EU AI Act compliance audit

The audit covers internally developed systems, APIs, AI functions integrated into ordinary software and general tools used by teams. For each, we record the provider, purpose, affected persons, data, output and decisions supported.

A company merely using a system is generally a deployer but may become a provider if it develops the system, places it on the market under its own name or substantially modifies it under the Regulation’s conditions.

The commercial label ‘AI assistant’ does not determine the regime. What matters is the function and context in which the system is put into service.

• Prohibited practices: immediate review and cessation of scenarios covered by the Regulation’s prohibitions.
• Transparency: AI interaction, emotion recognition, deepfakes and certain public-interest materials.
• High risk: identifying cases in the Regulation’s annexes and applicable exceptions.
• GPAI: distinct obligations for general-purpose model providers and downstream cooperation.
• Limited risk: internal governance, GDPR, consumers, intellectual property and security.
• Exclusions: research, personal use or other situations only if the precise conditions are met.

Prohibitions and AI literacy apply from 2 February 2025, while governance rules and GPAI-model obligations apply from 2 August 2025. Article 50 transparency obligations apply from 2 August 2026.

Following amendments agreed at EU level in 2026, the Commission indicates application of the rules for Annex III high-risk systems from 2 December 2027 and systems embedded in regulated products from 2 August 2028. The timetable must be rechecked for each project because AI Act implementation remains dynamic.

The report links each obligation to an owner, deadline and evidence: register, assessment, procedure, log, instruction, training or contractual clause. Measures are prioritised by applicability and impact.

For high-risk systems, risk management, data quality, technical documentation, logging, deployer information, human oversight, accuracy, robustness and security may be relevant. The legal audit is coordinated with the technical team and, where appropriate, conformity assessment.