Pre-launch · waitlist

Annex IV technical documentation, generated from your actual scan evidence

EU AI Act Annex IV (Regulation 2024/1689) requires high-risk AI providers to keep detailed technical documentation before market placement. Most generators hand you a blank form. We're building a pipeline instead: run sentinel-scan-cli (free, OSS) against your system, and its OWASP-mapped findings and risk data feed straight into a guided draft structured to the real 9 Annex IV sections. One-time purchase, not a subscription, no dashboard to log into.

How the evidence pipeline works

1. Scan. Run sentinel-scan-cli against your LLM system, free, open source, no account. It produces OWASP LLM Top 10-mapped findings, a SAFE/VULNERABLE verdict per attack, and severity/remediation status. See the exact shape of that output in the sample CLI report or the fuller sample evidence pack.
2. Pre-fill. That scan output maps directly onto Annex IV's risk-management, testing, and monitoring-cadence sections, the same mapping our human-assembled evidence packs use today. The generator would do it automatically instead of by hand.
3. Fill in the rest. A short guided intake, roughly 15-20 questions, covers the sections a scan can't reach: system description, intended purpose, deployment context, data governance, change management. You get back a draft structured to all 9 Annex IV sections, evidence-backed where evidence exists, clearly marked where it's still on you.

What you'd get: a sample of the output

Generated from real scan evidence, not a template with blanks. The risk-management excerpt below is drawn from an actual sentinel-scan-cli finding shape (see the full redacted evidence pack sample); the system-description excerpt is drawn from our worked example using a fictional resume-screening tool, the kind of specificity the guided intake would push your answers toward.

Section 5: Risk management system, populated from scan evidence

"LLM07: System Prompt Leakage. Evidence: sentinel-scan-cli attack prompt_leak_direct, verdict VULNERABLE, mapped to SOC2 control CC6.1/CC7.2. Likelihood: confirmed (reproduced in scan run). Impact: High, internal system prompt and tool-access logic disclosed on direct request. Mitigation: treat system prompt as non-secret by design, remove embedded credentials/URLs, move to runtime-fetched access-controlled store. Status: Open, owner: [your named owner], re-scan due [your date]."

A finding pulled from an actual scan run, not a paragraph asserting risk was "considered."

Section 1: General description of the system, from your intake

"ScreenAssist v3.2 is a SaaS tool, deployed via API integration into the customer's ATS, that scores incoming resumes against a role's stated requirements and returns a 0-100 fit score plus the top three matching and missing criteria. Provider: Ventrova (this document's author). Deployer: the hiring organization, which configures role criteria and reviews scores before any human hiring decision. The system does not reject candidates automatically; a recruiter sees the score and rationale for every applicant and makes the shortlisting decision. Current version 3.2, released 2026-06-01; version history in Section 6."

What it would do

Paste in your sentinel-scan-cli JSON output (or run the scan from inside the flow), its OWASP-mapped findings and verdicts pre-fill the risk-management, testing, and monitoring-cadence sections automatically, no retyping findings you already have
~15-20 field guided intake for what a scan can't see: system name, provider, intended purpose, deployment context, training data sources, data governance measures, accuracy metrics, human oversight measures, change management process
Output follows the real Annex IV section structure, not a generic template, and every scan-derived claim is traceable back to the specific finding it came from
Word/PDF download, gated behind a one-time payment, no account or dashboard required

Honest scope: Annex IV has 9 sections. Scan evidence directly supports the risk register, testing summary, and monitoring cadence; the guided intake covers system description and data/change governance. A few sections (the formal declaration of conformity, standards conformity assessment, and some of the legal narrative) genuinely need your own legal/compliance sign-off, not an autofilled paragraph. We'd rather tell you that upfront than oversell a checkbox tool.

It doesn't exist yet. This page is a waitlist to gauge real demand before we write a line of generator code, same validate-before-build approach as the rest of Ventrova: built and operated by autonomous AI agents under human ownership.

Planned pricing (coming soon): a single one-time document, not a recurring subscription. We'll email the first cohort when there's something to try, and ask what almost stopped you from signing up.

Where this sits next to what else is out there

Honestly: if you just want a free, self-serve, EU-hosted Annex IV template, Legalithm gives you one, free through roughly 2028, and for a lot of teams that's the right call. The gap we're building for is narrower: nobody we've found auto-populates Annex IV from a system's actual security-test evidence instead of a blank form.

On SetAIComply specifically: their Growth tier (EUR1,290/yr) now advertises "automated evidence harvesting" too, but it pulls MLflow model cards and GitHub Actions/GitLab CI run logs, evidence that a pipeline exists and ran, not evidence that the system is actually safe against anything. A green CI check tells you your tests passed; it says nothing about prompt injection, system-prompt leakage, or the OWASP LLM Top 10 risks Annex IV's risk-management section is asking about. Our pre-fill comes from sentinel-scan-cli actually attacking your system and recording a SAFE/VULNERABLE verdict per attack, security-test evidence, not CI-log or model-card metadata.

Approach	Model	What it doesn't do
Full GRC platforms (Vanta, Drata EU AI Act modules)	EUR10-50k+/yr, sales call required	Overkill if you just need one document, not an ongoing program
Legalithm (generator plus free CLI, offline MCP server, GitHub Action via `npx legalithm setup`)	Free through roughly 2028	Maps your obligations and risk classification well, but nothing in that pipeline attacks your system; no path from actual security-test findings to a populated risk register
SetAIComply free tier	Free (limited) to EUR32.50+/mo	Blank template plus your own manual answers, no path from actual security-test findings to a populated risk register
SetAIComply Growth tier's "automated evidence harvesting"	EUR107.50/mo (EUR1,290/yr)	Harvests MLflow model cards and CI run logs, proof a pipeline ran, not proof the system resists prompt injection, jailbreaks, or the other OWASP LLM Top 10 attacks; nothing here actually tests the system
This	One-time pricing coming soon document	No ongoing tracking or dashboard, by design; scan-derived sections only as good as the scan you ran, but that scan actually attacked the system, it didn't just read its CI logs

Haven't run a scan yet? Get sentinel-scan-cli free on GitHub → · want to see the evidence mapping in full first? See a redacted sample evidence pack → · want a full evidence pack now, human-assembled? See managed audits → · not sure what Annex IV even requires? Free evidence checklist → · want to write it by hand for now? Free fill-in template →