EU AI Act Readiness for providers and deployers
Know which tier each of your AI systems falls into, what that obliges you to do, and what evidence you need. We do the technical work; your counsel owns the legal call.
- Technical readiness work
- 2–3 week gap analysis
- Works with your DPO or counsel
Anyone selling into or operating in the EU with AI in the product
The Act reaches further than many teams expect. It covers systems placed on the EU market, systems used in the EU, and systems whose output is used there. It distinguishes providers, who build, from deployers, who use. Most companies are both.
- SaaS vendors with EU customers and an AI feature in the product.
- Employers using AI in recruiting, performance or scheduling decisions.
- Lenders, insurers and fintechs using models for creditworthiness or pricing.
- Healthcare, education and public sector organisations deploying AI in listed areas.
We are engineers. We classify systems, build the controls and assemble technical documentation, logging, oversight and testing evidence. We do not give legal advice and we work alongside your counsel for the legal interpretation and any notified-body process.
Four tiers, and obligations scale with the tier
Prohibited practices are banned outright: for example manipulative techniques that cause harm, social scoring and certain uses of biometrics.
High-risk systems are those listed in the Act's annexes: safety components of regulated products, and uses in areas such as biometrics, critical infrastructure, education, employment, access to essential services, law enforcement, migration and justice. These carry the heavy obligations.
Limited-risk systems carry transparency duties: tell people they are interacting with AI, label synthetic content, disclose deepfakes.
Minimal-risk systems, the majority, have no new obligations beyond existing law. General-purpose models have their own, separate obligations on their providers.
High-risk obligations for providers and for deployers
The provider carries most of the weight. The deployer's duties are about using the system as intended, keeping people in the loop and keeping records. Where you are both, you do both.
| Area | Provider (builds, places on market) | Deployer (uses under its authority) |
|---|---|---|
| Risk management | Establish and maintain a risk management system across the lifecycle | Use the system according to the provider's instructions |
| Data governance | Training, validation and test data quality, relevance and bias examination | Keep input data relevant and representative, where under your control |
| Technical documentation | Produce and maintain documentation before placing on the market | Keep the instructions for use and your own records |
| Logging | Design for automatic event logging | Retain the logs the system generates for the required period |
| Transparency | Provide clear instructions for use, including what the system can and cannot do | Inform affected people, including workers, where the Act requires |
| Human oversight | Design so that people can understand, monitor and override | Assign trained, competent people with authority to intervene |
| Accuracy, robustness, cybersecurity | Achieve and demonstrate appropriate levels throughout the lifecycle | Monitor operation and report serious incidents to the provider |
| Conformity and registration | Conformity assessment, declaration, marking, registration | Certain deployers register their use; some must run a fundamental rights impact assessment |
| Post-market | Monitoring, corrective action, serious incident reporting | Inform the provider and authorities of serious incidents |
| AI literacy | Train staff to a sufficient level of AI literacy | Train staff to a sufficient level of AI literacy |
A deployer that puts its own name on a high-risk system, changes its intended purpose or substantially modifies it can become the provider, with the full set of provider duties. We flag this early in classification.
The Act applies in stages
Obligations switched on in phases after the Act entered into force. The order below is what matters for planning; confirm the exact dates for your situation with counsel, as transition periods have been subject to amendment.
- Phase 1
Entry into force
The regulation became law. Nothing was yet enforceable, but the clock started for every later phase.
- Phase 2
Prohibitions and AI literacy
Banned practices and the general AI-literacy duty applied first, within months of entry into force. Review your estate for prohibited uses now if you have not.
- Phase 3
General-purpose models and governance structures
Obligations for general-purpose model providers, and the EU and national governance bodies, followed. Mostly relevant if you train or substantially fine-tune foundation models.
- Phase 4
Most high-risk and transparency obligations
The bulk of the Act, including most high-risk requirements and the transparency duties for limited-risk systems. This is the phase most product teams are preparing for.
- Phase 5
High-risk AI in regulated products
AI that is a safety component of products under existing EU product law, such as medical devices and machinery, has the longest transition.
Readiness in four moves
Inventory and classify
List every AI system, decide provider or deployer for each, assign a tier with written reasoning your counsel can review.
Gap analysis
Compare each high-risk and limited-risk system against its obligations: documentation, logging, oversight, accuracy testing, transparency.
Close gaps in order
Transparency notices and logging first because they are cheap. Then oversight design, evals and documentation. Then conformity preparation.
Evidence and rhythm
An evidence folder per system and a review trigger on model, data or purpose change. This slots into the governance cycle.
The technical controls behind compliance
Frequently asked questions
We are a UK company. Does the EU AI Act apply to us?
It applies if you place AI systems on the EU market, or if the output of your system is used in the EU, regardless of where you are established. Many UK vendors with EU customers are providers under the Act. Confirm your position with counsel; we handle the technical side.
Is our customer-support chatbot high-risk?
Usually not. A general support assistant is typically limited-risk, with transparency duties: users must know they are talking to AI. It becomes high-risk if it makes or materially informs decisions in listed areas such as credit, employment or access to essential services.
What is the difference between a provider and a deployer?
A provider develops an AI system or has it developed and places it on the market under its own name. A deployer uses an AI system under its own authority. If you substantially modify or rebrand a high-risk system you may become its provider. Read our compliance guide for worked examples.
Do you provide legal advice?
No. We provide the technical classification, gap analysis, controls and evidence. We work alongside your legal counsel or data protection officer, who owns the legal interpretation.
How long does readiness take?
Classification and gap analysis take two to three weeks. Closing gaps for a high-risk system can take one to two quarters depending on documentation, logging and oversight maturity. Limited-risk systems are usually a matter of weeks.