How to comply with the EU AI Act: A practical guide for consulting firms

Many consulting firms use AI tools for research, analysis, and proposal drafting. Some also deploy AI in hiring, client risk assessment, or automated decision-making. These applications span multiple risk categories under the EU AI Act, and compliance obligations scale with risk classification.

Non-compliance with the EU AI Act can lead to administrative fines up to €35 million or 7% of global annual turnover, contractual liability, and reputational damage.

This guide outlines five core governance areas under the EU AI Act, highlighting current obligations alongside high-risk rules which become enforceable on December 2, 2027.

Regulatory requirements at a glance

What counts as limited- vs. high-risk AI?

Begin by determining your risk category.

🟡 Limited-risk AI applications assist with analysis, drafting, writing, or content generation where humans retain decision-making authority and review outputs prior to use or delivery.

🔴 High-risk AI applications make or materially influence consequential decisions about individuals, including:

• Recruitment and employment decisions (e.g., hiring, promotion, performance evaluation, workforce management)
• Financial and access decisions (e.g., creditworthiness, insurance eligibility, lending)

If you are unsure whether an AI system is high-risk, the Annex III classification in the EU AI Act provides definitive categories. Where doubt remains, it might be prudent to treat the system as high-risk; the regulatory cost of over-compliance is typically lower than the cost of under-compliance.

Table of contents: Core governance areas

• 1. 📋 Governance and accountability
• 2. 🏷️ System roles and classifications
• 3. 🔗 Supply chain integrity and data infrastructure
• 4. 👁️ Transparency and disclosure
• 5. 📈 Post-market operational governance

The 5 governance areas: Requirements by risk category

The EU AI Act establishes requirements across five core governance areas. Baseline duties apply currently, while enhanced rules for high-risk applications become enforceable on December 2, 2027.

1. 📋 Governance and accountability

This area covers how your firm manages AI responsibilities, ensures staff competence, and monitors risk.

🟡 Limited-risk applications

Staff training:

• Ensure staff using AI have a sufficient level of AI literacy appropriate to their role and the context of use.
• This does not require formal certification, but staff should understand basic model limitations, hallucination risks, and when human review is required.

Written policy:

• Establish a tailored policy outlining which AI tools are approved for specific purposes, which data types are strictly prohibited, and what constitutes responsible use within your firm.

Record-keeping:

• Update your firm's Record of Processing Activities (RoPA) whenever an AI tool is integrated into a workflow. Document the tool name, vendor, processed data types, and your legal basis for processing.

Data Protection Impact Assessment (DPIA):

• If the AI tool processes special category data (e.g., health, biometric, genetic information) or involves systematic individual monitoring, conduct a standard DPIA. This focuses on data privacy, flows, storage security, and vendor access controls.

⚖️ Legal basis: EU AI Act Article 4; GDPR Articles 5, 30, and 35.

🔴 High-risk applications (enforceable Dec 2, 2027)

All limited-risk requirements apply, plus:

Comprehensive DPIA and Fundamental Rights Impact Assessment (FRIA):

• Conduct a comprehensive DPIA covering personal data handling, technical security safeguards, and privacy risks.
• Perform a Fundamental Rights Impact Assessment (FRIA). Distinct from a data-focused DPIA, a FRIA evaluates broader impacts on affected groups, such as non-discrimination, fairness, transparency, and human oversight in automated outcomes.

Operational monitoring and documentation:

• Monitor high-risk systems to track outcomes across affected groups, detect performance issues, and prevent discriminatory impacts.
• Maintain technical documentation covering system logic, training data, input types, performance metrics, and known limitations to ensure full operational traceability.

Human oversight:

• Implement mandatory human review protocols so that no high-risk decision is made by the system alone.
• Establish clear processes for individuals to request manual review or correction of any AI-generated outputs concerning them.

⚖️ Legal basis: EU AI Act Articles 4, 6, 13, 14, 26, and 27; GDPR Articles 5, 22, 30, and 35.

2. 🏷️ System roles and classifications

This area covers how you categorise and manage AI systems.

🟡 Limited-risk applications

No surveillance AI:

• Verify that none of your productivity tools, time-tracking systems, or analytics platforms use AI to infer employees' emotional states, psychological conditions, or behavioural metrics.

⚖️ Legal basis: EU AI Act Article 5.

🔴 High-risk applications (enforceable Dec 2, 2027)

All limited-risk requirements apply, plus:

Centralised register and classification:

• Maintain a dynamic register of all high-risk AI systems your firm deploys, including:
  • Tool name and vendor
  • Which employees can access it and for what purposes
  • What outcomes the system influences (e.g., hiring decisions, client assessments)
  • Current classification status

Employee notification:

• Before deploying any high-risk system that affects employee recruitment, evaluation or management, formally notify affected personnel and workers' representatives (such as works councils) in writing.
• Disclosure should specify the system's purpose, how it is used, and what data it processes.

⚖️ Legal basis: EU AI Act Articles 5, 6, 13, and 26.

3. 🔗 Supply chain integrity and data infrastructure

This area covers where your data flows, what vendor agreements you have in place, and how well your data is protected.

🟡 Limited-risk applications

Enterprise-tier accounts with Data Processing Agreements (DPAs):

• Use enterprise-tier accounts with written DPAs when processing any confidential data.

Training data opt-out confirmation:

• Obtain written confirmation from your vendor that confidential data is not used for model training or optimisation.

Data residency verification:

• Ensure that any personal data remains within the EEA, or that Standard Contractual Clauses and Transfer Impact Assessments are in place for non-EEA transfers.

Basic security controls:

• Verify that your firm uses Single Sign-On (SSO) or managed authentication to access AI tools.
• Confirm that data in transit to the vendor is encrypted.
• Use automated Data Loss Prevention filters or manual review to prevent employees from pasting confidential data into public AI tools.

⚖️ Legal basis: EU AI Act Article 26; GDPR Articles 28, 32, and 44-49.

🔴 High-risk applications (enforceable Dec 2, 2027)

All limited-risk requirements apply, plus:

Enhanced DPAs:

• Ensure DPAs address the risks posed by high-risk systems, covering:
  • Data retention limits
  • Breach notification procedures
  • Vendor accountability if the system produces discriminatory outcomes or materially misjudges an individual

Technical security for sensitive data:

• If the system processes special category data, ensure encryption at rest with encryption key management that remains under your firm's or a trusted EU provider's control.
• Implement Role-Based Access Control (RBAC) so that only authorised personnel can access the system, with permissions aligned to job roles.

⚖️ Legal basis: EU AI Act Articles 6, 26; GDPR Articles 9, 28, 32, and 44-49.

4. 👁️ Transparency and disclosure

This area covers how you communicate AI use to clients, employees, and individuals affected by automated decisions.

🟡 Limited-risk applications

Synthetic media labelling:

• Ensure visible disclosure and machine-readable metadata for deceptively realistic synthetic media or unreviewed AI-generated text published on matters of public interest.

⚖️ Legal basis: EU AI Act Article 50.

🔴 High-risk applications (enforceable Dec 2, 2027)

All limited-risk requirements apply, plus:

Automated decision disclosure and explanation rights:

• Inform individuals when automated systems make or materially influence consequential decisions regarding them, providing clear explanations of system logic, data considered, and decision thresholds upon request.

System and performance transparency:

• Provide clear documentation detailing system accuracy, capabilities, limitations, and operational metrics for regulatory review.

⚖️ Legal basis: EU AI Act Articles 13, 14, 26, 50, and 86; GDPR Articles 13–14 and 22.

5. 📈 Post-market operational governance

This area covers how you monitor high-risk systems after deployment.

🔴 High-risk applications (enforceable Dec 2, 2027)

Enhanced audit logging:

• Retain and securely store immutable, timestamped logging to capture:
  • User identity and role
  • System accessed and function invoked
  • Input data (appropriately redacted for privacy)
  • System output and confidence scores
  • Any system errors or anomalies
• Maintain documentation demonstrating that human review occurs before decisions are finalised.

System performance monitoring:

• Monitor system outputs to identify performance degradation, operational risks, or unexpected outcomes over time.
• If performance issues emerge, escalate to the vendor and prepare contingency plans (e.g., manual review, system suspension, or replacement).

Contingency and override procedures:

• Document procedures for operators to pause or override the system if it is malfunctioning.

⚖️ Legal basis: EU AI Act Articles 12, 14, and 26.

How Regulumos can help

Managing governance across limited- and high-risk systems can be complex, especially for smaller firms without dedicated legal or compliance teams.

Regulumos addresses this by providing purpose-built infrastructure designed specifically for professional services SMEs:

• EU data residency: All data remains within the EU, eliminating international transfer complexity and risk.
• Zero-training guarantee: Your firm's data is never used to train future models.
• Audit-ready architecture: Every interaction is logged, making it straightforward to demonstrate compliance during regulatory review.
• No shadow AI: By providing a compliant, dedicated workspace with frontier models providing high-quality outputs, Regulumos removes the need for staff to route sensitive work through unvetted consumer-grade tools.

Get in touch to book a free call to explore how Regulumos can support your compliance roadmap.