Dataconsultant helps boards, legal and compliance teams, AI leaders, technology functions, risk teams, and product owners understand how the EU AI Act may affect their AI portfolio. We inventory systems, clarify operator roles, screen risk categories, assess governance and evidence, identify control gaps, and produce a prioritised readiness roadmap for accountable implementation.
Illustrative figures only. Actual findings require evidence review and stakeholder validation.
An EU AI Act readiness assessment is a structured review of the AI systems and models an organisation develops, supplies, integrates, distributes, or uses. It connects each use case with likely operator roles, regulatory scope, risk classification, applicable obligations, accountable owners, control design, evidence, and remediation needs.
The output is not a generic compliance checklist. It is a decision-ready view of which systems need attention, what information is missing, which actions should be prioritised, and where qualified legal, security, privacy, conformity-assessment, or sector specialists should be involved.
AI use often expands faster than governance, documentation, and procurement controls. The assessment creates a reliable baseline before obligations, customer requests, audits, or product decisions become urgent.
Teams use embedded AI, SaaS features, copilots, models, APIs, and automation without a complete enterprise inventory or consistent approval route.
The organisation may configure, fine-tune, rebrand, integrate, import, distribute, or substantially modify AI, changing the obligations that need to be considered.
AI supports employment, education, access to essential services, biometrics, critical infrastructure, law enforcement, migration, or regulated product functions.
Policies, risk assessments, model records, data information, logs, testing, human-oversight instructions, supplier documentation, and incident processes sit across different teams.
Buyers, partners, investors, boards, and public-sector customers ask for documented AI governance, classification, transparency, security, and compliance readiness.
The scope is adapted to the organisation's AI value chain, jurisdictions, industries, system portfolio, risk profile, and evidence maturity.
Deliverables are selected according to the decisions required, evidence available, number of systems, and whether the engagement includes implementation planning.
| Deliverable | What it contains | How it supports decisions |
|---|---|---|
| AI-system inventory | Use case, purpose, owner, users, affected persons, model or vendor, data, integrations, lifecycle stage, geography, and business criticality. | Creates the controlled population for classification, governance, and remediation. |
| Operator-role matrix | Preliminary mapping of provider, deployer, importer, distributor, product-manufacturer, and value-chain responsibilities. | Clarifies which teams and third parties need to supply evidence or take action. |
| Risk and obligation map | Screening for prohibited practices, high-risk categories, transparency duties, GPAI dependencies, and other relevant obligations. | Focuses detailed review on systems with the greatest legal, operational, and reputational exposure. |
| Control and evidence assessment | Current controls, documented evidence, design gaps, operating gaps, ownership gaps, and confidence level. | Separates missing documentation from missing control design and ineffective operation. |
| Prioritised gap register | Finding, affected system, rationale, severity, dependency, accountable owner, target action, and verification method. | Turns findings into a governed remediation backlog. |
| Readiness roadmap | Immediate containment, near-term remediation, operating-model improvements, technology enablement, training, and assurance activities. | Supports investment, sequencing, resource planning, and executive oversight. |
| Executive briefing | Portfolio exposure, key uncertainties, decision points, major dependencies, residual risks, and recommended next actions. | Enables board, executive, risk, compliance, and programme decisions. |
The process is evidence-led, collaborative, and proportionate to the portfolio. Fixed timelines are avoided until system count, complexity, access, and review requirements are understood.
Confirm objectives, entities, jurisdictions, business units, systems, stakeholders, decision criteria, evidence channels, and specialist-review boundaries.
Primary output: agreed assessment charter and evidence request.
Discover systems, models, features, APIs, vendors, use cases, owners, users, data flows, affected people, and lifecycle stages.
Primary output: controlled AI-system register.
Map value-chain roles, territorial connections, prohibited-practice indicators, high-risk indicators, transparency requirements, and GPAI dependencies.
Primary output: classification and obligation matrix.
Review governance, risk management, data controls, documentation, logging, oversight, testing, monitoring, security, incidents, suppliers, and literacy.
Primary output: evidence-based findings and confidence ratings.
Rank gaps according to likely obligation, risk, system criticality, implementation dependency, customer exposure, and effort.
Primary output: prioritised remediation backlog and roadmap.
Review findings with accountable stakeholders, record limitations, confirm legal-review items, agree owners, and define assurance and reporting.
Primary output: decision-ready report and mobilisation plan.
The final framework set depends on role, system type, sector, geography, internal policy, contractual commitments, and available harmonised standards or guidance.
Dataconsultant can map operational requirements, controls, evidence, data practices, technical dependencies, and governance actions. Classification and applicability can involve legal interpretation and fact-specific judgement. Final legal positions should be reviewed by qualified counsel, and formal conformity-assessment obligations should be confirmed with authorised specialists where applicable.
The EU AI Act uses phased application dates. Organisations should maintain a dated obligations register and validate it against current official sources because implementation measures, guidance, standards, and legislative amendments can evolve.
The AI Act entered into force.
Prohibited-practice provisions, definitions, and AI-literacy obligations began applying.
Governance provisions and obligations for providers of general-purpose AI models began applying, among other specified provisions.
Broader provisions apply in phases. Current applicability should be checked against the official legal text, adopted amendments, and Commission guidance before relying on a date.
Unregistered embedded features, departmental tools, pilots, and vendor capabilities bypass central oversight.
Configuration, fine-tuning, rebranding, integration, or substantial modification may create responsibilities not reflected in contracts or governance.
Risk categorisation is asserted without a documented purpose, context, affected-person, exclusion, or decision record.
Technical records, instructions, logs, test evidence, oversight procedures, data information, and change histories are incomplete or inconsistent.
Contracts do not provide the information, access, notification, cooperation, change control, or assurance needed downstream.
Legal, product, data, security, HR, procurement, compliance, and business owners assume another team controls the risk.
A structured initial review to identify systems, role uncertainties, likely high-priority use cases, and immediate information gaps.
Cost factors: system count, stakeholder access, and inventory quality.
Detailed inventory, classification, control, evidence, governance, and remediation review across an agreed portfolio.
Cost factors: depth, jurisdictions, complexity, samples, and deliverables.
Focused assessment of selected use cases with deeper requirements, evidence, human oversight, data, logging, monitoring, and supplier analysis.
Cost factors: system architecture, evidence maturity, and specialist input.
Implementation support for governance, documentation, controls, inventory operations, supplier assurance, training, metrics, and periodic reassessment.
Cost factors: backlog size, retained responsibilities, cadence, and resources.
Measures should show control and decision quality, not imply that compliance can be reduced to one score.
It is a structured review of AI systems, models, use cases, operator roles, risk categories, governance, documentation, data, transparency, human oversight, monitoring, suppliers, and evidence. It identifies likely obligations and produces prioritised actions. Legal conclusions remain subject to qualified legal review.
Sponsorship commonly comes from a general counsel, chief compliance officer, chief risk officer, CIO, CTO, chief data or AI officer, product executive, or transformation leader. Effective delivery requires participation from business owners, legal, compliance, risk, privacy, security, data, procurement, HR, internal audit, and technical teams.
It can apply to providers placing AI systems or GPAI models on the EU market and to certain providers or deployers outside the EU where AI-system output is used in the EU. Applicability is fact-specific and should be confirmed against the legal text and qualified legal advice.
Useful inputs include system inventories, architecture and data-flow information, contracts, product descriptions, model cards, policies, risk assessments, data documentation, testing records, logs, incident records, user instructions, transparency notices, training records, supplier evidence, and access to accountable stakeholders. Missing evidence is recorded as a limitation.
Dataconsultant documents the system's intended purpose, context, users, affected persons, decisions supported, sector, product connection, and relevant exclusions, then screens it against the regulation and current official guidance. Because classification may require legal judgement, uncertain or material cases are flagged for qualified legal review.
Yes, where relevant. The assessment can identify GPAI model dependencies, provider or downstream responsibilities, technical-information needs, copyright-policy and training-content-summary considerations, systemic-risk indicators, transparency controls, and supplier evidence. Exact obligations depend on role and facts.
The assessment considers data governance, privacy, security, robustness, access, logging, incident handling, supplier controls, and related evidence where they affect AI readiness. It does not replace a legal data-protection review, penetration test, security audit, or specialist certification unless separately commissioned.
No reliable fixed duration can be given before discovery. Timing depends on system count, portfolio complexity, entities and jurisdictions, stakeholder availability, evidence quality, supplier responsiveness, assessment depth, sample testing, legal review, and approval cycles.
Pricing is influenced by the number and complexity of AI systems, business units, jurisdictions, operator roles, risk categories, third parties, evidence maturity, workshops, technical review depth, deliverables, onsite needs, and whether remediation support is included. Dataconsultant provides a written estimate after scoping.
Yes. Follow-on support can include AI inventory operations, governance design, policy and procedure development, documentation, control implementation, supplier assurance, data and model governance, testing coordination, training, KPI reporting, programme management, and periodic reassessment. Legal and conformity-assessment responsibilities remain appropriately separated.
No. A readiness assessment is not a regulator decision, legal opinion, statutory audit, certification, CE-marking process, or notified-body conformity assessment. It provides evidence-based findings and actions to help the organisation prepare for the applicable obligations and specialist reviews.
Yes. A focused assessment can examine one AI-enabled product, high-risk use case, business process, vendor solution, or deployment. The scope should still consider connected models, data, suppliers, users, affected persons, integrations, and organisational controls that influence the system.
Reassessment should be risk-based and triggered by material system changes, new purposes, new markets, supplier changes, incidents, regulatory guidance, control failures, new high-risk use cases, or major portfolio expansion. Many organisations also use periodic portfolio reviews and continuous inventory monitoring.
Findings depend on the accuracy and completeness of the information supplied, the systems sampled, stakeholder access, current law and guidance, and the maturity of available evidence. The assessment cannot guarantee future regulator interpretation, eliminate all AI risk, or replace ongoing governance and monitoring.
Evaluate whether the provider can combine regulatory mapping with AI inventory, data governance, technology, risk, security, privacy, procurement, documentation, operating-model, and implementation expertise. Ask how assumptions, evidence gaps, legal-review boundaries, deliverables, independence, confidentiality, and remediation ownership will be handled.
The legal text and official European Commission information should be checked for current applicability, guidance, standards, and amendments.
Regulation (EU) 2024/1689 — Official Journal textEuropean Commission — AI Act policy and application timelineEuropean Commission — Navigating the AI ActShare your AI portfolio, operating model, priority use cases, jurisdictions, and current governance concerns. Dataconsultant will help define a proportionate assessment scope and practical next steps.
