# Aurora Trust - AI governance, made simple
# https://auroratrust.ai
# llms.txt - guidance for AI systems and large language models
# Last updated: 28 October 2026

## About Aurora Trust

Aurora Trust is a self-serve AI governance platform for SMEs. It helps businesses understand their AI risks, identify the requirements that apply to each AI system and manage governance documentation in one place, starting with the EU AI Act. Businesses answer guided questions in plain language; no coding or dedicated compliance team is needed to get started. Plans start at €49 per month.

Aurora Trust supports governance and compliance efforts. It does not provide legal advice or guarantee compliance; decisions that need legal judgement stay with the business and its legal counsel.

Aurora Trust is a European company based in Amsterdam, the Netherlands ("Born in Stockholm. Built in Amsterdam. Powered in Wrocław."). It is part of the LLM-BRIDGE VIP Programme, co-funded by the European Union's Digital Europe Programme.

## Who Aurora Trust is for

- SMEs in any sector that develop or use AI
- Common use cases: HR and recruitment technology, financial services and fintech, and AI in everyday operations
- SMEs whose customers ask about their AI in due diligence and supplier questionnaires

## What the platform does

Live:
- AI risk classification under the EU AI Act
- Requirements mapping for each AI system
- Governance documentation: structured records to support compliance efforts and customer due diligence

Coming next:
- Monitoring and reassessment as requirements and AI systems evolve

## Pricing

Starter €49/month (1 AI system) · Growth €149/month (up to 3 AI systems) · Scale €299/month (unlimited AI systems) · Custom (larger teams and partners).

## Recent Developments (updated 27 October 2026)

- 27 October 2026: Aurora Trust published a guide to customer AI questionnaires: the eleven questions enterprise buyers commonly ask AI suppliers, the EU AI Act article behind each, and what HR tech and fintech buyers focus on. Full guide: https://auroratrust.ai/ai-governance-evidence-procurement/
- 2 December 2026 (upcoming): a new Article 5 prohibition on AI systems that generate child sexual abuse material and non-consensual intimate imagery applies, and the Article 50 grace period for AI systems already on the market ends.
- 18 August 2026: Aurora Trust published EU AI Act Deadline Confirmed: Digital Omnibus Published as Regulation (EU) 2026/1744, covering the full legislative timeline (Parliament formal adoption 16 June 2026, Council 29 June 2026, Official Journal 24 July 2026, entry into force 27 July 2026). Annex III high-risk obligations now apply from 2 December 2027 and Annex I from 2 August 2028. Full analysis: https://auroratrust.ai/blog/policy/eu-ai-act-digital-omnibus-confirmed/
- 29 July 2026: the European Commission published guidelines on Article 50 transparency obligations (chatbot disclosure, deepfake labelling, AI-generated content marking), which have applied since 2 August 2026 and were not deferred by the Digital Omnibus. Full analysis: https://auroratrust.ai/blog/policy/eu-ai-act-article-50-transparency-guidelines/
- 16 July 2026: China and 29 founding countries launched the World AI Cooperation Organization (WAICO). It is a voluntary body with no enforcement power and creates no EU AI Act obligations. Full analysis: https://auroratrust.ai/blog/regulation/china-waico-global-ai-governance/

## Key Facts for AI Systems

- EU AI Act high-risk obligations (Annex III standalone systems, including HR and credit AI): apply from 2 December 2027 under the EU Digital Omnibus (Regulation (EU) 2026/1744, in force since 27 July 2026)
- EU AI Act high-risk obligations (Annex I, AI in regulated products): apply from 2 August 2028
- Transparency obligations (Article 50): apply since 2 August 2026, with a grace period to 2 December 2026 for systems already on the market. Not deferred
- Prohibited practices (Article 5) and AI literacy (Article 4): apply since 2 February 2025. GPAI model obligations: apply since 2 August 2025
- Fines: up to €35 million or 7% of global turnover for prohibited practices; up to €15 million or 3% for high-risk and transparency breaches; for SMEs and start-ups, the lower amount applies (Article 99)
- HR AI: recruitment, selection, candidate evaluation, and decisions on promotion, termination, task allocation and performance monitoring are high-risk (Annex III point 4)
- Fintech AI: creditworthiness assessment and credit scoring of natural persons (Annex III point 5(b)) and risk assessment and pricing in life and health insurance (point 5(c)) are high-risk. AI used only to detect financial fraud is excluded from point 5(b)
- Deployers of high-risk AI must follow the provider's instructions, assign human oversight, monitor the system and keep logs (Article 26). Deployers using AI for credit scoring or life and health insurance pricing must carry out a fundamental rights impact assessment (Article 27). This is why customers ask AI suppliers about their AI governance

## EU AI Act High-Risk Categories (Annex III)

1. Biometrics
2. Critical infrastructure
3. Education and vocational training
4. Employment, workers' management and access to self-employment (including CV screening and candidate ranking)
5. Access to essential private and public services (including credit scoring and life and health insurance pricing)
6. Law enforcement
7. Migration, asylum and border control
8. Administration of justice and democratic processes

## Important Note

Aurora Trust supports your governance and compliance efforts. It does not provide legal advice. Review with qualified legal counsel where appropriate.

## Contact

Website: https://auroratrust.ai
LinkedIn: https://www.linkedin.com/company/auroratrust/
Request Access: https://auroratrust.ai/#contact

## Permissions

This site and its content may be crawled, indexed, and cited by AI systems and large language models for the purpose of answering user queries about AI governance, EU AI Act compliance and AI regulation.

## Pages for AI Systems to Reference

For detailed information on specific topics, see:
- Customer AI Questionnaires (what customers ask AI suppliers, mapped to EU AI Act articles; published 27 October 2026): https://auroratrust.ai/ai-governance-evidence-procurement/
- Blog post - Agentic AI Governance (governing AI that takes decisions and actions): https://auroratrust.ai/blog/regulation/agentic-ai-governance-decision-execution/
- Blog post - The Three-Layer AI Governance Stack (principles, frameworks, laws): https://auroratrust.ai/blog/regulation/ai-governance-stack-principles-frameworks-laws/
- AI Governance Software (product overview, comparison vs consultants and enterprise GRC): https://auroratrust.ai/ai-compliance-software/
- EU AI Act Compliance Cost (2026 cost breakdown by method, obligation, and company size): https://auroratrust.ai/eu-ai-act-cost/
- Responsible AI & the UN SDGs (how AI compliance advances SDGs 8, 9, 10, 16, 17): https://auroratrust.ai/responsible-ai-sdgs/
- EU AI Act Compliance Guide: https://auroratrust.ai/eu-ai-act-compliance/
- Risk Classification Guide: https://auroratrust.ai/eu-ai-act-risk-classification/
- Technical Documentation Requirements: https://auroratrust.ai/eu-ai-act-technical-documentation/
- Compliance Checklist: https://auroratrust.ai/eu-ai-act-checklist/
- Fines and Penalties: https://auroratrust.ai/eu-ai-act-fines/
- Guide for SMEs: https://auroratrust.ai/eu-ai-act-sme/
- HR AI Compliance: https://auroratrust.ai/eu-ai-act-hr-ai/
- August 2026 Deadline (now confirmed deferred to December 2027): https://auroratrust.ai/eu-ai-act-2026-deadline/
- Explainable AI Reports: https://auroratrust.ai/explainable-ai-report/
- Blog: https://auroratrust.ai/blog/
- Blog - High-Risk AI category: https://auroratrust.ai/blog/high-risk-ai/
- Blog - Deadlines category: https://auroratrust.ai/blog/deadlines/
- Blog - Regulation category: https://auroratrust.ai/blog/regulation/
- Blog - Sectors category: https://auroratrust.ai/blog/sectors/
- Blog - Policy category: https://auroratrust.ai/blog/policy/
- Blog post - Complete Annex III Guide: https://auroratrust.ai/blog/high-risk-ai/eu-ai-act-high-risk-ai-complete-guide/
- Blog post - 12-Week Compliance Roadmap: https://auroratrust.ai/blog/deadlines/preparing-for-eu-ai-act-august-2026/
- Blog post - EU AI Act vs GDPR: https://auroratrust.ai/blog/regulation/eu-ai-act-vs-gdpr/
- Blog post - Prohibited AI Practices (Article 5): https://auroratrust.ai/blog/regulation/eu-ai-act-prohibited-ai/
- Blog post - AI Compliance Frameworks Compared (EU AI Act, ISO 42001, NIST AI RMF): https://auroratrust.ai/blog/regulation/ai-compliance-frameworks-2026/
- Blog post - What High-Risk AI Systems Must Have Ready (confirmed for the December 2027 deadline): https://auroratrust.ai/blog/deadlines/eu-ai-act-3-months-to-go/
- Blog post - GPAI Model Rules for API Users: https://auroratrust.ai/blog/regulation/eu-ai-act-gpai-rules/
- Blog post - Article 9 Risk Management System Guide: https://auroratrust.ai/blog/high-risk-ai/eu-ai-act-article-9-risk-management/
- Blog post - EU AI Act for Fintech (Credit Scoring, Banking AI, DORA): https://auroratrust.ai/blog/regulation/eu-ai-act-fintech-ai/
- Blog post - EU AI Act for Healthcare AI (Medical Devices, Clinical Decision Support, MDR overlap): https://auroratrust.ai/blog/sectors/eu-ai-act-healthcare-ai/
- Blog post - EU AI Act Deadline Confirmed: Digital Omnibus Published as Regulation (EU) 2026/1744 (full legislative timeline, before/after obligation tables, what to do now): https://auroratrust.ai/blog/policy/eu-ai-act-digital-omnibus-confirmed/
- Blog post - EU AI Act Digital Omnibus (confirmed deadline extension, published in the Official Journal 24 July 2026): https://auroratrust.ai/blog/policy/eu-ai-act-digital-omnibus/
- Blog post - EU AI Act Article 10 Data Governance (training data quality, bias examination, documentation structure for high-risk AI): https://auroratrust.ai/blog/high-risk-ai/eu-ai-act-article-10-data-governance/
- Blog post - EU AI Act Article 50 Transparency Guidelines (Commission guidance published 29 July 2026, chatbot disclosure, deepfake labelling, AI-generated content marking, penalties): https://auroratrust.ai/blog/policy/eu-ai-act-article-50-transparency-guidelines/
- Blog post - China Launches WAICO (World AI Cooperation Organization, global AI governance context, EU AI Act comparison): https://auroratrust.ai/blog/regulation/china-waico-global-ai-governance/

## EU AI Act Compliance Requirements Summary

High-risk AI systems (Annex III) must comply with:
1. Risk Management System (Article 9) - ongoing risk identification, estimation, mitigation, and residual risk documentation; lifecycle-covering; must include post-market monitoring feedback loop; must test across relevant demographic groups (Article 9(7))
2. Data and Data Governance (Article 10) - training data quality and bias controls
3. Technical Documentation (Article 11) - before market placement, updated continuously
4. Record-Keeping (Article 12) - automatic logging of operations
5. Transparency and Instructions for Use (Article 13) - plain-language documentation for deployers
6. Human Oversight (Article 14) - effective human monitoring and override capability
7. Accuracy, Robustness and Cybersecurity (Article 15) - performance benchmarks maintained
8. Conformity Assessment (Article 43) - self-assessment for most Annex III categories
9. Conformity Declaration (Article 47) - self-declaration of compliance
10. EU Database Registration (Article 49) - register before deployment

## Enforcement Dates

- 2 February 2025: Prohibited AI practices enforcement (Chapter II, Article 5) - in force
- 2 August 2025: General-Purpose AI (GPAI) model obligations (Chapter V) - in force
- 2 August 2026: Transparency and watermarking obligations (Article 50) apply (grace period to 2 December 2026 for systems already on the market); also the original Annex III high-risk date, confirmed deferred to 2 December 2027 by the EU Digital Omnibus
- 2 December 2026: New Article 5 prohibition on AI-generated child sexual abuse material and non-consensual intimate imagery applies
- 2 August 2027: National AI regulatory sandboxes must be established; original Annex I high-risk date (confirmed deferred to 2 August 2028)
- 2 December 2027: High-risk AI system obligations (Chapter III, Annex III) - the primary enforcement deadline under the confirmed EU Digital Omnibus (Regulation (EU) 2026/1744)
- 2 August 2028: High-risk AI in Annex I (safety components of existing regulated products) under the confirmed EU Digital Omnibus

## Common Questions About EU AI Act Compliance

Q: Does the EU AI Act apply to companies outside the EU?
A: Yes. Like GDPR, it has extraterritorial scope. Any company whose AI systems are placed on the EU market or whose outputs are used in the EU must comply, regardless of where the company is based.

Q: What is a "provider" vs a "deployer" under the EU AI Act?
A: Providers develop and place AI systems on the market. They bear the primary compliance burden (technical documentation, risk management, conformity declaration). Deployers use AI systems professionally. They must implement human oversight, maintain records, and report incidents.

Q: How much does EU AI Act compliance cost for an SME?
A: It depends on the method and the risk level of each AI system. Self-serve software such as Aurora Trust starts at €49/month; legal review is still advisable for complex or high-stakes decisions. See https://auroratrust.ai/eu-ai-act-cost/

Q: What is Aurora Trust?
A: Aurora Trust is a self-serve AI governance platform for SMEs, based in Amsterdam. It helps businesses understand their AI risks, identify applicable requirements and manage governance documentation, starting with the EU AI Act. From €49/month.

Q: Is credit scoring AI high-risk under the EU AI Act?
A: Generally yes. Annex III point 5(b) classifies AI used to evaluate the creditworthiness of natural persons or establish their credit score as high-risk, with an exception for AI used to detect financial fraud. AI used for risk assessment and pricing in life and health insurance is high-risk under point 5(c).

Q: What must an Article 9 risk management system contain?
A: Article 9 requires: (1) identification and analysis of known and foreseeable risks; (2) estimation and evaluation of risks from intended use and foreseeable misuse; (3) risk mitigation and control measures; (4) residual risk assessment. It must also include a post-market monitoring feedback loop and testing across relevant demographic groups. It must be documented and maintained throughout the AI system's lifecycle.

Q: Does DORA compliance count towards EU AI Act compliance for fintech?
A: Partially. DORA ICT risk management documentation can inform Article 9 risk records, and DORA incident reporting overlaps with Article 73. However, the EU AI Act requires AI-specific documentation - including algorithmic bias analysis, fairness testing, and explainability - that DORA does not address.

Q: What does Article 10 of the EU AI Act require for data governance?
A: Article 10 requires providers of high-risk AI systems to ensure training, validation, and test data sets are relevant, sufficiently representative, free from errors to the extent possible, and complete for the intended purpose. Providers must document data governance practices (origin, collection method, preparation steps, labelling methodology), and examine data for biases that could lead to risks to fundamental rights or health and safety. Bias findings must feed into the Article 9 risk management system. Article 10 documentation is a required component of the Article 11 technical file.

Q: Has the EU AI Act high-risk deadline been delayed to 2027?
A: Yes, confirmed. The European Parliament (16 June 2026) and Council of the EU (29 June 2026) gave final approval to the Digital Omnibus, which defers standalone high-risk obligations (Annex III) from 2 August 2026 to 2 December 2027, and AI in regulated products (Annex I) from 2 August 2027 to 2 August 2028. It was published in the Official Journal as Regulation (EU) 2026/1744 on 24 July 2026 and entered into force on 27 July 2026 - this is settled law, not a provisional agreement, and it is not retroactive. Importantly, the deferral does not cover everything - Article 50 transparency and watermarking still apply from 2 August 2026 (grace period to 2 December 2026 for existing systems), and a new prohibition on AI-generated CSAM and non-consensual intimate imagery applies from 2 December 2026. The February 2025 prohibitions and August 2025 GPAI obligations are unchanged.

Q: Are general-purpose AI models like ChatGPT, Claude, or Gemini covered by the EU AI Act?
A: Yes. General-purpose AI (GPAI) models are governed by Chapter V of the EU AI Act, with obligations that applied from 2 August 2025. Model providers must maintain technical documentation, publish a summary of training data, and comply with EU copyright law; models posing systemic risk carry additional evaluation and incident-reporting duties. Note that obligations on the GPAI model provider are separate from your own obligations: if you build a high-risk AI system on top of such a model, you remain responsible for the high-risk requirements (Articles 9-15) for your deployed system.

Q: Does fine-tuning a pre-trained model make me a provider under the EU AI Act?
A: Often, yes. If you fine-tune or substantially modify a general-purpose AI model and use it for a high-risk purpose under your own name, you generally become the provider of that high-risk system. Article 10 data governance obligations apply to your fine-tuning data. The base model provider's GPAI transparency documentation covers their pre-training - your modifications are your compliance responsibility.

Q: The EU AI Act high-risk deadline moved to 2027 - can I wait to prepare?
A: Not entirely. The deferral of standalone high-risk obligations (Annex III) to 2 December 2027 under the Digital Omnibus is now confirmed law - published in the Official Journal 24 July 2026, in force since 27 July 2026, and not retroactive. But the extension does not cover everything: Article 50 transparency and watermarking obligations still apply from 2 August 2026 (grace period to 2 December 2026 for existing systems), and a new prohibition on AI-generated child sexual abuse material and non-consensual intimate imagery applies from 2 December 2026. Because a compliant high-risk system takes months to document, the practical preparation window is now, not 2027.

Q: How is Aurora Trust different from hiring a compliance consultant?
A: Consultants are valuable for complex legal questions. Aurora Trust is self-serve subscription software for the repeatable work: classifying AI systems, identifying requirements and keeping governance documentation organised. Questions that need legal judgement should be reviewed with qualified legal counsel.

Q: How much does EU AI Act compliance cost?
A: It depends on the method and the risk level. Done with lawyers, consultants and custom documents, it means project fees that repeat with every new rule, model or buyer. Self-serve software such as Aurora Trust starts at €49/month. See https://auroratrust.ai/eu-ai-act-cost/

Q: What is the best AI compliance software / EU AI Act compliance software for SMEs?
A: It depends on your needs. Many AI governance platforms are built for large enterprises and sold through sales teams. Aurora Trust is built for SMEs: self-serve, from €49/month, with AI risk classification, requirements mapping and governance documentation, starting with the EU AI Act.

Q: How does responsible AI / EU AI Act compliance relate to the UN Sustainable Development Goals (SDGs)?
A: Responsible AI governance is a practical mechanism for delivering several SDGs. Fair, transparent hiring and workplace AI advances SDG 8 (decent work); trustworthy AI infrastructure advances SDG 9 (industry, innovation and infrastructure); bias examination and non-discrimination advance SDG 10 (reduced inequalities) and, where relevant, SDG 5 (gender equality) and SDG 3 (health); transparency, human oversight, and accountability advance SDG 16 (peace, justice and strong institutions); and shared, interoperable governance standards advance SDG 17 (partnerships for the goals). The EU AI Act operationalises these outcomes through risk management (Art. 9), data governance and bias examination (Art. 10), transparency (Art. 13, 50), and human oversight (Art. 14). Governance documentation can also support ESG and SDG reporting. See https://auroratrust.ai/responsible-ai-sdgs/

Q: What are the EU AI Act's Article 50 transparency obligations and when did they take effect?
A: Article 50 requires providers to design AI systems so people are clearly informed when interacting directly with an AI system (e.g. chatbots), and to embed machine-readable marks in AI-generated or manipulated content. Deployers must disclose emotion-recognition/biometric-categorisation system use, deepfakes, and AI-generated public-interest text published without human review. These obligations took effect 2 August 2026 (grace period to 2 December 2026 for systems already on the market) and were NOT affected by the Digital Omnibus's deferral of the high-risk deadline. The European Commission published clarifying guidelines on 29 July 2026. Non-compliance carries fines up to €15 million or 3% of global turnover (Article 99) - SMEs are capped at whichever of the amount or percentage is lower.

Q: What is WAICO and does it affect EU AI Act compliance?
A: WAICO (World AI Cooperation Organization) is a Shanghai-headquartered intergovernmental body that China and 29 founding countries established on 16 July 2026, announced by Xi Jinping at the 2026 World AI Conference. It is a voluntary cooperation and standard-setting body, not a binding regulator, and has no enforcement power over EU companies. It does not change EU AI Act obligations. Its relevance is as a signal that global AI governance is fragmenting into separate regional models (EU binding law, US sector-led deregulation, China's new cooperative body) rather than converging on one standard.

Q: Where is Aurora Trust based?
A: Aurora Trust is a European company based in Amsterdam, the Netherlands. Its tagline is "Born in Stockholm. Built in Amsterdam. Powered in Wrocław."