EU AI Act: from scan to dossier
For anyone using AI or shipping AI inside their own product. We determine per system which risk category it falls into, which role you hold and what that means in obligations. Then we build the dossier that goes with it.
The regulation is not one deadline, and since the Digital Omnibus (Regulation (EU) 2026/1744, in force 27 July 2026) the dates diverge further. Prohibited practices have applied since 2 February 2025. The Article 50 transparency duties start on 2 August 2026. High risk under Annex III moved to 2 December 2027, and AI embedded in regulated products to 2 August 2028. In between sits 2 December 2026: generative systems already on the market before 2 August 2026 must mark their AI output machine-readably by then, and two new prohibited practices take effect. Which date counts for you depends on what your system does and which role you hold. Working that out is a short engagement; finding out during an inspection costs more.
What you get
Priced per case. The difference sits in the number of AI systems and whether you build them or only use them. You can start for free with the quickscan on this site: that gives you the category, this engagement gives you the dossier.
Thinking along, arranging it, staying inside the law
Three things that don't fit in a service list, but that decide how working with me feels.
I think along with you
You're not hiring a pair of hands that builds whatever the brief says. If I think your question isn't your real problem, I'll say so. Often there's a simpler or cheaper route, and sometimes the answer is that you shouldn't build this yet. Sparring over that choice is part of the work.
You don't have to figure it out
I run the whole track: choice of technology, the build, integrations with your existing systems, testing with real cases, explaining it to your team and maintenance afterwards. One point of contact, and one person responsible when something breaks. No vendors pointing at each other.
Compliant, and provably so
Everything I build has to survive current legislation: GDPR, the EU AI Act and the Data Act. That means agreeing up front which data the system may see, processing inside the EU, retention periods, a data processing agreement and a log of what the system did. So you can explain it when somebody asks.
Other services
Voice agents and telephony
An agent that answers the phone after hours, at peak moments and when everyone is already on a call. It recognises why someone is calling, books an appointment in your calendar, transfers when unsure and emails you the rest.
Read the article →Process automation
The work nobody enjoys: retyping invoices, moving data from system A to system B, producing the same report every Monday. I map the steps and build the chain that runs without you.
Read the article →Custom software, SaaS & AI assistants
For when off-the-shelf doesn't fit: a portal, an internal tool, or an assistant that answers from your own documents and data. Built around your way of working, not a vendor's.
Read the article →AI audit & AI training
The cheapest way to start. I come to you, and afterwards you get a report with the processes that return the most, what each costs, what it saves and what goes wrong if you approach it badly. I also run AI training for teams: what the technology can and cannot do, how to use it safely, and where the gains sit in your own work.
Read the article →GDPR & privacy in order
Mapping what happens to personal data and delivering the documents you need to be able to show: a record of processing activities, a DPIA where one is required, processor agreements and a working method for data breaches and data subject requests.
Read the article →European software regulation
GDPR and the AI Act are not the only laws that touch your software. Depending on what you build and for whom, NIS2, the Cyber Resilience Act, the accessibility directives, the Data Act or DORA apply too. I work out which ones apply to you and what has to happen next.
Read the article →Penetration testing and security testing
I attack your own software with your written permission, looking for what an attacker would find: logging in without the right password, reaching another customer's data, changing an amount in an order. Whatever works, you get on paper with the evidence attached and with the check that proves later on that it is really closed.
Read the article →Ready to see what's being left on the table?
Book a free thirty-minute call. You'll get an honest answer, even when that answer is “don't do this yet”.
Book your free intro call → Free · 30 minutes · no obligations