AI Act Compliance

The question

Most companies now use AI somewhere: a chatbot on the website, a screening tool in recruitment, a scoring model, a generative tool in marketing, or an AI feature in the product they sell. The AI Act (Regulation (EU) 2024/1689) applies to all of these in some way, and the questions that follow are practical. Is this system covered? Are we the provider or only the deployer? Is it high-risk? What do we have to do, and when?

The dates have also been moving. The European Commission proposed in November 2025 to postpone the high-risk obligations, and that postponement has since been adopted. Many companies are unsure which obligations apply today and which have been pushed back. Our timeline of what applies when sets this out as of October 2026.

Clients usually come to us in one of a few situations. A customer or investor has asked for proof of AI Act readiness in a questionnaire. A product team wants to add an AI feature and needs to know what it triggers. The HR department has started using a screening tool. Or management simply wants to know where the company stands before the obligations start to apply.

Our approach

We start with an inventory. Together with you we list the AI systems you develop, purchase or use, including the tools that individual teams adopted on their own. For each system we record the purpose, the supplier, the data involved and who in your organisation is responsible.

Next we classify. For every system we check whether it is a prohibited practice, a high-risk system, a system with transparency duties, or a system without specific obligations (risk classification explained). We also determine your role, because the obligations of a provider and a deployer differ considerably, and a deployer can become a provider by changing a system or putting its own name on it.

We record this in the AI Act register and assessments in our platform, which keeps each classification together with the articles it relies on and the evidence behind it. You see and edit the same register in the client portal. Where a system processes personal data, we link it to your records of processing and, where needed, to a data protection impact assessment, because the AI Act and the GDPR apply side by side (where the frameworks overlap).

In practice the work runs in three steps. First, an intake session with the people who know the tools: IT, HR, marketing and product. Second, our attorney drafts the classification and role for each system, using the register to keep the reasoning and the evidence together. Third, we discuss the results with you, you correct what we got wrong, and the attorney decides on the final classification and signs off. Where a point is unclear, for instance whether a tool really profiles individuals, we ask the supplier for documentation before concluding.

An attorney reviews every classification and every conclusion before it is final. The register supports that review; it does not replace it.

What you get

You receive a documented position that you can show to a customer, an auditor or a supervisory authority:

• an inventory of AI systems with risk class, role and responsible person;
• a reasoned classification for each system, including a written assessment where you rely on an exemption for a system listed in Annex III;
• an obligations list per system and per role, with the dates that apply, including the conformity assessment route for high-risk systems you provide;
• a plan for AI literacy in your organisation;
• a proportionate AI governance framework: policy, roles, approval of new tools and incident handling;
• for high-risk use, a fundamental rights impact assessment where Article 27 requires one, and advice on specific areas such as AI in recruitment.

A short scenario: a Ghent logistics company uses a third-party tool that proposes driver shifts, a chatbot on its website and a generative tool for marketing copy. After the intake we classify the shift tool as a high-risk system in the area of employment, with the company as deployer, so it needs oversight, logs and information for the works council. The chatbot needs a notice that users are talking to an AI system. The marketing tool needs only the literacy measures. The company ends up with three entries, three conclusions and a short list of actions with dates.

If you only buy AI from suppliers, we can also review the contract terms that allocate AI Act responsibilities and ask the supplier for the documentation you need as a deployer.

For the overall picture, our practical overview of the AI Act is a good place to start.

Next step

If you are not sure which of your systems are covered, a short intake is enough to tell you whether you need a full inventory or only a few targeted answers.

Schedule a meeting and tell us which AI tools you use or build.