EU AI Act compliance

Regulation (EU) 2024/1689 on artificial intelligence is the first horizontal regulation in the world for AI systems. It applies to any organisation placing on the EU market or using AI systems: providers (those who develop and commercialise), deployers (those who use it in their organisation), importers and distributors. It also applies to providers outside the EU if their system or its outputs are used in the EU. Risk-based classification is the central piece: prohibited, high-risk, GPAI, limited risk and minimal. Each level has different obligations and different application dates.

Staggered calendar: 2 February 2025 prohibited practices and AI literacy obligation (art. 4) already apply. 2 August 2025 general-purpose AI models (GPAI) obligations, governance and sanctioning regime. 2 August 2026 high-risk enters general application, along with most provider and deployer obligations. 2 August 2027 high-risk product safety systems (Annex I) and residual cases. 2026 is the year of highest compliance pressure; preparing the programme in H1 2026 gives reasonable margin. After that, reactive mode under AESIA or sectoral authority pressure.

Two routes to high-risk. Annex I (safety systems of products regulated by specific legislation: machinery, toys, medical devices, vehicles, lifts, protective equipment, etc.). Annex III (eight use areas): biometrics, critical infrastructure, education and vocational training, employment (selection, evaluation, task allocation), access to essential public and private services, law enforcement, migration and border control, justice and democratic processes. Correct classification is the founding decision of the programme: misclassifying down exposes you to fines; misclassifying up applies unnecessarily costly obligations. We do this as the first phase of the project.

Five blocks. Diagnostic and classification: AI systems inventory across the organisation, classification of each one (prohibited / high-risk / GPAI / limited / minimal) and obligations map. Governance: policies, role assignment, AI committee, internal AI systems register. Risk (art. 9): documented risk management system, continuous evaluation, mitigations. Technical compliance: data governance (art. 10), technical documentation (art. 11), logs (art. 12), transparency (art. 13), human oversight (art. 14), accuracy, robustness and cybersecurity (art. 15). Continuous operation: post-market monitoring, serious incident management (art. 73 / GPAI / provider), AESIA reporting, auditor evidence.

We do: technical classification of systems, art. 9 risk management system, art. 10 data governance, art. 11 technical documentation, art. 12 logging system, transparency and human oversight mechanisms (arts. 13 and 14), art. 15 technical testing (accuracy, robustness and cybersecurity — includes adversarial red teaming), post-market monitoring, serious incident notification procedures, art. 4 AI literacy training, internal policies and governance. We do not: legal representation before AESIA, legal defence in sanctions, notarial conformity of declarations, pure legal advice. For that we coordinate with the client's legal team or the firm they designate. We do draft the technical documentation that firm will need to sign.

Depends on number and criticality of AI systems. Initial diagnostic (inventory + classification + obligations map + roadmap) with 2-5 systems: 3-5 weeks, €8-18k. Full high-risk deployment programme with 1-3 systems: 12-24 weeks, 1-2 GRC consultants + 1 technical, €35-90k. GPAI or multi-system enterprise programme: 24-40 weeks, €50-160k. Continuous operation (periodic review, new systems, reporting) is delivered as a monthly subscription or handed over to the internal team with training. Before quoting we run the initial diagnostic to size accurately.

ISO/IEC 42001 (Artificial Intelligence Management System, AIMS) is the natural operational framework to support EU AI Act compliance: the management system covers most organisational obligations (governance, risk, continuous improvement) and the annexes cover technical controls. Deploying 42001 does not certify EU AI Act but generates the evidence base. With GDPR there is partial overlap: GDPR art. 22 (automated decisions) still applies when the AI system decides on people; GDPR DPIA complements the EU AI Act art. 27 Fundamental Rights Impact Assessment (FRIA) for high-risk systems in public sector or essential services. The two coexist, they do not replace each other.

Yes. The regulation applies extraterritorially when: the AI system is placed on the EU market (regardless of where it is developed), the deployer is established in the EU, or the outputs of the system are used in the EU. The organisation must designate an authorised representative in the EU (art. 22) for the high-risk systems in its catalogue. We coordinate with your international legal counsel for the designation; we cover the technical and programme management side directly.

Three tiers. Up to €35 million or 7% of total worldwide annual turnover of the previous financial year for using prohibited practices (art. 5). Up to €15 million or 3% for breaching high-risk, GPAI or transparency obligations. Up to €7.5 million or 1% for incorrect information to authorities. The national authority (AESIA in Spain) and sectoral authorities (CNMV, AEPD, etc.) can impose these sanctions. Beyond the fine, reputational and commercial risk is high: enterprise clients will start requiring compliance evidence as procurement condition through 2026-2027.

30-minute call to understand the context (what AI systems you have or are deploying, position in the chain: provider, deployer or both, sector, current GRC resources). If it fits, a 2-hour technical-organisational walkthrough with product/engineering + Compliance/DPO. From there we propose an initial diagnostic (3-5 weeks) with firm proposal after the diagnostic. No commitments until signature. If we see the organisation does not yet have AI systems in production or is in a very early phase, we recommend punctual orientation consulting instead of a full programme.