EU AI Act Readiness

EU AI Act readiness, built into the product and its records.

Most AI Act work ends up in code: a disclosure in the chat, a log the system actually writes, an oversight step a person can use, documentation that matches the release. We build that technical side. Your counsel decides the legal classification.

Scope your AI Act readiness work →

DIRECT ANSWER

This engagement prepares the technical evidence the EU AI Act asks for: an inventory of AI features, facts for your counsel’s classification, technical documentation, logging, human oversight design and Article 50 transparency in the interface. It is engineering work, not legal advice or a conformity assessment.

Best for

  • Product teams with chatbots, agents or generative features used by people in the EU
  • Companies whose counsel or enterprise buyers ask for records the codebase cannot yet produce

Consider another approach

  • A legal opinion, a classification decision or a declaration of conformity
  • A security review of prompts, tools and data access in an AI application

Engineering evidence, with legal decisions left to counsel

Whether a system is high-risk, which operator role you hold and which duties follow are legal questions. Your counsel answers them. We supply the facts they need and build what follows from their answer. Threat models and abuse tests of prompts, retrieval and tools belong to AI Security. Building a new AI product belongs to AI Agents & Products. Training teams and rolling out AI tools internally belongs to AI Enablement. This page covers the technical readiness in between.

Start with an inventory your counsel can work from

Classification depends on intended purpose, affected people and conditions in the regulation, not on the architecture label. Record those facts per feature before anyone budgets controls. Our AI Act cost and scope guide walks through that decision sequence, and the GDPR and AI Act overlap explains where data-protection records can share evidence.

AI touchpoints

Chatbots, agents, generative features, scoring and any model your product calls, including third-party APIs.

Purpose and affected people

What each feature is for, who it reaches and which decisions it informs.

Role and market-entry date

Facts your counsel needs to assign provider or deployer duties and to check transitional dates.

Components and suppliers

Models, datasets and services behind each feature. An [AI bill of materials](/blog/ai-bill-of-materials-cyclonedx-spdx-2026/) can hold this as versioned data.

Article 50 transparency, shipped in the interface

Article 50 has applied since 2 August 2026. A person must learn they are dealing with an AI at the latest at the first interaction, and in-scope generated content needs machine-readable marking. Generative systems already on the market before that date have until 2 December 2026 for the marking duty only. We implement the disclosure in the flow (not the footer), audible notices for voice agents, provenance metadata and labels where they apply, and screenshots or logs proving each notice fired. The Article 50 checklist lists what passes and what fails.

Logging, oversight and documentation that match the running system

Where your counsel concludes high-risk duties apply, the build work starts long before the deadlines. Requirements for Annex III systems apply from 2 December 2027 and for AI in Annex I regulated products from 2 August 2028. Data lineage, test records and oversight steps take time to put into a product.

Event logging

Decide what the system records, where it is stored, who can read it and how long it is kept, then verify the logs are written in production.

Human oversight

Review queues, override and stop controls, and the context a reviewer needs to make an informed decision.

Technical documentation

System description, data sources, evaluations and versions, kept in the repository and updated with each release.

Change and incident routines

Who reassesses a model or data change, and how a serious incident is escalated to the accountable owner.

Assess, implement and hand over

Each phase is scoped and quoted before work starts. You can take the assessment to your own team or commission the agreed implementation.

  1. Readiness assessment

    An AI feature inventory, open questions for counsel, a gap list against the controls they confirm and a prioritized backlog.

  2. Implementation and verification

    Agreed changes to interface, logging and oversight in your codebase, with evidence that each control works as specified.

  3. Ongoing upkeep

    Reassessment when models, data or features change, agreed separately. This does not create 24/7 coverage or an uptime SLA.

Your repository, your records, your decision

Documentation, logging configuration and interface changes live in your repository and stay yours. Teams outside the EU ask for this work too when their product reaches people in the EU; whether the regulation applies to you is part of counsel’s analysis. Our Trust Center explains delivery responsibilities and service levels.
// proof

AI Act and governance work in an existing engagement

For Cedars International, we reviewed an AI-native cybersecurity platform against EU AI Act requirements and developed product governance documentation, alongside QA and a scoped technical assessment. The case documents that published scope. It is not a certification, a legal opinion or a promise of the same result for another system.

Cedars

Live
Evidence trail Architecture, requirements, assets and responsibilities organized for review.

Documentation structures, targeted source checks and scoped AI assessment gave Cedars a prioritized basis for technical decisions.

PHP JavaScript Python
ENTERPRISE 2026

These are selected projects, not our full portfolio. We have shipped 100+ products since 2018.

Questions before you start

No. We are an engineering team. Legal classification, operator roles and the final reading of your obligations stay with your counsel. We prepare the facts they need and implement the technical controls that follow.
We cannot promise conformity. We deliver the agreed technical controls and records, verified against the acceptance criteria in the scope. Whether they satisfy your obligations is assessed by your counsel and, where applicable, the relevant conformity procedure.
Yes, since 2 August 2026. Generative systems placed on the market before that date have until 2 December 2026 for machine-readable marking only. Chatbot disclosure and deepfake labelling have no such delay.
Yes. Many products call third-party models. We document which component does what, which duties sit with you as the integrating company and what you need to request from the vendor.
AI Security tests whether prompts, retrieval and tools can be abused to expose data or trigger unauthorized actions. This service builds the transparency, logging, oversight and documentation the AI Act asks for. Many teams need both, scoped separately.

Choose your next step

Scope your AI Act readiness work

Describe the AI features in your product, who uses them and which AI Act question is blocking you. A short, non-sensitive outline is enough for the first conversation.

Scope your AI Act readiness work →