Implementing the AI Act in your company

Three principles for robust implementation

1. 01

   Record AI use

   You describe AI systems, tools, product features, providers, areas of use and the occasion. This can be a launch, customer audit, management approval, procurement, enterprise sales, due diligence or internal escalation.

   • Customer service chatbotown brand
   • Development copilotinternal use

2. 02

   Clarify obligations

   We check whether your company is a provider, deployer, integrator, purchaser, distributor, importer or part of an AI supply chain, and which obligations may arise from this.

   Role

   Deployer, close to provider

   Risk

   Transparency obligation

3. 03

   Set up implementation

   You receive a legally structured basis for measures, responsibilities, AI governance, contract review, transparency, training, evidence and further specialist reviews.

From AI use to implementation plan in detail

1. 1Capture

   We record AI systems, providers, models, integrations, user groups, places of use, data flows, purposes and the business occasion in a structured way.

2. 2Assess

   We classify roles, risk class, proximity to prohibitions, transparency, high-risk links, GPAI questions, data protection and contract structure from a legal perspective.

3. 3Prioritise

   The review produces an ordered list of measures. What takes priority, what belongs in contracts, what needs to be documented, trained or technically controlled?

4. 4Implement

   We translate the results into a policy, approval process, contract review, responsibilities, training, evidence structure and governance.

How long does it take? Most work steps are completed within a few working days. How quickly it goes depends on the scope and on your feedback. Do you have a fixed date, such as a launch? Tell us when you send your enquiry and we will plan for it.

Who delivers what and who decides

How does the engagement work?

1. 1
   Initial assessment

   We review your information and tell you whether the package fits or another route makes more sense.

2. 2
   Offer for the package

   If the package fits, you receive an offer for classification, an overview of obligations and an implementation plan. We only start after your approval.

3. 3
   Court action agreed separately

   Proceedings before authorities or courts and representation in them are not part of the package. We agree these steps separately.

Put simply, providers place an AI system on the market under their own responsibility, and deployers use it under their own responsibility. Adaptation, integration or your own brand can shift the boundary.

In practice, what counts is whether an AI use must be approved, sold, procured, audited or explained to third parties today. The deadlines reflect the status as of 26 October 2026. Updated on 26 October 2026: deadlines adjusted to the Digital Omnibus (Regulation (EU) 2026/1744).

With our AI Act initial check, you can roughly narrow down in advance whether your system is likely to be classified as high-risk AI, a GPAI application or a system subject to transparency obligations.

1. Customer service chatbot

   A company uses a chatbot under its own brand. We review the transparency notice, the role towards the model provider, data flows, escalation to humans and the evidence for customer questions.

2. AI in recruiting

   An HR tool pre-sorts applications. We review proximity to high risk, human oversight, information of employee representatives, data protection and the obligations as deployer.

3. AI feature in a SaaS product

   A software provider integrates a language model into its product. We clarify the provider role, documentation, customer contracts, usage limits and communication with the model provider.

4. Enterprise questionnaire

   A major customer requests information on AI systems, controls and training. We build a robust line of answers that also holds up in later audits and contract negotiations.

5. Due diligence

   Investors review AI risks before a funding round or transaction. We prepare the inventory, role clarification, contracts and governance so that questions can be answered in a traceable way.

The AI Act does not require a general AI officer modelled on a data protection officer. A responsible AI governance function can make sense. What matters are responsibilities, competence, approvals, control and evidence.

• AI Regulation (EU) 2024/1689 on EUR-Lex Official text for roles, risk classes, obligations, transparency, GPAI and penalties.
• European Commission on the AI Act Application timetable, AI Office, governance, guidelines and implementation instruments.
• European Commission on the GPAI Code of Practice Guidance for general-purpose AI models and their supply chain.
• Federal Network Agency on the AI Regulation National reference point on risk levels, AI literacy, high risk and market surveillance.

1. 1
   Broader AI questions

   For liability, copyright, data protection and product strategy in AI projects, AI law is the broader route.

2. 2
   Several digital acts

   If the Data Act, DSA, NIS2, CRA or DMA must be reviewed together with the AI Act, the EU Digital Acts Audit is the next step.

3. 3
   Chatbots with minors

   If a chatbot also reaches children, today mainly Art. 50(1) and Art. 5(1)(b) AI Regulation apply. The proposed EU KIDS Act would bring further obligations, but it has not yet been adopted.

Typical mistakes in implementation

• The AI list comes from IT, the contracts from procurement, the data protection review from legal and the product reality from the business unit. Nobody brings them together.
• A company considers itself a mere user, although integration, configuration, distribution or its own purpose move it closer to provider obligations.
• AI literacy is treated as standard training without taking account of roles, risks, contexts of use and the people affected.
• Proximity to high risk is only checked shortly before launch, although product design, data quality, control and documentation must be planned early.
• Contracts with AI providers contain no robust rules on information, audit, updates, liability, data protection, security or exit.
• Transparency obligations are treated as a UX copy problem, although they belong in product design, process, communication and documentation.
• GPAI and model questions are overlooked, although downstream information, usage limits and supply chain communication can be decisive.
• Evidence is only created when a customer, investor, auditor or supervisor asks for it. By then the approval history, responsibilities and documentation trail are missing.