EU AI Act consulting: AI inventory, risk categories and governance
The EU AI Act obliges companies that use AI, in stages, to ensure AI literacy and transparency and – depending on the risk category – risk management and documentation. Sascha Sambale helps build an AI inventory, classify applications and derive guidelines, training and processes, aligned with the GDPR and information security.
Last updated: November 8, 2026
- Legal basis
- Regulation (EU) 2024/1689
- Since 2 Feb 2025
- Prohibitions and AI literacy duty (Art. 4)
- Since 2 Aug 2026
- Transparency duties (Art. 50)
- Fines
- up to €35M or 7% (Art. 99)
What companies should do now
The first step is transparency: which AI systems and models are used where, for what, with which data and by whom? Only then can the role (provider or deployer) and risk category be determined and the concrete obligations derived.
- Build and maintain an AI inventory
- Classify applications by risk category: prohibited, high-risk, transparency obligations, minimal risk
- Provide documented AI literacy training under Art. 4
- Write AI guidelines for employees
- Define responsibilities, human oversight and documentation
Timeline and fines
The regulation applies in stages: prohibited practices and the AI literacy duty since 2 February 2025, obligations for general-purpose AI models since 2 August 2025, and the transparency obligations under Art. 50 since 2 August 2026. Some high-risk obligations have longer deadlines, which are being adjusted by the EU's Digital Omnibus. Art. 99 provides for fines of up to €35 million or 7% of worldwide annual turnover for prohibited practices and up to €15 million or 3% for other infringements; for SMEs the lower amount applies. Source: Regulation (EU) 2024/1689.
EU AI Act and GDPR together
As soon as personal data is processed, the GDPR applies alongside the AI Act. A joint AI governance that connects data protection, information security, procurement and business units is therefore more effective than parallel processes nobody maintains. This page is not legal advice; binding individual questions are handled together with your legal department or law firm.
EU AI Act formats
| Format | Length | For | Outcome |
|---|---|---|---|
| Keynote EU AI Act & Responsible AI | 30–60 min | Leaders, workforce | Overview of obligations and opportunities |
| AI literacy training (Art. 4) | 0.5–1 day | Employees | Documented AI literacy |
| AI inventory & risk category workshop | 1–2 days | Compliance, IT, business units | Inventory and first risk classification |
| AI governance & guidelines | project-based | Executives, data protection | Guidelines, roles, processes |
Frequently asked questions about the EU AI Act
Does the EU AI Act apply to companies that only use ChatGPT or Copilot?
Yes. Anyone using AI systems professionally is a deployer under the regulation. At a minimum, the duty to ensure sufficient AI literacy of staff (Art. 4) has applied since 2 February 2025.
What does AI literacy under Art. 4 mean?
Companies must ensure that staff working with AI have sufficient knowledge of how it works and of its opportunities and risks. In practice this means documented training tailored to each target group.
When is an AI application high-risk?
Among other cases, when it is used in areas listed in Annex III, such as recruitment, creditworthiness or critical infrastructure, or when it is a safety component of a regulated product. Classification is done per use case.
Does this consulting replace legal advice?
No. The consulting translates the requirements into processes, roles and technical guardrails. Binding legal assessments are made together with your legal department or law firm.
Request an EU AI Act workshop
Let us know which AI applications you use – you will receive a proposal for where to start.
Send a request