System inventory, risk classification, internal policy, training, transparency and evidence folder before an inspection, audit or incident.
Current text of Regulation (EU) 2024/1689: view on EUR-Lex. Digital Omnibus reform: adopted and signed final act, awaiting publication in the Official Journal.
The AI Act applies in phases. AI literacy and prohibited practices have applied since 2 February 2025; Article 50 transparency and much of the general regime apply from 2 August 2026. The specific duties depend on the company's role: provider, deployer, importer or distributor.
ChatGPT, Copilot, Gemini, Claude and assistants built into your CRM, invoicing or customer support. Even if AI is used only for drafting, you must support AI literacy and control data; transparency is required when the use falls within Article 50.
Website, WhatsApp, automated answering systems and assistants that recommend products. Article 50 requires people to know when they are interacting directly with AI unless this is obvious; the precise duty depends on whether you act as provider or deployer.
CV screening, creditworthiness scoring, employee evaluation, insurance, biometrics, education. These are Annex III areas: high risk, with reinforced obligations.
Images, videos, synthetic voices and deepfakes. Providers must add machine-readable marking; deployers must disclose deepfakes and certain public-interest content, among the other cases listed in Article 50.
The Regulation classifies AI systems into four levels. Your obligations, and your exposure to penalties, depend on which one each use falls into. This is the basis of every diagnosis.
| Risk level | Examples | What it requires of you |
|---|---|---|
| Unacceptable risk Prohibited · art. 5 | Subliminal manipulation, social scoring, emotion recognition at work or in education, mass scraping of faces. | Prohibited since 2 February 2025. Fines of up to €35M or 7% of worldwide turnover. |
| High risk Annex III | Staff recruitment, employee evaluation, credit scoring, life or health insurance, biometrics, education, essential services, justice. | Risk management, data quality, technical documentation, human oversight, log keeping and conformity assessment. The final Digital Omnibus act sets application from 2 December 2027 for Annex III. |
| Transparency risk Art. 50 | Customer-facing chatbots, AI-generated content, deepfakes, synthetic voices. | From 2 August 2026: providers must enable notices and technical marking; deployers must inform people in the uses listed in Article 50. |
| Minimal risk | AI for drafting, translating, summarising, basic filters or recommenders. | No specific product obligations, but staff AI literacy (art. 4) and data control in line with the GDPR are required. |
Not sure which category your systems fall into? That's exactly what the Express Diagnosis resolves.
Legislative status: the final Digital Omnibus act was signed on 8 July 2026 and the official procedure file still shows it as awaiting publication in the Official Journal. The 2026-2028 dates below are those in the adopted final text; the reform will enter into force on the third day after publication.
The penalty regime (Articles 99-101 of the AI Act) provides for fines of up to €35M or 7% of worldwide turnover for using AI in prohibited practices, up to €15M or 3% for breaching general obligations, and up to €7.5M or 1% for incorrect information to the authorities. For freelancers and SMEs, Article 99(6) applies the lower amount, not the higher one, but the penalty is still proportional to turnover, and the risk is usually compounded by a GDPR breach that the AEPD penalises separately.
Mapping the AI systems in use, classifying them under Annex III, identifying the role (deployer or provider) and detecting prohibited or high-risk practices.
Analysing the applicable obligations and comparing them with the current situation: policies, training, transparency, data control, human oversight and evidence.
Internal AI-use policy, literacy plan, transparency templates for chatbots and synthetic content, provider register and a risk-assessment model.
Staff training session (AI literacy, art. 4), implementation of controls, provider review and internal sign-off of the policy.
Annual review, updates in response to regulatory changes, support for specific cases and response to incidents or requests from the AESIA or the AEPD.
Your AI Act compliance is signed off by Manuel Navarro Rajoy, DPD/DPO certified by the AEPD (registration A2025166DPD) and Forensic IT Expert Witness TIP 639 AEPEJU. It is not just documentation: if an AESIA or AEPD inspection, a formal request or litigation over an algorithmic decision arrives, you have the very expert who analysed your system preparing and ratifying the forensic evidence. That is the difference between an agency that fills in templates and a professional who upholds your compliance before whoever challenges it.
See forensic IT reportsThe amounts are indicative and are finalised after the initial assessment. The final invoice depends on the number of AI systems involved, the risk level and how much prior documentation already exists.
VAT not included. First assessment free within 24 business hours.
For freelancers and micro-businesses with light AI use
€350one-off payment
For SMEs that use AI regularly in their activity
€980 - €1,800one-off payment
For companies with extensive use or high-risk systems
€2,400 - €5,500one-off payment
Permanent maintenance and support
From €240per month (annual commitment)
A list of systems, tools, providers, data processed, purpose and the company's role.
A document signed by staff covering usage rules, prohibited data, oversight and review.
A per-system matrix with classification (prohibited, high risk, transparency, low risk) and obligations.
Wording for chatbots, AI-generated content, deepfakes and notices to customers and workers.
Materials and an attendance record to demonstrate the AI literacy required by Article 4.
A file structure ready to hand over to an authority or auditor upon request.
Especially those where AI is involved in sensitive processes, automated decisions, video surveillance or activities with significant impact on people and business.
No. The documentary part is important, but must be aligned with controls, owners and real governance of the system.
Yes. In fact, AI Act, GDPR, cybersecurity and data management usually need to be coordinated so the system is sustainable.
It depends on your size and on how much you actually use AI. For freelancers and micro-SMEs with light use we offer an Express Diagnosis for €350. For SMEs with regular use, Basic Compliance from €980. For companies with high-risk systems, Full Adaptation from €2,400. Continuous governance starts at €240/month with an annual commitment. First assessment free within 24 h.
Yes. Most AI systems process personal data (GDPR) or run on critical infrastructure (cybersecurity). The service is coordinated internally with external DPO, GDPR audit and ENS / ISO 27001 so the company has a single point of contact instead of several providers that do not talk to each other.
The timeline is public. AI literacy and prohibited practices took effect on 2 February 2025, general-purpose AI model rules on 2 August 2025 and Article 50 transparency obligations on 2 August 2026. The final Digital Omnibus act, adopted and signed but still awaiting publication in the Official Journal, sets 2 December 2026 for certain transitional marking duties and new prohibited practices, 2 December 2027 for Annex III high-risk AI and 2 August 2028 for Annex I high-risk AI embedded in products. AESIA is the national supervisory authority, without prejudice to the AEPD's powers when personal data is involved.
Tell me which AI systems you use, in which processes and with what data. I prepare a free initial assessment within 24 business hours, with scope, plan and a fixed price before any work begins.
