EU AI Act readiness assessment for one AI agent
Before you build, or before an existing agent goes further, we look at one use case the way a regulator, an auditor and your data protection officer would. You get its likely risk class under the EU AI Act, the obligations that follow for you and your vendors, the data path drawn on one page, and a prioritised list of gaps. We are engineers, not your lawyers: the review is written for your counsel to confirm.
What the engagement covers
- One use case, planned or already running, built by us, by another vendor or in-house.
- The documents and people who know it: the process owner, IT, your DPO or counsel, and the vendor if there is one.
- The AI Act (risk class, role, obligations, dates) and GDPR (lawful basis, minimisation, processors, transfers, DPIA).
- Good fitsA team that has an agent in mind, or a pilot already running, and needs to know what the AI Act and GDPR mean for it before spending more.
- Not a substitute forLegal advice, a conformity assessment by a notified body, or a certification. No certificate exists for being “AI Act compliant”, and we will not sell you one.
What you get, in writing
- Risk classification with reasons: prohibited, high-risk (Annex III), transparency-only (Art. 50) or minimal, and whether you are provider or deployer.
- The obligations that follow, article by article, and the dates they apply: 2 August 2026 for transparency, 2 December 2027 for Annex III high-risk systems.
- The data path on one page: what personal data enters, where it is processed, which sub-processors and model regions are involved, how long it is kept.
- Inputs for your DPIA (GDPR Art. 35) and, where it applies, your fundamental rights impact assessment (AI Act Art. 27).
- A gap list with owners: what the vendor must change, what your process must change, and what we would build differently.
How long it takes
- Kick-off and documents week 1
- Interviews and the data path weeks 1–2
- Classification and gap list weeks 2–3
- Read-out with your counsel end of week 3
Usually 2–3 weeks, depending on how quickly the documents and people are available.
What this service doesn’t do
- A legal opinion. The review is written for your counsel and DPO to confirm.
- The DPIA or FRIA itself. Those are yours as controller and deployer; we supply the inputs.
- A conformity assessment, a certificate or a badge. None of those comes from a review.
- Fixing the gaps. If you want us to, the gap list becomes the brief for a separate engagement.
How the rules apply here
Each control points to the article it answers. We read them on 9 November 2026; your counsel confirms how they apply to you.
Risk classification
AI Act Art. 6Annex IIIAnnex III lists areas such as credit scoring and life and health insurance pricing. A provider who decides an Annex III system is not high-risk must document why (Art. 6(4)) and register it (Art. 49(2)).
Data protection by design
GDPR Art. 25Art. 5(1)(c)Only the data the task needs reaches the model. We check what is sent and what is left out.
Impact assessments
GDPR Art. 35AI Act Art. 27A DPIA where processing is likely to be high-risk; a FRIA for public bodies and for credit and insurance deployers.
Vendors and contracts
GDPR Art. 28Art. 44A DPA, a sub-processor list, and a lawful basis for any transfer outside the EU.
Questions about this service
Is this a legal opinion?
No. It is an engineering and governance review written for your counsel and DPO to confirm. We cite the article for every statement, with the date we read it.
Can you review an agent another vendor built?
Yes, if the vendor shares the information the review needs: model provider and region, sub-processors, logs, test results. Where they can’t, the gap list says so.
What happens after the review?
Nothing, if you choose. The review stands on its own. If you want us to build or fix the agent, the review’s findings become the brief.
Can we try a first screen ourselves?
Yes: the free AI Act risk-class screener on this site asks the same first questions we do. It is a first screen, not legal advice, and it sends nothing anywhere.
Bring one process. Leave with a risk class, a pass bar and a plan.
A 45-minute scoping call with the people who would build it. You get a first view of the AI Act risk class, the controls it needs, and whether an agent is the right tool at all.