How to Choose an EU AI Act Compliance Consultant

Most organisations looking for EU AI Act help already know the Regulation may apply to them. What they do not know is what kind of help they need: a lawyer to interpret the text, an engineer to make the evidence exist, a software tool to track it, or a team that can do several of these at once. Hiring the wrong kind of support is the most expensive mistake in the whole programme, because it produces months of activity and no usable proof.

This guide is for CTOs, Heads of AI, compliance leads and executives who are about to buy that support. After reading it you should be able to decide whether you need outside help at all, write a scope a provider can price, compare a consultant with a law firm, a tool or your own team, and recognise a weak proposal before you sign it. It is general information, not legal advice: formal determinations about a specific system belong with your counsel.

What does an EU AI Act compliance consultant do?

An EU AI Act compliance consultant turns the obligations in Regulation (EU) 2024/1689 into a picture of your own position and a plan to close the gaps. In practice the work covers seven activities:

• Applicability and role: whether the Act reaches each system, and whether you act as provider, deployer, importer or distributor under Article 3.
• Inventory: building or validating the list of AI systems in scope, including those embedded in vendor software.
• Risk classification: placing each system against Article 5, Article 6 with Annexes I and III, and Article 50, with the reasoning recorded.
• Evidence and control gaps: comparing what the applicable articles require with what you can actually produce.
• Technical review: data governance, logging, monitoring and human oversight as they exist in the running system.
• Ownership: mapping each obligation to a named owner and a piece of implementation work.
• Roadmap: a prioritised remediation plan sequenced by deadline and lead time.

EU AI Act consulting sits between two other disciplines. Legal interpretation decides what a contested provision means for you. Engineering implementation builds the logging, validation and documentation the law asks for. Some engagements need only one of them; a high-risk system usually needs both.

When should a company hire external EU AI Act support?

A company should hire external EU AI Act support when the internal team cannot answer the role, classification and evidence questions with confidence before a real deadline or review. The common triggers are:

• uncertainty about whether you are a provider, deployer, importer or distributor for a given system, especially after fine-tuning, rebranding or changing a bought-in tool's purpose (the Article 25 triggers);
• one or more systems that are, or might be, high-risk under Annex I or Annex III;
• technical documentation that is incomplete or was never written to the Annex IV standard;
• evidence scattered across legal, product, data and engineering teams with nobody holding the whole picture;
• an upcoming customer security questionnaire, investor due diligence, public procurement or board review that will ask for proof;
• a non-EU company entering the EU market, which may need an authorised representative under Article 22;
• no one internally with both AI engineering and governance experience.

External support is often unnecessary for a narrow, clearly minimal-risk use case, such as an internal spam filter or a coding assistant, when the company already has capable legal and engineering owners. In that case a documented classification and an internal checklist, such as our gap analysis evidence checklist, are usually enough.

What should an EU AI Act gap assessment include?

An EU AI Act gap assessment should cover ten areas, and a proposal that leaves one out should explain why. The exact obligations behind each area depend on your role and on how each system is classified, so a deployer of a minimal-risk tool will see most of them marked not applicable.

1. Scope and system inventory: which systems, legal entities and markets are in scope.
2. Role and applicability: provider, deployer, importer or distributor, per system, with the reasoning.
3. Risk classification: the tier, the Annex reference, and any Article 6(3) assessment.
4. Data governance: the Article 10 questions on data origin, preparation, representativeness and bias.
5. Technical documentation: the Article 11 and Annex IV file, or the gap between what exists and what is required.
6. Logging and record-keeping: automatic event logs under Article 12 and their retention, at least six months for deployers under Article 26(6).
7. Human oversight: the Article 14 design measures and the competent person named to apply them.
8. Accuracy, robustness and cybersecurity: the Article 15 evidence, including declared accuracy metrics and test conditions.
9. Post-market monitoring and incidents: the Article 72 monitoring plan and the Article 73 serious-incident procedure.
10. Remediation priorities and owners: what closes each gap, who does it and by when.

The step-by-step method behind each area is in our gap analysis checklist. The question for a buyer is narrower: does the provider's scope reach the running system, or does it stop at your policies?

What deliverables should an EU AI Act consultant provide?

An EU AI Act consultant should hand over concrete working documents, not "strategic advice". A credible deliverable set includes:

• Applicability and role matrix: each system against each role, with the legal basis for the conclusion.
• AI system inventory, or a review of yours with the missing systems added.
• Obligation-to-evidence matrix: each applicable article mapped to the document, log or test that proves it, and its status.
• Risk and gap register: every gap with severity, the obligation it breaches and the date that obligation applies.
• Prioritised remediation roadmap: actions ordered by deadline, severity and lead time.
• Technical documentation checklist against Annex IV, for any system where you are the provider of a high-risk system.
• Owner and RACI mapping across legal, engineering, product, security and the business.
• Implementation backlog: the roadmap broken into tickets your engineering team can estimate.
• Executive summary for the board or leadership, stating exposure, decisions needed and assumptions.

Every item in the register and the backlog should carry the evidence reference, an owner, a due date and its dependencies. A useful test: if the consultant left tomorrow, could your team start closing gaps on Monday without calling them?

How does an EU AI Act consultant compare with a law firm, a software tool or an internal team?

An EU AI Act consultant, a law firm, a compliance software tool and an internal team each cover different parts of the work, and mature programmes usually combine two or three of them. The table compares them across the six capabilities a programme needs. It describes typical strengths, not any specific provider.

Capability	Technical consultant	Law firm	Software tool	Internal team
Legal interpretation	Limited; should flag questions for counsel	Strong; can issue formal opinions	None; encodes someone's interpretation	Depends on in-house counsel
Technical system review	Strong if engineers are on the team	Usually limited	Questionnaire-based	Strong on familiar systems
Engineering implementation	Possible if offered	Rarely	None	Strong, if capacity exists
Evidence management	Designs the evidence model	Reviews evidence	Strong for storage and tracking	Owns it long term
Organisational change	Moderate; facilitates	Limited	Workflow only	Strong but slow
Recurring monitoring at scale	Periodic reviews	On request	Strong	Strong once set up

A common combination is a technical consultant for the gap assessment and evidence design, counsel for contested classifications and contracts, and a tool once the inventory grows beyond a spreadsheet.

How long does an EU AI Act gap assessment take?

An EU AI Act gap assessment usually runs through six phases, and its length depends more on your documentation and availability than on the provider. An illustrative sequence:

1. Scoping and document request: agree the systems and entities, and request existing policies, architecture diagrams, model cards, vendor contracts and logs.
2. Stakeholder interviews and system review: talk to system owners and inspect the actual pipelines, logs and monitoring.
3. Gap analysis: map evidence to obligations and rate each one.
4. Findings workshop: test the conclusions with the people who own the systems.
5. Remediation roadmap: sequence the fixes and assign owners.
6. Optional implementation support: help building what is missing.

The variables that change the timeline are the number of systems, how many are high-risk, how mature the documentation already is, the number of legal entities and markets, how quickly stakeholders are available, and whether remediation is included. Our own readiness assessment is scoped at one to two weeks for a defined set of systems; a group with dozens of systems across several countries will take longer with any provider. Any proposal quoting a duration should state which of these assumptions it rests on.

What does EU AI Act consulting cost?

EU AI Act consulting cost is driven by scope, not by the Regulation itself, which is why published "average prices" are of little use. The main cost drivers are:

• Engagement model: a fixed-scope diagnostic with defined deliverables, or open-ended advisory billed over time.
• Number and complexity of AI systems, including those inside vendor products.
• Role complexity: a deployer of bought-in tools is simpler than a provider that also modifies third-party models and triggers Article 25.
• High-risk obligations: a provider of a high-risk system faces Articles 9 to 17 in full, including a quality management system under Article 17.
• Evidence quality: missing logs and undocumented training data take longer to assess than a tidy model registry.
• Implementation and documentation support, if you want help writing the Annex IV file or building logging.
• Ongoing governance: periodic reviews, monitoring and incident support after the first assessment.

To compare proposals fairly, send every provider the same short brief: the list of systems, your believed role for each, the entities and markets in scope, the documentation that already exists, and the deliverables you expect. Ask each to price a fixed-scope diagnostic separately from any implementation work. Proposals that cannot be compared on the same scope are not cheaper or dearer; they are answers to different questions.

How do you evaluate an EU AI Act compliance consultant?

Evaluating an EU AI Act compliance consultant comes down to whether they can work on your actual systems, not only your policies. Check eight things:

• They distinguish provider, deployer, importer and distributor roles, and classification tiers, per system rather than per company.
• They will inspect the technical system: pipelines, logs, monitoring dashboards and model registries.
• Someone on the team understands machine learning, data engineering and MLOps well enough to judge Article 10, 12 and 15 evidence.
• Their deliverables are concrete documents with evidence references, owners and dates.
• They state assumptions openly and say where independent legal review is required.
• They have experience in your sector, such as medical devices, employment or financial services.
• They can work with legal, engineering, product, security and leadership in the same room.
• The proposal has a clear scope, exclusions and a definition of done.

Illustrative example, provider: an HR-tech company sells a CV-screening model to EU employers. Employment uses are listed in Annex III, so the company is likely the provider of a high-risk system. A useful consultant asks to see the training data lineage, the bias tests and the log schema, not only the privacy policy.

Illustrative example, deployer: a lender uses a vendor's credit-scoring model. Creditworthiness assessment is also in Annex III, and the lender is a deployer with Article 26 duties and, under Article 27, a fundamental rights impact assessment. A useful consultant checks whether the vendor contract gives the lender access to logs for six months and notice of model changes. Our guide to provider versus deployer obligations covers the full split.

What are the red flags when choosing an EU AI Act consultant?

The red flags in EU AI Act consulting proposals are mostly promises the Regulation does not allow anyone to make. Be wary of:

• "EU AI Act certification" offered without explaining the conformity route. The Act has no general certificate. High-risk systems go through conformity assessment under Article 43, which for most Annex III systems is internal control by the provider, and a notified body is involved only in defined cases. ISO/IEC 42001 certification is a management-system standard and is not the same thing.
• One generic checklist applied to every organisation regardless of role and classification.
• No distinction between provider and deployer obligations.
• No technical AI expertise on the team that will review your systems.
• Advice with no evidence model or implementation roadmap behind it.
• Unclear deliverables, described as "insights" or "recommendations" rather than named documents.
• Fear-based deadline claims. The current high-risk dates, as amended by Regulation (EU) 2026/1744, are 2 December 2027 for Annex III systems and 2 August 2028 for AI in Annex I products, and they should be checked against the official text rather than a sales deck.
• Guarantees that a system is fully compliant. Nobody can guarantee the outcome of a market surveillance review.

Where interpretation is still developing, for example around harmonised standards or Commission guidelines, a good provider says which conclusions rest on settled text and which are judgement calls.

What questions should you ask before signing with an EU AI Act consultant?

Ask an EU AI Act consultant these ten questions before signing, and get the answers in the proposal rather than on a call:

1. Which systems and legal entities are in scope?
2. How will you determine our role and the risk classification of each system?
3. Which documents, controls and technical artefacts will you inspect?
4. What exact deliverables will we receive, and in what format?
5. Who must participate internally, and for how many hours?
6. What is excluded?
7. How do findings become an implementation backlog our engineers can estimate?
8. Where is independent legal review required, and who provides it?
9. How will sensitive model, data and business information be handled, stored and deleted?
10. What happens after the assessment: implementation support, periodic review or handover?

Records matter beyond the assessment itself: providers keep technical documentation for ten years under Article 18, and deployers keep logs for at least six months. Our guide to document retention under GDPR and the EU AI Act explains how to reconcile those periods with data minimisation.

What is the right first step with an EU AI Act consultant?

The right first step with an EU AI Act consultant is a fixed-scope gap assessment rather than an open-ended retainer. A bounded diagnostic maps the obligations that apply to each system to your existing evidence, the missing controls, the responsible owners and a prioritised remediation roadmap. It gives you a defined set of documents, a basis for comparing providers on the same scope, and a clear point at which to decide what comes next: closing the gaps internally, bringing in counsel for specific questions, or continuing with implementation support.

Sitnik AI is an AI engineering consultancy, not a law firm, a notified body or a regulator. Our EU AI Act compliance service connects the regulatory requirements to the actual system (data, models, logs, monitoring, documentation and deployment architecture) and turns the findings into an implementable technical roadmap. Where a question is legal rather than technical, it goes to your counsel. We do not certify systems or guarantee compliance.

Where can you check the EU AI Act sources yourself?

The EU AI Act primary sources are short enough to check any claim a consultant makes against them. Start with these official texts:

• Regulation (EU) 2024/1689 (the AI Act), full text on EUR-Lex: Article 3 for definitions, Articles 9 to 27 for high-risk obligations, Article 43 for conformity assessment.
• Regulation (EU) 2026/1744 (Digital Omnibus on AI) on EUR-Lex, which set the current high-risk application dates.
• European Commission: regulatory framework for AI, including guidelines and implementation updates.

This article is general information about the EU AI Act as of October 2026, not legal advice. Classifications and obligations depend on the facts of each system; confirm determinations for your organisation with qualified counsel.

Frequently asked questions

Do we need a lawyer or an EU AI Act consultant?

Many organisations need both, for different parts of the work. A lawyer interprets contested provisions, drafts contracts and represents you before regulators. A technical EU AI Act consultant inspects the running system, designs the evidence and builds the remediation roadmap. If your main uncertainty is legal meaning, start with counsel; if it is missing evidence and controls, start with a technical gap assessment.

Can a software tool replace an EU AI Act consultant?

A compliance software tool can track an inventory, store evidence and manage workflows, but it cannot decide your role, classify a borderline system or inspect whether your logs actually reconstruct a decision. Tools are most useful after a gap assessment has established what needs tracking. Many programmes use a consultant for the first assessment and a tool for ongoing monitoring.

Is there an official EU AI Act certification?

No. The EU AI Act has no general certificate. High-risk systems undergo conformity assessment under Article 43, which for most Annex III systems is an internal control carried out by the provider; a notified body is involved only in defined cases. The provider then issues an EU declaration of conformity and affixes CE marking. Treat any offer of "AI Act certification" with caution.

What should we prepare before contacting an EU AI Act consultant?

Prepare a list of the AI systems you build or use, your best guess at your role for each, the legal entities and markets involved, and any existing documentation such as architecture diagrams, model cards, vendor contracts and log samples. Even an incomplete list lets a provider scope and price a fixed diagnostic accurately, and makes proposals from different providers comparable.

Does a deployer of bought-in AI tools need a gap assessment?

A deployer of bought-in AI tools may need only a light assessment. If none of the tools are high-risk, the work is mainly inventory, classification and any Article 50 transparency duties. If a tool falls under Annex III, such as recruitment or credit scoring, the deployer has Article 26 obligations on oversight, monitoring and log retention, and may need a fundamental rights impact assessment under Article 27.