EU AI Act Compliance Consulting

What is the EU AI Act, and who must comply?

The EU AI Act is a binding, risk-based regulation that classifies AI systems by the harm they can cause and imposes obligations accordingly — from outright bans to full conformity assessment. It entered into force on 1 August 2024 and applies in phases through 2028. It is enforceable EU law, not a voluntary framework, with penalties comparable to GDPR. You are in scope if you are:

• Providers — you develop an AI system or general-purpose AI (GPAI) model and place it on the EU market under your own name.
• Deployers — you use an AI system under your authority in a professional capacity. Most enterprises buying AI are deployers, and deployers carry real obligations.
• Importers, distributors, product manufacturers — you bring third-party AI into the EU or embed it in your products.
• Non-EU firms — the Act applies extraterritorially: if the output of your AI system is used within the EU, you must comply. A Toronto, New York, or Singapore company with EU users or EU-facing outputs is covered.

The practical takeaway: “we don't have an EU office” is not an exemption.

EU AI Act risk tiers explained

The Act sorts every AI system into one of four risk tiers, and the tier determines your entire obligation set. Classify first; everything else follows.

Most enterprise value — and most legal exposure — sits in the high-risk tier. GPAI models carry a separate, parallel obligation set (technical documentation, training-data summaries, copyright policy; plus model evaluation and incident reporting for models posing systemic risk).

EU AI Act timeline and deadlines (as of the Digital Omnibus)

The Act applies in staged waves. On 27 July 2026 the Digital Omnibus (Reg (EU) 2026/1744) deferred the high-risk deadlines — but left the transparency and 2025 duties untouched. The current schedule:

The Omnibus gave high-risk builders more runway — but it did not change the engineering reality: a conformity file, tamper-evident logging, and human-oversight design must exist in the system, and cannot be produced overnight. The extra time is for building compliance in, not deferring it.

What must high-risk AI providers and deployers actually do?

High-risk compliance is not paperwork bolted on at the end — it is a set of engineering and governance controls (Articles 9–15) designed into the system.

Provider checklist (high-risk):

1. Risk management system — continuous, documented, lifecycle-wide.
2. Data governance — relevant, representative, bias-examined datasets with documented provenance.
3. Technical documentation — a complete conformity file, prepared before market placement.
4. Record-keeping & logging — automatic, tamper-evident logging over the system's lifetime.
5. Transparency & instructions for use — enable deployers to interpret output correctly.
6. Human oversight — designed so humans can monitor, intervene, and override.
7. Accuracy, robustness & cybersecurity — resilient to error, manipulation, and attack.
8. Quality management system — documented policies and accountability.
9. Conformity assessment & CE marking — before market entry.
10. Registration — in the EU database before go-live.
11. Post-market monitoring — ongoing, with a plan to act on findings.
12. Serious-incident reporting — to the relevant authority.

Deployer checklist (high-risk):

• Use the system per the provider's instructions; assign trained humans to oversight.
• Monitor operation, suspend use if risks emerge, and report serious incidents.
• Keep the automatically generated logs under your control.
• Inform affected workers and, where required, conduct a fundamental-rights impact assessment before deployment.

The uncomfortable truth: you cannot reliably retrofit logging, oversight, and data governance into a black-box system a vendor did not design for it. Compliance has to be an architectural decision.

What are the EU AI Act penalties?

Fines reach the higher of €35 million or 7% of total worldwide annual turnover for prohibited-practice violations — a ceiling designed, like GDPR, to be felt at board level.

For SMEs and start-ups the fine is capped at the lower of the fixed amount or the percentage. Beyond fines, non-compliant systems can be ordered off the market — often a bigger cost than the fine.

How AIDOLS makes your AI compliant-by-design

AIDOLS is an AI-native, engineering-first firm that ships working, compliant production systems — not slide decks. We treat EU AI Act conformity as an engineering property built in from day one, evidenced with documentation as we go.

• The AI Governance Charter 2026. Every engagement is mapped to EU AI Act and NIST AI RMF requirements with documented evidence — risk classification, data-governance records, technical documentation, human-oversight design, and logging produced as the system is built.
• Compliant-by-design 90-day builds. A small senior team (typically 3–5 engineers) designs, builds, and deploys a production system in 90 days with the Article 9–15 control set architected in, not appended.
• Outcome accountability, not billed hours. The Build tier targets a 40%+ efficiency improvement and carries a 100% ROI guarantee: if it does not generate ROI exceeding its fee within 90 days, the fee is refunded in full.
• Physical & industrial-AI depth. Through a signed-MOU consortium with WONTECH Worldwide and Polytechnique Montréal on an Agentic AI Asset Intelligence Platform, AIDOLS brings governance rigour to the hardest, most safety-critical AI domains.

Next: our governance evidence model · assess your maturity · how fixed-fee works

Frequently asked questions