Regulation (EU) 2024/1689
EU AI Act compliance and AI governance
Use AI with confidence. We help you understand your obligations under the EU AI Act, put AI governance in place and secure the AI systems you build or use.
- EU AI Act
- AI Omnibus (EU) 2026/1744
- ISO/IEC 42001
- OWASP LLM Top 10
- EU company · Estonia
- 15+ years in cybersecurity
- ECSO member network
- Certified ethical hackers
- Remote across the EU
Who is affected
The AI Act applies to almost every company using AI
The EU AI Act sets obligations for providers that develop AI systems and for deployers that use them — including companies that simply use third-party AI tools. The obligations depend on the risk level of each use case.
| Risk level | What it means |
|---|---|
| Prohibited | Practices banned outright, such as social scoring or manipulative techniques that cause harm. |
| High risk | Uses such as recruitment, credit scoring, education or critical infrastructure: risk management, data governance, human oversight, logging and conformity requirements. |
| Transparency | Chatbots, deepfakes and AI-generated content: people must be informed they are dealing with AI. |
| Minimal risk | Most other uses: no specific obligations beyond AI literacy, but good governance is still recommended. |
Timeline
Key AI Act dates
| Date | What applies |
|---|---|
| 2 February 2025 | Prohibited AI practices and the AI literacy obligation for staff |
| 2 August 2025 | Obligations for general-purpose AI (GPAI) models and governance rules |
| 2 August 2026 | Transparency obligations (AI interaction disclosure, deepfake labelling) and most remaining provisions |
| 2 December 2027 | High-risk AI systems listed in Annex III (e.g. recruitment, credit, education), as amended by the AI Omnibus |
| 2 August 2028 | High-risk AI embedded in regulated products (Annex I), as amended by the AI Omnibus |
Dates reflect the AI Omnibus, Regulation (EU) 2026/1744, which entered into force on 27 July 2026 and deferred the high-risk obligations. Fines under the AI Act reach up to €35 million or 7% of global turnover for prohibited practices.
Our services
From inventory to governance and testing
STEP 1
AI inventory & classification
We identify every AI system you develop or use, your role (provider or deployer) and the risk level of each use case.
STEP 2
Gap analysis & roadmap
Your obligations by system and date, with a prioritised plan to meet them.
STEP 3
AI governance framework
AI policy, acceptable use, roles, approval workflow, risk assessment and AI literacy training.
STANDARD
ISO/IEC 42001
Implementation of an AI management system aligned with the international standard — and integrated with ISO 27001.
TESTING
AI security testing
Pentesting of chatbots, assistants and agents: prompt injection, data leakage and insecure tool use.
SUPPORT
Ongoing oversight
Monitoring of new AI use cases and regulatory changes as part of our CISO as a Service.
FAQ
Frequently asked questions
Does the AI Act apply if we only use tools like ChatGPT or Copilot?
Yes, as a deployer. You must ensure sufficient AI literacy among staff, respect transparency rules and assess whether any use case is high risk — for example, using AI to screen job applicants.
Have the high-risk deadlines changed?
Yes. The AI Omnibus, Regulation (EU) 2026/1744, moved the obligations for high-risk systems in Annex III to 2 December 2027 and for AI embedded in regulated products to 2 August 2028. Prohibitions, AI literacy and general-purpose AI rules were not delayed.
What are the fines?
Up to €35 million or 7% of worldwide annual turnover for prohibited practices, up to €15 million or 3% for most other infringements, and lower amounts for supplying incorrect information.
What is ISO/IEC 42001 and do we need it?
ISO/IEC 42001 is the certifiable international standard for AI management systems. It is not mandatory, but it provides a recognised framework to demonstrate responsible AI governance and fits naturally with ISO 27001.
Where should we start?
With an inventory: list the AI systems you use or develop, what they are used for and who is responsible. From there we classify risk and define your obligations.
Next step
Make AI an advantage, not a liability.
Start with an AI inventory and a clear view of your AI Act obligations.