Some AI Act deadlines moved.
The transparency rules already apply.
The Digital Omnibus gave Annex III high-risk systems until December 2027. It gave the transparency rules nothing. Those have applied since 2 August 2026. In three weeks, on a fixed scope, we work out which rules apply to your product and from which date.
EU AI Act timeline updated September 2026.
What changed
- 2 August 2026
Article 50 transparency obligations apply
You tell users when they are talking to an AI and label AI-generated content.
- 2 December 2026
Watermarking grace period ends
AI systems already on the market before 2 August 2026 need machine-readable marking of AI-generated content by this date.
- 2 December 2027
Annex III high-risk obligations
Use-based systems in areas such as employment, credit, education and essential services. Moved from August 2026.
- 2 August 2028
Annex I high-risk obligations
High-risk systems embedded in products.
The Digital Omnibus (agreed in May 2026, in force since 27 July 2026 as Regulation (EU) 2026/1744) pushed back two of the Act's biggest deadlines. The Article 50 transparency obligations stayed on schedule.
If you heard "the AI Act got delayed" and stopped reading, you may have missed that the transparency rules already apply. The opposite mistake costs money too: building high-risk compliance you won't need until December 2027. In the audit we check which rules apply to your product and from which date.
Fines reach up to €35 million or 7% of global annual turnover for prohibited practices, and up to €15 million or 3% for breaching the high-risk or transparency obligations once they apply to you.
Who this is for
- A European startup, somewhere between 10 and 100 people, that has shipped AI features in the last 18 months.
- Anyone putting OpenAI, Anthropic or another model API in front of customers.
- Teams building agents or automation, or anything that scores and ranks.
- Founders about to raise or sell, whose investors or buyers will want a credible audit of the AI code during diligence.
- And founders who know the Act touches their product somewhere but can't say where.
If you're not sure the EU AI Act applies to you at all, take the 60-second exposure check and you'll have a plain-English answer in a minute.
Raising, or being
acquired?
If your team moved fast with Claude Code, Cursor or something similar, technical due diligence will want to know who reviewed that code and what it exposes. That holds even when nothing in your product puts AI in front of customers. For these cases we run a pre-raise or pre-acquisition version of the audit. The scope is the same and so are the three weeks, but we organise the work around the questions the investor's or acquirer's technical team is going to ask you.
What's included
Fixed scope, 3 weeks.
- 1
A list of every AI system in your product, and every workflow in the company that touches AI.
- 2
Each system placed in its EU AI Act risk tier: prohibited, high-risk, limited or minimal.
- 3
A look at the third-party AI services you depend on, and where each of them stands on compliance.
- 4
A security review of your MCP servers and agent permissions. They open a different attack surface from the usual appsec checklist.
- 5
The documentation for a conformity assessment, if any of your systems are high-risk.
- 6
Recommendations on human oversight and logging, each with an estimate of the effort to build it.
- 7
A remediation roadmap, ordered by which deadline reaches you first.
- 8
A 90-minute call at the end, where we take your founder and tech lead through all of it.
Timeline
- Week 1
- We kick off, list your AI systems and review your vendors.
- Week 2
- We classify the risk, find the gaps and draft the documentation.
- Week 3
- You get the final report and the roadmap, and we walk you through both.
We can start within 5 business days of signing. If you book the 3-week audit now, the results reach you before the 2 December 2026 watermarking cut-off, and you also get a documented head start on the December 2027 high-risk deadline.
Why us
- We build production software ourselves, so each recommendation comes with an effort estimate your engineers can plan around.
- We are based in Portugal and work under GDPR ourselves, so the European rules are part of our own daily work.
- We have shipped AI features in live products: Loadmile, GoShip and GrowSober.
- If you don't need a full audit, we'll tell you in the free 20-minute call and point you to the cheaper option.
Common
questions
Didn't the EU AI Act deadline get pushed back? Why act now?
Part of it was. The Digital Omnibus (Regulation (EU) 2026/1744, in force since 27 July 2026) moved the Annex III high-risk deadline to 2 December 2027. Article 50 kept its dates. Its transparency rules have applied since 2 August 2026, and a system that was already on the market before then has until 2 December 2026 to add machine-readable marking to AI-generated content. So in the audit we pin each of your systems to its own date. You avoid a scramble later, and you don't spend money on compliance work that can wait.
Do we need this if we only use ChatGPT?
ChatGPT on its own is unlikely to put you in the high-risk tier. You'll probably still need a usage policy, a risk assessment of the vendor, and some control over staff using AI tools nobody approved (shadow AI). The exposure check will show you where you stand.
What if our use case is low-risk?
Then we'll tell you so on the 20-minute call, and that's the end of it. We won't sell you an audit you don't need.
Can you also handle the remediation after the audit?
Yes, if you want us to. You can go straight into a fractional CTO engagement or a Build Sprint and we'll implement the recommendations. The audit has its own fixed price, though, so your own team is free to do the fixes instead.
What does the free 20-min call involve?
Start with the 60-second exposure check. It gives you your likely risk tier. If the result needs a closer look, we get on a call, you tell us about the product and how it uses AI, and we tell you whether the EU AI Act applies and under which annex, what the audit would cover in your case, and whether we'd recommend going ahead. Nobody opens a slide deck.
Find out your exposure.
The exposure check takes 60 seconds, and a follow-up call, if you need one, takes 20 minutes.