AI Act compliance
Made simple.A calm, practical route for businesses using AI in or for Europe. Find out where you stand in a few minutes, then work with qualified EU lawyers on what actually applies to you.
Two questions decide almost everything
What risk level your system sits at, and what role you play. Get those right and the rest of the AI Act follows in order.
The four risk levels
Most businesses misclassify themselves at this step. Risk depends on what the system is used for, not on how sophisticated it is.
Your role under the AI Act
You developed the AI system or put it on the market under your name.
You use an AI system that somebody else developed.
You bring AI systems into the EU market from outside it.
You supply AI systems onward to third parties.
Roles shift quietly. Rebranding a system, fine tuning a model or changing its intended purpose can turn a deployer into a provider. Contracts alone do not move that line.
Risk, role, compliance score
The same three-part structure used in our guide, turned into a short guided assessment. It asks one focused question at a time and follows only the branches that apply to you.
Risk
What your AI system can realistically affect: people, rights, safety, access to services. This places you on the four-level scale.
Role
Where legal responsibility actually sits along your value chain, including the points where it may have shifted onto you without notice.
Compliance score
How exposed you currently are, given the governance, documentation and oversight you already have in place.
What you get back
A written snapshot: your answers, the likely role and risk signals, the provisions that matter in your case, and practical next steps.
- One question at a time, no long form to fill
- Role and risk signals with the reasoning shown
- The provisions that apply to your situation
- Practical next steps you can act on this week
- Saved to your workspace, so you can pick up where you left off
The snapshot reflects the information you give us. It does not inspect your systems and it is not a certificate. Please keep confidential, personal and client material out of the free assessment. The full gap analysis, with the detailed chart, belongs to the professional engagement that follows.
The dates that matter
The Digital Omnibus changed when the high-risk rules arrive. The milestones already in force remain in place.
Updated for Regulation (EU) 2026/1744, published on July 24th, 2026-
AI literacy and prohibited practices The first prohibited-practice rules and the AI literacy framework began to apply.
-
Governance and GPAI obligations EU governance provisions and obligations for providers of general-purpose AI models became applicable.
-
Transparency and wider application Article 50 transparency duties and most remaining AI Act provisions apply, subject to the amended transitions.
-
Content marking transition and new prohibited practices The transition point for certain pre-existing generative systems and the new prohibited-practice provisions applies.
-
Stand-alone high-risk systems The high-risk rules for systems classified under Article 6(2) and Annex III apply.
-
High-risk systems in regulated products The high-risk rules for systems classified under Article 6(1) and Annex I apply.
Clarity without complexity
The full compliance guide, plus the reference material behind it. Free to read. Downloads ask you to create an account.
The AI Act compliance guide
Twelve chapters covering scope, definitions, the risk-based system, roles, enforcement, AI literacy under Article 4, the RRCS framework and the governance regulators expect. Written in plain language, with the article references kept in place.
Read the guideThe library
Reference material you can use on its own: the compliance timeline, the role matrix, the risk matrix, an alphabetical glossary of more than thirty terms, and direct links to the official text of the Regulation and its annexes.
Open the libraryYou do not need to be in Europe
Territorial reach is output-based. If your AI system, or what it produces, is used in the EU, the Regulation can reach you wherever you are established.
Compliance is a system, not a document
Checklists fail on their own. What regulators look for is a working structure: decisions recorded, oversight assigned, monitoring that continues over time.
AI literacy is already due
Article 4 has applied since February 2025. It is structural rather than ancillary, and it lands on providers and deployers alike.
Qualified EU lawyers, specialised in AI
The assessment is the entry point. The advice, the documentation and the defence of a position are professional legal work, and they are done by people.
We work the way the guide reads: plain language, no inflated urgency, and a clear separation between what the law requires and what is merely good practice.
Speak to a lawyer
- Role and risk classification, argued and documented
- Gap analysis against the obligations that actually apply
- Policies, instructions for use and technical documentation
- Transparency notices under Article 50
- AI literacy training for the teams operating the systems
- Support in dealing with authorities, clients and insurers
The questions that come up first
What is the EU AI Act?
Regulation (EU) 2024/1689 is the European Union's horizontal law on artificial intelligence. It sorts AI systems by the risk they present, prohibits a small set of practices outright, imposes documented obligations on high-risk uses, and adds transparency duties for systems that interact with people or generate content. It regulates risk and responsibility, not innovation.
Does it apply to us if we are not established in the EU?
Very likely yes. The reach is output-based: if your AI system, or what it produces, is used in the EU, the Regulation can apply regardless of where you are based. The two most common false assumptions are "we are too small" and "we just use APIs". Neither holds.
We only use tools built by someone else. Are we still in scope?
Usually yes, as a deployer, with duties around human oversight, input data, monitoring and informing affected people. And the line moves: putting your name on a system, materially modifying it or changing its intended purpose can make you its provider. Contracts alone do not prevent that shift.
Is our system high risk?
That depends on what it is used for, not on how sophisticated it is. The high-risk category covers safety components of already regulated products and the specific uses listed in Annex III, such as employment, education, essential services, credit, law enforcement and migration. Many ordinary business systems fall outside it and still carry transparency duties.
What does the free assessment actually give us?
A written snapshot: what you told us, the likely role and risk signals in your case, the provisions that deserve attention, and a practical set of next steps. It is indicative and based on your answers. It is not a certificate and it is not legal advice.
How are the fines structured?
In tiers. The top tier reaches thirty-five million euro or seven per cent of total worldwide annual turnover, whichever is higher, and is reserved for prohibited practices. Lower tiers apply to other breaches. Enforcement is risk-driven rather than random, and most penalties will land on unprepared organisations rather than malicious ones.
Where does AI literacy fit in?
Article 4 requires providers and deployers to ensure a sufficient level of AI literacy among the staff who operate their systems. It has applied since February 2025 and is structural rather than ancillary: it shapes how oversight, escalation and documentation actually work in practice.
Start with clarity, not paperwork
Find out where you stand in a few minutes. If the snapshot shows you have work to do, we are the people who do it.