Skip to content
Venturalítica

Venturalítica

The ISO 23894 risk-treatment loop closed in git. The Annex IV comes out by construction.
Get startedRDD Methodology

🟡 Partial — froga does not yet produce a complete Annex IV.

You are about to ship AI that decides about people — who gets a loan, a diagnosis, a job. When those systems fail quietly or unfairly, the harm is real and so is the bill: under the EU AI Act, fines reach €35 M or 7% of worldwide turnover, and a high-risk system with no signed technical file cannot be placed on the EU market — no CE marking, no sale, out of every public tender that requires it. froga makes treating that risk part of writing the code, not a dossier you rewrite the night before an audit.

When AI decides about peopleReal systems that harmed real people because a risk went untreated, what non-compliance costs (fines, market access, public tenders), and the clock that is already running.

“By construction” refers to the generation mechanism — the Annex IV is assembled from the signed bundle, not hand-written; its completeness is still partial (see Status & gaps).

This documentation describes the real state of the project. The gaps towards a complete Annex IV are enumerated in Status & gaps.

What is froga

Section titled “What is froga”

froga is the Risk-Driven Development (RDD) CLI for AI systems classified as high-risk under the EU AI Act (Art. 6 and Annex III). It operates on a standard git repository and turns each risk treatment — code, parameter, or prompt — into a versioned change, signed with ECDSA-P256+DSSE+in-toto and traceable by normative clause.

The core principle: git closes the ISO 23894 treatment loop. A treatment is a code change; the git log is the evidence register; froga reconstruct converts it into the identification→evaluation→treatment→residual cycle. The Annex IV (EU AI Act Art. 11 and ISO/IEC 42001 Annex B) is generated from the signed bundle — it is not drafted by hand.

What RDD is in three lines

Section titled “What RDD is in three lines”

Risk-Driven Development (RDD) is an established idea in software engineering — Boehm’s spiral model made it the driver of the process; Venturalítica specializes it for AI risk treatment — and applies TDD discipline to the compliance cycle:

  • Red: the risk is identified but the measurement exceeds the threshold or evidence is missing.
  • Green: the treatment has been implemented, measured, and the metric crosses the gate.
  • Refactor: apply the lowest-cost treatment that brings the residual below the appetite declared in froga.yaml.

The cycle is orchestrated by froga run (which runs the pipeline and measures); artifact freshness is monitored by froga status, and per-clause normative compliance is emitted by froga conformance.

Two paths

Section titled “Two paths”

For agents

This documentation is also designed for consumption by AI agents.

  • For agents — conventions, /llms.txt and how to navigate
  • /llms.txt — curated site index (auto-generated)