- You use or license AI tools — including AI features inside software you already had
- A customer questionnaire, tender, insurer or contract clause has asked how you comply
- You supply a regulated customer whose own obligations now flow down to you
- You have recently completed a Futable adoption programme and you feel ready to build the evidence layer beneath it
All services
03 · Compliance embedded in daily work
AI Act Compliance Readiness
Know which AI obligations apply to you, and prove you meet them before a customer asks.
- 8–10 weeks
- ~16–18 consulting days
- Preparation for client-side audit
The problem
How can we find out which articles apply to our company now that it uses AI.
A customer sends a forty-question AI due-diligence form, or a tender asks how you comply with the AI Act, and the honest answer is that nobody has looked. The literacy obligation on employers has applied since February 2025 but there is very few companies that had the capacity or the possibility to properly prepare on it. All the while AI features keep arriving inside software you already licensed, without anyone reviewing the terms or asking where the data goes.
The law firm will tell you what articles applies. The AI vendor will tell you their product is compliant — from their perspective, not from the perspecitve of your usecase. It is very hard to provide the proper controls, or do the necessary evidencing in such cases.
The GDPR risk exists independently of the AI Act: if personal data is entered into an AI tool without an appropriate data processing agreement in place, the company’s GDPR compliance may be compromised.
Who it's for
This is a fit if
Who we recommend it for
- Managing directors; the head of legal or compliance; or the CFO when a contract is at stake
- For managers or executives in HR, procurement or, IT compliance controls
- High-risk users as identified under Annex III of AI Act, and regulated sectors, quoted individually
- If your company builds and place AI systems on the market, we provide our services quoted individually with legal counsel involved
How it happens
In six steps, through eight to ten weeks.
- Intake Duration: One week. Sponsor kick-off, and the inventory begins together with IT and department leads: we are inventorying every AI tool, every AI-enabled system, and the uses people actually put them to.
- Readiness assessment Duration: One to two weeks. We map your regulatory role for the usecase of each AI- or AI-enabled tool to find out whether you are categorized as deployer, provider, or neither based on Annex III of the AI Act, and also triage every one of your vendor's terms for the same purpose, so that we can do a gap analysis on what is already covered, or not.
- Statement of Work Duration: One week with an hour long meeting at the end. During this phase we fully map which tools and uses are in scope, which obligations will be met, which processes the controls go into, and where the Futable boundary sits. From here scope changes only by written change order.
- Obligation register and vendor review Duration: Two to three weeks. Each applicable article decomposed into a requirement, a control, an owner and an evidence type — and each AI tool reviewed for its data-processing position: whether or not the proper agreements are in place, if data residency is clear, if there is possibility for opting out from a training, and what data retention policies are in place.
- Control embedding Duration: Two to three weeks. Access, identity, logging and data-classification controls for AI tools written into your existing IT process descriptions, and the AI risks mapped and added to your risk register with owners.
- Sign-off and hand-over Duration: One week. During this week we sit down with all management sponsors and stakeholders to gather their sign off on the assessment report, hand over the indexed evidence pack, and a pre-seeded questionaire response library to help with future customer form in advance.
Premium adds implementation support with your IT or MSP, help renegotiating non-compliant vendor terms, a pre-inspection dry-run, and support answering up to three customer questionnaires from the pack.
What you get?
Readiness Assessment Report
Obligation Register
Literacy & Transparency Framework
AI Vendor & Data-Processing Review
Embedded Controls, Risk Entries & Evidence Pack
Five documents that helps to answer compliance questions or a questionnaire.
Every AI tool and usecase identified, each with its regulatory role and reasoning. Containing an Annex III screening, with every applicable obligation rated, and a linked, prioritised remediation plan.
Each applicable article as a requirement, with an assigned control, owner, evidence type and a status. This is the document that answers "what do we need to do?".
How the Article 4, literacy obligation of AI Act is evidenced per role, with the first records captured, together with the transparency measures that apply to you, with the actual disclosure wording and markers to where in the process it appears.
Ez a dokumentum minden vizsgált eszköz esetében teljes áttekintést ad: Ki a szolgáltató, mit tartalmaznak a szerződéses feltételek, rendelkezésre állnak-e a szükséges megállapodások, hol tárolódnak az adatok, felhasználásra kerülnek-e modellek tanításához, min szükséges változtatni, és ki felel a változtatások végrehajtásáért.
Access, logging and classification controls written into your IT processes with owners linked to them; AI risks addeed to your risk register; and the evidence index with a response library for customer questionnaires.
Packages
- Entry — maturity assessment In the entry package we provide you with an inventory, containing your regulatory role per usecase; a map of your obligations and a rated position based on your how your AI usage is categorized based on AI Act. Through this package you receive enough information to see where you stand currently with your AI maturity, and know what the gap costs.
- Standard — the compliance floor All services mentioned on this page: creation of an obligation register, documenting literacy and transparency evidence, reviewing vendors based on the facts from the obligation register, embedding necessary controls necessary for AI-tools your company uses, registering their risks, collecting the evidence pack for a future or imminent audit, gathering management sign-off for the implementation of all of the mentioned changes.
- Premium — with implementation Everything that is available in the Standard Plan, plus control implementation together with your IT or MSP, support in vendor renegotiation, if necessary, an audit dry-run, and questionnaire support for the next three customer questionnaires - if applicable.
- Custom For AI providers; those with AI-tool deployments considered high-risk according to Annex III of AI Act; for those in the regulated sectors; or multi-entity groups.
- A sponsor and a compliance or security owner (if applicable)
- The list of AI tools and licences in use — or permission to establish it with your IT and MSP
- Vendor contracts and whatever data-processing documentation exists
- HR for the literacy records, procurement for the vendor contracts
- Decisions on vendor actions and risk treatment within five business days
Next step
Before the next audit or questionnaire arrives.
The maturity assessment takes about two weeks and ends with a written position you can hand to a customer. Even if it turns out almost nothing applies to you, that is also a useful thing to have in writing.