Practice area · AI Act and governance

AI Act compliance, from people who build AI

We help organisations that build or use AI in the EU understand what Regulation (EU) 2024/1689 requires of them, close the gaps, and put in place governance that holds up as the rules phase in.

Readiness assessmentAI inventoryRisk classificationTechnical documentationAI literacyGovernance framework

What we deliver

Five services, one programme

Because we engineer AI systems ourselves, our assessments reach into the models, data and pipelines, not just the policies.

01

Readiness and gap assessment

A structured review of where you stand against the obligations that apply to you, with a prioritised remediation plan and realistic timelines.

02

AI inventory and risk classification

A register of every AI system you build, buy or use, your role for each (provider, deployer, importer or distributor), and its classification under the Act’s risk tiers.

03

Technical documentation and conformity support

Preparation of the technical file, risk-management and data-governance records, logging and human-oversight measures needed for high-risk systems and conformity assessment.

04

AI literacy training (Article 4)

Role-based training for executives, product teams and everyday users, so staff who operate AI understand its capabilities, limits and risks, with records to show it.

05

Governance framework and policies

An AI policy, acceptable-use rules, roles and accountabilities, approval gates for new use cases, and supplier due-diligence criteria, fitted to how your organisation already works.

How the Act works

Obligations scale with risk

The Act regulates uses of AI, not the technology itself. The same model can be minimal risk in one application and high risk in another, which is why classification comes first.

Unacceptable risk

Prohibited outright, such as social scoring and manipulative techniques.

High risk

Permitted with strict duties: risk management, data governance, technical documentation, human oversight, conformity assessment.

Transparency risk

Chatbots, emotion recognition and generated content must be disclosed to the people they affect.

Minimal risk

No new obligations beyond AI literacy, though voluntary codes are encouraged.

Key dates

The phase-in, as amended

Deadlines for high-risk systems were deferred by the Digital Omnibus on AI, Regulation (EU) 2026/1744, in force since 27 July 2026. The prohibitions, AI literacy and general-purpose AI obligations already apply.

  1. 1 Aug 2024The AI Act enters into force.
  2. 2 Feb 2025Prohibited practices banned. AI literacy duty (Article 4) applies to providers and deployers.
  3. 2 Aug 2025Obligations for general-purpose AI models apply. Governance and penalty regimes take effect.
  4. 2 Aug 2026Transparency obligations under Article 50 apply, including disclosure of AI interactions and deepfakes.
  5. 2 Dec 2026Machine-readable marking of AI-generated content extends to systems already on the market. New prohibitions on non-consensual intimate imagery and child sexual abuse material apply.
  6. 2 Dec 2027High-risk obligations apply to stand-alone systems listed in Annex III, such as employment, credit and education.
  7. 2 Aug 2028High-risk obligations apply to AI embedded in regulated products listed in Annex I.

Evidence

Results, with the names left out

Our clients are protected by strict non-disclosure agreements, so we never name them. Each result is described by sector and scale only, and measured against the baseline agreed at the start.

[CLIENT-SUPPLIED] Sector and size, e.g. mid-sized EU insurer

[CLIENT-SUPPLIED] What was built, in general terms

[CLIENT-SUPPLIED] The starting problem and what changed, in two sentences, with no names, places or details that could identify the client.

Result

[CLIENT-SUPPLIED]

[CLIENT-SUPPLIED] Sector and size, e.g. mid-sized EU insurer

[CLIENT-SUPPLIED] What was built, in general terms

[CLIENT-SUPPLIED] The starting problem and what changed, in two sentences, with no names, places or details that could identify the client.

Result

[CLIENT-SUPPLIED]

[CLIENT-SUPPLIED] Sector and size, e.g. mid-sized EU insurer

[CLIENT-SUPPLIED] What was built, in general terms

[CLIENT-SUPPLIED] The starting problem and what changed, in two sentences, with no names, places or details that could identify the client.

Result

[CLIENT-SUPPLIED]

How we engage

Discovery, pilot, scale

1Weeks

Discovery

Inventory and classification of your AI systems, and a gap assessment against the obligations that apply.

You receive

  • An AI system register
  • Risk classification and role for each system
  • A prioritised gap report
2Weeks to months

Pilot

We take one priority system through remediation end to end: documentation, controls and oversight.

You receive

  • A compliant reference system
  • Reusable templates and evidence packs
  • AI literacy training for the teams involved
3Ongoing

Scale

We roll the approach out across your portfolio and embed governance into how new AI gets approved.

You receive

  • A governance framework and policies
  • Organisation-wide AI literacy programme
  • Templates for new use cases

This page summarises the AI Act for general information and is not legal advice. Where a formal legal opinion is needed, we work alongside your legal counsel.

Not sure where you stand?

A readiness assessment tells you which of your systems the Act covers, what it asks of you, and by when.