EU AI Act Compliance Consulting

EU AI Act compliance consulting classifies your GenAI systems against the Act’s risk tiers and implements the engineering practices the file needs: reconstructable logs, human oversight, eval evidence, and technical documentation. It is not legal advice and not a certification. We work in your cloud, you own the IP, under a zero-retention, SOC 2-aligned process with no shared training. Four weeks is standard; financial-services reviews typically take 8–12 weeks.

No. High-risk turns on listed uses such as hiring, credit, and certain safety components, not on the fact that a large language model sits in the stack. Most customer-support and internal-drafting assistants are transparency and logging problems. Mis-classifying every chatbot as high-risk wastes a year; under-classifying an Annex III use is worse. Classification is a use-case decision with your counsel.

GPAI rules mainly target the model provider: documentation, training-data summary, copyright policy, and extra evaluation for systemic-risk models. High-risk rules target systems used in listed contexts: risk management, data governance, logging, human oversight, and a technical file. Fine-tuning or wrapping a GPAI model can change who owes what. We document the architecture; counsel decides the legal allocation.

A defensible file describes intended use, limitations, data involved, evaluation methods and results, logging, human oversight, and monitoring. Reconstructable traces make those sections true. Golden sets and rubric judges are how you show the system was tested after the last prompt change. A 40-page PDF that does not match production is not documentation; it is a liability.

No. We are not certified against the Act and we do not sell a compliance stamp. We build production systems with reconstructable logs, human fallback, scoped tools, eval gates, and documentation your legal and risk teams can use. If you need a notified body or formal conformity assessment, that is a separate legal path we will not pretend to be.

Logging stores inputs, retrieved context, tool calls, model version, and outputs so a decision can be reconstructed. Oversight is a queue and a permission: low-confidence and high-stakes cases route to a person; write actions sit behind confirmation until evals hold. Both live in your cloud. That practice is useful whether or not a regulator ever asks.

No. Personal data in prompts, logs, and retrieval still needs a lawful basis, minimisation, and a place to live. Act readiness and privacy are two workstreams that share the same traces. We implement zero-retention on our side and keep artifacts in the client cloud. Your DPO still owns the GDPR analysis.

Four weeks is the standard implementation for one bounded GenAI workflow: classification, logging, oversight, eval evidence, and a technical file. Financial-services programs with heavier second-line review typically take 8–12 weeks. Additional systems reuse the trace schema and document structure. Timelines assume counsel is available to challenge the classification memo.