AI ACT AND COMPLIANCE
Your systems' obligations under the AI Act
Risk classification, transparency and provider and deployer roles: what the European regulation on artificial intelligence actually requires, applied to your case.
The AI Act is the first European regulation to govern artificial intelligence in a comprehensive way, and it applies in phases with different obligations depending on the system's risk and the role of whoever places it on the market or uses it. The first question is not technical but legal: which systems fall within the scope of the regulation, how they are classified and who is responsible for what. Getting the framing wrong means building compliance on a mistaken premise. I start by mapping the AI systems in use or under development, determine their risk class and the organisation's role, then define the concrete obligations that follow. Fines reach up to 3% of worldwide turnover for breaches of transparency obligations and up to 35 million or 7% for prohibited practices, but the value of correct framing lies above all in avoiding needless obligations and focusing on those that count.
WHAT IT INCLUDES
What it includes
Mapping of AI systems
A census of the systems in use, under development or bought from third parties, as the basis for every later assessment.
Risk classification
Placing each system in the AI Act's categories, from prohibited cases to high risk to minimal obligations.
Provider and deployer roles
Determining the organisation's role along the chain and the specific obligations that follow.
Transparency obligations
Article 50 duties on informing users, from chatbots to AI-generated or manipulated content.
Documentation and governance
Setting up the technical documentation, assessments and organisational safeguards required by the regulation.
Coordination with GDPR and cybersecurity
Integrating AI Act obligations with data protection and security, where systems process personal data.
WHO IT IS FOR
Who it is for
The service is designed for companies that develop AI systems, for those that integrate them into their products and for organisations that simply use them in internal processes, all subject to different obligations depending on their role. It is the starting point for those who must understand whether and how the AI Act concerns them, before investing in obligations that may not apply or overlooking ones that are due.
HOW IT WORKS
How it works
Step 01
Inventory and framing
Mapping the AI systems and identifying those that fall within the scope of the regulation.
Step 02
Classification and roles
Assigning each system a risk class and the organisation its role along the chain.
Step 03
Compliance plan
Defining the concrete obligations, priorities and documentation to produce, in phases.
FREQUENTLY ASKED
Frequently asked questions
Does the AI Act apply to my company? Am I a provider or a deployer?
The AI Act applies both to those who develop or place an AI system on the market, the provider, and to those who use it in the course of their activity, the deployer, with different obligations depending on the role and the system's risk level. The same organisation can be a provider for some systems and a deployer for others. Determining the role is the first step, because the obligations follow from it.
What does the AI Act require on transparency (Article 50)?
Article 50 imposes transparency obligations towards users: people must know when they are interacting with an AI system, such as a chatbot, and AI-generated or manipulated content, such as text, images or audio, must be identifiable as such. The aim is that users are not misled about the origin of what they are interacting with.