How an Oblioria assessment works

Invite the people who know the answers

Your administrators invite colleagues by email, as participants or as administrators. Invitations expire if nobody accepts them, and nobody can join without one. Product, engineering, legal and privacy can each answer the parts they know.

One editor at a time

Only one person edits an assessment at a time, so answers never overwrite each other. Everyone else sees who is editing and can ask them to hand over. Your work saves as you type.

Questions that follow your answers

The questionnaire branches, so you only see the questions that apply to your system. Almost every question is multiple choice. If your answers show that the system has no link to the EU, the questions stop there and your consultant confirms that result. If you change an earlier answer and it adds a question you have not seen, we mark it as new so nobody misses it.

We explain why we ask

Every screen has a "Why we ask this" note. Two examples from the questionnaire:

Checks first

Our checks run on exactly what you submitted. They are fixed rules, written in advance and tested against worked example cases before each questionnaire edition is published. They suggest a risk category, a role and the points your consultant needs to look at.

Then your consultant

Your consultant reads your answers and decides on each point the checks raise. They can correct a check, recording their reason, and they can add issues the checks did not raise. Your consultant reviews every report before it is released.

Follow-up questions

If something is unclear, your consultant sends a short set of follow-up questions. Each one points to one exact answer and says why it is asked. Your consultant can choose who on your team should answer. That person updates the answers in the platform. The person responsible for the assessment then confirms the changes, and the assessment goes back for review. You and your consultant can exchange messages about a request while it is open.

Your assessment shows as Under review until the report is released.

What does the report contain?

It covers one AI system. It sets out, from your answers and after expert review, your likely role, the risk category and the obligations that apply, with their dates. When the review is done, your consultant releases it, and the person responsible and your main contact are notified. The report contains:

• Your role: provider, deployer, both, importer or distributor, or no role under the EU AI Act (provider and deployer explained)
• Risk category: from prohibited practice and high-risk, through limited and minimal risk, to outside the Act
• General-purpose AI: whether the system counts as a general-purpose AI model
• Conclusion and key reasons
• Findings, grouped: Needs attention, Recommendations, Uncertainties and limitations, No issues identified. Each item gives what was found, why it matters, the recommended outcome, a priority and the legal reference.
• Dates: the legal deadline and its legal basis where the law sets one, or a recommended date
• What you told us is in place
• What this review did not cover
• Next action
• Sign-off: the name of the consultant who reviewed and released it, and a reference number

You read the report in your workspace. Next to it are the answers it is based on and the full history of the assessment. Once released, the report is a fixed copy with its own checksum, and nobody can change or withdraw it.