How we check
This page states what you can hold us to — including the places where we know nothing. The directory entries themselves are in German.
The yardstick
Does a customer based in the EU have to do something for the statement to hold? No → green. Yes → amber.
Doing something means: choosing a region, adding a tariff, flipping a switch, objecting, asking. A condition that follows from being based in the EU is not a restriction. Every rating has been set by this rule since 31 July 2026 — and you can hold each one of them against it.
| Rating | Meaning |
|---|---|
| demonstrably met | The vendor documents it, and an EU customer need do nothing. |
| partly / conditional | It holds only under a condition — a tariff, a region, a setting, an objection. |
| demonstrably not met | The vendor's own documents show the statement does not hold. |
| not assessed | No demonstrable statement found. Not a finding against the vendor. |
Which sources count
Evidence comes only from the vendor's own documents: data processing agreement, privacy policy, subprocessor list, certificate, trust portal. 621 such addresses are on file; 7057 retrievals sit in the archive, each with a date.
Why a criterion stays grey
Grey is not an error state but a statement — and one of two different ones. Of 466 open criteria, 370 sit with the vendor and 96 with us. The first is a finding about them, the second a commitment by us.
| Reason | Whose side | Criteria |
|---|---|---|
| Read the vendor's documents; they say nothing about it. | Vendor’s side | 328 |
| We could not extract readable text from the source. | Our side | 88 |
| No verifiable reference on the vendor's own domain. | Vendor’s side | 40 |
| Not looked at yet. | Our side | 7 |
| There is a statement, but it does not settle the question. | Vendor’s side | 1 |
| Only a third party says it — that is not evidence about the vendor. | Our side | 1 |
| The vendor says two things that contradict each other. | Vendor’s side | 1 |
| The vendor refuses automated retrieval. | Our side | — |
| The statement found is out of date. | Vendor’s side | — |
| Needs to be read by a person. | Our side | — |
Silence never becomes a red rating. “Not findable” does not mean “does not exist”, and a machine-made negative claim about a named company is precisely the case § 824 of the German Civil Code is written for.
What a red rating requires
Red is the only rating that publishes a negative factual claim about a named company. It is set only when both are present: evidence on the vendor's own domain in which they say it themselves — and the release of a data protection officer, recorded on the assessment with name and date. At present 15 published assessments carry a red rating; not one of them without a release.
What we do not know
A verification date reads like a promise that we will notice when something changes. For 30 of 265 tools that is not true.
| State of the source | do we notice a change? | Tools |
|---|---|---|
| Monitored automatically. | yes | 235 |
| Checked by hand. | yes | — |
| The page is built in the browser; retrieval returns little text. Changes are not reliably noticed. | no | 1 |
| The vendor refuses automated retrieval. | no | 5 |
| The source is only reachable after signing in. | no | — |
| Retrieval has been failing for several runs. | no | — |
| The address is no longer reachable. | no | — |
| Monitoring is paused. | no | — |
| No vendor source on file for this tool. | no | 24 |
On top of that comes what cannot be measured at all: whether a vendor does what its documents say. We check documents, not data centres. And the AI Act classification describes typical use — the binding class depends on how you deploy the system.
If we get it wrong
Then we correct it with a note of change and a new verification date, and the previous state remains in the history. A correction with evidence costs nothing and needs no account — every entry page carries the way to do it. Vendors can commission a review, never an outcome: a participant in the vendor programme can come out worse than before.
Check us
Every entry carries its sources with retrieval dates, the reason for each open criterion, and the changes to its assessment.