aligned policy, an AI use register, and ready-to-send questionnaire answers. So enterprise deals stop stalling on the AI section.
● Built for AI-using SaaS teams selling into the enterprise
A security review used to ask about encryption. Now it asks about your AI — and you don't have the answers.
Answer a short intake about how you build with and use AI. Annex generates the documentation a buyer's security team — and a regulator — actually want to see.
An ISO/IEC 42001-aligned AI management policy, written for your stack and the way your team actually works.
Every model, provider, and internal AI tool inventoried — with purpose, data flow, and risk tier in one place.
Copy-paste responses for the AI sections of CAIQ, SIG, and bespoke DDQs — grounded in the policy and register above.
A guided intake: what you build, which model APIs you call, what your team uses internally, and whether EU users touch it.
Annex maps your usage to the AI Act risk tiers and flags anything that needs a closer look before you ship answers.
Your policy, register, and questionnaire answers are drafted from your real answers — not boilerplate.
Export the docs, or send a hosted AI-trust summary so prospects can self-serve before the review even starts.
Knowing your tier is the first thing a buyer asks and the first thing Annex settles. We place each of your AI uses, explain why, and generate only the obligations that actually apply to you.
The dramatic "high-risk" deadline moved to 2027, but the duties that touch ordinary AI-using SaaS are already landing. And your buyers aren't waiting for any of them.
No charge today. We'll email you the founding link before launch. Not legal advice.
No. Annex produces governance documentation and questionnaire answers for your team and your counsel to review. It's scaffolding that gets you audit- and buyer-ready — not a legal opinion or a certification.
Often, yes. The Act reaches non-EU companies whose AI output is used in the EU. If you have EU users or customers, you're likely in scope for at least the transparency duties.
ISO/IEC 42001 as the backbone, the EU AI Act's transparency and literacy obligations, and the AI sections of CAIQ and SIG-style questionnaires. More on the roadmap.
Annex flags it rather than papering over it. High-risk systems need work Annex doesn't pretend to replace — but you'll know exactly where you stand before a buyer or regulator does.