The first comprehensive AI law anywhere, and it sorts systems by what they are used for rather than how they are built: banned, high-risk, transparency-only, or everything else. Which band you are in is rarely obvious from outside, and it sets every one of the duties that follow.
EU AI ACT · COMPLIANCE SCAN · LIVE NOW
Your vendor’s CE mark probably doesn’t cover you.
The Act binds the deployer as well as the provider - four duties, two of them already live, and Article 25 can make you the provider.
Annex III
High-risk
Article 50
Annex IV file
Human oversight
Our promise
“A policy is a promise. The technical file is evidence.”
Every finding is written against a clause of the instrument itself — defensible line by line, to anyone who asks. The fee is fixed at $25,000, and nothing is charged until you approve it.
- Each additional system
- $6,000
- Re-audit, same scope
- $16,000
- Renewal, every twelve months
- $21,000 locked
This costs more than the estate ladder, and it should. The ladder is a private assessment written for you. A framework audit produces a published summary iDharma maintains for twelve months - a notice template where the law requires one, a 60-day expiry warning, and a quarterly check that the summary is still live and still linked.
Request this auditThe case file
The EU AI Act, in three chapters
Most teams assume a CE-marked vendor has covered them. It has not: a deployer keeps human oversight, logging and disclosure whatever certificate the vendor holds. Put your own name on it under Article 25 and you become the provider of it, with the whole provider set behind it.
Our review is the independent read. We inventory the systems, place each one in its tier against Annex III and Article 5, settle your role under Article 25, and hand you the register and the gap list — with every duty mapped to the article it comes from, so a finding can be checked.
Risk tiers explained
Four bands. Yours is one of them.
The Act sorts systems by what they are used for, not by how clever they are.
- Unacceptable - banned outright since February 2025
- Social scoring, untargeted face scraping, emotion at work
- High-risk - the Annex III list, and Annex I safety components
- Employment, credit, education, essential services, biometrics
- Limited - transparency duties only, and they are live now
- Chatbots, deepfakes, emotion and biometric categorisation
- Minimal - no obligations under the Act at all
- Spam filters, recommendation engines, most internal tooling
Know your role
The duty is yours. The model is theirs.
The deployer, using it in the EU
The Act binds whoever puts an AI system into service under their own authority. Human oversight, informing the people it is used on, keeping logs and using it for its intended purpose are all yours, whatever the vendor holds. None of them can be discharged by somebody else on your behalf.
The people who built the model
Carries its own provider duties - conformity assessment, the Annex IV technical file, registration, the CE mark. Many vendors do that work properly and will show you the certificate. The difficulty is not the quality of that work - it is which of your own duties, if any of them, it actually discharges.
When their duties become yours
Put your own name on a high-risk system, change what it is for, or modify it substantially, and Article 25 makes you its provider, with the whole provider set behind it. Building a bought-in model into your own product is how a deployer becomes a provider without ever deciding to.
What most teams assume
“Our vendor is CE-marked, so we’re covered.”
What the rule says
Their mark covers their duties. Yours stay yours.
It is the most common finding we write up.
- Who it is for
- AI product teams
- SaaS & platform vendors
- Banking & insurance
- Legal & compliance
- Medical device and HR tech
Penalties & enforcement
02
Breaching the high-risk obligations reaches EUR 15 million or 3% of worldwide turnover - the tier most organisations actually sit under.
03
Giving a notified body or a national authority incorrect or misleading information is its own tier again: EUR 7.5 million or 1% of turnover.
04
National authorities enforce it, with the AI Office over general-purpose models. Your disclosures are checkable from outside, by anyone.
The 60-second check
Three questions. Then you’ll know.
No email, no signup. A starting point, not a determination.
Opens in a panel. Close it any time - your answers are kept.
EU AI Act
Your scope check
The calendar
Four moments, and two have already passed.
Two of these are live obligations today and two are still ahead - so they cannot be planned as one deadline, and the documentation runs longest.
-
Prohibited
Since Feb 2025Unacceptable-risk uses - social scoring, untargeted face scraping - have been banned since February 2025.
-
Disclose
Since Aug 2026Article 50 is already live: chatbot disclosure, synthetic-media marking and biometric notices apply to you today.
-
High-risk
2 December 2027The Annex III high-risk regime lands here, deferred by the Digital Omnibus from its 2 August 2026 date.
-
Embedded
2 August 2028High-risk systems embedded in Annex I regulated products get one further year, and not a single day beyond that.
The trap
Teams plan for December 2027 and forget that Article 50 is already in force. If your product talks to people or generates media, the disclosure duty applied from August 2026 - two winters before the date on the plan.
Requirement & coverage
What the Act says, what we ship
12 obligations, and the artefact that discharges each one. Paired, so every claim on this page can be checked against the requirement beside it.
- Which role you hold Provider or deployer - and it can be both
- A written determination of your role for each system, so a vendor's conformity is never mistaken for yours.
- Substantial modification Article 25 - change it enough and you are the provider
- An assessment of whether your changes make you the provider - and what must be redone if they do.
- Risk classification Prohibited, high-risk, transparency-only or minimal
- Each system placed against Annex III and the Article 5 list, with the reasoning written down.
- Risk management system Article 9 - continuous, across the lifecycle
- A risk process you can actually run, not a one-off register written the week before an audit.
- Data governance Article 10 - training, validation and testing sets
- Provenance, representativeness and bias checks recorded against the sets the system was built on.
- Technical documentation Annex IV - before it goes on the market
- The Annex IV pack assembled and gap-listed, so a notified body is not its first real reader.
- Record-keeping Article 12 - automatic logging of events
- A logging specification with retention periods, and a check that what is kept is what is required.
- Human oversight Article 14 - by people who can actually stop it
- Oversight design tested against what your people can really see, and really override, in the moment.
- Accuracy and robustness Article 15 - declared, and tested
- Declared accuracy metrics with the tests behind them, and the cybersecurity measures stated.
- Transparency duties Article 50 - in force now, not in 2027
- Chatbot, synthetic-media and emotion-recognition notices drafted and placed where users meet them.
- Registration The EU database, before putting into service
- The registration record prepared per high-risk system, in the fields the database actually asks for.
- General-purpose models Chapter V - if you train one, or build on one
- Whether your model or your use triggers Chapter V, and the documentation each answer demands.
The engagement
Your AI estate, independently read
From model providers to everyday deployers.
-
Inventory
Which AI systems you run, and which of them the Act reaches.
-
Classify
Each system placed in its tier, against Annex III and Article 5.
-
Sign off and file
You see the draft first. Then the register, gaps and notices - dated.
Struck in your favour
Why teams choose iDharma to read the Act with them
Genuinely independent
We build, resell and operate no AI systems of our own, and take no fee tied to what we find.
Written to the Act
Every finding maps to the article it discharges, so a reviewer checks it against the law.
One engagement, end to end
Inventory, classification, gaps and notices sit in one scope, so no duty falls between vendors.
Classification first
Which tier each system is in gets settled before anything else - it decides every duty after.
Four marks, struck on every report.
Deliverables
What you get
Concrete artefacts, each with a name and a format - you know what lands before you buy.
Classification report
The full assessment in one document: every system placed as prohibited, high-risk, transparency-only or minimal against Annex III and Article 5, your own role under Article 25 settled for each one of them, every gap mapped to the article it belongs to, and the findings written in plain language rather than in the Act's.
AI system register
Every system, its role, its tier, its owner and its status, in a workbook that your own team can keep current after we hand it over.
Article 50 notice pack
Chatbot, synthetic-media and biometric disclosures, marked up ready to drop into the places your users actually meet them.
Annex IV documentation index
The technical file broken into its Annex IV sections, showing what you already hold, what is thin, and what is missing altogether.
Scope memo
Which systems were in scope, which were not, and why each call was made - the written record behind your AI inventory.
Remediation shortlist
Where the gaps sit, what to do first, and why each one is where it is. Ranked by consequence to the people affected, not by ease of fixing.
Vendor-conformity assessment
What your vendor's conformity actually discharges, which duties stay yours, and whether Article 25 has moved you to provider.
Format & fee
Real numbers, upfront.
- Scope
- Set by the Act, not by us
- Input
- Your systems and what exists on them
- Re-read
- Annually, or on modification - $21,000 against your known baseline
The Act fixed the scope, not us, so the fee is flat - nothing to meter, and nothing charged until you approve it.
Request your scan
EU AI Act · Compliance scan
$25,000 flat
- Independent classification report
- System register, tier by tier
- Article 50 notice text, ready to post
- Annex IV gap list included
Show your hand
Four things you have to be able to produce
The Act is not graded on intent. Each of these is either in your hand on the day an authority asks, or it is not.
The tier,
determined
A written determination of where each system sits against Annex III and Article 5, with your own role settled for each of them. An assumption is not a position.
The file,
assembled
The Annex IV technical file for each high-risk system, broken into its sections so the thin ones show - and the ability to produce it in full on the day it is asked for.
The notice,
up front
The people who meet it told that it is AI and what it does, before it is used on them. Article 50 disclosure sits where the user is, not on a policy page nobody opens.
The proof,
underneath
The governance, the logs, the human oversight and the tests the file asserts, each of them dated. The record is the evidence, and the file on its own is only the claim.
Four cards, and the date on each one is part of the card.
FAQ
Plain answers
Scope, timing, and the cost of getting it wrong. Answered straight.
Request your scanOur vendor is CE-marked. Are we covered?
Only for their duties, not yours. A deployer keeps oversight, logging and disclosure whatever the vendor holds - and under Article 25 you may have become the provider yourself.
How do I know if we are high-risk?
Two routes in: the system is a safety component of an Annex I regulated product, or it does one of the things on the Annex III list - employment, credit, education, essential services, biometrics, law enforcement.
What is actually in force right now?
Prohibitions since February 2025, and the Article 50 transparency duties since August 2026 - chatbot disclosure, synthetic-media marking, biometric notices. Those are live obligations today, not future ones.
What are the penalties?
Up to EUR 35 million or 7% of global annual turnover for prohibited practices, up to EUR 15 million or 3% for most other breaches, and up to EUR 7.5 million or 1% for supplying misleading information.
How long does it take?
Typically two to four weeks from hand-over for a first inventory, longer where the system count turns out to be bigger than expected - which it usually does. Scope is agreed before anything is charged.
Get started
Request your compliance scan
Tell us about your AI systems and we come back with a scoping call within one business day.
What we need from you
Nothing you do not already have. Most of this is a folder someone can assemble in an afternoon, and we name every document first, in writing, before you commit.
- Which AI systems you build or use, and what each decides
- Whether any of it is on the EU market or used there
- Any documentation - model cards, contracts, DPIAs
- Whether you built the system, bought it, or modified one
- Your target readiness date, if you have one
What happens next
- You send the five items we need.
- You get a scoping call within one business day.
- Nothing is charged until you approve the scope.
Sources & standing
Where this page gets its facts
Where the claims on this page come from, and what they are worth - stated, not assumed.
What it is drawn from
- Regulation (EU) 2024/1689 - the AI Act
- Digital Omnibus deferral, Annexes I-IV
- Effective
- 1 January 2023
- Enforced from
- 5 July 2023
What it means
- General information about what the law requires — not legal advice, and no professional relationship arises from reading it. It determines nothing about your own systems.
- Where a scope question is arguable, our reports say so rather than the convenient one.
Scope & limitation
- Do not rest a binding decision on it; engage qualified counsel.
- It covers the EU AI Act alone - GDPR and sectoral rules can reach the same system.
- Use it as a starting point for a scoping conversation, not as your final word.
Something on this page out of date?
Tell usFrom Insights
Before you commission one
How to Prepare for an AI Audit: The Readiness Checklist
Six things to have ready before the engagement starts. Assembling them takes a fortnight off the clock — and tends to find the first two findings before an auditor does.
Read the notes
METHODOLOGY NOTES
What Is an AI Audit? Scope, Standards, and What You Get
An independent review of what your AI actually does, measured against a named standard — not a certificate, and not a review of what the documentation says it does.
STANDARDS EXPLAINED
What an AI Governance Framework Actually Contains
Five working parts, not a policy document. What each one has to do, how to tell whether yours is real, and why a framework is not the same thing as compliance.
STANDARDS EXPLAINED
ISO/IEC 42001, SOC 2 and NIST AI RMF: Which One Your Buyer Is Actually Asking For
One certifies an organisation, one is an opinion about controls over a window, one is a method with nothing to issue. What each covers — and what none of them answers.
