EU AI Act Readiness and AI Regulation Compliance

It can, in two main ways. You are a provider if you develop an AI system or general-purpose AI model and place it on the EU market or put it into service there under your own name or trademark, whether or not you have an establishment in the Union. You are a deployer if you use an AI system under your own authority within the EU. The Act also reaches providers and deployers located outside the EU where the output produced by the system is used in the Union, which catches many Indian SaaS and services companies serving European clients. We establish your role for each system during scoping, because the obligations differ sharply between provider and deployer. Getting the role right matters commercially as well as legally, because a provider carries documentation, conformity assessment and registration duties that a deployer does not, and contracts sometimes push those duties between the parties.

The Act entered into force on 1 August 2024 and applies in stages. Prohibited practices and AI literacy duties have applied since February 2025, and rules for general-purpose AI models since August 2025, with the Commission's enforcement powers over those models from 2 August 2026. Transparency duties under Article 50, such as telling people they are interacting with an AI system and marking synthetic content, apply from 2 August 2026. The high-risk deadlines moved: Regulation (EU) 2026/1744, the Digital Omnibus on AI of 8 July 2026, published on 24 July 2026, set 2 December 2027 for standalone high-risk systems listed in Annex III and 2 August 2028 for AI embedded in products covered by Annex I. Confirm the dates for your systems, since amendments continue. We track amendments as they are published rather than working from a slide of the original timetable, and we plan work against the date that applies to your classification instead of the earliest date in the Act.

Classification follows the Act rather than intuition. A system is high-risk if it is a safety component of, or itself a product covered by, the Union legislation listed in Annex I and requires third-party conformity assessment, or if it falls within one of the use cases in Annex III, which covers areas such as biometrics, critical infrastructure, education, employment, essential services including credit scoring, law enforcement, migration, and justice. Annex III has a filter: a system may escape the classification where it performs only a narrow procedural task or improves a previous human activity without replacing judgement, but that assessment must be documented and the system registered. We work system by system and record the reasoning, because the classification decides everything that follows. We also record the decision and its evidence for each system, because the Act expects that reasoning to be documented and a regulator or customer can ask for it later, long after the people who made the call have moved on.

Run a risk management system across the lifecycle, govern the training, validation and testing data, produce and keep technical documentation, design the system to keep automatic logs, provide instructions that let deployers use it correctly, build in human oversight, and meet appropriate levels of accuracy, robustness and cybersecurity. You also need a quality management system, must carry out the relevant conformity assessment and draw up an EU declaration of conformity, affix the CE marking, register the system in the EU database, and monitor it after it is on the market, reporting serious incidents. Providers established outside the Union must also appoint an authorised representative in the EU. Deployers carry lighter but real duties, including using the system per instructions, assigning competent human oversight and monitoring operation. We map each of those duties to something concrete in your organisation, an owner, a document and a process, so obligations do not sit as a list in a report that nobody can act on.

No, and no certification body can grant compliance with the Act. ISO/IEC 42001 is a management system standard: it gives you the inventory, risk and impact assessment, data governance, documentation, oversight and monitoring routines that the Act's duties depend on, which makes the evidence exist and stay current. The Act's own conformity assessment route for high-risk systems, its registration in the EU database, the CE marking and the declaration of conformity are separate legal steps. Harmonised standards developed for the Act will carry a presumption of conformity where they apply; ISO 42001 does not. We usually recommend running both together: the management system to keep AI governance working, and a mapping from its controls to the specific Act obligations each of your systems carries. Where a vendor or consultant offers you EU AI Act certification, treat the claim carefully and check exactly what is being certified, because that phrasing is common in marketing and misleading in procurement.

Start with an inventory and classification, because every duty and deadline depends on them. Most teams discover AI in more places than expected: product features, vendor tools embedded in workflows, and internal automation. From there we map obligations per system and role, run a gap assessment, and build the documentation, data governance and oversight the Act expects, usually over two to four months depending on how many systems are in scope. We do not publish a price, since the effort depends on the number and classification of systems, whether you are a provider, a deployer or both, and how much documentation already exists. Legal advice on classification questions in the EU, where you need it, sits outside our fee. We scope first, then quote a fixed price in writing. We also prioritise by exposure rather than tackling everything at once, starting with prohibited practices and transparency duties that already apply, then the high-risk work that the revised dates now allow you to plan properly.