What does Maditon produce once a system is classified?

The classification is the input, not the deliverable. What it produces is a work list.

The obligation checklist. Every duty the tier triggers, as a discrete item you can close. A high-risk determination generates a long list — risk management, data governance, technical documentation, logging, human oversight, accuracy and robustness, registration. A transparency-only determination generates the Article 50 disclosure duties and little else. The list is derived from the classification, so it changes if the classification changes.

Evidence against each item. A checklist item without evidence is a claim. Attach the document, the screenshot, the policy, the test report — whatever substantiates it — and the item carries its proof.

A dashboard and an urgent-actions view. Across all systems: what is done, what is open, and what is time-critical.

The point of the structure is that on the day someone asks, you are not reconstructing a year of decisions from Slack and Drive. The work was recorded as it happened.