EU AI Act Readiness · AI Governance & Responsible AI
Your EU customer needs an answer. Your product team needs to know what changes. We help you establish which AI Act duties apply to each system, what evidence is missing and who needs to act next.
Start with a 4-week entry assessment for one entity and up to 3 AI systems, with the scope and delivery plan agreed before kickoff. Timing depends on required evidence and stakeholder availability. Receive applicability and risk-classification analysis, a dated obligations map, documented gaps, a prioritized roadmap and a management readout for the agreed scope.
Free 30-minute EU AI Act strategy call. No obligation.
Your scope, fee and assessment delivery plan are agreed in writing before work starts. Every obligation is linked to its source and review date. You receive 30 days of follow-up access for questions about the agreed deliverables.
01
Procurement asks how your AI feature is classified and what you have done about the obligations. A supplier statement or an AI policy does not answer every question. We help you assemble the system facts, reasoning and evidence gaps so your team can give a grounded response and explain the work still in progress.
You use a third-party model in a product, buy AI-enabled software and let employees use assistants internally. Those activities may create different responsibilities. We review each agreed use and supply-chain role so product, procurement and legal teams are working from the same facts.
Legal has identified an issue, but engineering needs controls, owners and acceptance evidence. Leadership needs to know what affects a launch or deployment decision. We connect reviewed obligations to the records, decisions and actions needed to move the work forward.
02
The EU AI Act is Regulation (EU) 2024/1689, as amended. It regulates particular AI activities and roles. Its reach can include organizations outside the EU, including providers placing systems or general-purpose AI models on the EU market and certain providers or deployers whose system outputs are used in the EU. Headquarters alone does not settle applicability. For every system in scope, we record its purpose, users, affected people, geography, model dependencies and deployment context. We then review relevant roles, classifications, exceptions and obligations with your legal stakeholders. A change in intended use, branding, functionality or supplier arrangements can require a new review.
03
| Review | What it establishes |
|---|---|
| Prohibited practices | Whether the intended use falls within Article 5 and whether an exception is relevant. |
| High-risk classification | Whether Article 6 and Annex I or Annex III apply, including their conditions and exclusions. |
| Transparency | Whether Article 50 requires disclosures, content marking or other information. |
| Other relevant duties | Whether model-provider duties, AI literacy measures or other provisions apply. |
These reviews can overlap. A system outside a high-risk category may still have duties. GDPR, sector rules and contracts also need their own analysis.
04
Legal sources reviewed on 20 October 2026. The 2026 Digital Omnibus on AI is adopted legislation: Regulation (EU) 2026/1744 entered into force on 27 July 2026. Its revised high-risk dates are not merely a proposal. Future proposals and draft guidance are tracked separately from binding requirements.
| Provision | Application date or transition |
|---|---|
| Original prohibited practices | 2 February 2025. The additional Article 5 provisions introduced in 2026 have a separate 2 December 2026 date. |
| General-purpose AI model regime | 2 August 2025, with a transition for certain earlier models. |
| Article 50 transparency | Generally 2 August 2026. Providers of qualifying synthetic-content systems marketed before that date have until 2 December 2026 for Article 50(2). |
| Annex III high-risk systems | 2 December 2027 for Chapter III Sections 1–3, except Article 6(5). |
| Article 6(1) high-risk systems | 2 August 2028 for Chapter III Sections 1–3, except Article 6(5). Check the applicable product-law route and Article 2(2). |
These dates apply to particular provisions. They do not postpone the whole Act or establish that every system has the same deadline. We connect each relevant date to your role, system facts and required evidence.
Under Article 111, GPAI models placed on the market before 2 August 2025 have a 2 August 2027 compliance deadline. For other pre-existing high-risk systems, the transition depends on the relevant Chapter III application date and significant design changes afterward. This is not a general 2028 deadline for every existing Annex III system. High-risk systems intended for public-authority use have a separate 2 August 2030 requirement. Qualifying AI components of the Annex X large-scale IT systems placed on the market or put into service before 2 August 2027 have a 31 December 2030 date. Article 5 must still be checked independently. Preserve placement, service-entry and change records with the analysis.
The amended Article 4 requires providers and deployers to take measures supporting AI literacy for relevant staff and others operating or using systems on their behalf. The measures reflect knowledge, experience and context; the provision does not require a guaranteed literacy level for each individual.
05
A risk label needs a reason. Your classification register records the system version, intended use, facts reviewed, relevant provision, decision owner, unresolved questions and review trigger. That gives procurement, legal and engineering a conclusion they can trace back to the actual system.
An Annex I product connection alone does not establish high-risk status. Review the Article 6 conditions and the amended safety-component provisions. For Annex III, identify the particular use case and conditions rather than assigning a category solely from an industry label. An Article 6(3) exception needs documented reasoning about harm and influence on decisions, including the profiling rule. A narrow procedural task is not automatically exempt. For a relevant Annex III system assessed as not high-risk, retain the Article 6(4) assessment and check registration obligations. Counsel resolves contested interpretations.
06
| Role | Records and responsibilities to examine |
|---|---|
| Provider | Development or commissioning, branding, intended purpose and changes; product governance and relevant provider duties. |
| Deployer | Actual use, instructions, oversight, monitoring and affected-person processes. |
| Importer or distributor | Supply chain, market access and role-specific checks. |
| Authorized representative | Appointment and defined responsibilities where applicable. |
| GPAI model provider | Model supply, documentation, capabilities, release arrangements and separate model obligations. |
A supplier statement is one piece of evidence. For a high-risk deployment, review instructions, competent human oversight, input data within your control, monitoring, logs and escalation. Check worker and affected-person information, registration and impact-assessment duties separately. Assign who can suspend use and what happens if the supplier cannot be reached. Changes in branding, intended purpose or a high-risk system can change responsibilities under Article 25. Fine-tuning calls for a fact-specific review; it does not automatically make every team a high-risk provider.
07
Where high-risk preparation is included in the agreed scope, we connect applicable requirements to existing records and missing work. The review identifies what needs attention; it does not certify the system or complete every technical evaluation.
| Review area | Evidence and decisions |
|---|---|
| Risk management • Article 9 | Harms, foreseeable misuse, treatments, residual-risk reasoning, tests and review triggers. |
| Data governance • Article 10 | Origin, preparation, suitability, quality criteria, bias-related assessment and data owners. |
| Technical documentation • Article 11 and Annex IV | System and version description, design records, evaluation evidence and a maintained documentation index. |
| Record keeping • Article 12 | Logging capability, events, retrieval and traceability gaps. |
| Instructions • Article 13 | Intended use, limitations, foreseeable failures and information deployers need. |
| Human oversight • Article 14 | Responsibilities, interpretation support, escalation, override and stop arrangements. |
| Performance and security • Article 15 | Accuracy and robustness measures, validation, cybersecurity evidence and specialist testing needs. |
The map also considers relevant quality-management, conformity, declaration, marking, registration and operator duties. Your team can see which records already exist and which require legal, engineering or specialist assessment work.
Article 27 applies to specified deployers and uses, including public-law bodies, private entities providing public services and certain creditworthiness and life or health insurance uses. Check its precise scope and critical-infrastructure exception before deciding whether it applies. Where relevant, identify affected groups, deployment context, frequency of use, potential harms, oversight, response measures and complaints processes. Cross-reference relevant data-protection assessments. Assign updating and notification responsibilities separately. A gap review is not a completed statutory assessment or a filing on your behalf.
Review how the provider’s post-market monitoring plan collects and evaluates performance information and feeds changes back into risk management. Define who recognizes an incident, preserves evidence, checks reporting duties and contacts the appropriate authority. Reporting clocks and sector interactions need a documented legal check. Monitoring operations and regulatory reporting services require their own scope.
08
Choose the assessment depth that matches the decision your team needs to make. Both offers include the entry assessment deliverables below. Full Readiness adds governance documentation, assigned controls, oversight arrangements and evidence reviews for up to 5 AI systems.
| Deliverable | How your team uses it |
|---|---|
| AI inventory and exposure memo | See the scoped systems, purposes, roles, EU connection and assumptions that need confirmation. |
| Classification register | Trace relevant prohibition, risk, transparency and model-duty conclusions to facts and sources. |
| Source-linked obligations map | Connect articles, dates, roles and evidence requirements to each assessed system. Included in the entry assessment. |
| Governance gap register | Understand missing controls and records that affect release or deployment decisions. Included in the entry assessment. |
| Prioritized roadmap | Prioritize next steps, owners, dependencies and closure evidence. Included in the entry assessment. |
| Management readout | Review material exposure, unresolved assumptions and decisions for leadership and counsel. |
09
10
Agree where the inventory, classifications and evidence links live. Assign an owner, version, review date, access rules and change trigger. Connect supplier records to the actual use, relevant contract responsibilities, missing evidence and change notifications. Existing repositories can support the work; no platform purchase or integration is included by implication. Your engagement includes 30 days of follow-up access for questions about the agreed deliverables. Technical system changes, new assessments and ongoing regulatory monitoring require a separate agreed scope.
Free 30-minute EU AI Act strategy call. No obligation.
11
Organizations developing AI products for EU customers need a clear account of their system roles and the evidence behind their position. Financial services, healthcare, HR and other teams using AI in consequential decisions need to examine the specific use and conditions. Businesses adopting AI-enabled software need to understand their own responsibilities alongside supplier assurances. We start with the systems, uses and markets driving the question.
12
Agree the systems and review depth before work begins. The assessment delivery period covers the stated outputs, subject to required evidence and stakeholder availability. Remediation, statutory assessments and conformity processes have their own dependencies.
| Entry Assessment | Most Popular Full Readiness |
|---|---|
| From $5,000 per engagement | From $12,000 per engagement |
| AI inventory and exposure memo Classification register Source-linked obligations map Governance gap register Prioritized roadmap Management readout |
Everything in Entry Assessment, plus… Governance documentation Assigned controls Oversight arrangements Evidence reviews |
| One entity, up to 3 AI systems | Up to 5 AI systems |
| 4 weeks for the stated assessment deliverables | 6 weeks for the stated governance deliverables |
| 30 days of follow-up access | 30 days of follow-up access |
A written proposal confirms the final boundary, fee, deliverables, dependencies and delivery plan. Both offers include 30 days of follow-up access for clarification of the agreed deliverables. High-risk, general-purpose AI and complex portfolios require custom scoping; no fixed price is implied for that work.
Free 30-minute EU AI Act strategy call. No obligation.
13
| Your question | Appropriate work |
|---|---|
| Which legal duties apply to our AI systems? | EU AI Act readiness provides role, classification and obligations analysis with operational evidence planning and legal-review dependencies. |
| How do we establish an AI management system? | ISO 42001 readiness develops management-system preparation. Certification is a separate independent assessment. |
| How should we organize voluntary AI risk management? | NIST AI RMF alignment supports a risk operating approach, with context, ownership, evaluation and treatment. |
| Can we reuse security and privacy work? | An evidence crosswalk identifies the specific obligation, useful existing record and remaining gap. |
An ISO certificate or a framework label does not settle legal compliance. Under Article 40, a presumption of conformity depends on the applicable harmonised-standard reference in the Official Journal and the requirements it covers. Check version, scope and restrictions before relying on it; no universal overlap percentage applies.
14
We define the assessment and governance work included in your engagement, with clear deliverables, owners and next steps. Where the roadmap identifies legal questions, technical changes or conformity-assessment requirements, we identify the appropriate next steps and responsible parties.
15
We hand over the inventory, classification register, obligations map, governance documents and recommended review schedule prepared within your engagement. Your team receives the records supporting the decisions and the next steps for keeping them current. If you need continuing governance leadership, our Virtual CISO service provides a route to discuss responsibility, review cadence and oversight of open actions. The included 30 days of follow-up access remains separate from any ongoing engagement.
16
Every EU AI Act readiness engagement is led by Temi, with 20+ years of security, audit and governance experience and more than 100 assessments across industries. Temi’s consulting experience includes Amazon, Walgreens and Humana.
LinkedIn recommendations
Temi is an incredibly thorough GRC professional with an impressive command of PCI requirements. During our time working together, I was consistently impressed by her ability to navigate complex audit workflows and provide clear, actionable insights. She is a dedicated expert who brings high standards of professionalism to every project.
I’ve had the privilege of working alongside Temi, and I can confidently say she is one of the most reliable and technically proficient GRC and IT Security professionals I have partnered with. Her expertise spans SOX compliance, IT risk management, security controls, and governance frameworks, and she consistently brings clarity, structure, and rigor to every engagement.
Temi has a rare ability to translate complex regulatory requirements into practical, actionable controls that strengthen organizational resilience. Her attention to detail, strong analytical mindset, and commitment to high-quality execution make her an invaluable asset to any team. Beyond her technical strengths, she is collaborative, solutions-oriented, and trusted by stakeholders across the business.
Temi is GRC professional who has exhibited top level IT security risk and audit competence by leading high visibility, high impact projects building frameworks and implementation of systems that have improved the safety and reliability of business operations in global organizations. I have interacted with Temi on tangential projects and I can attest to her professionalism, commitment and leadership.
I had the privilege of being mentored by Temi during my transition from a general tech role into the security field, and I can confidently say her guidance made a significant difference in my journey.
Temi has a rare ability to support and uplift others in whatever capacity she can. She helped me not only understand complex security concepts and frameworks, but also gain practical, real-world exposure to the role. She taught me how to think like a security professional - from communicating security concepts to cross-functional teams with varying levels of understanding, to reviewing and analyzing security documentation for accuracy and completeness.
What stood out most was her genuine investment in my growth. Whether it was recommending resources, connecting me with a trainer to deepen my knowledge, reviewing my learning path, or sharing valuable industry insights, she was always generous with her time and expertise.
If you’re looking for a mentor or security leader who truly empowers others, I highly recommend Temi. I’m incredibly grateful for her support and the lasting impact she has had on my career.
Recommendations as published on LinkedIn, shown with the recommender's name and headline at the time of writing.
17
Article 99 sets upper limits for specified infringements: €35 million or 7% of preceding-year worldwide turnover for prohibited practices; €15 million or 3% for listed operator and notified-body duties; and €7.5 million or 1% for incorrect, incomplete or misleading information provided in response to requests from national competent authorities or notified bodies. For undertakings the higher amount generally applies, subject to exceptions. SMEs, including start-ups, have a lower-of-the-two rule; small mid-cap enterprises have a separate lower-of-the-two rule for the latter two categories. Actual enforcement depends on the provisions, infringement and circumstances. Other regimes, including Commission powers, need separate analysis. These maxima do not predict a fine or the revenue effect of a customer review.
The entry assessment starts at $5,000 for one entity and up to 3 AI systems. It includes applicability and risk classification, obligations mapping, gaps and a prioritized roadmap. Your proposal confirms the final scope and fee. Use the pricing table to compare broader scopes.
The starting assessment is proposed at 4 weeks for the stated scope, with evidence and stakeholder availability confirmed before kickoff. Wider portfolios and deeper work take longer, as shown in the table. Completing remediation or conformity work is a separate planning question.
It can. We review your market, use and role facts, including the EU connection of the system or its outputs. Your headquarters is only part of that analysis.
No. Intended purpose and the Article 6 conditions matter. Transparency, AI literacy or other duties can still apply. Include actual uses of chat tools and embedded software features; drafting text and influencing hiring decisions raise different questions.
Yes. The adopted 2026 amendment changes the application dates for particular high-risk provisions. The dated table identifies the affected sections. The assessment also checks each system’s transitions and duties already in effect.
18
A management-system certificate provides assurance within its scope. The system’s legal duties and conformity requirements still need their own evidence and analysis. We identify existing governance records that can help and the work that remains.
No. Article 43 distinguishes the routes and their conditions. Annex III points 2–8 generally use an internal-control procedure, with applicable product-law interactions checked separately. Biometric and product-related cases require their specific route to be assessed. Our readiness review does not perform the conformity assessment.
You receive operational readiness materials with sources, assumptions and unresolved questions. Your counsel confirms legal interpretations and provides any formal legal opinion required.
Assign an owner and connect changes in models, data, suppliers, intended uses and markets to a review decision. Preserve earlier reasoning and approvals. Ongoing regulatory watch and support need their own scope.
System complexity, supplier cooperation, evidence quality, legal decisions, testing needs and implementation capacity affect the next phase. We identify those dependencies so the assessment delivery date is not mistaken for the end of every compliance activity.
The relevant Member State authority and national procedures need confirmation with counsel alongside the EU timetable. We record jurisdiction-specific questions rather than assuming local representation or a particular authority designation.
You have 30 days of follow-up access for questions about the agreed deliverables. New systems, implementation, technical testing and ongoing legal monitoring are separately scoped.
19
Tell us which AI systems you provide or use, where they reach the EU and what your customer or leadership team needs to decide. We will discuss the review boundary, timing and next steps for a scoped proposal.
Free 30-minute EU AI Act strategy call. No obligation.