EU AI Act readiness is a build task, not a binder.
EU AI Act readiness is an engineering job, not a document. Pexon classifies each AI system under Article 6 and Annex III of Regulation (EU) 2024/1689, builds the event logging Articles 12 and 19 require, and produces evaluation evidence per release, so Annex IV documentation describes a system that behaves that way.
The policy exists. The evidence does not.
An industrial group with a few AI systems in production typically has a policy document, an owner in legal, and no way to answer a question about one specific output from March. Article 12 of Regulation (EU) 2024/1689 requires high-risk systems to record events automatically across their lifetime, and Articles 19 and 26(6) require those records to be retained for at least six months. That is a logging architecture, not a paragraph in a policy. The document states intent; the system has to produce proof.
Three things that have to exist in the system
Inventory and classification
Every AI system in use mapped to a role under Article 3, provider or deployer, and to a risk class under Article 6 and Annex III. Where you rely on the Article 6(3) derogation, the assessment is written down before deployment, which Article 6(4) requires in any case. We need a list of candidate systems and thirty minutes with each owner.
Logging at the gateway
Prompt, retrieved context, model version, tool calls and output recorded where traffic passes through, rather than scraped back out of application logs afterwards. Retention is configurable and defaults to the six months Articles 19 and 26(6) set as the floor. Queryable by system, by user and by date range.
Evaluation evidence per release
A regression suite with thresholds you set, run on every model, prompt and retrieval change, results kept as dated artefacts. Article 15 expects declared levels of accuracy and robustness; this is where the numbers behind that declaration come from, and what the Annex IV documentation points at.
What changes
- Every AI system in the estate has a named owner, a documented role and a risk classification that survives being questioned.
- Reconstructing which inputs produced a given output becomes a query against the log, not a forensic exercise across four teams.
- Model, prompt and retrieval changes ship against a recorded baseline, so the question of whether quality regressed has an answer with a date on it.
- Counsel reviews evidence the system emits, instead of a description of what the system is believed to do.
- The classification decision is documented before deployment, which is the point at which Article 6(4) expects it to exist.
Two weeks, fixed at €4,900 net. We inventory the AI systems actually in use, classify each one by role and risk, and hand back a costed plan for the logging and evaluation gaps we find. Build work is scoped from that plan afterwards. If you decide to build it with someone else, the plan is still yours to keep.
Scope, roles and cost
What does EU AI Act readiness cost?
The two-week Readiness Blueprint is fixed at €4,900 net. It returns a system inventory, a role and risk classification per system, and a costed plan for the logging and evaluation gaps it finds. Build work is scoped from that plan, never quoted before it.
Are we a provider or a deployer under the AI Act?
Usually a deployer, until Article 25 turns you into a provider. That happens if you put your own name on a high-risk system, modify it substantially, or change its intended purpose so that it becomes high-risk. Adapting a general-purpose model for a use listed in Annex III is the case that catches most companies.
Does this replace our legal counsel?
No. We give no legal advice and will not sign off a conformity assessment. We build the technical evidence your counsel needs in order to make that call: the classification record, the logs, the evaluation results, and the artefacts the Annex IV documentation points to.
Not a sales call. An architecture call.
Thirty minutes with the architect who would actually run the engagement.