EU AI Act compliance
for the company that uses AI
Why this concerns you
The common assumption is that the AI Act is a problem for technology companies. It is not. The Regulation distinguishes between the provider, who places a system on the market, and the deployer, who uses it. Most companies are deployers, often without having decided to be.
AI arrives inside software bought for something else: a recruitment platform that ranks candidates, a customer service tool that drafts replies, an assistant embedded in the office suite. Each of those is a system in use, and each belongs in the inventory.
Where the use falls under Annex III — recruitment and worker management among them — the system is high-risk and the deployer has obligations of its own. That is covered on the high-risk systems page.
What we do
Inventory and classification
We identify the AI systems actually in use, including the ones that arrived as a feature of something else, and classify them by risk tier under the Regulation.
AI use policy
What staff may use, for what, and with what data. Written so it can be followed, and so that a breach of it is something the company can act on.
Staff training
Article 4 requires providers and deployers to take measures supporting the AI literacy of the people who operate these systems on their behalf. Training is the usual measure; we deliver it as part of the package.
Technical documentation
For high-risk systems: risk management, data governance, logging, human oversight and the records the Regulation requires under Articles 9 to 15.
What non-compliance costs
Up to 35 million EUR or 7% of worldwide annual turnover for using prohibited AI systems.
Up to 15 million EUR or 3% for non-compliance of high-risk systems.
Up to 7.5 million EUR or 1% for supplying incorrect information to the authorities.
Compliance packages
Fixed, transparent prices. Each package builds on the one before it.
Basic
800 EUR
- Full AI audit (one day)
- Tailored AI use policy
- List of approved AI tools
- Risk report and recommendations
- One staff training session (2h)
Standard
2,000 EUR
- Everything in Basic
- Risk assessment per department
- Internal AI procedures (HR, marketing, operations)
- AI contract clauses for suppliers
- Three staff training sessions
- Three months of post-implementation support
Enterprise
3,600 EUR
- Everything in Standard
- Complete register of AI systems
- AI impact assessment (adapted DPIA)
- Baseline NIS2 policies included
- Outsourced AI officer for six months
- Priority support for six months
- Updates as the rules change
The initial assessment audit is free and carries no obligation to continue.
Frequently asked
We do not build AI. Does the Regulation still apply to us?
In most cases, yes. Regulation (EU) 2024/1689 places obligations on the deployer, that is the company that uses an AI system in its own activity, not only on the provider that builds it. If your staff use a general-purpose assistant, if your recruitment software scores candidates, or if a supplier has added an AI feature to a tool you already licence, you are a deployer.
What are the penalties?
Up to 35 million EUR or 7% of worldwide annual turnover for using prohibited AI systems; up to 15 million EUR or 3% for non-compliance of high-risk systems; up to 7.5 million EUR or 1% for supplying incorrect information to the authorities. In Romania the supervisory authority is designated by national law.
Where do we start?
With an inventory. Most companies underestimate how many AI systems are already in use, because they arrive as features inside software that was bought for something else. Until the inventory exists, no classification and no documentation is possible.
What does it cost?
Packages start at 800 EUR for the Basic tier and run to 3,600 EUR for the Enterprise tier, which covers full compliance for high-risk systems. The initial assessment audit is free.
Which AI systems are already in use in your company?
Most companies find more than they expected. The initial audit is free.
Request a free audit