Which systems, in which role, with which obligations — and in what order.

01Who it is for

Organisations deploying or procuring AI systems, particularly where obligations differ between provider and deployer; groups whose AI governance was designed before the Act was finalised.

02The problem

“We do not know which of our AI systems the Act captures, which role we occupy for each, or what we must have in place and by when.”

03Scope

Inventory and classification of AI systems; role determination; applicable obligations and timelines; interaction with the GDPR; governance, documentation and AI literacy requirements; supplier and contractual position.

04Method

System inventory workshopIncluding the AI that arrived inside software nobody classified as AI.
ClassificationAgainst the Act's risk tiers, with the reasoning recorded — because the classification will be questioned.
Role analysis per systemProvider, deployer, importer or distributor. It changes when a system is fine-tuned, rebranded or embedded.
Obligation mappingWhat follows from each classification, and what the GDPR adds on its own terms.
RoadmapSequenced by legal deadline, not by internal convenience.

05Deliverables

Classified AI system register
Obligation map by system and role
Gap analysis
Sequenced roadmap
Board briefing

Timeline note. The Digital Omnibus deferred the high-risk obligations to 2 December 2027 (Annex III) and 2 August 2028 (Annex I). It did not touch Article 4 on AI literacy, which has applied since 2 February 2025, nor the transparency and marking rules of Article 50(2), which reach systems already on the market from 2 December 2026.

Expertise beyond Law & Technology

Digital regulation applies to systems, not to documents. We work where law, technology and governance actually meet — which is where the obligations bite.