Bringing legal rigor to innovation.

From initial assessment to ongoing compliance.

We advise businesses, AI providers, and deployers on designing and implementing an AI Act compliance program, bringing legal analysis together with technical and organizational expertise.

The program reflects the business’s role, the system’s intended purpose, and its risk level. We identify applicable obligations, exemptions, and deadlines, distinguishing high-risk system requirements from other duties.

1. 01

   System inventory and operator roles

   Map AI systems, models, intended uses, and suppliers. Identify provider, deployer, importer, and distributor roles, including where businesses integrate or modify third-party solutions.

2. 02

   Risk classification and prohibited practices

   Assess scope, exclusions, and prohibitions. Analyze high-risk classification, possible exceptions, and transparency requirements, documenting the reasoning behind each conclusion.

3. 03

   Gap analysis and implementation plan

   Review existing measures and set priorities. Prepare a roadmap identifying responsibilities, documentation, controls, and deadlines for developing, purchasing, and using AI systems.

4. 04

   Governance, policies, and training

   Define internal responsibilities, acceptable-use policies, and approval procedures. Develop AI literacy and training programs suited to staff roles, system risks, and the operational context.

5. 05

   Risk and quality management

   Support the design of risk and quality management systems required of high-risk AI providers, including lifecycle controls, change management, and retention of supporting evidence.

6. 06

   Data, GDPR, and impact assessments

   Address governance of training, validation, testing, and input data, including quality and bias. Coordinate GDPR compliance, DPIAs, and fundamental rights impact assessments (FRIAs) for the entities and uses subject to those requirements.

7. 07

   Documentation, instructions, and records

   Assist with technical documentation and instructions for use, and their ongoing updates. Define traceability, logging, and retention requirements with input from technical teams.

8. 08

   Human oversight and technical controls

   Establish oversight, intervention, and suspension procedures. Provide legal support for accuracy, robustness, and cybersecurity testing programs, working with technical teams and independent specialists.

9. 09

   Transparency and generated content

   Develop notices for interactions with AI systems and address synthetic-content marking and detectability where required. Assess duties concerning deepfakes, public-interest text, biometric systems, and emotion recognition, including applicable exceptions.

10. 10

    Suppliers, contracts, and the value chain

    Conduct supplier due diligence and negotiate documentation, information access, audit, data, and intellectual property provisions. Allocate responsibilities, address updates, and assist with insurance coverage assessments.

11. 11

    General-purpose AI models

    Assess GPAI provider obligations concerning documentation, information for downstream integrators, copyright policies, and training-content summaries. For models with systemic risk, advise on additional evaluation, mitigation, and reporting duties.

12. 12

    Conformity and market access

    Advise on the appropriate conformity assessment procedure, involving notified bodies where necessary. Assist with EU declarations of conformity, CE marking, and required registrations, coordinated with sector-specific rules.

13. 13

    Deployment and individual rights

    Develop deployer procedures covering instructions for use, suitability of input data, and assignment of human oversight. Address worker and individual notices, explanation requests, and registration duties where applicable.

14. 14

    Monitoring, incidents, and updates

    Prepare post-market monitoring plans, feedback channels, and serious-incident procedures. Address corrective action, authority notifications, substantial modifications, and periodic updates to documentation and controls.