How it works.
Six steps, in the order the work actually happens. About four minutes to read, and you can open the real thing at any point without signing up.
- 01
Find what you are already running
We search the systems you already have and list the AI we find. Then you keep the real ones and dismiss the rest, with a reason. A person decides every time.
A list built only from what people report holds what people remembered.
- 02
Say how risky each one is
Describe a tool in normal words. We check it against what the law treats as high risk and suggest a level. A named lawyer confirms it before it counts for anything.
Set the level and twenty-one jobs appear, each with a team that owns it and a step it is due by. Get the level wrong and none of them is ever created — so your record looks finished, and is not.
- 03
Carry it through six steps
From somebody asking for it to switching it off for good. Nothing moves to the next step without approval and written proof.
A step signed off without its proof is the finding an auditor opens with.
- 04
Keep the proof as you go
Every job carries the proof that closes it. The same record for every tool, and teams cannot change what gets kept.
Given the choice, the high-risk tools are the ones that record least. Those are the ones where it matters most.
- 05
Watch the agents that act alone
What each agent used, exactly what it asked for, what it was refused, and who approved the step where it stopped. Nobody can edit it afterwards.
The rules say what an agent can technically do. They do not say who allowed it, whose money it spends, or who pays when it is wrong.
- 06
Switch off what stops paying
Every tool reports what it costs against what it gives back, counting only the people who actually use it.
Without a cut-off you collect tools that are forever about to get better.
What it does not do.
- It does not build your AI. That is the point — we have nothing to defend when we check it.
- It does not write your privacy check for you. It tells you when you need one and tracks it.
- It does not decide anything. Every risk level is confirmed by a named person.
An agent asked. We said no.
Agents reach Ephorian the way a person does — from a chat or a terminal, with no screen open. They are refused by the same rules. This is a real run from the demo, not a drawing.
- Agent proposesProposed high risk for Credit Decision Support. Annex III(5)(b). Confidence 0.82.
- Ephorian refusesRefused: only a named person in Legal may confirm a tier.
- Sent to a humanRouted to Helena Vos, Director of Legal and Privacy. Waiting on her.
Confirming a tier creates the twenty jobs that tier carries, each with an owner and a due step. That is an accountable act, so it belongs to an accountable person.
The refusal carries a name, a reason and a time, and sits in the audit trail beside what people did. That is the difference between a floor and a pipe: a pipe passes things through.
Ephorian has no agent connector today. This is the rule working inside the product, shown honestly, not an integration we are claiming.
Reading about it is slower than opening it.
No signup. Pick a role and you are in. The demo comes loaded with five real problems to find.