- Home
- Compliance
- EU AI Act compliance
EU AI Act compliance
You don't have to build AI to be liable for it
The costliest mistake we hear: "We don't develop AI, so the regulation isn't our problem." Regulation (EU) 2024/1689 sets separate duties for those who provide AI systems and those who deploy them. If your staff use AI tools, you're a deployer.
Most companies can't answer the first question an inspector asks: which AI systems do you run?
Trusted since 2004 by the public sector, energy and heavy industry: buyers who audit their suppliers before they sign. See the case studies.
The timeline has changed more than once. Don't set internal deadlines from a news article or from this page. Check the consolidated text in the Official Journal and any implementing acts. This page explains how the rules work and isn't legal advice.
Four questions you need to answer
Which AI systems do we use?
Including features switched on by default in software you own, tools bought on department cards and browser extensions staff installed.
What risk does each carry?
Prohibited, high-risk, transparency duties, or none of these. The classification decides every obligation that follows.
Who oversees them?
High-risk systems need real human oversight: named, competent people with the authority and means to step in or stop the system.
Do staff understand what they use?
The AI literacy duty applies to deployers, not just to the companies that build models.
Where high risk shows up in an ordinary company
- Recruitment. CV screening, candidate ranking, assessment tools. The most common case, often bought by HR without IT.
- Employee evaluation. Anything that affects promotion, task allocation or dismissal.
- Access to essential services. Credit scoring, pricing of some insurance.
- Safety components in products. Relevant if you make equipment.
A rule of thumb: an agent matching invoices to purchase orders is normally not high-risk. An agent ranking job applicants very likely is. Getting the classification wrong costs you either way. Over-classify and you pay for work you didn't need. Under-classify and you risk a fine.
What we deliver
Documentation
- An AI register your team can keep up to date
- A record per system, with its classification and the reasoning
- Human oversight: who, what they see, when they step in
- An internal AI use policy staff can follow
- AI literacy training material
Working mechanisms
- Decision logs that let you rebuild any output later
- Confidence thresholds with automatic human escalation
- Pinned model versions, so behaviour can't change silently
- Reference tests on a schedule, results kept as evidence
- Content marking where transparency duties apply
Do it once, not three times
The AI Act, NIS2 and data protection overlap. Your AI inventory is part of your NIS2 asset inventory. Assessing a model vendor is also a supply chain risk assessment. If the system touches personal data, GDPR applies too.
Companies that hire three consultancies end up with three inventories that don't match, and pay three times for the same interviews. We do it as one project.
Start with the inventory
It's useful however the timeline moves, because you can't govern what you don't know you have. The readiness assessment usually produces it within a week, with the risk classification and a business case for automation. Or start with a free call, and we'll tell you roughly how exposed you are before you spend anything.
Common questions
We only use AI, we do not build it. Does it apply?
Yes. The regulation places distinct obligations on providers and on deployers. The AI literacy obligation for staff applies regardless of role, and deploying a high-risk system brings additional oversight requirements.
What counts as a high-risk AI system?
The categories are listed in the regulation's annexes and include, among others, uses in recruitment, employee evaluation, access to essential services, and safety components of products. Classification is case by case.
Is the application timeline final?
The timeline has been amended more than once since entry into force. Always check the consolidated version in the Official Journal, and any implementing acts, before fixing internal deadlines.
Find out in 30 minutes if it's worth doing.
Tell us about one process that eats your team's week. We'll tell you on the call whether an agent can take it over, roughly what it costs and what it saves. If it's not a fit, we'll say so.