Deployers of AI tools
You use AI in decisions about people: recruitment, credit, customer service. Deployer obligations apply even though you built none of it.
The problem
You cannot comply with obligations you have not mapped
The AI Act regulates by risk category: some practices are prohibited outright, high-risk systems carry substantial obligations around risk management, data governance, documentation, human oversight and monitoring, and general-purpose AI models have their own regime. Which category each of your systems falls into is a factual question about what the system does and where it is used, and most organisations have not answered it system by system. Guessing in either direction is expensive: over-compliance wastes engineering effort, under-compliance risks penalties that scale with global turnover.
The alignment review does the factual work: inventory, classification, obligation mapping and an evidence-based assessment of where your current practices stand.
Deliverables
What an engagement includes
- D1AI system inventory and classificationEvery in-scope system identified and classified against the Act's risk categories, with the reasoning documented so it can be defended or revisited as guidance evolves.
- D2Role determinationFor each system: are you the provider, the deployer, an importer or distributor? Your obligations depend on it, and organisations are frequently more than one at once.
- D3Obligation mappingThe specific articles that apply to each system and role, translated into concrete requirements your teams can recognise in their own work.
- D4An evidence-based gap registerCurrent practices tested against each obligation, with gaps ranked by exposure and effort, not an undifferentiated list of everything.
- D5Re-review after remediationOnce gaps are closed, we verify and update the register, giving you a defensible record of diligence over time.
Who this is for
Three situations we see most
Product companies selling into the EU
Provider obligations follow your product into the EU market, wherever you are based. Buyers are already asking for evidence of alignment.
Organisations pursuing ISO/IEC 42001
The Act and the standard overlap heavily. Map once, use twice: the review's outputs feed directly into an AI management system.
An assurance review, not legal advice: we establish the technical and governance facts, test them against the Act's requirements and document the gaps. Interpretation of genuine legal edge cases belongs with your counsel, and our reports are written to slot straight into that conversation.
FAQ
Fair questions, straight answers
Does ISO/IEC 42001 certification satisfy the EU AI Act?
No, though it helps substantially. The Act is law with its own specific obligations; the standard is a management system that builds the governance, documentation and oversight those obligations rest on. Organisations running both an AI management system and an obligation-level mapping are in the strongest position, and the two share most of their groundwork.
We only use AI tools. Does the Act apply to us?
Quite possibly. The Act places obligations on deployers, not only on the companies that build AI. If your organisation uses AI systems in areas the Act treats as higher risk, such as employment decisions or access to essential services, deployer obligations such as human oversight and monitoring apply to you.
Is this legal advice?
No. It is an evidence-based assurance review: we establish what your systems do, classify them with documented reasoning, and test your practices against the Act's requirements. Where genuine legal interpretation is needed, the report frames the question precisely for your counsel, which makes their time cheaper and their answer better.