RhymetecNew York, NY, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for EU AI Act, ISO 27001, SOC 2, HIPAA, PCI DSS and more.
- Standards
- Pricing
- Not published
EU AI Act
The EU Artificial Intelligence Act (Regulation (EU) 2024/1689) is the European Union's horizontal law on AI.
It sorts AI systems by risk: a short list of prohibited practices, a set of high-risk uses (Annex III standalone systems such as hiring, credit scoring, and critical infrastructure, plus Annex I systems embedded in products already covered by EU product safety law), transparency duties for chatbots and synthetic content, and a separate regime for general-purpose AI models.
The prohibitions have applied since February 2, 2025 and the general-purpose model obligations since August 2, 2025. The Digital Omnibus on AI, reported as entering into force on July 27, 2026, pushed the high-risk deadlines back: Annex III systems to December 2, 2027 and Annex I systems to August 2, 2028. The Article 50 transparency duties kept their August 2, 2026 date.
For a provider of a high-risk system the law is largely a documentation statute. It requires a written risk management system that runs across the lifecycle, data governance records for training and testing sets, technical documentation per Annex IV, automatic logging, instructions for use, a human oversight design, a quality management system, a declaration of conformity, and post-market monitoring with serious incident reporting.
Deployers must follow those instructions, keep logs, assign trained human oversight, and in some cases complete a fundamental rights impact assessment. Every organization, whatever its role, must ensure staff have adequate AI literacy.
Share
Ad from the publisher
Policy Acknowledgment Proof
AcknowledgedAI use policy v1by name, on record
Article 4 Handledwith AllyMatter
Govern the Modern WayEvery AI-use policy, acknowledged by the people who deploy the system
01
Approve it, lock the version
Non-author approval, obsolete copies blocked
02
Every operator on record
Who read which version, and when
03
Show the market surveillance authority the trail
From $29/mo, 20 editors, unlimited staff (published)
Who has to comply
Providers that place AI systems or general-purpose models on the EU market, deployers established in the EU, and importers and distributors. Providers and deployers outside the EU are caught when the system's output is used in the EU. Obligations scale with the risk tier; most SMEs using off-the-shelf tools face only the AI literacy and transparency duties.
What the assessor asks to see
AI system inventory and risk classification rationale; risk management system documentation; data governance records (provenance, bias examination, relevance of training data); Annex IV technical documentation; logging design and retained logs; instructions for use; human oversight measures; quality management system; conformity assessment record and EU declaration of conformity; EU database registration; post-market monitoring plan and incident reports; AI literacy training records; for deployers, the fundamental rights impact assessment where required.
Where the requirement sits: Art 4 AI literacy; Art 26 deployer obligations; Art 9 risk management; Art 11 technical documentation; Art 17 QMS
Application timeline
Entry into force August 1, 2024. Prohibited practices and AI literacy from February 2, 2025. General-purpose AI model obligations and governance provisions from August 2, 2025.
Transparency obligations (Article 50) from August 2, 2026. High-risk Annex III systems deferred by the AI Omnibus to December 2, 2027 and Annex I systems to August 2, 2028; these amended dates were reported by legal commentary after the Omnibus entered into force on July 27, 2026 and should be verified against the Official Journal text.
Every internal policy in one place
AllyMatter is a full system for every internal policy your company keeps, including the ones EU AI Act turns on. Build the whole library in one place, across every department, and prove who has read what.
What you can run here
Every written policy and procedure your organization keeps, from one library, whatever the standard asks for.
How it works
Every document is approved by someone other than its author, versioned, distributed to the people it covers and acknowledged by name. Sign it where a signature is what the standard wants, send a set out together as a package, and export a dated record of who read which version when an assessor asks.
The written policies this standard turns on live here, with every version and every acknowledgment on the record.
Who helps with EU AI Act
A fast-growing ecosystem of law firms, AI governance consultancies, and GRC platform vendors. Typical engagements start with an inventory and risk classification of AI systems, then build the risk management system, technical documentation, and quality management system for anything high-risk, and often map the work onto ISO/IEC 42001.
Engagements run from a few weeks for classification to many months for a high-risk provider.
Firms that name this framework in their own material. A listing is not a recommendation. Each firm can confirm its own.
Listed in random order, reshuffled each time the page loads. Firms that pay for a listing are shown at the top, labeled Sponsored.
VistradaNew York, New York, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for EU AI Act, ISO 27001, SOC 2, HIPAA, PCI DSS and more.
- Standards
- Pricing
- Not published
CycoreMiami, FL, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for EU AI Act, ISO 27001, SOC 2, HIPAA, PCI DSS and more.
- Standards
- Pricing
- Not published
Atlant SecurityUSA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for EU AI Act, ISO 27001, SOC 2, HIPAA, PCI DSS and more.
- Standards
- Pricing
- Not published
VISTA InfoSecMumbai, India
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for EU AI Act, ISO 27001, SOC 2, HIPAA, PCI DSS and more.
- Standards
- Pricing
- Not published
IsecurionBengaluru, Karnataka, India
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for EU AI Act, ISO 27001, SOC 2, HIPAA, PCI DSS and more.
- Standards
- Pricing
- Not published
CognisysLeeds, UK, UK
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for EU AI Act, CMMC, NIST 800-171, PCI DSS, GDPR and more.
- Standards
- Pricing
- Not published
Lawless SolutionsUSA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for EU AI Act, HIPAA, GDPR.
- Standards
- Pricing
- Not published
Deura Information Security ConsultingPetaluma, California, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for EU AI Act, HIPAA, PCI DSS, GDPR, NIST CSF and more.
- Standards
- Pricing
- Not published
Meraki Innovatory IncMissouri City, Texas, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for EU AI Act, ISO 9001, ISO 45001, ISO 42001, ISO 13485 and more.
- Standards
- Pricing
- Not published
Noviqa LtdBelfast, UK
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for EU AI Act, ISO 9001, GDPR, ISO 14001, ISO 45001 and more.
- Standards
- Pricing
- Not published
QCert360Bengaluru, Karnataka, India
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for EU AI Act, ISO 27001, SOC 2, ISO 9001, HIPAA and more.
- Standards
- Pricing
- Not published
Assure StartKirkcaldy, Fife, Scotland, UK
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for EU AI Act, ISO 27001, GDPR, NIST CSF, ISO 42001 and more.
- Standards
- Pricing
- Not published
Lorit ConsultancySalzburg, Austria
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for EU AI Act, ISO 13485, IATF 16949, IEC 60601, IEC 60601-1 and more.
- Standards
- Pricing
- Not published
BD EmersonRichmond, VA, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for EU AI Act, SOC 2, CMMC, NIST 800-171, PCI DSS and more.
- Standards
- Pricing
- Not published
Cyber Security SpecialistsAltrincham, Greater Manchester, UK
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for EU AI Act, ISO 27001, SOC 2, PCI DSS, GDPR and more.
- Standards
- Pricing
- Not published
BH ConsultingDublin 15, Ireland
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for EU AI Act, PCI DSS, GDPR, NIST CSF, ISO 42001 and more.
- Standards
- Pricing
- Not published
GRC HubLeeds, UK
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for EU AI Act, PCI DSS, GDPR, ISO 42001, ISO 27701 and more.
- Standards
- Pricing
- Not published
Risk CrewLondon, UK
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for EU AI Act, PCI DSS, GDPR, ISO 42001, Cyber Essentials and more.
- Standards
- Pricing
- Not published
Claranet UKUK-wide
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for EU AI Act, ISO 27001, PCI DSS, GDPR, ISO 42001 and more.
- Standards
- Pricing
- Not published
Evolve NorthRichmond, North Yorkshire, UK
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for EU AI Act, PCI DSS, GDPR, ISO 42001, DORA and more.
- Standards
- Pricing
- Not published
Oxford InfosecOxford, UK
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for EU AI Act, PCI DSS, GDPR, ISO 42001, ISO 27701 and more.
- Standards
- Pricing
- Not published
GDPR AdvisorAylesbury, Buckinghamshire, UK
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for EU AI Act, SOC 2, GDPR, Cyber Essentials, DSPT and more.
- Standards
- Pricing
- Not published
Equilibrium SecurityBirmingham, UK
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for EU AI Act, PCI DSS, GDPR, NIST CSF, ISO 42001 and more.
- Standards
- Pricing
- Not published
NormCyberFareham, Hampshire, UK
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for EU AI Act, ISO 27001, GDPR, UK GDPR.
- Standards
- Pricing
- Not published
ByteBakCalgary AB, Canada
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for EU AI Act, SOC 2, ISO 9001, PCI DSS, ISO 14001 and more.
- Standards
- Pricing
- Not published
Waterleaf International LLC (Cyberleaf)Fort Myers, FL, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for EU AI Act, ISO 27001, SOC 2, HIPAA, CMMC and more.
- Standards
- Pricing
- Not published
Intrax Technology Group, Ltd.USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for EU AI Act, ISO 27001, CMMC, NIST 800-171.
- Standards
- Pricing
- Not published
Axiom GRCUK
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for EU AI Act, ISO 27001, ISO 9001, CMMC, PCI DSS and more.
- Standards
- Pricing
- Not published
ZaviantPhiladelphia, PA, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for EU AI Act, ISO 27001, SOC 2, HIPAA, CMMC and more.
- Standards
- Pricing
- Not published
AssenteoLondon, UK
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for EU AI Act, SOC 2, ISO 27001, ISO 42001, HIPAA and more.
- Standards
- Pricing
- Not published
SHOKA consulting LTDUK
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for EU AI Act, ISO 27001, ISO 42001, ISO 23894, ISO 42005.
- Standards
- Pricing
- Not published
Technoserve IT Consulting LTDLondon, UK
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for EU AI Act, GDPR, ISO 42001, DORA.
- Standards
- Pricing
- Not published
Who assesses EU AI Act
Depends on the system. Most Annex III high-risk providers self-assess through the internal control procedure in Annex VI. Third-party assessment by a notified body is required for certain biometric systems where harmonized standards are not fully applied, and for Annex I products it runs through the notified body already used under the sectoral product law.
General-purpose model providers are supervised directly by the AI Office. Accredited by National notifying authorities designate notified bodies, normally on the basis of accreditation by the national accreditation body under Regulation (EC) 765/2008. Designations are published in the Commission's NANDO database.
Public register of assessors: webgate.ec.europa.eu ↗
Assessors
Be the first EU AI Act assessor listed here
This page is read by the organizations looking for someone to certify them.
Tools for EU AI Act
Tools that name this framework in their own material.
Grouped by type. Inside each group the order is random, reshuffled each time the page loads. AllyMatter, the publisher of this site, is always first.
AllyMatterPolicy management tool, the policy and acknowledgment layerPublisher of this siteGRC and compliance automation10 tools
Controls, evidence and audit workflows, with a policy module inside.
SecfixGermanyCompliance automation platformNot publishedOneTrustGRC platform for privacy, consent, AI governance and third-party riskNot publishedSAI360Chicago, IL, United StatesCompliance management platform for ethics, risk and regulatory complianceQuote onlyComplAIUnited StatesContinuous compliance assurance platform for federal and regulated frameworksQuote onlytuss.ioSingaporeAI-powered compliance gap analysis platformNot publishedShieldIQDublin, IrelandAI-powered GRC platformPrice publishedDataGuardMunich, GermanySecurity and compliance platformQuote onlyKertosMunich, GermanyCompliance automation platformQuote onlyKetryxCambridge, MA, United StatesCompliance and application lifecycle management platform for regulated softwareQuote onlyheygrcCompliance code review for pull requestsPrice published
AI governance5 tools
Inventories, risk assessments and controls for AI systems under the EU AI Act, ISO 42001 and NIST AI RMF.
Privacy and data governance3 tools
Consent, data maps and data subject requests under GDPR, CCPA and similar laws.
Related reading
- High-level summary of the AI ActClause-by-clause plain-language walkthrough of the risk tiers and what providers and deployers must actually do for each.Future of Life Institute
- EU AI Act Omnibus Agreement: postponed high-risk deadlines and other key changesExplains the Digital Omnibus changes that moved the high-risk compliance dates, and what stayed on the original timetable.Gibson Dunn
- U.S. companies face the EU AI Act's compliance deadlineSets out when the Act reaches a non-EU company and which documentation and governance duties follow from that.Holland & Knight
Independent third-party explainers, chosen by hand. Not affiliated with this site and not paid placements. All links are nofollow.
Need a hand implementing it?
Find a Consultant for EU AI Act
Tell us what you need done and we will point you to firms that do this work. Your details go to a firm only when you choose it.
From the publisher
Run the Policy Side of EU AI Act in AllyMatter
Approve the policies EU AI Act asks for, keep every version, and record a named acknowledgment from each person who has to read them.
See how AllyMatter works ↗From $29/mo, 20 editors, unlimited staff