EU AI Act
Readiness & Engineering

Record AI tools, product features, system owners, suppliers, model versions, intended uses, affected people, and data flows. Support a review of provider and deployer roles, prohibited uses, risk classification, and applicable requirements with your appointed specialists. Keep confirmed findings separate from questions that need legal review.

Implement the agreed user notices, content disclosures, permissions, action approvals, human review, audit records, and stop controls where required. Define what the system can do, who can approve an action, and how operators respond to failures. Verify controls in the application and connected tools.

Test representative tasks, incorrect outputs, prompt injection, unauthorized retrieval, tool misuse, and approval bypasses. Agree accuracy, robustness, and bias testing for the intended use and available data. Record test conditions, results, limitations, fixes, and retest evidence. A security test alone does not establish AI Act compliance.

Connect requirements to controls, owners, test results, and open actions. Organize system descriptions, supplier documentation, model and data records, operating limits, and change history. Support technical documentation, incident procedures, and monitoring within the agreed scope. Use the client’s existing evidence or GRC tools where suitable.

Provide practical training for each team’s tools, tasks, experience, and responsibilities. Cover permitted data, output checking, human oversight, escalation, and incident reporting where relevant. Supply exercises, usage guidance, and training records. Agree learning goals and follow-up actions; training supports readiness and does not certify legal compliance.