EU AI Act readiness is an engineering job, not a document. Pexon classifies each AI system under Article 6 and Annex III of Regulation (EU) 2024/1689, builds the event logging Articles 12 and 19 require, and produces evaluation evidence per release, so Annex IV documentation describes a system that behaves that way.
The starting point
An industrial group with a few AI systems in production typically has a policy document, an owner in legal, and no way to answer a question about one specific output from March.
Article 12 of Regulation (EU) 2024/1689 requires high-risk systems to record events automatically across their lifetime, and Articles 19 and 26(6) require those records to be retained for at least six months. That is a logging architecture, not a paragraph in a policy.
The document states intent; the system has to produce proof.
What we build
Articles 3 and 6
Every AI system in use mapped to a role under Article 3, provider or deployer, and to a risk class under Article 6 and Annex III. Where you rely on the Article 6(3) derogation, the assessment is written down before deployment, which Article 6(4) requires in any case. We need a list of candidate systems and thirty minutes with each owner.
Articles 19 and 26(6)
Prompt, retrieved context, model version, tool calls and output recorded where traffic passes through, rather than scraped back out of application logs afterwards. Retention is configurable and defaults to the six months Articles 19 and 26(6) set as the floor. Queryable by system, by user and by date range.
Article 15
A regression suite with thresholds you set, run on every model, prompt and retrieval change, results kept as dated artefacts. Article 15 expects declared levels of accuracy and robustness; this is where the numbers behind that declaration come from, and what the Annex IV documentation points at.
The obligation map
| Obligation | The artefact that satisfies it |
|---|---|
| Articles 3 and 6 — role and risk classification | A system inventory with provider-or-deployer role and risk class per system, documented before deployment (Article 6(4)). |
| Article 12 — automatic event recording | Prompt, retrieved context, model version, tool calls and output recorded at the gateway for every high-risk system. |
| Articles 19 and 26(6) — retention | The same logs retained for at least six months, configurable, queryable by system, user and date range. |
| Article 15 — accuracy and robustness | A regression suite with declared thresholds, run on every model, prompt and retrieval change, results kept as dated artefacts. |
| Article 25 — becoming a provider | A documented check for the cases that turn a deployer into a provider: your own name on the system, substantial modification, or a change of intended purpose. |
Every cell in this table is something the build on this page produces. Counsel still makes the legal call — the artefacts are the evidence they need to make it.
Provider or deployer
Most industrial companies are deployers under the AI Act — until Article 25 turns them into providers. That happens if you put your own name on a high-risk system, modify it substantially, or change its intended purpose so that it becomes high-risk. Adapting a general-purpose model for a use listed in Annex III is the case that catches most companies.
The distinction matters because provider obligations are heavier: conformity assessment, technical documentation per Annex IV, and the full logging and evaluation regime. The classification step in the blueprint exists precisely to catch this before a rollout, when changing the plan is cheap.
€4,900
We inventory the AI systems actually in use, classify each one by role and risk, and hand back a costed plan for the logging and evaluation gaps we find.
Build work is scoped from that plan afterwards. If you decide to build it with someone else, the plan is still yours to keep.
The two-week Readiness Blueprint is fixed at €4,900 net. It returns a system inventory, a role and risk classification per system, and a costed plan for the logging and evaluation gaps it finds. Build work is scoped from that plan, never quoted before it.
Usually a deployer, until Article 25 turns you into a provider. That happens if you put your own name on a high-risk system, modify it substantially, or change its intended purpose so that it becomes high-risk. Adapting a general-purpose model for a use listed in Annex III is the case that catches most companies.
No. We give no legal advice and will not sign off a conformity assessment. We build the technical evidence your counsel needs in order to make that call: the classification record, the logs, the evaluation results, and the artefacts the Annex IV documentation points to.
Next step
Thirty minutes with the architect who would actually run the engagement.