EU AI Act Compliance Consulting
The EU AI Act is now law. If your AI systems affect EU citizens, you need to comply - regardless of where your company is based. We help you navigate the requirements, classify your risks, and build a compliance roadmap before the deadlines hit.
What is the EU AI Act?
The EU AI Act is the world's first comprehensive AI regulation. It establishes a risk-based framework that applies to any company deploying AI systems that affect people in the European Union - even if the company is headquartered outside the EU.
The regulation categorizes AI systems into risk levels: unacceptable, high-risk, limited risk, and minimal risk. Each level has different requirements for transparency, documentation, human oversight, and conformity assessment.
Non-compliance can result in fines up to €35 million or 7% of global annual turnover - whichever is higher.
Does the EU AI Act apply to you?
You use AI to make decisions about EU citizens
You develop AI products used in the EU market
You deploy AI in healthcare, finance, HR, or education
You use general-purpose AI models (like GPT, Claude, etc.)
If any of these apply, you likely need to take action.
EU AI Act Timeline - Key Deadlines
Feb 2025
Prohibited AI practices banned. Social scoring, manipulative AI, and untargeted facial recognition databases are now illegal.
Aug 2025
General-Purpose AI (GPAI) rules apply. Providers of foundation models must comply with transparency and documentation requirements.
2 Dec 2027
Standalone high-risk systems under Annex III must comply. This covers AI used in employment, education, essential services, credit and emergency triage.
2 Aug 2028
High-risk AI embedded in products already covered by EU product-safety law under Annex I, which is the route most medical devices and machinery take.
The two high-risk dates were deferred by the Digital Omnibus on AI, Regulation (EU) 2026/1744, which entered into force on 27 July 2026. The prohibitions and the general-purpose AI rules were not deferred and already apply. Separately, the Machinery Regulation (EU) 2023/1230 applies from 20 January 2027 and was not affected.
What a compliance engagement delivers
Seven artefacts, in this order. Each one is a document you keep and can put in front of an auditor, a notified body or a customer's procurement team.
1. Applicability assessment
Whether the Act reaches your systems at all, and on what basis: placing on the EU market, use inside the EU, or output used in the EU. The answer is sometimes no, and that is worth establishing in writing before anything else is built.
2. AI system inventory
Every system in scope, including the ones bought rather than built and the ones embedded in vendor software. Most inventories surface systems nobody had counted as AI.
3. Provider and deployer role mapping
Per system, which role you hold. Obligations differ sharply between the two, and substantially modifying or rebranding a bought-in system can make a deployer into a provider without anyone deciding to become one.
4. Risk classification
Each system placed in the Act's categories, with the reasoning recorded: prohibited, high-risk under Annex I or Annex III, transparency obligations, or minimal. The reasoning matters as much as the label when it is later challenged.
5. Governance gap analysis
Your current practice against the obligations that apply to each classified system: risk management, data governance, logging, human oversight, accuracy and robustness. Gaps are prioritised by exposure, not listed alphabetically.
6. Evidence and documentation plan
What has to exist, who produces it and where it lives: technical documentation, logs and their retention, instructions for use, and the records a conformity assessment will ask for.
7. Implementation roadmap
The sequence, mapped to the dates that apply to your systems rather than to the earliest date in the regulation, with owners named and the decisions that block other work pulled to the front.
Where this work stops
This is technical and organisational readiness work: classification, documentation, governance design and engineering practice. It is not legal advice, and it does not replace your counsel or a notified body.
- We do not issue legal opinions, and we do not certify systems. Conformity assessment for high-risk systems is carried out by you or, where required, a notified body.
- We prepare the documentation and the evidence; signing the declaration of conformity stays with the provider.
- Where a question is genuinely legal rather than technical, we say so and it goes to your counsel.
Work through it yourself first
Most of this can be started without us. These walk through the same steps in the order an engagement follows them.
Scope and classification
Governance and evidence
Sources and review
The dates and obligations on this page come from the regulation itself and from the Commission's own material, not from secondary summaries.
- Regulation (EU) 2024/1689 (the AI Act), full text on EUR-Lex
- European Commission: regulatory framework for AI
Page last reviewed: 29 September 2026. The high-risk dates shown reflect the Digital Omnibus on AI, Regulation (EU) 2026/1744. This page is reviewed when the regulation or its implementing acts change.
How We Help You Comply
End-to-end EU AI Act compliance support - from initial assessment to conformity documentation.
Risk Classification Audit
We analyze all your AI systems and classify them according to the EU AI Act risk framework. You'll know exactly which systems are high-risk and what's required.
Compliance Gap Analysis
We compare your current practices against EU AI Act requirements and identify every gap. You get a prioritized remediation roadmap with clear action items.
GDPR + AI Act Alignment
The EU AI Act builds on GDPR. We ensure your AI governance framework addresses both regulations coherently, avoiding duplication and gaps.
Technical Documentation
High-risk AI systems require extensive documentation. We create the technical docs, risk assessments, and quality management systems the regulation demands.
Conformity Assessment Support
We guide you through the conformity assessment process, prepare your systems for third-party audits, and help you achieve and maintain compliance.
Who this is for
We work with technical and product teams that need to translate the EU AI Act into engineering reality — risk classification, gap analysis, technical documentation, and a governance roadmap — not legal opinions.
- ✓ Healthcare and medical-AI teams facing high-risk obligations
- ✓ Manufacturers deploying AI in safety- or quality-critical processes
- ✓ Teams deploying general-purpose AI in business-critical workflows
We provide technical readiness and documentation support, not legal advice.
EU AI Act Readiness Assessment
Not sure where you stand? Our Readiness Assessment gives you a clear picture of your EU AI Act exposure and what you need to do - in 1-2 weeks.
What you get:
- ✓ Complete inventory of your AI systems
- ✓ Risk classification for each system
- ✓ Gap analysis against current requirements
- ✓ Prioritized remediation roadmap
- ✓ Executive summary with timeline & budget estimates
Frequently Asked Questions
Does the EU AI Act apply to companies outside the EU?
Yes. If your AI system is used by or affects people in the EU, the regulation applies to you — regardless of where your company is headquartered. This is similar to how GDPR works.
What counts as a 'high-risk' AI system?
High-risk systems include AI used in healthcare, finance, employment, education, law enforcement, critical infrastructure, and migration. The full list is defined in Annex III of the regulation.
What are the penalties for non-compliance?
Fines can reach up to €35 million or 7% of global annual turnover for the most serious violations. Even minor infractions can result in fines of €7.5 million or 1% of turnover.
How long does it take to become compliant?
It depends on the number and complexity of your AI systems. A basic readiness assessment takes 1-2 weeks. Full compliance for high-risk systems typically takes 3-6 months.
Are we a provider or a deployer?
Usually a deployer if you use a system someone else placed on the market, and a provider if you develop one or place it on the market under your own name. The distinction is not fixed: putting your branding on a bought-in system, or substantially modifying it, can move you into provider obligations, which are considerably heavier.
When do the high-risk obligations actually apply?
2 December 2027 for standalone high-risk systems under Annex III, and 2 August 2028 for high-risk AI embedded in products already covered by EU product-safety law under Annex I. Both dates were deferred by the Digital Omnibus on AI, Regulation (EU) 2026/1744. The prohibitions and the general-purpose AI rules were not deferred and already apply.
Do I need to comply if I only use ChatGPT or similar tools?
If you deploy general-purpose AI models in business-critical processes, you may have obligations under the GPAI provisions. Using AI for internal productivity tools has lighter requirements than customer-facing applications.
Based outside the EU?
The Act reaches companies with no European entity whenever an AI system is placed on the EU market or its output is used inside the EU. What that means in practice differs by where you are established.
Ready to Get Started?
Book a free consultation to discuss your AI project.