Helping your AI play by the rules – without killing the spark
The EU AI Act is Europe’s primary rulebook for artificial intelligence systems. It aims to keep people safe without strangling innovation. It sorts AI into four risk categories:
- Unacceptable risk is prohibited – for example, social scoring systems and manipulative AI.
- High-risk AI systems – most of the Act focuses on these, which are strictly regulated.
- Limited-risk AI systems – a smaller section covers these, with lighter transparency obligations; developers and deployers must ensure end-users know they are interacting with AI (e.g., chatbots and deepfakes).
- Minimal-risk AI systems – unregulated; this includes most AI applications currently on the EU single market, such as AI-enabled video games and spam filters.
If your organisation makes, sells, or uses AI systems in the EU, the Act applies. High-risk obligations start 24 months after entry into force (August 2026). Transparency duties apply after 12 months (August 2025). Fines of up to €35 million or 7% of global turnover apply to infringements, in line with the relevant obligations’ start dates.
Understanding your risk category is half the work. Documenting the proof is the other half.
Our two-step playbook
Gap Assessment
We perform a systematic review of your AI landscape, catalogue all AI touchpoints, and inventory each deployed AI system. By benchmarking existing controls against the EU AI Act, we produce a detailed gap analysis. Deliverables:
- AI Inventory – a catalogue of AI systems, applications, and data flows.
- Control Mapping – an audit of safeguards, procedures, and documentation, aligned to the relevant EU AI Act Articles.
- Gap Heat-map – a visual that shows compliance gaps, assigns accountable owners, and prioritises fixes by risk and urgency.
Governance Policies & Procedures
Using the gap-assessment insights, we draft a tailored governance framework that closes identified gaps. Components:
- AI Governance Policies – guidelines on data quality, transparency, accountability, and risk management.
- AI Risk Register – a register of potential risks (e.g., safety, fairness, security), likelihood, and mitigations.
- Human-oversight Checklist – step-by-step controls ensuring appropriate human monitoring, intervention, and record-keeping for high-risk systems (Article 14).
- Implementation Roadmap – timelines, responsibilities, and milestones for adopting the policies and achieving compliance.
Together, these actions give your organisation a clear path from assessment to ongoing compliance under the EU AI Act.