1. AI inventory
Which tools are used, for what and with what data. Including the AI employees have switched on by themselves without going through IT.
AI automation · Governance
AI governance and the EU AI Act
Your company already uses AI, even if you never decided to. We help you find out which tools, with what data, and what the EU AI Act requires from you.
Timeline
When the Act applies
The EU AI Act applies in stages. These are the dates already in force and the two that the 2025 amendment package proposes to move.
Already applies
Prohibited practices and training
Uses the regulation considers unacceptable are banned, such as social scoring or harmful manipulation. On top of that, anyone using AI must make sure their team knows what it can and cannot do with it.
Already applies
General-purpose models
Obligations start for providers of general-purpose AI models: technical documentation, information about training data and respect for copyright.
Already applies
Transparency and high-risk systems
From this date, transparency duties — telling users they are talking to an AI and marking generated content — and the requirements for high-risk systems apply: risk management, technical documentation and human oversight.
Proposed date pending confirmation in the Official Journal of the EU
Annex III high-risk systems
The 2025 amendment package proposes moving the obligations for Annex III high-risk systems to this date. It is not a confirmed date: it is pending publication in the Official Journal of the EU.
Proposed date pending confirmation in the Official Journal of the EU
Regulated products in Annex I
The same proposal moves systems embedded in products covered by safety legislation (Annex I) to this date. It is not confirmed in the Official Journal of the EU either.
What it includes
What we do with you
2. Usage policy and owners
Clear rules on what can be used, with what information and who is accountable for each decision, adapted to how your organisation works.
3. Transparency
How to tell users they are talking to an AI and how to mark generated content when the regulation requires it.
4. Training by profile
Separate sessions for leadership, teams using AI every day and technical profiles, with a record of who has attended.
5. Technical controls
Data leak prevention, labelling of sensitive information, blocking of unauthorised tools and logging of what agents do.
6. High-risk readiness
If your activity falls under the high-risk categories, we prepare the documentation, risk management and human oversight they require.
Deliverables
What you receive
- AI inventory with a risk classification per use.
- An approved AI usage policy, ready to share with the team.
- A training plan by profile and a record of the sessions.
- Controls configured in your tools and checked one by one.
- An annual review report with what needs adjusting.
Regulation and engineering in the same team
We bring the regulatory side and the technical side together: the controls are configured in the same Microsoft and Sophos tools that already protect your company.
Common questions
Questions about AI governance and the EU AI Act
Does the Act affect me if I only use Copilot or ChatGPT?
Yes. When you use AI in your company you are responsible for the deployment: you have to train your team, tell users when they are interacting with an AI and control what data goes in.
Who enforces it in Spain?
The Spanish Agency for the Supervision of Artificial Intelligence oversees the market. On top of that, the Spanish Data Protection Agency can already fine any AI use involving personal data under the GDPR.
Does this replace my lawyer?
No. We work with your legal adviser or with the firm you appoint: we bring the inventory, the controls and the technical evidence.
What if I want to use AI without my data leaving?
Then the conversation is different: models running on your own infrastructure, without sending anything to an external provider. See private AI on your infrastructure
You may also be interested in
Related services
AI Automation
AI agents that learn from your operations and run repetitive work under human control: fewer manual tasks, fewer errors and more time for your team.
Learn morePrivate AI on your own infrastructure
Open AI models on your servers or in a European private cloud, connected to your documents and without your data leaving the company.
Learn moreCybersecurity
We protect your company with NDR/XDR, 24/7 MDR and SIEM: we detect threats, analyse risks and coordinate incident response under the NIST framework.
Learn moreDo you know which AI is used in your company today?
In the assessment we build the inventory and tell you what to review first.