Artificial intelligence, advised on as a regulated system.

Most organisations did not decide to become AI deployers. They bought software that acquired AI features, or built a model for one purpose and found it used for three.

The EU AI Act does not ask how the situation arose. It asks which systems you operate, in which role, at which risk level — and it attaches obligations, documentation and deadlines to the answer. The GDPR asks a different set of questions about the same systems, and reaches its own conclusions about lawful basis, transparency, automated decision-making and the data used to train.

Very few organisations can currently answer either set of questions with confidence about their whole estate.

We start with classification, because every other obligation depends on it. Which of your systems fall inside the Act; whether you are a provider, a deployer, an importer or a distributor for each of them — a distinction that frequently changes when a system is fine-tuned, rebranded or embedded; and what follows for each classification.

From there the work is governance and implementation: the policies, the documentation, the human oversight arrangements, the AI literacy obligations, the contractual position with suppliers who may or may not accept the role the Act assigns them, and the impact assessments that the AI Act and the GDPR each require on their own terms.

We advise on AI as it is actually deployed — inside procurement processes, HR systems, credit decisions, customer service, fraud detection and product features — rather than as an abstract category.

The AI Act does not operate alone. Where the system processes personal data, the GDPR applies in full and asks harder questions. Where the system is part of critical infrastructure, NIS2 applies. Where the deployer is a financial entity, DORA governs the technology risk. Where the model sits in a product, sectoral safety rules may apply.