02B — Services
EU AI Act classification, gap analysis, technical documentation, evidence, and governance. We turn regulation into a plan your team can maintain, aligned with GDPR, NIS2, and ISO 42001 when relevant.
02B — Services
We turn regulatory obligations into technical work your team can act on: classification, evidence, documentation, controls, and owners. No endless consulting, just maintainable deliverables.
Role, risk category, and obligation mapping for AI systems in use or under development.
Analysis against EU AI Act, GDPR, and NIS2 with realistic milestones, owners, and priorities.
System files, risk records, controls, traceability, and audit-ready material.
Supervision processes, post-market review, and alignment with AI management systems.
03 — Why now
AI Act, prohibited practices in force, general-purpose models, liability case law and certifiable standards.
Up to €35M or 7% of global turnover in fines. Annex III, Art. 50 transparency duties and the rest of the articles stop being optional. Classifying, documenting and registering high-risk systems is a multidisciplinary project, not a checklist.
EUR-Lex · Regulation 2024/1689In force since 2 February 2025. Subliminal manipulation, social scoring, untargeted facial scraping, emotion recognition at work or in schools, and sensitive biometric categorisation. This sits in the highest fine bracket of the Regulation.
EUR-Lex · Art. 5Art. 51-56 — applicable since 2 August 2025. Technical documentation (Annex XI), downstream information (Annex XII), copyright policy and a training-data summary. Above 10²⁵ FLOPs you are a systemic-risk provider with mandatory red-teaming.
EUR-Lex · Chapter VMoffatt v. Air Canada — binding precedent. The tribunal rejected the argument that AI is a separate entity from the company. Without audited guardrails and a decision log, every model output puts capital and reputation on the line.
Civil Resolution TribunalFirst international certifiable standard for AI governance. It maps to the risk-management duties of AI Act Art. 9 and to NIS2 obligations for essential entities. Adopting it makes diligence demonstrable to regulators, auditors and B2B buyers.
ISO/IEC 42001:202304 — Use cases
Examples of the type of projects we take on across our two service areas. If your situation looks familiar, we can probably help.
The EU AI Act imposes differentiated obligations depending on the company's role (provider, deployer, or importer) and the risk category of the system. High-risk systems — in areas such as HR, credit, healthcare, or critical infrastructure — require conformity assessment, technical documentation, registration in the EU database, human oversight, and risk management. Limited-risk systems have lighter transparency obligations. Prohibited applications, such as generalised social scoring or subliminal manipulation, are directly banned.
The EU AI Act entered into force on 1 August 2024 with a phased application schedule. Prohibited practices apply from 2 February 2025. Obligations for high-risk systems apply in full from 2 August 2026. Penalties for non-compliance can reach €35 million or 7% of global annual turnover, whichever is higher.
The EU AI Act classifies as high-risk AI systems used in eight areas: critical infrastructure, education, employment and worker management, access to essential services (credit, insurance), law enforcement, border management, administration of justice, and democratic processes. Systems that constitute safety components of products regulated by European sectoral legislation are also high-risk. The classification determines the full set of applicable obligations.
The EU AI Act requires providers of high-risk systems to maintain technical documentation covering: system description and intended purpose, training data and evaluation methodology, performance metrics and accuracy thresholds, human oversight measures, risk analysis and mitigation plans, instructions for use, and a change log. This documentation must be available to supervisory authorities throughout the system's lifecycle.
The EU AI Act sets three penalty levels: up to €35 million or 7% of global annual turnover for using prohibited practices; up to €15 million or 3% of global turnover for breaching other regulation obligations; and up to €7.5 million or 1.5% of global turnover for providing incorrect information to authorities. For SMEs and startups, penalties are calculated on whichever figure — percentage of turnover or fixed amount — is lower.
In-house training
We run in-house technical training, not open courses. Each course is designed around the client's case: EU AI Act classification, audit-ready technical documentation and governance for engineering, compliance and legal teams, with the scope the team asks for.
We respond within 24 – 48 business hours. We'll suggest a first call to understand your case.
[email protected]