EU AI Act Compliance
Prepare your AI systems for the EU AI Act, with engineering evidence behind every answer.
AI system inventory, risk classification, technical documentation, logging, human oversight — the engineering side of Regulation (EU) 2024/1689, done alongside your legal counsel.
EU AI ACT, IN PRACTICE
The regulation is written by lawyers. Most of the work lands on engineers.
Know which AI you run, which role you have and which evidence you need.
Regulation (EU) 2024/1689, the EU AI Act, applies to companies that place AI systems on the EU market and to companies that use them in their business. Its obligations apply in phases between 2025 and 2027, and what you have to do depends on two questions: how risky is the use case, and are you the provider of the system or a deployer of it. Answering them honestly requires knowing exactly which models, APIs and automated decisions exist in your products and internal tools, and that is often the first surprise. AI tends to arrive through a vendor feature, a developer’s experiment or a spreadsheet macro long before anyone writes a policy for it.
We are a software engineering company, not a law firm, and we do not give legal advice. We work alongside your legal counsel or compliance officer: they interpret the regulation for your situation, we do the technical work it implies. Our team has been building production software since 2013 and today we also build and run AI systems, so we know where the logs, prompts, training data and decision paths actually live.
AI system inventory
We map every AI system you build, buy or embed: what it does, which model or vendor sits behind it, what data it touches, who relies on its output and who owns it. The result is a register that your legal and technical teams can both read.
Risk classification and roles
For each system we prepare the technical facts needed to place it in a risk category (prohibited, high-risk, limited or minimal) and to establish whether you act as provider or deployer. Your counsel confirms the classification; we document the reasoning.
Evidence built into the system
Documentation, logging, human oversight controls, data governance and transparency notices implemented in the software itself, not only described in a policy. Evidence that the system produces stays current as the system changes.- AI system register with owners, vendors, models and data flows
- Risk classification worksheets for review by your legal counsel
- Provider and deployer obligations mapped per system
- Gap analysis with a prioritised remediation plan
- Technical documentation drafted from the real architecture
- Automatic event logging with defined retention and access
- Human oversight: review queues, overrides and stop controls
- Data governance for training, evaluation and input data
- Transparency notices for chatbots and AI-generated content
- AI literacy sessions for the teams that build and use AI
WHAT THE ACT ASKS FOR
Four risk levels, two main roles, and the GDPR you already know
The Act sorts AI uses by risk. A small set of practices is prohibited outright, such as certain forms of manipulation, social scoring and some uses of biometric identification. High-risk systems include AI used as a safety component in regulated products and AI used in areas the Act lists, such as recruitment and worker management, access to education, creditworthiness and access to essential services; these carry the heaviest obligations. Limited-risk systems, like chatbots or tools that generate images, audio, video or text, mainly carry transparency duties: people should know when they are talking to an AI or looking at AI-generated content. Most other AI, such as spam filters or internal search, is minimal risk, with no specific new obligations beyond AI literacy. General-purpose AI models have their own rules, aimed mainly at the companies that develop them.
Providers, the companies that develop an AI system or place it on the market under their own name, carry most of the high-risk obligations: a risk management system, data governance, technical documentation, automatic logging, instructions for use, human oversight by design, accuracy, robustness and cybersecurity, a quality management system and a conformity assessment before release. Deployers, the companies that use a system under their own authority, must use it according to its instructions, assign competent people to oversee it, monitor how it behaves, keep the logs under their control and, in some cases, inform the people affected or carry out a fundamental rights impact assessment. Roles can shift: putting your brand on a high-risk system or substantially modifying it can turn a deployer into a provider.
None of this replaces GDPR. When an AI system processes personal data, the lawful basis, data minimisation, data protection impact assessments and the rules on automated decisions still apply, and much of the evidence overlaps. We build one set of controls and documentation that serves both, so your teams do not maintain two parallel paper trails. When data should not leave your control at all, we can also run models on dedicated infrastructure in Romania — see Private AI.
HOW WE WORK
From scattered AI use to documented, controlled systems
Your counsel owns the legal interpretation. We own the technical work.
Kick-off with your counsel
We agree on scope, roles and how decisions are made, and which systems, products and business units are in the first round.
Inventory
Interviews, code and infrastructure review, vendor contracts and API usage: we find the AI that is actually running, including what nobody declared. If you are still deciding where AI fits, an AI readiness assessment produces the same inventory.
Classify and assign roles
For each system we prepare a worksheet with the use case, the people affected and the technical facts, and review it with your counsel until the classification and role are agreed.
Gap analysis
We compare what the obligations require with what exists today and give you a prioritised plan: what to fix, what to document, what to change in the process and what to retire.
Implement the controls
Logging, oversight interfaces, data governance, transparency notices and documentation, built into your systems. Accuracy and robustness claims are backed by AI testing and evaluation and AI security red teaming.
Keep it current
New models, vendors and use cases keep arriving. We keep the register, documentation and monitoring up to date, and revisit the plan when official guidance or standards change.FAQ
Common questions about the EU AI Act
Are you a law firm? Do you give legal advice on the AI Act?
No. We are a software engineering company and we do not give legal advice. We work alongside your legal counsel or compliance officer: they interpret the regulation for your situation and confirm decisions such as risk classification, and we deliver the technical analysis, documentation and implementation those decisions require.
We only use third-party AI tools. Does the AI Act apply to us?
Often yes, usually as a deployer. Even then you have duties such as AI literacy for your staff and, depending on the use case, transparency towards people affected by the system or oversight and monitoring of a high-risk system. If you put your own name on a high-risk system or substantially modify it, you may take on provider obligations. Your counsel confirms the role; we document the technical facts behind it.
When do the obligations apply?
The regulation entered into force in 2024 and its obligations apply in phases between 2025 and 2027. Some of the earliest ones, including the prohibited practices and AI literacy, are already in effect. The EU has discussed adjusting parts of the timeline, so we plan against the current official text and guidance and review the plan with your counsel when anything changes.
How does this relate to GDPR?
The AI Act does not replace GDPR. When an AI system processes personal data, the lawful basis, data minimisation, data protection impact assessments and the rules on automated decisions still apply. Much of the evidence overlaps, so we build one set of controls and documentation that serves both.
Do we have to host our AI models ourselves to comply?
No. The AI Act does not require self-hosting. Hosted APIs can be used in a compliant way when contracts, data flows, logging and oversight are in order. Some companies still choose private infrastructure for data control or confidentiality, and we can run open-weight models on our own cloud in Romania when that is the better fit.
Not sure where your AI stands? Talk to an engineer.
Tell us which AI systems you build or use, and we will propose a first inventory and a plan you can review with your legal counsel.