Scanners Find Yesterday's Attacks
Automated tools operate on known vulnerability databases. Your adversaries and the regulators assessing your preparedness are concerned with attack vectors that don't exist in any ruleset yet.
EU AI Act Red Teaming
We Helped Build Frontier AI.
We Helped Build Frontier AI.
Now We Break Yours.
The only EU AI Act red teaming firm staffed by practitioners who trained and stress-tested Gemini and Apple Intelligence before they were released to the public. We find what your compliance team cannot.
Why Automated Tools Won't Save You
Regulators Interview Humans, Not Logs
TÜV Notified Body assessors conduct interviews and review structured documentation. Article 9 demands evidence of human reasoning about foreseeable misuse. A scan report cannot contain that. A human-led audit does.
Your Safety Filters Only Speak English
AI safety guardrails trained on English data fail systematically in German, French, Polish, and Arabic. The same harmful request blocked in English goes through in Polish. No automated tool tests this. We do — as standard.
"We don't guess how these models fail. We know."
Our team participated in the pre-deployment evaluation of frontier large language models at production scale — including systems subsequently released by major technology companies. We understand the training objectives, RLHF reward hacking patterns, and annotation edge cases that create systematic blind spots in production AI. Because we were inside the process when it happened.
Three Phases. One Audit-Proof System.
Cognitive Adversarial Testing
Beyond automated prompt injection. We apply psychological profiling, social engineering simulation, and native-language adversarial inputs across EN, DE, FR, NL, PL — exposing human-driven jailbreaks and context-specific data leakage that no scanner finds. Including the attacks that succeed in Polish but fail in English.
EU AI Act Conformity Mapping
Every vulnerability translated directly into the language of Articles 9, 10, 13, 14, and 15 — and mapped to Annex III classification requirements. Your legal team and TÜV assessor receive documentation they can act on immediately, without a technical translation layer.
Audit-Proof Remediation Blueprint
Not a bug list. A prioritised, costed remediation roadmap with specific human-in-the-loop checkpoints, guardrail specifications, and re-test criteria — structured so a Notified Body assessor can verify completion without re-explanation.
Built for High-Risk AI Under Annex III
High Risk
HR & Recruitment AI
CV screening, performance evaluation, workforce management. Explicitly named in Annex III.
High Risk
Financial Services
Credit scoring, fraud detection, insurance underwriting. Dual exposure: EU AI Act + DSGVO.
Critical
Healthcare & Medical
Diagnostic AI, patient triage, clinical decision support. Parallel MDR obligations apply.
High Risk
Legal & Public Admin
AI-assisted legal interpretation, public service delivery, access to essential services.
Active Now
Customer-Facing AI
Any chatbot with access to personal or sensitive user data. Transparency rules active now.
From First Call to TÜV-Ready in Weeks
01
Scoping Call
60 minutes, no charge. We review system architecture, deployment context, and Annex III classification. Fixed-price proposal within 5 business days.
02
Threat Modelling
Trust boundary mapping, user population analysis, language exposure classification, and high-value attack objective enumeration.
03
Adversarial Testing
Four-layer protocol: script-level, social engineering, multilingual safety bypass, and systemic failure mode induction. Every test documented in real time.
04
Conformity Documentation
Article-by-article gap analysis, ISO 42001 mapping, human-in-the-loop specifications, TÜV-formatted summary report.
05
Remediation Handoff
Prioritised roadmap with success criteria and re-test protocols. Implementation partners facilitated where model-level fixes are required.
Free Research
The Multilingual Safety Gap Report
We tested leading HR AI systems across four European languages. The results are not what their vendors claim. Download our methodology whitepaper and research findings — free.
Used by compliance teams and Notified Body partners across DACH.
Human-Led Adversarial Audit Methodology for EU AI Act Compliance
- Safety guardrails fail in non-English EU languages at a statistically significant rate
- Article 9 requires documented human judgment, not scan logs
- TÜV assessors review reasoning traces, not automated reports
- External testers find yesterday's attacks. We find tomorrow's.
Priced on Risk Exposure. Not Day Rates.
A company with €500M revenue faces a €35M fine for non-compliance. Our audit is risk insurance with documentation — fixed scopes, no hourly billing.
Readiness Assessment
For Series A/B AI companies needing a rapid baseline before investor or customer due diligence.
- Half-day adversarial testing
- Top 3 critical findings
- Annex III classification memo
- Priority remediation list
- EN + DE testing
Most Common
Tier 02
Full Adversarial Audit
For enterprises deploying or acquiring AI in Annex III categories before August 2026.
- Complete 4-layer protocol
- Multilingual EN DE FR PL
- Article-by-article gap analysis
- ISO 42001 mapping
- TÜV-formatted report
- Remediation blueprint + re-test criteria
Partner Programme
For consulting firms and system integrators who need a red teaming subcontractor they can stand behind.
- White-label delivery
- Co-branded documentation
- All EU official languages
- Preferred turnaround SLA
- Joint Notified Body briefings
Common Questions
Do we need to give you access to our production system?
We work with sandbox, staging, or live deployments with controlled test accounts. We operate under NDA in regulated environments.
Which languages do you test in as standard?
English, German, French, and Polish as standard. Dutch, Italian, Spanish, Arabic, Turkish on request. The multilingual gap is widest in Polish and Arabic — always prioritised.
How is this different from existing automated red-teaming tools?
Some tools provide excellent monitoring for known patterns. While they can recognize common tactics, we deliver a documented reasoning trace — clear evidence of human judgment — that a Notified Body assessor specifically requires. Most clients use both.
How long does a full audit take?
Four to seven weeks from contract to final documentation. Readiness Assessments in five business days.
We have an internal red team. Why do we need you?
Internal teams have deep system knowledge and limited adversarial imagination. We bring attack patterns and multilingual capability they haven't developed plus the independence a Notified Body requires.
Are you a TÜV certified body?
We are the experts who prepare you for them. Vektor is a specialized red teaming firm that maps your AI vulnerabilities directly to Articles 9, 10, 13, 14, and 15 of the EU AI Act. While we are not a Notified Body, our methodology is designed to meet their strictest standards. We deliver TÜV-ready documentation and Annex III conformity mapping, ensuring your high-risk AI system meets every technical requirement for a successful first-time certification
Your August 2026 Deadline Is a Fixed Point.
The enterprises that begin their conformity work now will pass. The ones that wait for their first regulatory inquiry will not.
Typically 60 minutes · No sales pitch · We tell you exactly what your system needs · Scoping is free