--- title: "EU AI Act Compliance: Technical Readiness" canonical: https://wavect.io/services/eu-ai-act-compliance/ language: en description: "Prepare your AI system for the EU AI Act: inventory, technical documentation, logging, human oversight and Article 50 transparency built into the product. Not legal advice." image: "https://wavect.io/img/general/bak/open_graph_preview.jpg" --- EU AI Act Readiness # EU AI Act readiness, built into the product and its records. Most AI Act work ends up in code: a disclosure in the chat, a log the system actually writes, an oversight step a person can use, documentation that matches the release. We build that technical side. Your counsel decides the legal classification. THE ENGAGEMENT ## Inventory the AI. Build the controls. Keep the evidence. 1. **Map every AI feature** Purpose, users, data, operator role and market-entry date. 2. **Build the agreed controls** Disclosures, marking, logging and oversight in your product. 3. **Hand over the records** Versioned documentation tied to tests and releases. DIRECT ANSWER This engagement prepares the technical evidence the EU AI Act asks for: an inventory of AI features, facts for your counsel's classification, technical documentation, logging, human oversight design and Article 50 transparency in the interface. It is engineering work, not legal advice or a conformity assessment. Best for - Product teams with chatbots, agents or generative features used by people in the EU - Companies whose counsel or enterprise buyers ask for records the codebase cannot yet produce Consider another approach - A legal opinion, a classification decision or a declaration of conformity - A security review of prompts, tools and data access in an AI application ## Engineering evidence, with legal decisions left to counsel Whether a system is high-risk, which operator role you hold and which duties follow are legal questions. Your counsel answers them. We supply the facts they need and build what follows from their answer. Threat models and abuse tests of prompts, retrieval and tools belong to [AI Security](/services/ai-security/). Building a new AI product belongs to [AI Agents & Products](/services/artificial-intelligence/). Training teams and rolling out AI tools internally belongs to [AI Enablement](/services/ai-enablement/). This page covers the technical readiness in between. ## Start with an inventory your counsel can work from Classification depends on intended purpose, affected people and conditions in the regulation, not on the architecture label. Record those facts per feature before anyone budgets controls. Our [AI Act cost and scope guide](/blog/eu-ai-act-compliance-cost-startup/) walks through that decision sequence, and the [GDPR and AI Act overlap](/blog/gdpr-ai-act-stacking-dach-saas/) explains where data-protection records can share evidence. AI touchpoints Chatbots, agents, generative features, scoring and any model your product calls, including third-party APIs. Purpose and affected people What each feature is for, who it reaches and which decisions it informs. Role and market-entry date Facts your counsel needs to assign provider or deployer duties and to check transitional dates. Components and suppliers Models, datasets and services behind each feature. An [AI bill of materials](/blog/ai-bill-of-materials-cyclonedx-spdx-2026/) can hold this as versioned data. ## Article 50 transparency, shipped in the interface Article 50 has applied since 2 August 2026. A person must learn they are dealing with an AI at the latest at the first interaction, and in-scope generated content needs machine-readable marking. Generative systems already on the market before that date have until 2 December 2026 for the marking duty only. We implement the disclosure in the flow (not the footer), audible notices for voice agents, provenance metadata and labels where they apply, and screenshots or logs proving each notice fired. The [Article 50 checklist](/blog/eu-ai-act-article-50-checklist/) lists what passes and what fails. ## Logging, oversight and documentation that match the running system Where your counsel concludes high-risk duties apply, the build work starts long before the deadlines. Requirements for Annex III systems apply from 2 December 2027 and for AI in Annex I regulated products from 2 August 2028. Data lineage, test records and oversight steps take time to put into a product. Event logging Decide what the system records, where it is stored, who can read it and how long it is kept, then verify the logs are written in production. Human oversight Review queues, override and stop controls, and the context a reviewer needs to make an informed decision. Technical documentation System description, data sources, evaluations and versions, kept in the repository and updated with each release. Change and incident routines Who reassesses a model or data change, and how a serious incident is escalated to the accountable owner. ## Assess, implement and hand over Each phase is scoped and quoted before work starts. You can take the assessment to your own team or commission the agreed implementation. 1. **Readiness assessment** - An AI feature inventory, open questions for counsel, a gap list against the controls they confirm and a prioritized backlog. 2. **Implementation and verification** - Agreed changes to interface, logging and oversight in your codebase, with evidence that each control works as specified. 3. **Ongoing upkeep** - Reassessment when models, data or features change, agreed separately. This does not create 24/7 coverage or an uptime SLA. ## Your repository, your records, your decision Documentation, logging configuration and interface changes live in your repository and stay yours. Teams outside the EU ask for this work too when their product reaches people in the EU; whether the regulation applies to you is part of counsel’s analysis. [Our Trust Center](/trust-center/) explains delivery responsibilities and service levels. // proof ## AI Act and governance work in an existing engagement For Cedars International, we reviewed an AI-native cybersecurity platform against EU AI Act requirements and developed product governance documentation, alongside QA and a scoped technical assessment. The case documents that published scope. It is not a certification, a legal opinion or a promise of the same result for another system. ### [Cedars](/case-studies/cedars/) - **Status:** Live - **Outcome:** Evidence trail - Architecture, requirements, assets and responsibilities organized for review. - **Summary:** Documentation structures, targeted source checks and scoped AI assessment gave Cedars a prioritized basis for technical decisions. - **Stack:** PHP, JavaScript, Python These are selected projects, not our full portfolio. We have shipped 100+ products since 2018. ## Questions before you start ### Is this legal advice? No. We are an engineering team. Legal classification, operator roles and the final reading of your obligations stay with your counsel. We prepare the facts they need and implement the technical controls that follow. ### Will this make us AI Act compliant? We cannot promise conformity. We deliver the agreed technical controls and records, verified against the acceptance criteria in the scope. Whether they satisfy your obligations is assessed by your counsel and, where applicable, the relevant conformity procedure. ### Does Article 50 already apply? Yes, since 2 August 2026. Generative systems placed on the market before that date have until 2 December 2026 for machine-readable marking only. Chatbot disclosure and deepfake labelling have no such delay. ### Can you work with our existing AI vendor or model API? Yes. Many products call third-party models. We document which component does what, which duties sit with you as the integrating company and what you need to request from the vendor. ### How is this different from AI Security? AI Security tests whether prompts, retrieval and tools can be abused to expose data or trigger unauthorized actions. This service builds the transparency, logging, oversight and documentation the AI Act asks for. Many teams need both, scoped separately. ## Choose your next step - [Test AI data and tool boundaries](/services/ai-security/) - [Build an AI product](/services/artificial-intelligence/) - [Roll out AI inside your team](/services/ai-enablement/) ## Structured Data ```json { "@context": "https://schema.org", "@graph": [ { "@id": "https://wavect.io/#organization", "@type": [ "Organization", "ProfessionalService", "LocalBusiness" ], "employee": [ { "@id": "https://wavect.io/team/kevin-riedl/#person", "@type": "Person", "jobTitle": "Managing Director", "name": "Kevin Riedl", "url": "https://wavect.io/team/kevin-riedl/", "worksFor": { "@id": "https://wavect.io/#organization", "@type": [ "Organization", "ProfessionalService", "LocalBusiness" ] } }, { "@id": "https://wavect.io/team/christof-jori/#person", "@type": "Person", "jobTitle": "Managing Director", "name": "Christof Jori", "url": "https://wavect.io/team/christof-jori/", "worksFor": { "@id": "https://wavect.io/#organization", "@type": [ "Organization", "ProfessionalService", "LocalBusiness" ] } } ], "founder": [ { "@id": "https://wavect.io/team/kevin-riedl/#person", "@type": "Person", "jobTitle": "Managing Director", "name": "Kevin Riedl", "url": "https://wavect.io/team/kevin-riedl/", "worksFor": { "@id": "https://wavect.io/#organization", "@type": [ "Organization", "ProfessionalService", "LocalBusiness" ] } }, { "@id": "https://wavect.io/team/christof-jori/#person", "@type": "Person", "jobTitle": "Managing Director", "name": "Christof Jori", "url": "https://wavect.io/team/christof-jori/", "worksFor": { "@id": "https://wavect.io/#organization", "@type": [ "Organization", "ProfessionalService", "LocalBusiness" ] } } ], "legalRepresentative": [ { "@id": "https://wavect.io/team/kevin-riedl/#person", "@type": "Person", "jobTitle": "Managing Director", "name": "Kevin Riedl", "url": "https://wavect.io/team/kevin-riedl/", "worksFor": { "@id": "https://wavect.io/#organization", "@type": [ "Organization", "ProfessionalService", "LocalBusiness" ] } }, { "@id": "https://wavect.io/team/christof-jori/#person", "@type": "Person", "jobTitle": "Managing Director", "name": "Christof Jori", "url": "https://wavect.io/team/christof-jori/", "worksFor": { "@id": "https://wavect.io/#organization", "@type": [ "Organization", "ProfessionalService", "LocalBusiness" ] } } ], "name": "Wavect GmbH", "subjectOf": { "@id": "https://wavect.io/verified-claims.json#dataset", "@type": "Dataset", "creator": { "@id": "https://wavect.io/#organization", "@type": [ "Organization", "ProfessionalService", "LocalBusiness" ] }, "description": "A machine-readable registry of quantitative and qualitative claims published by Wavect, with review dates, localized page appearances and public third-party citations where available.", "inLanguage": "en", "isAccessibleForFree": true, "license": "https://creativecommons.org/licenses/by/4.0/", "name": "Wavect verified publication claims", "url": "https://wavect.io/verified-claims.json" }, "url": "https://wavect.io/" }, { "@id": "https://wavect.io/team/kevin-riedl/#person", "@type": "Person", "jobTitle": "Managing Director", "name": "Kevin Riedl", "sameAs": [ "https://www.wikidata.org/wiki/Q139796365", "https://www.linkedin.com/in/wsdt", "https://github.com/wsdt" ], "url": "https://wavect.io/team/kevin-riedl/", "worksFor": { "@id": "https://wavect.io/#organization", "@type": [ "Organization", "ProfessionalService", "LocalBusiness" ] } }, { "@id": "https://wavect.io/team/christof-jori/#person", "@type": "Person", "jobTitle": "Managing Director", "name": "Christof Jori", "sameAs": [ "https://www.wikidata.org/wiki/Q139796367", "https://www.linkedin.com/in/jocr77/", "https://github.com/jo-chris" ], "url": "https://wavect.io/team/christof-jori/", "worksFor": { "@id": "https://wavect.io/#organization", "@type": [ "Organization", "ProfessionalService", "LocalBusiness" ] } }, { "@id": "https://wavect.io/#website", "@type": "WebSite", "inLanguage": [ "en", "de", "es", "zh" ], "name": "Wavect", "potentialAction": { "@type": "SearchAction", "query-input": "required name=search_term_string", "target": { "@type": "EntryPoint", "urlTemplate": "https://wavect.io/search/?q={search_term_string}" } }, "publisher": { "@id": "https://wavect.io/#organization", "@type": [ "Organization", "ProfessionalService", "LocalBusiness" ] }, "url": "https://wavect.io/" } ] } ``` ```json { "@context": "https://schema.org", "@graph": [ { "@id": "https://wavect.io/services/eu-ai-act-compliance/#service", "@type": "Service", "areaServed": [ { "@type": "Country", "name": "Austria" }, { "@type": "Place", "name": "Worldwide" } ], "category": "Security & Operations", "dateModified": "2026-10-30", "description": "Prepare your AI system for the EU AI Act: inventory, technical documentation, logging, human oversight and Article 50 transparency built into the product. Not legal advice.", "name": "EU AI Act Compliance", "provider": { "@id": "https://wavect.io/#organization", "@type": [ "Organization", "ProfessionalService", "LocalBusiness" ] }, "serviceType": "EU AI Act", "url": "https://wavect.io/services/eu-ai-act-compliance/" }, { "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "item": "https://wavect.io/", "name": "Home", "position": 1 }, { "@type": "ListItem", "item": "https://wavect.io/services/overview/", "name": "Services", "position": 2 }, { "@type": "ListItem", "item": "https://wavect.io/services/overview/#security", "name": "Security & Operations", "position": 3 }, { "@type": "ListItem", "item": "https://wavect.io/services/eu-ai-act-compliance/", "name": "EU AI Act", "position": 4 } ] }, { "@id": "https://wavect.io/services/eu-ai-act-compliance/#webpage", "@type": "WebPage", "dateModified": "2026-10-30", "description": "Prepare your AI system for the EU AI Act: inventory, technical documentation, logging, human oversight and Article 50 transparency built into the product. Not legal advice.", "inLanguage": "en", "isPartOf": { "@id": "https://wavect.io/#website", "@type": "WebSite" }, "mainEntity": { "@id": "https://wavect.io/services/eu-ai-act-compliance/#service" }, "name": "EU AI Act Compliance", "url": "https://wavect.io/services/eu-ai-act-compliance/" } ] } ``` ```json { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "acceptedAnswer": { "@type": "Answer", "text": "No. We are an engineering team. Legal classification, operator roles and the final reading of your obligations stay with your counsel. We prepare the facts they need and implement the technical controls that follow." }, "name": "Is this legal advice?" }, { "@type": "Question", "acceptedAnswer": { "@type": "Answer", "text": "We cannot promise conformity. We deliver the agreed technical controls and records, verified against the acceptance criteria in the scope. Whether they satisfy your obligations is assessed by your counsel and, where applicable, the relevant conformity procedure." }, "name": "Will this make us AI Act compliant?" }, { "@type": "Question", "acceptedAnswer": { "@type": "Answer", "text": "Yes, since 2 August 2026. Generative systems placed on the market before that date have until 2 December 2026 for machine-readable marking only. Chatbot disclosure and deepfake labelling have no such delay." }, "name": "Does Article 50 already apply?" }, { "@type": "Question", "acceptedAnswer": { "@type": "Answer", "text": "Yes. Many products call third-party models. We document which component does what, which duties sit with you as the integrating company and what you need to request from the vendor." }, "name": "Can you work with our existing AI vendor or model API?" }, { "@type": "Question", "acceptedAnswer": { "@type": "Answer", "text": "AI Security tests whether prompts, retrieval and tools can be abused to expose data or trigger unauthorized actions. This service builds the transparency, logging, oversight and documentation the AI Act asks for. Many teams need both, scoped separately." }, "name": "How is this different from AI Security?" } ], "speakable": { "@type": "SpeakableSpecification", "cssSelector": [ ".faq-question", ".faq-answer" ] } } ```