EU AI Act Readiness

What is EU AI Act readiness?

EU AI Act Readiness checks which AI your business uses, your role and the applicable provisions and dates. Using a supplied tool and placing a system on the market under your own name can carry different roles. We assess the actual use rather than classify the business from the product name alone.

This readiness assessment is not a certificate or legal opinion. Where conformity assessment is required, we establish the applicable route and the current competent bodies. A standard, a management-system certificate and a system conformity assessment are different evidence.

What applies and when?

• From 2 February 2025: the original prohibited practices under Article 5, subject to their statutory conditions and exceptions. Newly specified prohibitions under the amendment apply from 2 December 2026. Each use must be checked against the actual provision.
• AI literacy under Article 4 applies from 2 February 2025. The amended text requires providers and deployers to take measures supporting staff literacy, with regard to experience, context and the people affected. It does not remove the duty.
• Article 50 transparency applies generally from 2 August 2026. We check interaction notice, technical marking and publication disclosure separately, with their roles and exceptions. Providers of synthetic-content systems already on the market before that date have a specific Article 50(2) marking transition until 2 December 2026.
• The amended high-risk schedule specifies 2 December 2027 for Article 6(2)/Annex III systems and 2 August 2028 for Article 6(1)/Annex I systems. It covers specified high-risk sections, with express exceptions and transitions; it does not postpone the whole Act.

Every date in your map carries its source and the reason it applies to the recorded use.

Who is this for?

• Your team uses ChatGPT, Copilot or AI built into your tools, and nobody has written down where and with what data.
• Your website has a chatbot or shows text and images made with AI.
• A customer or partner has sent you an AI Act questionnaire and is waiting for an answer.
• You use AI to select people, to assess customers, or in decisions that affect someone.
• Someone is offering you an AI Act certificate and you want to know what you would actually be buying.

What do we look at?

The scope is every AI tool your team uses and every place where a customer meets AI.

• The tools: paid and free, including the AI features inside software you already have.
• The website and the inbox: chatbots, automatic replies, content made with AI.
• The decisions: where AI influences a decision about a person, a customer or an employee.
• The suppliers: who is behind each tool and what its terms say about your data.

Each tool receives an assessed classification and a record of applicable duties, including prohibited-practice checks, high-risk requirements or transparency. These are not necessarily mutually exclusive labels; the register explains the basis for the assessment.

How does it run?

1. 01
   Conversation.About an hour with the person who knows what the team uses. We start from the list of tools, however incomplete it is.
2. 02
   Register.We record every AI tool: what it does, who uses it, with what data, and where it comes from.
3. 03
   Classification.Every line gets a class under the regulation, your role for it (deployer or provider) and the article it rests on.
4. 04
   Map.What applies now, which later dates apply and what does not concern your uses. We walk through the map on a call.

What do you get?

An AI Use Register and an Obligations Map.

The register is a table of every AI tool running in your business, and it is yours to keep up to date when you add a tool. The map orders the obligations by date: for each one, the article, the deadline, what to do, and who in your business does it. Every date carries its source.

How long does it take?

The register and the map reach you within ten working days of the conversation and the list of tools.

What happens next?

The map identifies the actions for the particular case, rather than assuming every transparency fix is a label or every high-risk deadline is the same. Legal questions are flagged. If it shows that AI could take on more work, the next step is the AI Opportunity Map.

Articles

• What are the fines for non-compliance with the EU AI Act?Article 99 distinguishes offence-specific ceilings and different conditions for SMEs and small mid-cap enterprises (SMCs). A maximum is not an individual fine, and small size is not a blanket exemption.
• What is the difference between the EU AI Act and GDPR?GDPR concerns personal-data processing. The AI Act concerns AI systems and their uses, including cases without personal data. Check the duties and timing of each regime separately.
• Do we need to label content made with AI?Separate provider output marking, deployer publication disclosure and notice of interaction with AI. Article 50 has role-specific conditions and exceptions; it is not a universal caption rule or a general no-duty rule.
• What does AI literacy under Article 4 of the EU AI Act require?Article 4 requires measures supporting staff AI literacy. The appropriate measures depend on knowledge, experience, use context and affected people; the amendment changes the wording without abolishing the duty.
• What is the Digital Omnibus, and why did it delay the EU AI Act deadline?Regulation (EU) 2026/1744 changes specified high-risk dates and other rules. It does not pause the whole Act; transparency, prohibitions and individual transitions need separate checks.
• What are high-risk AI systems under Annex III?Check the listed uses in Annex III and the classification rules and exceptions in Article 6. The tool name alone does not establish a high-risk classification.
• Does the EU AI Act still apply if the AI tool is made by a non-EU company?Check the territorial scope in Article 2, your role and where the system or output is used. A supplier outside the EU does not by itself remove an EU business’s duties.
• What is the difference between an AI Act provider and a deployer?A provider develops or commissions a system and places it on the market or puts it into service under its own name. A deployer uses it under its authority. Establish your role from the actual arrangement, not the software label alone.
• Are there exemptions for small businesses under the EU AI Act?Size alone is not a blanket exemption. SME support and simplification have conditions; SME and SMC penalty relief differ. Check the measure alongside the duty it eases.

Questions