Align · Second stage of your AI journey
EU AI Act assessment
“Is this high-risk?” is rarely a simple yes or no, and the answer depends on a rule most teams have not read and a role they have not worked out. In two to three weeks we go through your AI use cases one by one, record what the EU AI Act means for each, put a named owner against it, and tell you what to ask your lawyers.
“Is it high-risk?” is rarely a simple yes or no
Sooner or later, someone in your organisation asks whether a particular AI idea is allowed under the EU AI Act. In most organisations nobody can answer with confidence, and the usual response is to wait until somebody senior gets nervous. By then the idea is half built.
What usually goes wrong is predictable:
- The answer is often not clear. In a 2023 analysis of 106 AI systems from enterprises, about four in ten could not be clearly classified. These are not exotic cases. They include systems in areas like employment and critical infrastructure, where a small difference in how a system is used changes the answer.
- Nobody has worked out the role. Your obligations depend on whether you are the provider of an AI system, or only a deployer of someone else’s. A deployer can become a provider by changing what a system is used for, or by modifying it substantially. This is easy to miss and expensive to discover late.
- Agents do not fit neatly. An agent that reads, decides and acts across several systems has to be looked at as one system, together with the tools it uses, and not as a model with a few add-ons.
The rules are also still settling. The European Commission has yet to adopt its final guidelines on how to classify high-risk systems, and a conclusion that is sound today may need a second look once they appear.
Every use case screened, owned and on one page
The EU AI Act assessment is one of our Align engagements, which means it is pre-defined rather than fully bespoke. You know before you start what happens, who needs to be involved, and what lands on the table at the end. It is deliberately a screening exercise. We go through your AI use cases one by one, quickly and with evidence, so that you know where you stand and what to do first.
For each use case we write a one-page record. It says what the use case is, which role you play, whether anything in it is prohibited, whether it could count as high-risk, whether the transparency rules apply, and whether a general-purpose AI model is involved. And because we also build these systems, each record says what the answer means for the design: which disclosure the user must see, what must be logged, where a person has to be able to step in.
We are not a law firm, so where the law is genuinely unclear, we say so and put the question on a list for your counsel, rather than guessing. A confident wrong answer is worse than an honest “this needs a lawyer”.
You also get a one-time re-check once the Commission’s final guidelines on high-risk classification are adopted, so that the records you hold reflect what the guidance actually says.
Three phases over two to three weeks
Shaping (before the work starts)
A short call to agree which use cases are in scope, who owns each one, and who can answer questions about them. We also agree where the information will come from, such as design documents, supplier documentation and the people who built or bought each system. If you have done Use case prioritisation with us, this takes minutes, because the shortlist and the briefs are already there.
Phase one: Collect and frame
We build a clean list of the AI in scope, including systems you built, systems you bought, and AI features inside software you already own. For each one we gather the few facts that decide the answer: what it does, who uses it, what data it touches, how much it acts on its own, whether a person reviews what it decides, and which model or supplier is behind it. We do this through short conversations with the owners and a review of the documents they already have. We do not need access to production data.
Phase two: Screen
We work through each use case, one by one, and write its record. We start with the questions whose answers matter most: is it an AI system under the Act at all, is any of it prohibited, what role do you play, and does the transparency duty apply. Then we look at whether the use case could be high-risk, and whether a general-purpose model is involved. Agents are looked at as a whole, with their tools, data access and level of autonomy.
Every conclusion cites the provision that decides it and carries a confidence level. Where the answer is unclear, the use case goes on the list of questions for counsel. A second person on our side reviews the reasoning before anything is handed over.
Phase three: Review and hand over
We present the results to your sponsor and, if you wish, your counsel. You see a heat map of your use cases, the action list for the rules that apply now, and the list of questions for your lawyers. Each owner confirms their record, so the first version is already approved by the person responsible for it.
We close by agreeing when a record needs a fresh look: when a use case changes its purpose, its model or its tools, and when the Commission publishes its final guidance. The one-off re-check covers that last point, once the guidance is adopted.
Questions we get asked
How long does it take?
Two to three weeks, on average, plus a short shaping call beforehand. The range depends mostly on how many use cases are in scope, and on how quickly we can reach the people who know each one.
Do you need access to our data?
No. We need documents, supplier information and conversations with the people who know each system, which is a much smaller ask and a much shorter approval path. We do not touch production data.
Are you giving us legal advice?
No, we are not a law firm. What you get is a structured, evidenced first pass, written so that your own counsel can check it quickly. We work alongside them throughout, and they are welcome at the readout.
Is this the conformity assessment the Act talks about?
No. A conformity assessment is a formal procedure that a high-risk system goes through before it is placed on the market or put into service. This engagement is a screening exercise: it tells you where each use case stands, what it means, and who owns it.
What if a use case is borderline?
Then we say so. Some classifications genuinely depend on how the use case is used, and on guidance that is still being finalised. We record what we found, the options and our confidence, and put it on a list of questions for your counsel. That is more useful than a confident answer that falls apart on review.
What about agents?
We look at an agent as one system, together with its tools, its data access and how much it acts on its own, because that is how the rules are likely to treat it. Each record includes those details and says what the user needs to be told.
Do we have to do Use case prioritisation first?
No. It works best straight after, because the shortlist and briefs give us a head start, but you can bring your own list of use cases.
What happens when the rules change?
The rules are still settling. Each record notes the guidance it was written against, and we include a re-check once the Commission adopts its final guidelines on high-risk classification. After that, a record needs a fresh look whenever a use case changes its purpose, its model or its tools.
Who should take part?
The owner of each use case, someone from legal or compliance, and someone from IT or procurement. An executive sponsor to receive the readout is the one other thing we would ask for.
What happens afterwards?
That is up to you. The records and the action list are yours, and your own team can carry them on. If you want standing rules, controls and evidence kept current across all your AI, that is Governance programme design, and this engagement is a good first step towards it.
Ready to find out where your use cases stand?
If your teams keep asking whether an AI idea is allowed, and nobody can say who would answer for it, that is a conversation worth having. Fill in the details and we’ll send you the full description of this engagement, including what deliverables you should expect from us. If that aligns with your goals, then we can schedule a first call to work out the details.
