Part of IOanyT’s engineering capability. Most clients reach this team through a Workflow Diagnostic or Proof Sprint. How we work

Advisory · AI governance

EU AI Act readiness assessment: which of your AI uses the Act touches, and what evidence each needs

You build, sell or use AI in the EU, and someone has asked which of your systems the EU AI Act covers and what you will have to show. We map every AI use in your business against the Act’s own categories and tell you, in writing.

Book a free Reliability Review Get a fixed quote

ISO/IEC 42001 certified for AI management, with ISO/IEC 27001 and ISO 9001. Readiness work, not legal advice and not a certification.

Who it’s for

Product, risk and compliance leads at firms that build, sell or use AI in the EU.
Lenders and insurers first: Annex III lists AI that evaluates people’s creditworthiness or credit score (except fraud detection), and AI for risk assessment and pricing in life and health insurance, as high-risk.
Anyone who has been asked which of their systems the Act covers, and what they will have to show.

What you get

An inventory of your AI

Every AI system and use in the business, including AI inside the software you buy.

Likely category for each

Its likely category under the Act, with the article or annex it turns on, for your legal advisers to confirm.

Your likely role

For each use: provider or deployer.

Evidence gaps and a plan

What you can show today, what is missing, and a plan to close the gaps in order.

How it works

Step 1

Kick-off

We agree the scope and who handles legal and risk on your side, so we can work alongside them.
Step 2

Inventory

We list every AI system and use in the business, including AI inside the software you buy.
Step 3

Map

For each use: its likely category under the Act, the article or annex it turns on, and your likely role.
Step 4

Evidence gaps and plan

What you can show today, what is missing, and a plan to close the gaps in order.

The dates

Under the EU’s 2026 Digital Omnibus (Regulation (EU) 2026/1744), obligations for high-risk systems listed in Annex III apply from 2 December 2027.
High-risk systems under Annex I: from 2 August 2028.
Article 50 transparency duties: from 2 August 2026.

Last reviewed: 2026-10-22. Not legal advice: confirm dates with your advisers. For the basics, see EU AI Act basics in the Academy.

What you own

The inventory, the map and the gap list are yours, for your legal advisers and auditors.
This is readiness work, designed to support your own conformity work with your legal advisers. It is not legal advice and not a certification.

What it does not cover

Legal advice or a legal opinion.
A conformity assessment, CE marking or any certification.
Building the controls or the evidence (quoted separately; see the Workflow Diagnostic and Proof Sprint).
Other laws, such as data protection.

ISO/IEC 42001
ISO/IEC 27001
ISO 9001
Member of Nasscom

Our own AI work runs under a certified AI management system, and the evidence we hand over is built the same way.

EU AI Act readiness questions

Will this make us compliant?

No. It shows where you stand and what evidence you will need. Conformity is the provider’s or deployer’s own duty, with its legal advisers.

When do the high-risk rules apply?

Under the EU’s 2026 Digital Omnibus (Regulation (EU) 2026/1744), obligations for high-risk systems listed in Annex III apply from 2 December 2027. Not legal advice: confirm dates with your advisers.

Is credit scoring or insurance pricing high-risk?

Annex III lists AI that evaluates people’s creditworthiness or credit score (except fraud detection), and AI for risk assessment and pricing in life and health insurance, as high-risk. The map shows where your uses fall.

Does IOanyT certify anything?

No. ISO/IEC 42001 certifies our own AI management system, not your system or anything we deliver.

Start with the free Review.

Free, 60–90 minutes. Bring the system or decision you are weighing; we tell you what to check first, in a 2-page note you keep.