If nobody can answer that in one sitting, the Act is not owned yet. In 2 to 3 weeks we review one AI system against the EU AI Act and the GDPR. We work from the architecture and the logs, not from a questionnaire. Every obligation is mapped to a design decision or to a gap.
The AI system is in production, or about to be. Legal has asked whether it is high-risk. Nobody is sure which obligations apply, from when, or who owns them. The model shapes decisions about people, and the record of those decisions is a chat log, or nothing. Compliance was going to be added after the build.
Compliance bolted on after the build.
Every obligation mapped to a design decision, with an owner and a record.
How many AI systems you run that touch people or their data. How many of their decisions have no record you could show an auditor.
At enterprises with an AI system in production that affects customers, employees or the public.
Who have been handed the AI Act next to the GDPR and need an engineering view, not another questionnaire.
Selling a product with a model or an agent inside it to customers in the EU, and asked about the Act in procurement.
Whose GenAI pilot cannot ship because nobody can answer the compliance question.
We read the architecture, the code and configuration, the prompts, the traces and the logs, and the contracts with your model providers. Interviews come after, with the people who own the system.
What the system does and who it affects. Whether you are a provider or a deployer under the Act. The risk tier: prohibited, high-risk, transparency obligations, or none of these. Which GDPR processing it involves, and whether a data protection impact assessment is due.
Every decision the model takes or shapes, who reviews it, and whether a record exists that would stand up in an audit. What goes into the prompts and what is retained. Where inference runs and what leaves your tenancy. Whether people know they are dealing with an AI system, and whether generated content is marked, as Article 50 asks.
Which tools the model can call, how actions are confirmed, and what happens when it is wrong, slow or unavailable. What evaluation and monitoring exist. Then the obligations map, the gap list, and a read-out with your DPO and the owning team.
This is an engineering review, not legal advice. Your DPO and counsel own the legal position. We give them the evidence and the design decisions to defend it.
From 10,000 euros, excluding VAT. The indicative band is 10,000 to 15,000 euros, depending on whether the system is high-risk under the Act and on the number of integrations and data flows. The price is fixed in the proposal before we start.
We run our own real-time voice agent runtime, Atsky Voice, with the GDPR and the EU AI Act designed in. That means session boundaries, data minimisation, and Article 50 disclosure built into the conversation flow. In a Tier-1 Nordic operator's NOC, for Nokia, we built the situation enrichment agent as a deterministic four-step flow rather than an open agent loop. The NOC needs reproducible, auditable output, so the flow had to be one it could replay. The agent recommends and the NOC decides. Every run is traced end to end with OpenTelemetry, and inference stays inside the operator's tenancy. For a Nokia account in Japan, we treated residency and sovereignty as separate requirements. Each customer requirement was traced to one or the other, so the design could be defended line by line.
Good. They need the engineering facts: what the system decides, what it records, where the data goes. That is what we produce.
Deployers have obligations too, and so does anyone whose system touches personal data. The review says which ones apply to you.
Read access to the architecture, the code or configuration, the traces and logs, and one owner for a 45-minute interview.