Services · EU AI Act compliance & governance
Know exactly what the EU AI Act asks of you — and be able to prove it
Risk-classify every AI system you run or plan, close the documentation and oversight gaps, and put proportionate governance in place before a supervisor, auditor or client asks — guided by an Independent AI Expert for the European Commission.
When to call us
Sound familiar?
Because nobody in the room can answer the AI Act question with confidence, and “no” feels safer than “maybe”.
Vendor tools, a credit model, a chatbot someone bought — nobody knows what is classified how, or who owns it.
A client questionnaire, an auditor, a works council, a regulator — and the answer is currently a shrug.
What you get
Outcomes, not deliverables first
One register of every AI system, its AI Act risk class, its owner and its gaps — the document the board and the regulator both want.
Proportionate obligations mapped to each system, so low-risk work moves fast and high-risk work gets the real controls.
Classification and documentation reviewed by someone who advises the Commission on AI — practice, not a reading of the text.
What we deliver
The scope you can actually sign
01
AI system inventory & risk classification
Every current and planned system — built or bought — mapped to prohibited / high-risk / limited / minimal, with your provider-vs-deployer role per system.
02
AI Act exposure register & gap analysis
Obligations per system (risk management, data governance, documentation, logging, transparency, human oversight) against what exists today.
03
Technical documentation, pre-filled
Annex-style technical files and transparency notices started from our templates and your systems, so your teams finish them rather than face a blank page.
04
AI governance charter & policy
Decision rights, approval workflow for new AI, an acceptable-use policy staff can read, and a register process that stays alive.
05
Human-oversight & logging design
Where a human must be in the loop, what they see, what gets logged — designed into the workflow, not bolted on.
06
Compliance as a service
Quarterly review of new systems, vendor changes and regulatory updates as the Act phases in — a retainer, not a one-off.
How it runs
Fixed scope, fixed price per phase — you decide at each step.
Inventory (1–2 weeks)
Interviews, tool audit, vendor contracts — we find the AI you forgot you had.
Classify & gap (1–2 weeks)
Risk classes, roles, obligations, and the gap against today — in one register.
Document & govern (2–4 weeks)
Templates pre-filled, charter adopted, oversight designed, owners named.
Maintain (quarterly)
New systems, vendor updates and deadlines tracked — compliance that stays current.
Regulation & sovereignty
Where the AI Act stands — and what else applies
Prohibited practices and AI-literacy duties already apply; general-purpose AI obligations and the bulk of high-risk requirements phase in through 2026–2027, with national supervisory authorities in Belgium and Luxembourg being set up. GDPR governs the personal data inside your systems, DORA treats AI vendors as ICT risk in finance, NIS2 adds cyber duties for essential entities. We map all of it per system — and we keep the register alive as deadlines land.
Questions
Are we even in scope if we only use vendor tools?
Very likely yes — as a deployer. Using an AI system in a high-risk context (HR decisions, credit, essential services) brings obligations even when a vendor built it. The inventory tells you exactly where.
Does using ChatGPT or Copilot make us a “provider”?
Usually no — you are a deployer of a general-purpose AI system, with transparency and AI-literacy duties. It changes if you build your own system on top of it for a high-risk purpose; we check that case by case.
How long does classification take?
For a mid-market organisation, two to four weeks for inventory and classification; documentation depends on how many high-risk systems you run. Fixed price, scoped after a 30-minute debrief.
Can this be combined with the AI Readiness Assessment?
Yes — the Assessment + AI Act Compliance Pack tier bundles both. If you only need the compliance work, this service stands alone.
Start with a 30-minute conversation
Tell us the problem, not a spec. You get an honest read on feasibility, data, compliance exposure and a first step — within one business day.