AI Act Compliance
A practical readiness assessment against the EU AI Act - risk classification of your AI systems, a gap analysis against governance, transparency and documentation requirements, and a prioritised remediation roadmap. Scoped for regulated and technology firms preparing for phased compliance deadlines.
What to expect:
Mobilisation — scope confirmed and systems/business units agreed
AI inventory & classification — your AI systems identified and classified by EU AI Act risk tier
Discovery — governance and data documentation reviewed, stakeholder interviews held
Gap assessment — findings mapped against applicable obligations per risk tier
Roadmap & reporting — prioritised remediation roadmap and full assessment report
Close-out — review cycle and executive readout
Typical duration: 3–4 weeks
What the EU AI Act requires
The EU AI Act (Regulation (EU) 2024/1689) classifies AI systems into risk tiers and attaches different obligations to each:
Prohibited practices (Article 5) — a short list of AI uses banned outright, including subliminal manipulation, social scoring, and certain biometric categorisation and real-time remote biometric identification uses. In force since 2 February 2025.
High-risk systems (Chapter III, Article 6 and Annex III) — AI used in areas like employment, education, essential services, and biometrics. These carry the Act's heaviest obligations (Articles 8–21): a risk management system across the system's lifecycle, data governance, technical documentation, record-keeping, human oversight, accuracy/robustness/cybersecurity standards, and conformity assessment with CE marking before use.
Limited-risk / transparency obligations (Article 50) — systems like chatbots and deepfake generators, which must make clear that a person is interacting with AI or AI-generated content. In force since 2 August 2026.
General-purpose AI (GPAI) models (Chapter V) — documentation, copyright-policy and systemic-risk obligations for model providers, phased in from 2 August 2025 for new models, with existing models given until 2 August 2027 to catch up.
A note on timing, since this shifted recently: the original 2 August 2026 deadline for high-risk (Annex III) obligations has been pushed back. The Digital Omnibus (Regulation (EU) 2026/1744), which entered into force on 27 July 2026, extended the high-risk compliance deadline to 2 December 2027 — giving in-scope organisations more runway, but the classification and gap-assessment work is worth doing now rather than at the deadline, not less.
Is this for you?
This is for any organisation developing or deploying AI systems that:
Doesn't have a clean, central inventory of AI systems in use — including tools individual teams or business units have adopted without central sign-off.
Hasn't formally classified its AI systems against the Act's risk tiers, and can't say with confidence which, if any, are high-risk.
Is preparing for the 2 December 2027 high-risk deadline and wants a head start rather than a scramble.
Sits in financial services or another regulated sector already managing DORA, GDPR, or similar obligations, and wants AI Act readiness assessed with the same rigour rather than bolted on as an afterthought.
Typical buyers: CISO, Head of Technology Risk, Data Protection Officer, or Chief AI/Data Officer at a regulated entity deploying or developing AI systems.
Frequently asked questions
How long does an AI Act readiness assessment take?
Around 17.5 person-days over roughly 4–5 weeks, matched to the same shape as a DORA Sprint — inventory and classification, discovery, gap assessment, roadmap and reporting.
We're not using AI in anything "high-risk." Do we still need this?
Worth confirming rather than assuming — the Annex III high-risk categories (including employment decisions, credit scoring, and some biometric uses) catch more than people expect, and "shadow AI" adopted by individual teams is often the biggest classification blind spot. The inventory and classification phase exists precisely to answer that question with evidence, not a guess.
Does the extended deadline mean we can wait?
The 2 December 2027 deadline gives more runway, but the underlying work — knowing what AI you're actually using and how it's classified — doesn't get easier by waiting, and the prohibited-practice rules (Article 5) and GPAI obligations are already in force now. Firms that start the inventory and classification work early avoid a scramble later.
Can you help with genuinely ambiguous classification calls?
The assessment flags genuinely ambiguous cases clearly rather than resolving them unilaterally — those are noted as needing legal input, since a classification dispute is ultimately a legal question.
What happens if we don't comply?
Article 99 sets three penalty tiers: up to €35m or 7% of global annual turnover (whichever is higher) for prohibited-practice violations; up to €15m or 3% for most other non-compliance; and up to €7.5m or 1% for supplying incorrect information to authorities. SMEs get the lower of the amount or percentage in each tier.
What does it cost, and how does it pair with DORA work?
Scoped and quoted after a short call, tailored to your AI inventory and risk profile — there's no published price. It's structured to match the DORA Sprint, so a firm facing both regulations can run them as a paired "regulatory readiness sprint" rather than two disconnected engagements. Get in touch and we'll confirm scope and cost together.
A practical readiness assessment against the EU AI Act - risk classification of your AI systems, a gap analysis against governance, transparency and documentation requirements, and a prioritised remediation roadmap. Scoped for regulated and technology firms preparing for phased compliance deadlines.
What to expect:
Mobilisation — scope confirmed and systems/business units agreed
AI inventory & classification — your AI systems identified and classified by EU AI Act risk tier
Discovery — governance and data documentation reviewed, stakeholder interviews held
Gap assessment — findings mapped against applicable obligations per risk tier
Roadmap & reporting — prioritised remediation roadmap and full assessment report
Close-out — review cycle and executive readout
Typical duration: 3–4 weeks
What the EU AI Act requires
The EU AI Act (Regulation (EU) 2024/1689) classifies AI systems into risk tiers and attaches different obligations to each:
Prohibited practices (Article 5) — a short list of AI uses banned outright, including subliminal manipulation, social scoring, and certain biometric categorisation and real-time remote biometric identification uses. In force since 2 February 2025.
High-risk systems (Chapter III, Article 6 and Annex III) — AI used in areas like employment, education, essential services, and biometrics. These carry the Act's heaviest obligations (Articles 8–21): a risk management system across the system's lifecycle, data governance, technical documentation, record-keeping, human oversight, accuracy/robustness/cybersecurity standards, and conformity assessment with CE marking before use.
Limited-risk / transparency obligations (Article 50) — systems like chatbots and deepfake generators, which must make clear that a person is interacting with AI or AI-generated content. In force since 2 August 2026.
General-purpose AI (GPAI) models (Chapter V) — documentation, copyright-policy and systemic-risk obligations for model providers, phased in from 2 August 2025 for new models, with existing models given until 2 August 2027 to catch up.
A note on timing, since this shifted recently: the original 2 August 2026 deadline for high-risk (Annex III) obligations has been pushed back. The Digital Omnibus (Regulation (EU) 2026/1744), which entered into force on 27 July 2026, extended the high-risk compliance deadline to 2 December 2027 — giving in-scope organisations more runway, but the classification and gap-assessment work is worth doing now rather than at the deadline, not less.
Is this for you?
This is for any organisation developing or deploying AI systems that:
Doesn't have a clean, central inventory of AI systems in use — including tools individual teams or business units have adopted without central sign-off.
Hasn't formally classified its AI systems against the Act's risk tiers, and can't say with confidence which, if any, are high-risk.
Is preparing for the 2 December 2027 high-risk deadline and wants a head start rather than a scramble.
Sits in financial services or another regulated sector already managing DORA, GDPR, or similar obligations, and wants AI Act readiness assessed with the same rigour rather than bolted on as an afterthought.
Typical buyers: CISO, Head of Technology Risk, Data Protection Officer, or Chief AI/Data Officer at a regulated entity deploying or developing AI systems.
Frequently asked questions
How long does an AI Act readiness assessment take?
Around 17.5 person-days over roughly 4–5 weeks, matched to the same shape as a DORA Sprint — inventory and classification, discovery, gap assessment, roadmap and reporting.
We're not using AI in anything "high-risk." Do we still need this?
Worth confirming rather than assuming — the Annex III high-risk categories (including employment decisions, credit scoring, and some biometric uses) catch more than people expect, and "shadow AI" adopted by individual teams is often the biggest classification blind spot. The inventory and classification phase exists precisely to answer that question with evidence, not a guess.
Does the extended deadline mean we can wait?
The 2 December 2027 deadline gives more runway, but the underlying work — knowing what AI you're actually using and how it's classified — doesn't get easier by waiting, and the prohibited-practice rules (Article 5) and GPAI obligations are already in force now. Firms that start the inventory and classification work early avoid a scramble later.
Can you help with genuinely ambiguous classification calls?
The assessment flags genuinely ambiguous cases clearly rather than resolving them unilaterally — those are noted as needing legal input, since a classification dispute is ultimately a legal question.
What happens if we don't comply?
Article 99 sets three penalty tiers: up to €35m or 7% of global annual turnover (whichever is higher) for prohibited-practice violations; up to €15m or 3% for most other non-compliance; and up to €7.5m or 1% for supplying incorrect information to authorities. SMEs get the lower of the amount or percentage in each tier.
What does it cost, and how does it pair with DORA work?
Scoped and quoted after a short call, tailored to your AI inventory and risk profile — there's no published price. It's structured to match the DORA Sprint, so a firm facing both regulations can run them as a paired "regulatory readiness sprint" rather than two disconnected engagements. Get in touch and we'll confirm scope and cost together.