Your AI complies with the EU AI Act, and you can prove it.

There is a chatbot on your website. Someone in finance lets a model read invoices. HR runs a tool that screens job applications, and nobody remembers exactly who turned it on. As long as nobody asks, that goes unnoticed. The EU AI Act turns that question into an obligation, with deadlines that are already running, and the one asking is usually a client or a procurement team, not a regulator. We make sure you know what you run and that you can show it.

Which risk class applies

The Act sorts AI systems by what goes wrong when they get it wrong. A handful of uses are prohibited outright. A second group is called high risk: systems that help decide on employment, education, creditworthiness, or access to services. Those face strict requirements for documentation, data quality, and oversight. A third group mainly needs transparency: you have to tell people they are talking to a machine or that an image was generated. The rest falls under the normal regime and asks little more than common sense.

The difference between those groups is large, and many companies misjudge where they sit. A chatbot that reads out opening hours is light stuff. The same chatbot deciding whether a request goes through to an employee is suddenly in another category. We walk through your applications, look at what a system actually decides rather than what its vendor calls it, and write down for each system why it falls in that class. If you are in the lightest category, we tell you right away and stop there.

From transparency to evidence

Complying with the law is one thing. Being able to show it is another. For the heavier classes, you must be able to show where your data comes from, which version of which model ran at which moment, and what the system answered. A document you update once a year cannot do that. It has to come from your systems themselves.

That is why we set up logging at the moment we build the application. Each request records a timestamp, the model version used, and the outcome, and we keep that data exactly as long as needed and not a day longer. What you put into a model is often personal data, so retention periods and data processing agreements run alongside the work we do under GDPR compliance. If the model runs at a vendor outside the EU, we tell you what that means and what the alternative is: a model that runs in an EU data center, where your data is not used to train a public model.

Human oversight that works

For high risk, the law requires that a person oversees the system. In practice, that is often filled in with a checkbox: someone clicks approve and the system moves on. That is not oversight. That is a signature under something you have not read. Oversight only works when the person looking can actually see what the advice is based on, has time to look at it, and can overrule it without any hassle.

That is largely a design question. We make sure the screen shows which data tipped the decision, that overruling is one action and not a request form, and that every override is logged. That log is also your best source of information: if people consistently overrule the system for a certain type of case, something is wrong with the model. The law also asks that your staff know what they are working with. That is not a three-day course, but a short instruction per role, so someone knows what the system can and cannot do.

What we need from you

We start with a free intake and a tour of the departments. AI is rarely only where you expect it: there is some in your CRM, in your email filter, and in the tool your marketing agency uses. We need someone who knows which vendors you have, and access to the systems the models run in.

After that, within 10 business days, you get a first version of the register and the risk classification, so you see right away where it chafes. The rest is setting up and recording. If you work in a sector that also falls under NIS2, we use the same inventory for both, because it is largely the same homework. You own the records and the code we write, so you can continue without us.