.svg)
Documentation that holds up
The transparency obligations have applied since August 2026. We classify your AI systems and deliver the technical documentation you have to keep as the operator.
- EU AI Act
- The EU AI Act is Regulation (EU) 2024/1689, the European Union’s regulation on artificial intelligence. It sorts AI systems into four risk classes and attaches obligations to them. Those obligations fall mainly on the companies operating a system, not only on the ones who built it.
The duty sits with the operator, not the maker.
Many companies have been using AI for a while without calling it that. An assistant in customer service, a sorting step in the inbox, a drafting tool in marketing.
To a regulator each of those is an AI system with an operator. Whether the tool was bought or commissioned changes little. The questions go to the company putting it to use.
The uncomfortable part is rarely the obligation itself. It gets uncomfortable when nobody can say which systems are running and what data they work with.
Four classes, and where you probably land
The regulation grades by risk. For mid sized companies the third step is almost always the relevant one.
Unacceptable risk
Social scoring of people, targeted exploitation of vulnerabilities, real time biometric identification in public spaces. These uses are banned outright.
ProhibitedHigh risk
Systems in recruitment, credit decisions, critical infrastructure or medical devices. Risk management, data quality requirements, logging and conformity assessment are added.
Extensive obligationsLimited risk
Chatbots, assistants, knowledge agents, text generators. A notice to users and traceable documentation of the use. This covers nearly every project we build.
This is the normal caseMinimal risk
Spell checking, spam filters, recommendations without personal data. Voluntary codes are possible, nothing is mandatory.
No specific obligationsWhat we hand over
A folder you can put in front of an audit without spending two weeks searching first.
System register
An overview of every AI system in the company, with purpose, owner, provider and risk class. The starting point for everything else.
Risk classification
For each system the class with reasoning, not just the claim. Checkable against the criteria in the regulation.
Technical description
Models, providers, processing locations, data sources and interfaces. The first thing an auditor asks about.
Human oversight
Who checks which outputs, where an approval sits, when the system is switched off. Described and implemented in the system.
User notice
How users can tell they are talking to a machine. Wording, placement, and evidence that it is visible.
Link to GDPR
Connection to your record of processing activities, deletion concept and, where required, the data protection impact assessment.
Four steps to the folder
We work along the risk classes. Whatever is classed high comes first.
You receive the material as editable files, not as a PDF nobody can carry forward.
Inventory
Which systems run, who operates them, what data flows.
Classification
Risk class per system, argued along the regulation.
Close the gaps
Missing notices, logging or oversight get retrofitted.
Handover
Documentation, register and instructions for keeping it current.
What this costs
Five questions for your company
If three of them are not answerable on the spot, a register is worth doing.
- Which AI systems run in your company? That includes the tools departments introduced themselves.
- Who owns each system? Not IT in general, but a person.
- Can users tell it is a machine? And can you show that the notice is visible?
- Where is the data processed? Provider, region and legal basis.
- Who checks the outputs? And what happens when the system is obviously wrong?
EU AI Act: common questions
Related topics
Where these figures come from
The articles and deadlines named on this page are in the regulation itself. The primary sources, for anyone who wants to read them.
Last checked August 2026. We revisit these figures when the regulation text or the application dates change.
Tell us what is running.
Thirty minutes are enough for a first classification. If there is nothing to do at your end, we say that too.