--- title: "AI Act Compliance | Pitch" description: "We help you find out which of your AI systems fall under the EU AI Act, in what role, and what you must have in place and by when." url: https://www.pitch.law/solutions/ai-act-compliance --- [pitch](https://www.pitch.law/) [Solutions](https://www.pitch.law/solutions) [Information Technology](https://www.pitch.law/solution-categories/information-technology) # AI Act Compliance We help you find out which of your AI systems fall under the EU AI Act, in what role, and what you must have in place and by when. ## The question Most companies now use AI somewhere: a chatbot on the website, a screening tool in recruitment, a scoring model, a generative tool in marketing, or an AI feature in the product they sell. The AI Act (Regulation (EU) 2024/1689) applies to all of these in some way, and the questions that follow are practical. Is this system covered? Are we the provider or only the deployer? Is it high-risk? What do we have to do, and when? The dates have also been moving. The European Commission proposed in November 2025 to postpone the high-risk obligations, and that postponement has since been adopted. Many companies are unsure which obligations apply today and which have been pushed back. Our [timeline of what applies when](https://www.pitch.law/academy/ai-act-compliance-timeline) sets this out as of October 2026. Clients usually come to us in one of a few situations. A customer or investor has asked for proof of AI Act readiness in a questionnaire. A product team wants to add an AI feature and needs to know what it triggers. The HR department has started using a screening tool. Or management simply wants to know where the company stands before the obligations start to apply. ## Our approach We start with an inventory. Together with you we list the AI systems you develop, purchase or use, including the tools that individual teams adopted on their own. For each system we record the purpose, the supplier, the data involved and who in your organisation is responsible. Next we classify. For every system we check whether it is a prohibited practice, a high-risk system, a system with transparency duties, or a system without specific obligations ([risk classification explained](https://www.pitch.law/academy/ai-act-risk-classification-explained)). We also determine your role, because the obligations of a [provider and a deployer](https://www.pitch.law/academy/provider-vs-deployer-ai-act) differ considerably, and a deployer can become a provider by changing a system or putting its own name on it. We record this in the AI Act register and assessments in [our platform](https://www.pitch.law/technologies/ai-act-governance-toolkit), which keeps each classification together with the articles it relies on and the evidence behind it. You see and edit the same register in the client portal. Where a system processes personal data, we link it to your [records of processing](https://www.pitch.law/technologies/privacy-register) and, where needed, to a [data protection impact assessment](https://www.pitch.law/technologies/digital-data-protection-impact-assessment), because the AI Act and the GDPR apply side by side ([where the frameworks overlap](https://www.pitch.law/academy/ai-act-meets-gdpr-where-frameworks-overlap)). In practice the work runs in three steps. First, an intake session with the people who know the tools: IT, HR, marketing and product. Second, our attorney drafts the classification and role for each system, using the register to keep the reasoning and the evidence together. Third, we discuss the results with you, you correct what we got wrong, and the attorney decides on the final classification and signs off. Where a point is unclear, for instance whether a tool really profiles individuals, we ask the supplier for documentation before concluding. An attorney reviews every classification and every conclusion before it is final. The register supports that review; it does not replace it. ## What you get You receive a documented position that you can show to a customer, an auditor or a supervisory authority: - an inventory of AI systems with risk class, role and responsible person; - a reasoned classification for each system, including a written assessment where you rely on an exemption for a system listed in Annex III; - an obligations list per system and per role, with the dates that apply, including the [conformity assessment](https://www.pitch.law/academy/conformity-assessments-high-risk-ai-systems) route for high-risk systems you provide; - a plan for [AI literacy](https://www.pitch.law/academy/ai-literacy-obligation-businesses-overlooking) in your organisation; - a proportionate [AI governance framework](https://www.pitch.law/academy/building-an-ai-governance-framework): policy, roles, approval of new tools and incident handling; - for high-risk use, a fundamental rights impact assessment where Article 27 requires one, and advice on specific areas such as [AI in recruitment](https://www.pitch.law/academy/ai-in-hr-and-recruitment-under-the-ai-act). A short scenario: a Ghent logistics company uses a third-party tool that proposes driver shifts, a chatbot on its website and a generative tool for marketing copy. After the intake we classify the shift tool as a high-risk system in the area of employment, with the company as deployer, so it needs oversight, logs and information for the works council. The chatbot needs a notice that users are talking to an AI system. The marketing tool needs only the literacy measures. The company ends up with three entries, three conclusions and a short list of actions with dates. If you only buy AI from suppliers, we can also review the contract terms that allocate AI Act responsibilities and ask the supplier for the documentation you need as a deployer. For the overall picture, our [practical overview of the AI Act](https://www.pitch.law/academy/eu-ai-act-practical-overview-for-businesses) is a good place to start. ## Next step If you are not sure which of your systems are covered, a short intake is enough to tell you whether you need a full inventory or only a few targeted answers. [Schedule a meeting](https://www.pitch.law/schedule) and tell us which AI tools you use or build. ## In short - Inventory of the AI systems you build, buy or use - Risk class and role (provider or deployer) documented per system - Obligations and dates mapped to your situation - AI literacy and governance measures you can show to a regulator - Registers you edit together with us in the client portal ## Technology we use - [Technology](https://www.pitch.law/technologies/ai-act-governance-toolkit) ### [AI Act Register and Assessments](https://www.pitch.law/technologies/ai-act-governance-toolkit) [One register where your AI systems are listed, classified and followed per role, with assessments, incident records and an AI Act timeline, all checked by an attorney.](https://www.pitch.law/technologies/ai-act-governance-toolkit) - [Technology](https://www.pitch.law/technologies/privacy-register) ### [Records of Processing and Compliance Registers](https://www.pitch.law/technologies/privacy-register) [One register engine for the GDPR record of processing activities and for the AI Act, NIS2 and DORA registers, with article references, evidence and attorney or DPO approval.](https://www.pitch.law/technologies/privacy-register) - [Technology](https://www.pitch.law/technologies/digital-data-protection-impact-assessment) ### [DPIA](https://www.pitch.law/technologies/digital-data-protection-impact-assessment) [Guided data protection impact assessments, kept as working records that you and your attorney complete together in the client portal.](https://www.pitch.law/technologies/digital-data-protection-impact-assessment) ## Background reading - [Academy](https://www.pitch.law/academy/eu-ai-act-practical-overview-for-businesses) ### [The EU AI Act: a Practical Overview](https://www.pitch.law/academy/eu-ai-act-practical-overview-for-businesses) [What the AI Act regulates, who it applies to, how the risk-based approach works and what the penalties are, as of October 2026.](https://www.pitch.law/academy/eu-ai-act-practical-overview-for-businesses) - [Academy](https://www.pitch.law/academy/ai-act-risk-classification-explained) ### [AI Act Risk Classification](https://www.pitch.law/academy/ai-act-risk-classification-explained) [How to tell whether an AI system is prohibited, high-risk, subject to transparency duties or free of specific obligations under the AI Act.](https://www.pitch.law/academy/ai-act-risk-classification-explained) - [Academy](https://www.pitch.law/academy/provider-vs-deployer-ai-act) ### [Provider or Deployer?](https://www.pitch.law/academy/provider-vs-deployer-ai-act) [The AI Act allocates duties by role. Who counts as provider, deployer, importer or distributor, and when does a deployer become a provider?](https://www.pitch.law/academy/provider-vs-deployer-ai-act) - [Academy](https://www.pitch.law/academy/ai-act-compliance-timeline) ### [AI Act Timeline: What Applies When](https://www.pitch.law/academy/ai-act-compliance-timeline) [The application dates of the AI Act as of October 2026, including the postponement of the high-risk rules adopted in 2026.](https://www.pitch.law/academy/ai-act-compliance-timeline) - [Academy](https://www.pitch.law/academy/conformity-assessments-high-risk-ai-systems) ### [Conformity Assessments for High-Risk AI](https://www.pitch.law/academy/conformity-assessments-high-risk-ai-systems) [What a provider of a high-risk AI system must demonstrate before market entry under the AI Act, which assessment route applies and what follows afterwards.](https://www.pitch.law/academy/conformity-assessments-high-risk-ai-systems) - [Academy](https://www.pitch.law/academy/ai-literacy-obligation-businesses-overlooking) ### [The AI Literacy Obligation](https://www.pitch.law/academy/ai-literacy-obligation-businesses-overlooking) [Article 4 of the AI Act has applied since February 2025 to every company using AI. What it requires, how the 2026 amendment changed it and what to document.](https://www.pitch.law/academy/ai-literacy-obligation-businesses-overlooking) - [Academy](https://www.pitch.law/academy/building-an-ai-governance-framework) ### [Building an AI Governance Framework](https://www.pitch.law/academy/building-an-ai-governance-framework) [What an internal AI governance framework consists of, which legal duties it must carry, and how a mid-sized organisation can build one in proportion to its use of AI.](https://www.pitch.law/academy/building-an-ai-governance-framework) - [Academy](https://www.pitch.law/academy/ai-in-hr-and-recruitment-under-the-ai-act) ### [AI in HR and Recruitment](https://www.pitch.law/academy/ai-in-hr-and-recruitment-under-the-ai-act) [Which AI tools in recruitment and people management are prohibited or high-risk under the AI Act, what employers must do, and how national labour law and the GDPR add to it.](https://www.pitch.law/academy/ai-in-hr-and-recruitment-under-the-ai-act) - [Academy](https://www.pitch.law/academy/ai-act-meets-gdpr-where-frameworks-overlap) ### [AI Act Meets GDPR: Where the Two Frameworks Overlap](https://www.pitch.law/academy/ai-act-meets-gdpr-where-frameworks-overlap) [How the AI Act and the GDPR apply side by side to the same AI system: roles, impact assessments, automated decisions, transparency, data quality and special categories.](https://www.pitch.law/academy/ai-act-meets-gdpr-where-frameworks-overlap) ## More in Information Technology - ### [Data and Database Rights Protection](https://www.pitch.law/solutions/data-and-database-rights-protection) [How to protect the data and databases you build, through database rights, trade secrets, copyright and the contracts that hold them together.](https://www.pitch.law/solutions/data-and-database-rights-protection) ## Let’s talk Tell us what you’re working on. We’ll get the right person on it and reply within one business day. The first chat is free. [Schedule a meeting](https://www.pitch.law/schedule)