--- title: "Compliance: technical documents checked against standards, with private AI — CSIDIA" description: "What CSIDIA does for compliance: it checks manuals and technical files against standards with an open-weight AI model, on our infrastructure or yours, requirement by requirement, with the citation. And why where the model runs matters for GDPR, NIS2 and the AI Act." url: https://csidia.com/en/compliance/ lang: en publisher: CSIDIA S.r.l. (https://csidia.com/) --- Compliance # Compliance, requirement by requirement. For compliance we do one precise thing: we check your technical documents against the standards that apply to you, with an open-weight AI model that runs on our infrastructure or yours. On that task: the model prepares the report, your expert signs it. What we do ## Checking technical documents against standards. ### Every requirement, across the whole document For every requirement of the standards that apply to you, the model searches the whole manual or technical file, page by page, decides and writes the outcome with the citation: the page and the passage it comes from. ### The standards that apply to you The check is built on your standards. For machinery manufacturers: the Machinery Directive, Regulation (EU) 2023/1230, which applies from 20 January 2027, and the harmonised standards. ### Your expert signs You receive the report requirement by requirement, with the outcome and the citation, which your expert checks and signs. When the document or the standard changes, the check is run again. ### Measured on one precise task In one of our trials on four machinery manuals: 4,346 requirements checked, each with the outcome and the page of the manual, none skipped. [How we do it](https://csidia.com/en/capabilities/#standards) Where the model runs ## On our infrastructure or yours: you decide. The model runs on our compute infrastructure, an NVIDIA GB300 server and a workstation with two NVIDIA RTX PRO 6000 Blackwell Max-Q, or on-premise, on infrastructure at your site that we design, install and manage. Either way we tell you which model reads your documents and where it runs. The rules we set ourselves - **Clients’ technical manuals are read only by the AI running on our machines**, never by a cloud model. - **For every project we keep a register of models**: what each one does, where it runs, its licence and commercial use, the tests with the numbers and why it was chosen. Open weights do not mean a free licence: each model’s licence is written down there. - **We write the notes on this site with the help of AI**, from public sources: a second check verifies the facts and a person reads them before they go out. - **Never the names of our clients**, neither on the site’s pages nor in the notes. The rules that apply to you ## GDPR, NIS2, AI Act: where the model runs matters. ### GDPR Regulation (EU) 2016/679. Articles 24 and 32 ask for technical and organisational measures that can be described and demonstrated, not just declared. Knowing which model reads the documents, which machine it runs on and who has access is one of those measures, and it can only be written down if it is known: that is why we always tell you which model reads your documents and where it runs. On its own it is not compliance: the processing has to be described and kept up to date like any other. ### NIS2 Directive (EU) 2022/2555, transposed in Italy by Legislative Decree 138/2024, for essential and important entities. Risk-management measures are demonstrated with documents: approved policies, registers, supplier contracts, records of the checks performed. Whoever supplies the AI is a supplier too: the register of models we keep for every project (what each model does, where it runs, under which licence, with which tests) is the kind of document these measures ask for. ### AI Act Regulation (EU) 2024/1689. Article 26(6) requires whoever uses a high-risk AI system to keep the automatically generated logs “to the extent such logs are under their control”, for at least six months: when the model runs on your infrastructure, the logs are under your control. Article 25(4) requires the provider of a high-risk system and whoever supplies it with AI tools, services or components to put in writing the information, capabilities and technical access needed for compliance. Article 4 requires AI literacy measures for staff: since 27 July 2026 Regulation (EU) 2026/1744 has rewritten it as a duty of means. ### Dual-use Activities subject to authorisation are carried out in accordance with applicable law, in Italy and abroad. ### Where we stop Italian Law 124/2007 restricts knowledge of state-secret material to those called to essential functions, within the limits their task requires; EU classified information, governed by Council Decision 2013/488/EU, may be handled only on accredited systems. No commercial supplier, ourselves included, replaces a state-accredited environment and the personal clearances that grant access to it. Where the data demands it, the architecture is not chosen: it is inherited from the classification. On that task, not on everything - **No legal opinions.** We read the standards and build the checks; the opinion stays with your lawyer. - **No certifications.** The report does not take the place of the notified body or of your declaration of conformity. - **No general promises.** A model specialised on a task does better on that task, not on everything: the first thing we discuss is how we would measure it on your documents. Further reading - [AI Act: every deadline, in order](https://csidia.com/en/guides/ai-act-deadlines/) - [The deadlines that ask for documents](https://csidia.com/en/guides/documentation-duties-2026-2028/) - [Compliance deadlines](https://csidia.com/en/tools/compliance-deadlines/), with the days left - [Machinery Regulation checklist](https://csidia.com/en/tools/machinery-regulation-checklist/) for the instruction manual The first step ## Book a meeting. Tell us the purpose. We tell you whether an agent or a trained model would do it better than you do today, what it would take (data, compute, time) and which route fits: our infrastructure or yours. If it is not a job for us, we say so. - video call or in person - 30 minutes - free [Book a meeting](https://csidia.com/en/book/?servizio=manuali) [or write to engagement@csidia.com](mailto:engagement@csidia.com?subject=First%20meeting%3A%20Checking%20technical%20documents%20against%20standards) The service Checking technical documents against standards Every requirement of the standards that apply to you, searched for across the whole document, page by page, with the outcome and the citation. Your expert signs. [How we do it](https://csidia.com/en/capabilities/#standards) Page: https://csidia.com/en/compliance/ · CSIDIA S.r.l., Vignola (MO), Italy · engagement@csidia.com · index for agents: https://csidia.com/llms.txt