EU AI Act Compliance (Regulation 2024/1689)
We assist providers, deployers, importers and distributors of AI systems to implement the EU AI Act: risk classification, technical files, FRIA, GPAI obligations, regulatory sandboxes.
What we cover
AI risk classification
Map your AI system: prohibited practices, high-risk Annex III/I, GPAI, limited or minimal risk.
Technical documentation
Build the technical file under Annex IV: architecture, data, risk assessment, post-market monitoring.
Fundamental Rights Impact Assessment
FRIA for deployers of high-risk systems in public sector or essential services.
GPAI & systemic-risk models
Provider obligations: model card, copyright policy, evaluations, incident reporting to the AI Office.
Regulatory sandboxes
Support for national and cross-border AI regulatory sandbox participation.
Conformity assessment & CE marking
Support with notified bodies, EU declaration of conformity, EU database registration.
Applicable legal framework
- §Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 — the EU AI Act
- §Annex I (harmonised product legislation) and Annex III (high-risk systems)
- §Commission Decision establishing the AI Office (Decision C(2024) 1459)
- §Commission guidelines on prohibited AI practices
- §National implementation framework (market surveillance authority designated in Romania)
How we work
- 1
Discovery & AI inventory
We map all AI systems used or developed, the legal role (provider / deployer) and data flow.
- 2
EU AI Act gap analysis
We assess each system against the regulation and identify compliance gaps.
- 3
Roadmap & remediation
Action plan calibrated to the AI Act timeline (Feb 2025, Aug 2025, Aug 2026, Aug 2027).
- 4
Documentation & governance
We draft technical files, model cards, FRIA, internal policies and the AI systems register.
- 5
Training & monitoring
AI literacy for staff, post-market monitoring and incident reporting procedures.
Frequently asked questions
When do I have to be EU AI Act compliant?
Prohibited practices (Art. 5) and AI literacy apply from 2 February 2025. GPAI rules from 2 August 2025. High-risk requirements under Annex III from 2 August 2026. Annex I products: 2 August 2027.
What is the difference between a provider and a deployer?
Provider = entity that develops or places the AI system on the market under its own name. Deployer = professional user. Obligations differ significantly — the provider bears the main compliance burden.
Who supervises the EU AI Act in Romania?
The AI Office coordinates at EU level. At national level, the market surveillance authority is to be officially designated; in parallel, sectoral authorities remain competent (Data Protection Authority, ANCOM, ASF, etc.).
What are the penalties?
Up to EUR 35 million or 7% of global annual turnover for prohibited practices; up to EUR 15 million or 3% for other infringements; up to EUR 7.5 million or 1.5% for incorrect information.
Related AI services
Need AI legal advice?
Book an initial consultation about AI law and compliance.