The Digital Omnibus moved your high-risk deadline, recruitment and employment AI included, from August 2026 to December 2027. That is runway to get this right, not a reason to wait. What still lands in August 2026 is narrower: Article 50 transparency and GPAI enforcement. The fines regime has applied since August 2025.
A four-week readiness assessment, the EU AI Act track of the Discovery Sprint. I produce your AI system inventory, gap analysis, risk classification, prioritized roadmap and a quick-wins memo your team can act on this week. Fixed fee.
Refund clause: if your team can’t act on three findings in 30 days, half comes back.
maximum fine, or 7% of global turnover
Regulation (EU) 2024/1689
haven’t taken meaningful compliance steps
Vision Compliance, 2026
no complete inventory of AI systems in use
PwC, 2025
of your team’s time across 4 calendar weeks
Worklabs engagement
The high-risk deadline moved to December 2027, so you have runway. But the board is asking, your legal counsel has flagged it, and you haven’t scoped the work. You’re not even sure which of your AI systems fall under the Act, or which duties already bite in August 2026. You don’t have an inventory.
Someone did a first pass. Maybe an external lawyer wrote a memo. There’s a 50-page document on SharePoint. Nothing has actually changed in operations. The deadline moved to 2027, the pressure came off, and nobody owns the next step.
If you’re in neither situation, you’re ahead of 78% of European mid-market.
Not a 50-page PDF that nobody reads. An action plan with named owners and weekly checkpoints.
I map every AI system in use across the organization. Including shadow AI, the tools your team adopted without IT knowing. Each one is classified by risk tier per the Act.
For each AI system, what the Act requires vs. what you have. Documentation, transparency, human oversight, data governance, conformity assessment status, vendor contract clauses.
High-risk, limited-risk, minimal-risk. Obligations per category. Prioritized action plan with timeline, effort estimates and recommended owners.
Three things you can do this week to reduce exposure right away. Plus the executive briefing for the board and the 30-day check-in already on the calendar.
If you need legal liability advice, you still want your law firm. I bring the operational side, and the two work well together.
Most AI consulting engagements end with a report and a handshake. Six months later, nothing changed. That’s not the outcome I’m selling.
The clause exists because I’m confident. I won’t recommend things you can’t act on.
A short working worksheet you can run with your team in 30 minutes. Identifies your AI risk tier, the 7 obligations that apply to most mid-market companies, and the 3 quick wins to start this week. Yours by email. No call required.
Roughly 10 days of your team’s time spread across 4 calendar weeks. Two days of stakeholder interviews in week 1, two days of technical walkthroughs in week 2, one day of risk classification workshop in week 3, half a day of board briefing prep in week 4, plus async review of working documents. I do the heavy lifting between sessions.
Minimum: the AI or IT lead, one operational leader (typically COO or Head of Operations), and one risk, compliance or legal point of contact. The CFO or CEO joins for the kickoff and the board briefing. I can run it with as few as 3 people. Works better with 5 to 6.
That’s normal and it’s exactly what the inventory phase surfaces. Shadow AI, the tools individual team members adopted without IT, is one of the most common findings. I have a method for discovery that doesn’t require everyone to confess.
That’s the most common finding for mid-market. Most systems fall under limited-risk or minimal-risk classifications. The obligations are lighter but still real (transparency, basic documentation). The assessment tells you what you do and don’t need to do, and often saves you from over-investing in compliance theater.
Yes. The Digital Omnibus, adopted in June 2026 and awaiting publication in the Official Journal, moved the stand-alone high-risk obligations, recruitment and employment AI included, from 2 August 2026 to 2 December 2027. What still lands on 2 August 2026 is narrower: Article 50 transparency duties and GPAI enforcement. The fines regime itself has applied since 2 August 2025. So you have runway on the heavy duties, which is exactly when a readiness assessment pays off. You fix the gaps on a calm schedule instead of a scramble, and you’re not exposed on the pieces that do bite in August.
Yes. That’s the Implementation phase from the practice page. If the assessment surfaces gaps that need building (logging infrastructure, governance workflows, vendor contract renegotiation), I can either run the remediation directly or scope it for your team to execute. The assessment is sold separately so you’re not locked in.
Yes. The deliverables come in the language your team works in. If your board reads in English and your operations team works in Spanish, I produce both.
No. I’m an operator with experience shipping governed AI in production. The assessment is operational and architectural, not legal. For liability questions, pair this work with a specialist EU AI Act lawyer. I work alongside legal counsel and can refer you to lawyers I trust if helpful.