Use cases
Built for the moments compliance cannot wait.
Compliance work usually starts because something specific happens: a deal stalls, a new market opens, the board asks a question nobody can answer. Here are the situations AM8 is built for, what it does in each, and the plan it takes.
01
Founders, CEOs and heads of product at AI companies
Your customer’s lawyers asked for your AI Act file
You sell an AI product, and a promising deal is waiting on procurement. The buyer’s legal team wants to see how your system meets the EU AI Act before they sign, and a policy PDF will not answer their questions.
- Rules in play
- EU AI Act: Art. 5, Art. 50, and Art. 9 or Art. 26 depending on your role
- Plan
- Professional, or Corridor if the buyer is in the other region
What AM8 does
- Screens your system against the practices the EU AI Act prohibits and proposes its role and risk tier, for a named person on your team to confirm.
- Sets out the obligations that apply to you, each with the date it takes effect.
- Drafts the documents the buyer is really asking for: transparency information and a risk register, plus an impact assessment and conformity file where the law requires them.
- Checks each draft independently, then puts it in front of your named signer to approve.
What you walk away with
A signed audit pack you can send to the buyer’s counsel, which they can check for themselves without contacting us.
Worth knowing: The signature proves the file has not been altered since it was signed. It supports your buyer’s legal review rather than replacing it, and AM8 does not give legal advice.
02
Founders, COOs and heads of expansion
You are taking your AI product between Europe and the UAE
You have customers in Europe and are opening in the UAE, or the other way round. The same AI system now answers to two sets of rules, on timetables that do not line up, and nobody on your team has a map of where they overlap.
- Rules in play
- EU AI Act, UAE PDPL, DIFC Regulation 10, UAE AI Charter
- Plan
- Corridor
What AM8 does
- Puts your EU AI Act and UAE obligations side by side for each system, each with its own dates and its own documents.
- Treats UAE PDPL and DIFC Regulation 10 as binding requirements with their own tests, kept separate from the voluntary UAE AI Charter.
- Scores your alignment with the twelve UAE AI Charter principles in a bilingual report carrying the official Arabic principle terminology, and flags any quarter without a current assessment.
- Records your team’s lawful basis for moving AI-processed personal data out of the UAE, and tests the outcome figures you supply for bias between groups, as evidence for the UAE Charter and, for hiring systems, the EU AI Act.
What you walk away with
One view of where you stand in both regions, and an audit pack for each framework, ready for whichever regulator or customer asks.
Worth knowing: Corridor covers the EU and the UAE. Operating somewhere else as well? Tell us where.
03
Product leads and data protection officers
Your chatbot talks to customers in the EU
Since 2 August 2026, an AI system that talks to people in the EU must tell them they are dealing with an AI, unless that is already obvious. If your product has a chatbot or assistant on a public page, you need to know the disclosure is actually there, and be able to prove it.
- Rules in play
- EU AI Act Art. 50(1), in force since 2 Aug 2026
- Plan
- Professional or Corridor
What AM8 does
- Reads the public page where your AI system is offered and reports whether it found disclosure wording in the page, showing the exact phrase.
- Puts the result in front of your team to judge, because whether a disclosure is clear enough is a legal decision.
- Keeps the scan and your team’s decision on the record as evidence for the Article 50 control.
What you walk away with
A dated record of the disclosure wording on your public page, and who confirmed it was enough.
Worth knowing: AM8 scans when you register the system, when its public address changes and whenever you ask; it does not watch the page in between. It reads the page as served, so wording that only appears inside a chat window once it opens is confirmed by your team. Marking generated content for machines (Art. 50(2)) is confirmed by your team rather than scanned.
04
Data protection officers, compliance leads and general counsel
Your board asked whether you comply with the AI Act
AI is in use across several teams, and the board wants a straight answer. Some obligations already apply, more arrive on 2 December 2026, and the high-risk duties from 2 December 2027, and the evidence lives in scattered emails and spreadsheets.
- Rules in play
- EU AI Act: Art. 4 and Art. 5 in force now, Art. 50 since 2 Aug 2026, Annex III high-risk duties from 2 Dec 2027
- Plan
- Starter for up to 3 AI systems; Professional for documents and audit packs
What AM8 does
- Keeps a register of your AI systems, each with its risk classification and the obligations it carries.
- Re-tests your controls on a schedule, and keeps what is in force today separate from what is coming.
- Opens a finding when a control fails and closes it when it recovers. From Professional, it alerts you the same day a passing control starts to fail.
- From Professional, connects to Microsoft Entra, Google Workspace or Okta to surface the AI applications your people were granted access to, including ones IT never registered.
- Produces a governance report whenever you need one, and from Professional sends one every week.
What you walk away with
A dated answer backed by evidence: what applies today, what is passing, what needs work, and what lands next, and what each system costs beside the value your team declared.
Worth knowing: Many obligations are confirmed by your team rather than tested automatically. AM8 records who confirmed what and when, and opens a finding when a confirmation lapses. Discovery sees what your identity provider sees, and nothing outside it.
05
HR, risk and compliance leads
You use AI to screen candidates or assess credit
AI used to recruit or select candidates, or to assess a person’s creditworthiness, is listed as high-risk in Annex III of the EU AI Act, unless a narrow Article 6(3) exception applies. The full obligations apply from 2 December 2027.
- Rules in play
- EU AI Act Annex III (employment, creditworthiness) from 2 Dec 2027; Art. 4 and Art. 5 in force now
- Plan
- Professional; Corridor for bias testing and UAE coverage
What AM8 does
- Proposes the system’s role and risk tier, for your named person to confirm.
- Shows the high-risk obligations as upcoming, with their dates, so your position today is neither overstated nor understated.
- Drafts a risk register scoped to your role. As a deployer, that covers oversight, monitoring and incident reporting, plus a fundamental rights impact assessment where the law requires one.
- On Corridor, tests the outcome figures you supply for bias between groups, and records the result as evidence for the UAE Charter’s fairness principle and, for hiring systems, the EU AI Act.
What you walk away with
A head start on your 2027 programme, and the documents to show your preparation.
Worth knowing: AM8 drafts and your team decides. It does not certify a high-risk system or carry out a conformity assessment on your behalf.
06
CFOs, CIOs and heads of AI
Your CFO asked what your AI costs and what it returns
AI spend arrives as separate invoices from each provider, and nobody has tied it to the systems it pays for. The CFO wants to know what each one costs and what the business expects back from it.
- Rules in play
- The same register carries each system’s EU and UAE obligations
- Plan
- Every plan
What AM8 does
- Shows what each AI system costs, as your connected provider accounts and uploaded billing exports report it.
- Flags spend not attributed to any AI system you declared, for your team to assign.
- Records the value your team expects from each system, with the inputs and formula shown and the name of the person who signed it.
- Produces a cost and value report for your board, each figure labelled for where it came from.
What you walk away with
One view of what each AI system costs and what your team says it returns, every figure labelled.
Worth knowing: AM8 sees only the accounts you connect and the exports you upload. Value is declared by your team, never measured by AM8 or netted against cost.
07
General counsel, compliance leads and their auditors
Your auditor wants to check, not take your word for it
An audit, a due-diligence request or a regulator’s question lands, and screenshots and slide decks will not do. The reviewer wants records they can test for themselves.
- Rules in play
- EU AI Act; UAE PDPL and DIFC Regulation 10 on Corridor
- Plan
- Professional or Corridor
What AM8 does
- Exports an audit pack per framework: the controls, the evidence, the test history, each document’s review record, and who approved what.
- Signs the pack cryptographically, so the reviewer can confirm offline, against our published key, that nothing changed after export.
- Keeps a history where corrections are added, never written over, and only your named signer can sign.
What you walk away with
A file your auditor can verify without calling us.
Worth knowing: A signature proves the pack has not been altered. It does not make the contents true: that is what your review and sign-off are for.
By role
Find the situation that sounds like yours.
Founders and CEOs
Legal, DPO and compliance
Product and engineering
Recognise your situation?
Tell us where you operate, roughly how many AI systems you run and what is driving your timeline. In forty minutes you leave with a clear picture of your EU and UAE obligations, whether or not you buy anything.