If an AI system you build or sell reaches people in the EU, the AI Act may apply to it. We work out which obligations apply and build the technical evidence they ask for.
“Does the Act even apply to us?”
A written classification of each AI system: what it does, who it affects and which category the text places it in. Your counsel confirms the legal reading.
“We do not know what documentation is expected.”
Technical documentation drafted from your actual system: purpose, data, design, testing and limits.
“We cannot show what the system did last month.”
Logging and traceability built in, so events can be reconstructed and reviewed.
“Who is responsible when the AI decides?”
Human oversight designed into the workflow: who can review, who can override and who can stop it.
“Do our users know they are dealing with AI?”
Transparency notices and interface changes where the Act expects people to be told.
Five areas the Act cares about, and a plan to close the gaps between them and where you are now.
Sorting each system into the categories of the Act from its purpose and use, with the reasoning written down.
Drafting system documentation from the code, the data and the tests, in a form an auditor can read.
Designing and building the event logs that let a decision be reconstructed and reviewed.
Approval, override and stop controls, with named roles and evidence that they are used.
Notices and interface changes that tell people when they are dealing with AI or AI-generated content.
What is done, what is missing and in what order to close it, ranked by what matters most.
Yes. The work fits into how you already build and document software, so it does not become a parallel process.
We write the documentation in the formats your team already keeps, so it can be maintained after we leave.
The obligations attach to the system and how it is used, not to where it is hosted. Hosting still changes how you meet them.
Fits, with limits
Logs live on devices you may not control. We design how records are collected and kept.
Fits
You control retention and access to logs. You also carry the duty to keep them.
Fits
Logging, access control and retention sit in your tenancy, which makes evidence easier to hold.
Fits
Records must cover both sides of the boundary, so the trace stays whole across it.
Fits
Ask the provider what it documents and logs. Its documentation can help yours, but it does not replace it.
We have not published an EU AI Act engagement, and we do not publish client work. What we can show is the governance engineering this work relies on, in systems we run.
Approval gates, an audit trail and evidence chains: the raw material for oversight and traceability.
Beta, with access on request at daena.mas-ai.co. It is the reference architecture we draw on for governed agent builds.
Read the case study
An audit log and an approval gate on every tool call an AI assistant makes.
Open sourceRead the case studyIt can. The Act looks at whether an AI system is placed on the EU market or its output is used in the EU, not where the company is based. Whether it applies to you is a legal question for your counsel. We prepare the technical side either way.
They phase in over several years, and different parts apply at different times. We do not quote dates on this page, because they can change with amendments and guidance. We work from the current Official Journal text and confirm the timing with your counsel for each system.
That depends on its purpose and the setting where it is used, not on the technology. Classification is the first thing we do, in writing, with the reasoning shown. Your counsel confirms it.
No. We are not a notified body or a law firm. We produce technical documentation, logging, oversight and transparency work, and a gap analysis that your counsel and auditors can review.
We do not publish a fixed price, because the work depends on how many systems you have and how they are built. A short scoping step ends in a scope and a cost range for your case.
Closely. Several obligations rest on the same controls: logging, access, oversight and testing. The security, evaluation and governance page describes those controls.
We start with the problem, then tell you whether it is worth building.
Bring us a bottleneck