EU AI Act Compliance Services: AI Inventory, Risk Classification, and High-Risk Readiness Before December 2027
EU AI Act compliance readiness for companies that build, sell, or use AI in the European Union, wherever they are based. We map your AI systems, classify each one under the Act, assess it against the requirements that apply to your role, and test it for bias, robustness, and cybersecurity. You get a risk-ranked roadmap to the deadlines that matter, and a clear path to ISO 42001 certification. Most assessments take 6–12 weeks.
What Is EU AI Act Compliance?
EU AI Act compliance means meeting Regulation (EU) 2024/1689, the European Union's law on artificial intelligence. The Act sorts AI by risk. A few practices are banned outright, high-risk systems must meet strict requirements before they are sold or used, some systems must tell people they are dealing with AI, and general-purpose AI models carry their own duties. What you must do depends on the risk tier and on your role: provider, deployer, importer, or distributor.
The Act reaches well beyond Europe. A US or Indian software company is in scope if it places AI on the EU market, or if the output of its AI is used in the EU. So is any business in the EU that uses AI at work, from hiring tools to customer chatbots.
Accredify Global helps you find out where you stand and what to fix first. We work alongside your counsel, who interprets the law, and your engineers, who build the controls. For the management system that holds it all together, we certify ISO/IEC 42001 under UAF accreditation.
EU AI Act in 2026: New Deadlines, Live Enforcement, and the First Harmonised Standard
The high-risk deadlines moved. The Digital Omnibus on AI, Regulation (EU) 2026/1744, entered into force on 27 July 2026. High-risk rules for stand-alone systems listed in Annex III now apply from 2 December 2027, and for AI built into regulated products under Annex I from 2 August 2028. The Omnibus also softened the AI literacy duty, extended relief for smaller companies, and added two prohibited practices: AI that generates child sexual abuse material, and "nudifier" tools that create intimate images of real people without consent.
Other duties did not move. Transparency duties under Article 50, such as telling people they are talking to AI and labelling deepfakes, have applied since 2 August 2026. Systems already on the market before that date have until 2 December 2026 to add machine-readable marking to AI-generated content. Since 2 August 2026 the AI Office can also fine providers of general-purpose AI models.
Standards are arriving. EN 18286, the European standard for quality management systems under the Act, was published by CEN-CENELEC on 31 July 2026 and cited in the Official Journal in October 2026 as the first harmonised standard. It is designed to sit on top of ISO/IEC 42001, not replace it.
Sources: AI Act, Regulation (EU) 2024/1689 (EUR-Lex) · Digital Omnibus on AI (White & Case) · GPAI enforcement (Bratby Law) · EN 18286 harmonised (AI Weekly)
EU AI Act Timeline: What Applies When
The dates below reflect the Act as amended by the Digital Omnibus on AI.
| Date | What applies | Who it affects |
|---|---|---|
| 2 February 2025 | Prohibited practices banned; AI literacy duty | Everyone placing or using AI in the EU |
| 2 August 2025 | General-purpose AI model obligations; governance and penalty rules | Providers of GPAI models |
| 2 August 2026 | Transparency duties (Article 50); AI Office can fine GPAI providers | Chatbots, deepfakes, AI-generated content, GPAI providers |
| 2 December 2026 | Grace period ends for machine-readable marking on older generative AI systems | Generative AI already on the market before 2 August 2026 |
| 2 August 2027 | GPAI models placed on the market before 2 August 2025 must comply | Providers of older GPAI models |
| 2 December 2027 | High-risk requirements for Annex III systems | HR, credit, insurance, education, biometrics, critical infrastructure, public services |
| 2 August 2028 | High-risk requirements for AI in products under Annex I | Medical devices, machinery, toys, vehicles, and other regulated products |
EU AI Act Risk Categories, and What Each One Means for You
Classification is the first and most important step. Get it wrong and you either over-build or miss a legal duty.
| Category | Examples | What you must do |
|---|---|---|
| Prohibited | Social scoring, manipulative techniques, untargeted scraping of faces, emotion recognition at work or school, CSAM and "nudifier" tools | Stop. These cannot be used in the EU |
| High-risk | Hiring and worker management, credit scoring, life and health insurance pricing, education, biometrics, critical infrastructure, and AI in regulated products | Risk management, data governance, documentation, logging, human oversight, accuracy and security, conformity assessment, and registration |
| Transparency | Chatbots, deepfakes, AI-generated text and images, emotion recognition and biometric categorisation | Tell people, label content, and mark outputs |
| Minimal | Spam filters, recommendations, most internal productivity tools | No specific duties beyond AI literacy; voluntary codes |
| General-purpose AI models | Foundation and large language models offered to others | Technical documentation, a copyright policy, and a training data summary; more for systemic-risk models |
High-Risk AI Requirements, and What We Assess
The core duties for providers of high-risk AI, and the evidence our assessment looks for.
| Requirement | What the Act expects | Evidence we look for |
|---|---|---|
| Risk management (Art. 9) | A risk process that runs for the whole life of the system | Risk register, testing, and residual risk decisions |
| Data governance (Art. 10) | Relevant, representative data, examined for bias | Data sheets, bias testing, and data quality checks |
| Technical documentation (Art. 11) | Documentation set out in Annex IV, kept up to date | A documentation map against Annex IV |
| Record-keeping (Art. 12) | Automatic logs that let events be traced | Logging design, retention, and access |
| Transparency to deployers (Art. 13) | Clear instructions for use | Instructions covering purpose, limits, and oversight |
| Human oversight (Art. 14) | People able to understand, override, and stop the system | Oversight design and trained operators |
| Accuracy, robustness, cybersecurity (Art. 15) | Appropriate accuracy and resilience against errors and attacks | Metrics, robustness tests, and AI security testing |
| Quality management (Art. 17) | A documented quality management system | An ISO 42001-based system aligned to EN 18286 |
| Conformity, CE marking, registration | Conformity assessment, EU declaration, CE mark, and EU database registration | A conformity plan and registration readiness |
| Post-market monitoring and incidents | Monitoring in use, and reporting serious incidents within 15 days at most | A monitoring plan and incident procedure |
Deployers carry their own duties too: use the system as instructed, assign trained human oversight, monitor it, keep its logs for at least six months, and tell workers before AI is used on them. Public bodies, and deployers using AI for credit scoring or life and health insurance pricing, must also complete a fundamental rights impact assessment.
How Our EU AI Act Readiness Assessment Works
Six stages, from an AI inventory to a roadmap your board can sign off.
Not sure whether your AI is high-risk, or which deadline applies to you? A free scoping review answers that first.
Book a free scoping reviewISO 42001, EN 18286, and NIST AI RMF: How They Fit the EU AI Act
No single certificate makes you AI Act compliant. These standards give you the structure and evidence that compliance rests on.
| Standard | What it is | How it helps with the Act |
|---|---|---|
| ISO/IEC 42001 | The international AI management system standard, certifiable by accredited bodies | Governance, risk, impact assessment, and lifecycle controls the Act builds on |
| EN 18286 | The European quality management standard for AI Act purposes | Presumption of conformity with Article 17 when followed; layered on ISO 42001 |
| NIST AI RMF | A voluntary US framework: Govern, Map, Measure, Manage | Useful structure for global groups, mapped to the same evidence |
| ISO/IEC 27001 | Information security management | Supports the cybersecurity part of Article 15 |
| ISO/IEC 27701 and GDPR | Privacy management and EU data protection law | Personal data in training and use, which the AI Act does not replace |
Read more in ISO 42001 and the EU AI Act, and see how certification bodies for AI management systems are assessed in ISO/IEC 42006 explained.
Who Needs EU AI Act Compliance?
AI features sold to EU customers, including copilots and chatbots.
CV screening, interview analysis, and worker management tools are high-risk.
Credit scoring and life and health insurance pricing are high-risk.
AI in regulated devices falls under the Annex I timeline.
Admissions, grading, and proctoring tools are high-risk.
US, UK, Indian, and Gulf companies whose AI output is used in the EU.
EU AI Act Fines, Compliance Cost, and Timeline
Maximum fines under the Act
- Up to €35 million or 7% of worldwide turnover for prohibited practices
- Up to €15 million or 3% for most other obligations, including GPAI duties
- Up to €7.5 million or 1% for supplying incorrect information to authorities
- For SMEs and start-ups, the lower of the two amounts applies
Cost and timeline
We do not publish a price list. The cost depends on how many AI systems you have, how many are high-risk, and how much testing is needed. A free scoping review gives you a tailored proposal.
| Inventory and classification | The first stage of every assessment |
|---|---|
| Full readiness assessment | 6–12 weeks, depending on scope |
| Closing gaps | Planned back from your deadline |
How to Choose EU AI Act Compliance Services
Questions worth asking any EU AI Act provider, and how Accredify Global answers them.
| Question to ask | Accredify Global's answer |
|---|---|
| Can you certify us as EU AI Act compliant? | No one can for most systems. Providers run the conformity assessment and sign the EU declaration. We certify ISO 42001, which supports it. |
| Are you a notified body? | No. Where the Act requires a notified body, such as for some biometric and product-embedded AI, we help you prepare for one. |
| Do you test the AI itself? | Yes. Bias, robustness, and security testing produce the evidence Articles 10 and 15 ask for. |
| Can you prepare us and also certify our ISO 42001? | Not both. If we certify you, our EU AI Act work stays at assessment and testing, so our certification stays impartial. |
| Do you give legal advice? | No. Legal interpretation stays with your counsel; we work alongside them. |
| How is it priced? | A tailored proposal after a free scoping review. |
What You Receive From an EU AI Act Assessment
Every AI system, its owner, purpose, data, and your role.
The risk tier for each system, with the reasoning recorded.
Each in-scope system measured against the articles that apply.
Bias, robustness, and security findings, where in scope.
Actions in order of risk and deadline, with owners.
A plain summary for your board and customers.
Frequently Asked Questions About EU AI Act Compliance
Answers on scope, deadlines, high-risk AI, ISO 42001, fines, and cost.
What is the EU AI Act?
The EU AI Act, Regulation (EU) 2024/1689, is the European Union's law on artificial intelligence. It bans a small number of AI practices, sets strict requirements for high-risk AI systems, adds transparency duties for chatbots and AI-generated content, and regulates general-purpose AI models.
Does the EU AI Act apply to companies outside the EU?
Yes. It applies to providers that place AI systems or general-purpose AI models on the EU market wherever they are based, to deployers using AI in the EU, and to providers and deployers outside the EU when the output of their AI is used in the EU.
When do the EU AI Act high-risk rules apply?
After the Digital Omnibus on AI, high-risk rules for stand-alone systems listed in Annex III apply from 2 December 2027, and for AI built into regulated products under Annex I from 2 August 2028. Prohibited practices have been banned since 2 February 2025.
What changed with the Digital Omnibus on AI?
Regulation (EU) 2026/1744 entered into force on 27 July 2026. It delayed the high-risk deadlines, softened the AI literacy duty to taking measures to support AI literacy, extended relief for smaller companies, and added prohibitions on AI that generates child sexual abuse material or non-consensual intimate images of real people. Transparency duties were not delayed.
Is my AI system high-risk?
It is high-risk if it is a safety component of, or itself, a product covered by EU product laws listed in Annex I, or if it is used in an Annex III area such as hiring and worker management, credit scoring, life and health insurance pricing, education, biometrics, critical infrastructure, or access to public services. Some Annex III systems can be exempted if they pose no significant risk, but the reasoning must be documented.
What are the transparency duties under Article 50?
Since 2 August 2026, people must be told when they are interacting with an AI system, deepfakes and certain AI-generated text must be disclosed, AI-generated content must be marked in a machine-readable way, and people must be told when emotion recognition or biometric categorisation is used on them. Older generative AI systems have until 2 December 2026 for the marking duty.
What does a provider of high-risk AI have to do?
Run a risk management system, use well-governed data, keep technical documentation and automatic logs, give deployers clear instructions, design for human oversight, ensure accuracy, robustness, and cybersecurity, operate a quality management system, complete a conformity assessment, sign an EU declaration of conformity, apply the CE mark, register the system, and monitor it after launch.
What do deployers of high-risk AI have to do?
Use the system according to its instructions, assign trained people to oversee it, monitor its operation, keep its logs for at least six months, and inform workers before using it on them. Public bodies and deployers using AI for credit scoring or life and health insurance pricing must also complete a fundamental rights impact assessment.
What are the EU AI Act fines?
Fines reach up to €35 million or 7% of worldwide annual turnover for prohibited practices, up to €15 million or 3% for most other obligations, and up to €7.5 million or 1% for supplying incorrect information to authorities. For SMEs and start-ups, the lower amount applies.
Is there an EU AI Act certification?
Not as a general certificate. For most high-risk systems the provider carries out the conformity assessment itself and signs an EU declaration of conformity; some systems need a notified body. ISO/IEC 42001 certification is the internationally recognized way to show your AI management system is independently audited.
Does ISO 42001 make us EU AI Act compliant?
Not on its own, but it covers much of the groundwork: governance, risk and impact assessment, data and lifecycle controls, and monitoring. EN 18286, the first harmonised standard under the Act, is designed to sit on top of ISO/IEC 42001 to meet the Article 17 quality management requirement.
What is EN 18286?
EN 18286 is the European standard for quality management systems for EU AI Act purposes. CEN-CENELEC published it on 31 July 2026, and it was cited in the Official Journal in October 2026 as the first harmonised standard under the Act, giving presumption of conformity with Article 17 when followed.
Is Accredify Global a notified body under the EU AI Act?
No. We assess readiness, test AI systems, and certify ISO/IEC 42001 under UAF accreditation. Where the Act requires a notified body, we help you prepare for that assessment.
How long does an EU AI Act readiness assessment take?
Most assessments take 6 to 12 weeks, depending on how many AI systems you have and how many are high-risk. The inventory and classification come first, so you know early which systems need the most work.
How much does EU AI Act compliance cost?
There is no list price. Cost depends on the number of AI systems, how many are high-risk, your role as provider or deployer, and how much testing is needed. A free scoping review gives you a tailored proposal.
Know Which of Your AI Systems the EU AI Act Covers, and What Is Due When
Tell us about the AI you build, buy, and use. We'll confirm your role, flag anything high-risk or prohibited, and send a tailored proposal.
Book your free scoping review →Last reviewed by the Accredify Global compliance team.