Nothing to install. Nothing to connect.
Nothing we can see.
AnnexWise classifies your AI systems without touching them — a structured legal questionnaire, evaluated by a deterministic rules engine, entirely inside your browser tab. This page explains exactly how, and exactly where the boundaries are.
What AnnexWise never does
✓No installation
AnnexWise is a web page. There is no agent, plugin, or desktop software — nothing enters your environment.
✓No connection to your systems
The product has no integrations and requests no credentials, API keys or network access. It cannot reach your infrastructure — or your clients'.
✓No scanning
Nothing crawls your code, models or data. The assessment evaluates declared facts about use context, which is what the law turns on.
✓No assessment data on our servers
Answers, verdicts, inventory and documents are processed and stored client-side only. We architecturally cannot see them — there is no database of customer assessments to breach.
How it assesses without access
Whether a system is high-risk is a question about intended use and context — facts that live with the people who run it, not in its code. That is why every form of AI Act due diligence, at any price, works by structured questioning. Ours takes six steps and about ten minutes per system:
Your organisation
Provider or deployer, and your EU nexus (Art. 2).
Prohibited practices screen
Targeted questions against the Article 5 list.
High-risk screen
Mapping against the eight Annex III categories, including the Article 6(3) derogation.
Transparency triggers
Chatbots, synthetic content, emotion recognition (Art. 50).
General-purpose AI
Model-provider duties and systemic-risk scale (Arts. 53/55).
Current compliance posture
Which obligations you already meet — this feeds the gap score.
The answers are classified by a deterministic, versioned rule set — not an LLM — and every verdict carries article references. The full rule inventory is public on the methodology page.
“Only answers” — and still defensible
Yes: like every legal opinion and every audit, the verdict rests on the facts the client declares. Three design decisions make that a defensible foundation rather than a weakness:
Reproducibility. Every report is stamped with a deterministic fingerprint of the answers, the engine version and a legal-state date. Months later, anyone can re-derive exactly why the verdict was what it was, from exactly what was declared — the same property a signed legal memo has, mechanised.
Flagged gray zones. Genuinely contestable calls — Article 6(3) derogation edges, emotion-recognition boundaries — are surfaced as explicit counsel-review flags, never silently resolved. The tool structures the analysis; legal judgment stays with qualified counsel.
An honest technical boundary.The AI Act does demand real technical evidence — accuracy, robustness and bias testing (Articles 10, 15). No tool can honestly verify those in ten minutes, so AnnexWise doesn’t pretend to: it maps them as concrete gap items with article references, for your engineers to execute and your counsel to review. Classification tells you which evidence you owe; producing it is the remediation the 30-day plan sequences.
The one-paragraph review for your IT team
AnnexWise (annexwise.com, hosted on Vercel, TLS via Let’s Encrypt) is a client-side web application: assessment answers, classifications and generated documents are processed and stored in the browser only and are never transmitted. Its only outbound calls are payment checkout, an optional email field if a payment link is requested, and cookieless aggregate page analytics — all verifiable in the browser’s network inspector. No software is installed and no access to internal systems is requested.
Note: some secure web gateways block newly registered domains by default for their first weeks regardless of content. If annexwise.com doesn’t load on your corporate network, that is why — whitelisting the domain resolves it, and the product works from any other network in the meantime.
The questions we get from counsel and IT
→Does AnnexWise connect to or scan our systems?
No — nothing is connected, installed or scanned, ever. The assessment is a structured questionnaire answered by a person who knows the AI system; the rules engine classifies those answers entirely inside the browser tab. There are no agents, no integrations and no network access to your environment — architecturally there is nothing to grant access to.
→How can it assess our AI without technical access?
Because classification under the EU AI Act is a legal question about intended use and context — is the system used for recruitment, credit, insurance pricing? — and those facts live with the people who operate it, not in its code. Every form of AI Act due diligence, including six-figure consultancy audits, establishes classification through structured questions and documents. AnnexWise makes that interview consistent, article-mapped and 10 minutes long.
→So the verdict rests only on our answers?
Yes — like every legal opinion, which rests on the facts the client provides. Three safeguards make that defensible: every report is stamped with a fingerprint of the answers given, the engine version and a legal-state date, so the verdict is exactly reproducible from what was declared; genuinely gray calls are flagged for counsel review instead of silently resolved; and the technical evidence the Act itself requires (accuracy, robustness and bias testing under Articles 10 and 15) is mapped as explicit gap items for your engineers — no tool could honestly claim to verify those in 10 minutes.
→What does reach your servers?
Not your assessment. Answers, classifications, your system inventory and every generated document are processed and stored in your browser only — there is no server-side database of assessments to breach. The only network calls the product makes are payments (via our payment provider), the optional email field if you request a payment link, and cookieless aggregate page analytics. You can verify all of this live in your browser's developer tools.
The fastest way to verify all of this: run one.
Open your browser’s network tab, run a free assessment, and watch nothing leave. Ten minutes, no signup.