EU AI Act · AI regulation · 2024

Implement the EU AI Act — classify your AI systems and document compliance so it stands up to scrutiny

We establish your role as provider, deployer or importer, classify your AI systems by risk level and build the technical documentation, governance, transparency obligations and conformity evidence in a structured way.

  • A named AI officer — as an external service
  • Risk classification — prohibited · high risk · limited · minimal
  • Overlap with ISO 42001 — AI management set up
  • Reduce the risk of fines — settle the duties early and prepare the evidence
Book an AI Act assessment Have your AI systems reviewed
notivia since 2003· +50 ISMS clients*· +20 Full-service projects*· ISO 27001, ISO 42001 & the EU AI Act in one platform· ★★★★★5.0

* Audit success relates to completed full-service certification projects since 2019. Client numbers include ISMS platform licence holders.

Quick check

This page is for you if …

  • … you want to prepare for develop or use AI systems.
  • … you are in scope as a provider, deployer or importer .
  • … you want to prepare for high-risk AI under Annex III .
  • … you want to prepare for technical documentation and a conformity assessment .
  • … you want to know what EU AI Act compliance costs and how long it takes.
Our services for the EU AI Act

Four building blocks. One route to compliance.

AI compliance under the EU AI Act — risk classification, conformity assessment and the AI register, all from one source.

Maximum support

Full-service support

AI Act readiness for your AI portfolio: the inventory, clarifying your role, risk classification, the gap analysis, the documentation structure and the action plan.

This suits you if you want EU AI Act compliance with as little internal project load as possible.
  • The AI system register built
  • Risk classification (prohibited / high risk / limited risk)
  • Technical documentation
  • Human oversight documented
from €5,900 one-off · M from 11,800 € · L from 19,600 €for small AI portfolios / a basic scope · the high-risk conformity assessment, the CE process and a notified body come on top depending on the system · all prices exclude VAT
Request a quote
Ongoing

External AI governance support

We support your internal team with the AI inventory, risk reviews, technical documentation, training and reporting — responsibility stays with you.

This suits you if you want to outsource ongoing AI governance and conformity reporting.
  • AI system lifecycle governance
  • Quarterly AI risk review
  • Preparing the conformity assessment — internally or with a notified body, depending on the system
  • Training for AI product teams
from €700 / month
Enquire about consulting
12-month minimum term · 3 months' notice
One-off / yearly

Internal audit

An AI Act compliance check of your existing AI systems.

This suits you if you want your AI systems verified before the conformity assessment.
  • Classification for each system
  • Completeness of the documentation
  • Bias & data governance check
  • Action plan
from €2,900 one-off
Enquire about an audit
Self-service

Build it yourself

Build EU AI Act compliance yourself — the ISMS platform takes you through the requirements step by step.

  • The guide shows the next step
  • AI produces your documents
  • 800+ templates to build on
  • Support can be added at any time
from€249/ month · cancellable monthly
See the self-service option

Additionally for the EU AI Act

Standard-specific extras — bookable individually

AI risk classification

A system-by-system classification as prohibited / high risk / limited risk / minimal risk.

from €1,490

Conformity assessment (high risk)

The CE marking process for high-risk AI systems.

from €8,900

Building the AI register

Building the company-wide inventory of AI systems.

from €2,490
Retainer services (external officer, reporting channel): 12-month minimum term · 3 months' notice to the end of the month · all prices exclude VAT.
Free initial assessment

In 30 minutes settled: your role, the risk level and the duties that come next

We establish whether you are a provider, deployer or importer, which AI systems are in scope, and whether technical documentation, transparency obligations or a conformity assessment become necessary.

Lead consultant
Lead consultant
Your contact
  • A quick answer
  • Realistic figures for time and cost
  • No sales pressure, no obligation
  • From notivia GmbH, Stuttgart — since 2019
think why NETFORMIC Animus Intelligence Crest Digital Veoma VERDURE
Book directly — the quickest way
Pick a 30-minute slot yourself
or send us a message

    No spam·No obligation·A quick answer·GDPR-compliant
    Prefer to call? +49 711 35 15 705
    Start on your own

    Two tools — ready to use right now

    Before you get in touch: work out the cost and explore the platform — free and without obligation.

    Free AI Act check · 3 min

    Does the EU AI Act apply to you?

    10 questions on AI systems, your role and the risk tier. Know straight away which obligations fall to you.

    Start the check

    Or do it yourself

    The ISMS platform with its AI governance module

    The multi-standard ISMS digitalises AI risk classification, the technical documentation and the conformity assessment — made for internal teams that want to document their AI systems in a structured way.

    Explore the platform
    Guide · PDF

    EU AI Act guide for companies

    What the regulation requires, which deadlines apply, what providers and deployers need to know — explained plainly.

    Download the guide
    A RISK-BASED APPROACH

    Four risk levels for AI systems

    The higher the risk, the stricter the requirements — from prohibited practices to minimal transparency duties.

    Prohibited AI practices

    Social scoring, manipulative techniques, real-time biometrics in public spaces (with exceptions), emotion recognition at work

    High-risk AI systems

    Biometrics, critical infrastructure, education, employment, creditworthiness, law enforcement, migration — the strictest requirements

    Limited risk

    Chatbots, deepfakes, AI-generated content — transparency and labelling duties

    Minimal risk

    Spam filters, AI in video games, recommendation algorithms — voluntary codes of conduct

    WHO IS IN SCOPE?

    Roles under the EU AI Act

    The AI Act sets clear responsibilities along the whole AI value chain.

    Provider

    Develops an AI system, or has one developed, and places it on the market or puts it into service. Carries the main responsibility for compliance.

    Deployer

    Uses an AI system in its own business. Must monitor risks, meet transparency duties and ensure human oversight.

    Importer / distributor

    Brings AI systems from third countries onto the EU market. Must make sure the provider meets the conformity requirements.

    CORE REQUIREMENTS

    Duties for high-risk AI systems

    Chapter III of the AI Act sets out comprehensive requirements for high-risk AI.

    Risk management system

    A continuous process to identify, analyse and mitigate risks across the whole lifecycle (Art. 9).

    Data governance

    Requirements for training, validation and test data: quality, representativeness and bias testing (Art. 10).

    Technical documentation

    Comprehensive documentation before placing on the market: architecture, training methods, performance metrics (Art. 11).

    Logging & traceability

    Automatic recording of everything that happens, so decisions and incidents can be traced (Art. 12).

    Transparency & information

    Clear instructions for deployers: capabilities, limits and intended use (Art. 13).

    Human oversight

    AI systems must be designed so that people can oversee the decisions and intervene (Art. 14).

    Accuracy & robustness

    An appropriate level of accuracy, robustness and cyber security across the whole lifecycle (Art. 15).

    Conformity assessment

    Before placing on the market: CE marking, the declaration of conformity and, where required, third-party assessment (Art. 43).

    TIMELINE

    Coming into force in stages

    02/25
    February 2025

    Prohibited AI practices

    The ban on social scoring, manipulative techniques and unlawful biometric surveillance takes effect.

    08/25
    August 2025

    GPAI & governance

    The rules for general purpose AI (GPT-style models), the governance structures and the AI literacy duties start to apply.

    08/26
    August 2026

    High-risk AI (Annex III)

    Every duty for high-risk AI systems under Annex III applies in full — including the conformity assessment.

    08/27
    August 2027

    Full application

    All remaining provisions apply — including high-risk AI under existing sectoral EU legislation (Annex I).

    €35 million / 7 %

    For prohibited AI practices: up to €35 million or 7 % of worldwide annual turnover.

    €15 million / 3 %

    For breaches concerning high-risk AI: up to €15 million or 3 % of annual turnover.

    €7.5 million / 1 %

    For incorrect information given to authorities: up to €7.5 million or 1 % of annual turnover.

    The regulation in brief

    What has to be in place for the ISO 27001?

    Eight building blocks — the mandatory set for AI Act compliance with high-risk AI.

    1. Risk classification of the AI systems (Annex III)
    2. Technical documentation (Art. 11)
    3. Risk management system (Art. 9)
    4. Data quality & data governance (Art. 10)
    5. Human oversight (Art. 14)
    6. Conformity assessment (Art. 43)
    7. CE marking & registration (Art. 49)
    8. Post-market monitoring (Art. 72)

    In the initial call we show you which points you already meet.

    Book a free initial assessment
    OVERLAP

    ISO 27001 and ISO 42001 as a basis for AI Act compliance

    ISO 27001 helps with the security organisation, risk management, documentation, logging and cyber security. ISO 42001 is the better fit for AI governance, the AI lifecycle, data quality, human oversight and continual improvement. Neither standard replaces the EU AI Act, but both can prepare a good deal of the evidence. Depending on scope and what you already have, ISO 27001 can prepare around 30–50 % and ISO 42001 around 60–70 % of the relevant governance and documentation building blocks.

    EU AI Act requirementCovered by ISO 27001
    Art. 9 risk management system ISO 27001 cl. 6.1 risk assessment
    Art. 11 technical documentation ISO 27001 cl. 7.5 documentation
    Art. 12 logging ISO 27001 A.8.15 logging
    Art. 15 cyber security ISO 27001 A.8 technical controls
    Art. 17 quality management ISO 27001 cl. 9 + 10 PDCA
    Art. 10 data governance ISO 27001 A.5.9–A.5.14
    30–70 %
    prepared by ISO 27001 + ISO 42001 — depending on scope and what you already have
    OUR SOLUTION

    Implementing the EU AI Act with iso-easy

    1

    Build the AI inventory

    Identifying every AI system, classifying it and assigning the right risk level.

    2

    Gap analysis

    Comparing your existing measures against the AI Act requirements and identifying the gaps.

    3

    Build compliance

    Implementing the risk management system, the documentation and the governance for your AI systems.

    4

    Compliant for the long run

    Monitoring, incident reporting and continual improvement in a PDCA operating mode.

    AI risk classification Technical documentation Bias testing Data governance Human oversight Conformity assessment

    Or do it yourself

    The ISMS platform for the EU AI Act — and 10 further standards

    Digitalise AI risk classification, the technical documentation and the conformity evidence in a multi-standard ISMS. With an AI copilot, templates and the audit guide — without external consulting costs.

    • Multi-standard ISMS
    • AI copilot & templates
    • Audit guide
    • Cancellable monthly

    from €249

    / month · Starter with 1 standard

    Explore the platform
    FAQ

    Frequently asked questions about the EU AI Act

    What is the EU AI Act?
    The EU AI Act (Regulation 2024/1689) is the world's first comprehensive law regulating artificial intelligence. It takes a risk-based approach: the higher the risk of an AI system, the stricter the requirements.
    Is my company in scope?
    Most companies are at least indirectly in scope as soon as they develop, buy or use AI systems. Which duties actually apply depends on your role (provider, deployer, importer), the purpose of the system and its risk level. For many applications it starts with AI literacy, transparency and keeping an inventory; for high-risk AI far stricter duties come on top.
    What is a high-risk AI system?
    AI systems in sensitive areas: biometric identification, critical infrastructure, education, employment (recruiting, performance assessment), creditworthiness, law enforcement and migration. These face the strictest requirements of the AI Act.
    What are the deadlines?
    In stages: the prohibitions since February 2025. The GPAI rules from August 2025. High-risk AI (Annex III) from August 2026. Full application from August 2027. The earlier you start the better — implementation is involved.
    Does ISO 27001 help with AI Act compliance?
    Yes. An ISO 27001 ISMS covers around 50 % of the AI Act requirements — above all risk management, documentation, logging and cyber security. The AI-specific parts (bias testing, data governance, the conformity assessment) have to be added.
    Does the AI Act apply to open-source AI?
    As a rule, open-source AI models face lighter requirements. There are exceptions for high-risk applications and for GPAI models with systemic risk — those carry the full duties even when open source.
    How much internal work does this really mean for us?
    A conventional AI Act project swallows 30–60 person-days of internal time (risk classification, technical documentation, the conformity assessment). With our approach plus the ISMS platform we bring that down to 15–25 person-days — because we prepare most of the risk templates, the documentation structures and the assessment checklists for you.
    Which risk level applies to my AI system?
    The EU AI Act distinguishes 4 levels: prohibited, high risk (Annex III: shortlisting candidates, education or creditworthiness, for example), limited risk (transparency duty, chatbots for example) and minimal risk. Our scope assessment settles your classification in 3 minutes.
    What happens after the AI Act is implemented? Inspections?
    For high-risk AI: Conformity assessment plus CE marking and registration in the EU database (Art. 49). Supervisory authorities can ask for the technical documentation and the logs at any time. With our ISMS platform every piece of evidence (risk analyses, data quality checks, oversight logs) is available whenever it is needed.
    Is ISO 27001 / ISO 42001 enough for AI Act compliance?
    ISO 27001 covers around 30–40 % of the AI Act requirements (risk management, security). ISO 42001 covers around 60–70 % (the AI lifecycle, data quality, oversight) and is the ideal base. But the AI Act adds specific duties such as the conformity assessment, CE marking and post-market monitoring — depending on scope and what you already have.
    How high are the penalties for breaching the AI Act?
    It depends on the breach. For prohibited practices up to 35 million € or 7 % of worldwide annual turnover (whichever is higher). For high-risk breaches up to 15 million € or 3 %. For false statements to authorities up to 7.5 million € or 1 %.