An EU AI Act readiness assessment maps your systems, provider or deployer roles and applicable duties. We identify EU AI Act risk assessment requirements and evidence gaps so UK and European teams can plan governance around the right obligations and transition dates.
The EU AI Act (Regulation (EU) 2024/1689) is the world's first comprehensive legal framework for artificial intelligence. Adopted in 2024 and in force from 1 August 2024, it classifies AI systems into risk tiers and assigns obligations to actors including providers, deployers, importers and distributors. Its territorial scope can include organisations outside the EU, but applicability depends on the organisation's role, the AI system, the relevant provision and applicable transitional arrangements.
Understand your AI systems, your role under the Act, and which obligations actually apply to you. We assess, classify, and help you build governance you can operate — for UK and European teams.
AI systems banned entirely — e.g. social scoring, real-time biometric surveillance in public spaces, subliminal manipulation. Enforceable from February 2025.
AI used for specific purposes listed in Annex III — for example within education, employment, credit, insurance, critical infrastructure, law enforcement, migration or justice systems. Whether a given system is actually "high-risk" depends on its intended purpose and role, not the industry label alone. Conformity assessment, data governance, transparency and human oversight are required where it applies.
AI that interacts with humans (chatbots, deepfakes) generally carries transparency obligations — disclosing the AI's nature to users. Whether a specific system sits here, in the high-risk tier, or elsewhere depends on an assessment of its intended purpose and use, not an assumption based on sector.
AI spam filters, recommendation systems, AI in video games. No tier-specific requirements, but voluntary codes of conduct encouraged. General duties such as AI literacy under Article 4 can still apply to providers and deployers.
Full inventory of AI systems across your products and operations, with documentation of purpose, inputs, outputs, and deployment context.
Classification of each AI system against EU AI Act risk tiers — Prohibited, High-risk, Limited, Minimal — with documented rationale.
For high-risk AI: conformity assessment documentation, technical documentation pack, EU declaration of conformity.
User-facing AI disclosures, capability and limitation documentation, intended use statements.
Training data documentation, bias assessment, data quality controls — required for high-risk AI systems.
Human oversight mechanisms design and documentation — a core requirement for high-risk AI systems under Annex III.
For General Purpose AI model providers: technical documentation, training content policy, copyright compliance documentation.
Post-market monitoring plan, incident reporting procedures, and regulatory change tracking as EU AI Act provisions continue to come into force.
Identify every AI system in your products and operations — including third-party AI you deploy. Most startups undercount this significantly on first pass.
Classify each system against EU AI Act risk tiers. This determines your obligations. High-risk classification triggers significant documentation and conformity assessment requirements.
Compare current documentation and governance against what each risk tier requires. Identify what is missing, what is partial, and what timeline applies to each obligation.
Build the policies, documentation, processes, and oversight mechanisms your risk classification requires. For high-risk systems, this includes conformity assessments and technical documentation packs.
The EU AI Act is phased, with amended high-risk application milestones in December 2027 and August 2028. Track regulatory developments, applicable transitional arrangements and changes to each system's role or intended purpose.
Application is phased. The general application date of 2 August 2026 included Article 50 transparency obligations and other applicable provisions; it was not the general start date for the Annex III high-risk regime. Under the amended timeline, Sections 1, 2 and 3 of Chapter III apply from 2 December 2027 to high-risk systems classified under Article 6(2) and Annex III, and from 2 August 2028 to those classified under Article 6(1) and Annex I. Applicability depends on the organisation's role, the AI system, the relevant provision and applicable transitional arrangements. This is general information, not legal advice. Check Regulation (EU) 2024/1689 together with amending Regulation (EU) 2026/1744 before relying on a deadline.
The 44-point checklist covering AI system inventory, risk classification, conformity assessment requirements, GPAI obligations, and enforcement timeline. Enter your email to receive it.
Outcome-based pricing — fixed fee agreed upfront. No hourly meters.
We can combine EU AI Act readiness with ISO 42001 implementation for organisations who want both governance documentation and preparation for a certification body's independent assessment. Certification body fees are separate and quoted independently.
The EU AI Act (Regulation (EU) 2024/1689) is the world's first comprehensive legal framework for AI. It classifies AI systems into risk tiers — Prohibited, High-risk, Limited risk, and Minimal risk — and imposes obligations on AI providers, deployers, and importers operating in the EU, proportional to risk level.
Application is phased. The Regulation entered into force on 1 August 2024. Article 4 AI-literacy obligations and the original Article 5 prohibited-practice rules began applying on 2 February 2025, and GPAI obligations began applying on 2 August 2025, subject to relevant transitional provisions. The general application date, including Article 50 transparency obligations and other applicable provisions, was 2 August 2026; this was not the general start date for the Annex III high-risk regime. Sections 1, 2 and 3 of Chapter III apply from 2 December 2027 to high-risk systems classified under Article 6(2) and Annex III, and from 2 August 2028 to those classified under Article 6(1) and Annex I. Applicability depends on the organisation's role, the AI system, the relevant provision and applicable transitional arrangements.
An EU AI Act readiness assessment inventories AI systems, identifies whether you are a provider or deployer for each use, checks the intended purpose and risk classification, and maps applicable duties, evidence gaps and transition dates. The outcome is a prioritised plan for the systems and roles actually in scope, rather than a blanket compliance claim.
Requirements depend on the system's classification and your role. Providers of high-risk AI systems must establish, implement, document and maintain an Article 9 risk management system when the relevant high-risk provisions apply. Deployers have separate duties, and certain deployers must carry out an Article 27 fundamental rights impact assessment before use. Check the intended purpose, applicable exceptions and transitional arrangements before deciding which assessments are required.
UK organisations can fall within scope depending on their role, the market in which a system is supplied or used, and the Act's territorial provisions. Having an EU customer does not automatically trigger every possible obligation — each system and deployment needs to be assessed on its own facts.
The Act classifies certain AI systems as high-risk under Article 6. This includes systems that meet the Article 6(1) conditions concerning products or safety components covered by Annex I legislation, and systems within the Article 6(2) use cases listed in Annex III, subject to the Regulation's detailed conditions and exceptions. Classification depends on the system's intended purpose and context, so it should be assessed system by system.
ISO 42001 is not yet a harmonised standard for EU AI Act conformity, but it provides the systematic AI risk management and governance framework the Act requires. Organisations certified against ISO 42001 have the documented processes, risk assessments, and governance structures that underpin EU AI Act compliance — and will be significantly better positioned when the final QMS conformity standard is released.
Penalty ceilings depend on the infringement and applicable rules; Article 99 includes specific treatment for SMEs, including startups, and the large-enterprise calculation should not be applied indiscriminately. See Article 99 of the Regulation for the current figures rather than relying on a simplified summary here.
We'll classify your systems, map your obligations, and tell you exactly what you need to build. 45 minutes.
Book a working session →