01
EU data residency by default
Product runtimes on our own infrastructure across the EU (Germany, France) and North America (Canada). See our security posture.
EU AI Act compliance, scoped before the obligations land.
Regulation (EU) 2024/1689 asks for evidence you can produce: a classification, a technical file, an oversight design, logs that exist. We build that trail for EU teams shipping AI into regulated use cases.
Updated:
What we do
Four pieces of readiness work.
Preparation support, not legal advice. The legal call stays with your counsel.
01
Classification first
Where does your system sit under Regulation (EU) 2024/1689? We classify it before anything else: prohibited practice, high-risk under Annex III, transparency risk under Article 50, or minimal risk. The classification decides which duties apply, and it is the cheapest hour of work in the whole engagement.
02
The Annex III duty set
If the system is high-risk under Annex III, Chapter III Sections 1–3 apply from 2 December 2027: risk management (Art. 9), data governance (Art. 10), technical documentation (Art. 11), record-keeping (Art. 12), transparency (Art. 13), human oversight (Art. 14), and accuracy, robustness and cybersecurity (Art. 15).
03
Documentation that survives an audit
A technical file to Annex IV, a conformity assessment, a registration entry for the EU database under Article 49, a deployer-information pack and a post-market monitoring plan — written from the code and the evidence you already produce, and kept next to the code.
04
Ready for the next change
The regulation and its guidance are still moving, and the dates have already moved once. A trail built as artefacts, checks and versioned evidence absorbs a change in scope or timetable as a version bump — not as a rewrite of the compliance folder.
Compliance work is rarely a standalone project. The same team usually also needs AI workflow automation, custom AI software development, or AI integration services added to a product you already run. One paragraph about the problem is enough to tell us which of the four it is.
Read the law itself: the European Commission on the AI Act regulatory framework, and the EU AI Act Explorer for the text of Annex III and the individual articles cited above. If a claim here does not match the instrument, the instrument wins.
In practice
Who carries which duty.
The same system can make you a provider, a deployer, or both — depending on what you did with it.
01
If you build it
Placing an AI system on the market under your own name makes you a provider. That carries the Chapter III duties, the conformity assessment, the technical documentation and the registration. Provider work is engineering work with a deadline attached.
02
If you use it
Using a provider's system inside your own business makes you a deployer. Article 25 asks for use according to the instructions, human oversight, monitoring, log retention, and telling the people a decision was made about them.
03
What we need from you
Your system, your data and its provenance, the decisions a human takes today, and the one metric that says the AI part is working. We do not need your legal team in the room on day one — we need them in the room for the classification sign-off.
Every engagement starts with a fixed first milestone, scoped and priced before kickoff. The figure is written into the scope and does not move once signed. What a milestone includes is on how an engagement runs.
Trust signals
Proof close to the decision.
Three signals buyers can verify before they start a conversation.
02
Founder-led delivery
The person you contact stays close to the work, from written scope through operation. See how we work.
03
The method is a product
We build and operate the EU AI Act Scanner — five risk tiers, eight obligation areas — and client work runs the same method against your system, your data and your evidence rather than against a template. See it running: the free classifier at euaigap.co.
Questions
What people ask before starting.
The questions a compliance team or a CTO sends us first.
Which EU AI Act obligations apply to us first?
Three sets are already in force: the prohibited practices and the AI-literacy duty, both since 2 February 2025, and the general-purpose AI model obligations since 2 August 2025. If your system is high-risk under Annex III, the Chapter III Sections 1–3 duties — risk management, data governance, technical documentation, record-keeping, transparency, human oversight, accuracy and cybersecurity — apply from 2 December 2027.
Are we a provider or a deployer of AI systems?
You are a provider if you develop an AI system and place it on the market under your own name, and a deployer if you use someone else's system inside your own business. A provider carries the Chapter III duties and the conformity assessment. A deployer carries the Article 25 duties: use the system according to instructions, assign human oversight, monitor it, keep the logs, and tell affected people when it makes decisions about them.
What does the technical documentation have to contain?
Annex IV of Regulation (EU) 2024/1689 sets the list: a general description of the system and its intended purpose, the data and its governance, the monitoring and human-oversight design, the accuracy and robustness metrics, the cybersecurity measures, and the post-market monitoring plan. We write it from the code and the evidence you already produce, so it stays true when the system changes.
Is this legal advice?
No. This is preparation support: engineering work, documentation and evidence, produced by an AI studio. Decisions on classification, conformity assessment and registration stay with your counsel, and with a notified body where one is required. We build the evidence trail; the legal call stays yours.
Do you build the compliance tooling yourselves?
We build and operate the EU AI Act Scanner, an automated assessment for Regulation 2024/1689 with five-tier risk classification, eight-area scoring and four compliance documents. Client work uses the same method, applied to your system, your data and your evidence rather than to a template.
What if our system turns out to be minimal risk?
Minimal risk means the Chapter III Sections 1 to 3 duties do not apply to you, and the classification still has to place your system in one of four categories under Regulation (EU) 2024/1689: prohibited practice, high-risk under Annex III, transparency risk under Article 50, or minimal risk. Some duties do not depend on the classification at all. The prohibited practices and the AI-literacy duty have applied since 2 February 2025, and the general-purpose AI model obligations since 2 August 2025.
Our own compliance posture — subprocessors, the DPA, the security page — is published rather than promised. See the subprocessors register, the DPA and the trust index. The scanner itself is described on the EU AI Act Scanner page.
One paragraph is enough to start.
We take on a limited number of contracts each year. If your paragraph names these three things, one reply can tell you whether it’s a fit.
- The problem What is done by hand today, and by whom.
- The metric The one number that will say it worked.
- The deadline The date it has to work by.