AI compliance
We do the technical and governance work for AI under the EU AI Act, GDPR, ISO/IEC 42001 and DORA, beside your legal team. We prepare the risk classification of your AI systems, write the technical documentation, design human oversight into your processes and build the management system ISO/IEC 42001 describes. This is not legal advice.
The task.
The EU AI Act applies in stages, and the AI Omnibus moved the high-risk dates. The rules for Annex III systems now apply from 2 December 2027. Your legal team reads the law; someone must build what it asks for.
The duties land in systems: logs, documentation, human oversight and data records. GDPR, ISO/IEC 42001 and, for banks and insurers, DORA add their own. We do the technical work; the legal judgement stays with your lawyers.
What we do.
- 01
EU AI Act
We list your AI systems and prepare their risk classification with your legal team. Then we build what applies: technical documentation, logging and human oversight for high-risk systems, and the transparency duties of Art. 50 where they apply.
- 02
GDPR
Where AI processes personal data, we prepare the technical part of the DPIA: data flows, purposes and safeguards. For automated decisions under Art. 22, we design a human review into the process as a user task.
- 03
ISO/IEC 42001
We prepare an AI management system to ISO/IEC 42001:2023: policies, roles, risk records and the evidence an auditor asks for. The certificate itself comes from an accredited certification body.
- 04
DORA
For banks and insurers, AI runs on ICT systems that DORA covers. We map the AI components into your ICT risk management and your register of ICT third-party providers.
- 05
Beside your legal team
This is technical and governance work. It is not legal advice and no compliance guarantee: your counsel decides how the law applies to you.
Typical engagements.
AI inventory and classification
A written list of your AI systems, each with a proposed risk class for your legal team to confirm.
Readiness for Annex III
For a system that may be high-risk, the documentation, logging and oversight built before 2 December 2027.
ISO/IEC 42001 preparation
The AI management system and its records prepared before you engage an accredited certification body.
The dates.
From EUR-Lex and the Commission's pages, checked on 18 October 2026.
The EU AI Act (Regulation (EU) 2024/1689) entered into force on 1 August 2024, and its prohibited practices and AI literacy duty apply from 2 February 2025.
The obligations for general-purpose AI models apply from 2 August 2025, and the general date of application, the transparency duties of Art. 50 included, is 2 August 2026.
The AI Omnibus (Regulation (EU) 2026/1744), in force since 27 July 2026, moved the high-risk rules: Annex III from 2 December 2027, Annex I from 2 August 2028.
ISO/IEC 42001:2023 was published in December 2023; we checked the AI Act dates on 18 October 2026.
- A date the regulation sets
- Last checked 18 October 2026
- 1 August 2024Ended :
The EU AI Act (Regulation (EU) 2024/1689) entered into force.
- 2 February 2025Ended :
The prohibited practices and the AI literacy duty apply.
- 2 August 2025Ended :
The obligations for general-purpose AI models, governance and penalties apply.
- 27 July 2026Ended :
The AI Omnibus amending the AI Act entered into force (Regulation (EU) 2026/1744).
- 2 August 2026Ended :
The general date of application, the transparency duties of Art. 50 included.
- 2 December 2027 :
The rules for high-risk AI systems in Annex III apply (moved by the AI Omnibus).
- 2 August 2028 :
The rules for high-risk AI embedded in products (Annex I) apply (moved by the AI Omnibus).
Is this for you?
A good fit
- You have AI systems in use or planned that make or support decisions about people.
- Your legal team wants engineers who build what the law asks for.
- You are a bank or insurer and need AI inside your DORA framework.
Not a fit
- You need legal advice: your legal team or external counsel gives it.
- You want a compliance guarantee or a certificate from us.
- You need people placed, with no technical lead on your side.
Questions.
Is this legal advice?
Our AI compliance work is technical and governance work beside your legal team, not legal advice. Your legal team or external counsel decides how the law applies to you, and nothing here is a compliance guarantee.
When do the AI Act’s high-risk rules apply?
The rules for high-risk AI systems in Annex III apply from 2 December 2027, and those for AI embedded in products under Annex I from 2 August 2028. The AI Omnibus, in force since 27 July 2026, moved both dates. We checked them on 18 October 2026.
Can you prepare us for ISO/IEC 42001?
Yes, we prepare the AI management system that ISO/IEC 42001:2023 describes: policies, roles, risk records and evidence. The certificate comes from an accredited certification body, not from us.
How does DORA relate to AI work?
For banks and insurers, the AI components sit on ICT systems that DORA already covers. We map them into your ICT risk management and your register of ICT third-party providers. How DORA applies to you is for your legal team to decide.
How do you handle automated decisions under GDPR Art. 22?
We design a human review step into the process, as a user task, wherever your legal team says Art. 22 requires one. The process records who reviewed each decision and when.
Which version are you on?
Tell us the platform, the version and what has to change. We reply with questions or a proposed next step.
Talk to an architect