AI Risk Assessment And EU AI Act Compliance, Without The Legal Jargon

Find out which AI rules apply to your business, what you have to do, and by when. Then get the documentation, oversight and policies in place before anyone asks to see them.

Book a free 30-minute call Read our EU AI Act guide

ISO 42001 CERTIFIED  ·  ISO 27001 CERTIFIED  ·  GDPR COMPLIANT  ·  EU AI ACT READY

Most Businesses Don't Know Which Rules Apply To Them

Most Businesses Don't Know Which Rules Apply To Them

The EU AI Act has been in force since August 2024, but its obligations arrive in stages, and the dates have moved.

Some duties are already live. Prohibited practices have been enforceable since February 2025, and the transparency obligations that require telling people when they're dealing with AI took effect in August 2026.

Others have been deferred. The Digital Omnibus, which came into force in July 2026, pushed the high-risk obligations for standalone systems from August 2026 out to December 2027.

The practical result is confusion. Businesses either assume nothing applies to them, or assume everything does. Usually neither is true.

An AI risk assessment tells you which category your AI systems actually fall into, what that means in obligations, and what you need to do first.

This page is general information, not legal advice. For a formal legal opinion, speak to a qualified solicitor.

What An AI Risk Assessment Covers

What An AI Risk Assessment Covers

What AI you're actually using. Most businesses find more than they expected once shadow tools and AI features inside existing software are counted.

Where each system sits under the Act: prohibited, high-risk, limited-risk with transparency duties, or minimal risk. This determines everything else.

What each classification requires of you specifically, whether you're building the AI or just using it. The duties differ considerably.

What's in place already and what isn't, across documentation, human oversight, logging, data governance and staff training.

Where your AI use triggers data protection obligations, including whether a Data Protection Impact Assessment is needed.

What to fix first, what can wait, and what's genuinely not a concern. With dates attached.

Our AI Governance Consulting Services

AI Risk Assessment

The review above, delivered as a written report with a classification for every system and a prioritised plan.

AI Policies And Procedures

The AI policy for business documents you need: acceptable use for staff, procurement rules for AI tools, incident response, and human oversight procedures.

Human Oversight Design

Building the approval and review steps into your AI systems so a person is genuinely accountable, not just nominally.

Documentation And Record-Keeping

The technical documentation, logging and audit trails you'd need if a regulator or a client asked.

AI Literacy Training

The Act expects businesses using AI to ensure staff have sufficient AI literacy. We deliver that as practical sessions.

See AI Training icon

Vendor And Procurement Review

Assessing the AI tools you're buying, since using someone else's AI system still carries obligations.

Your Obligations Depend On What You Do

The Act treats providers and deployers differently, and most Irish SMEs are deployers rather than providers.

Your Obligations Depend On What You Do

If you use AI tools built by someone else, your duties are lighter but real: ensuring staff AI literacy, maintaining human oversight, using the system as intended, and telling people when they're interacting with AI.

If you build or substantially modify AI for others to use, you take on provider obligations, which are considerably heavier.

If your AI touches recruitment, credit scoring, education or access to essential services, it may fall into the high-risk category, where the full documentation and conformity requirements apply from December 2027.

Working out which applies to you is the first thing the assessment does.

We're Certified Ourselves

We are one of Ireland's first companies to achieve ISO 42001 certification, the international standard for AI management systems, alongside ISO 27001:2022 for information security.

Both were independently audited. We went through the documentation, the risk assessments, the oversight procedures and the evidence requirements ourselves.

That matters here for one reason: we know what an auditor actually asks to see, because we've been asked. Advice about governance from a firm that has never been audited is theoretical.

We're Certified Ourselves

How The
Engagement Works

Free Call,
30 Minutes

Free Call, 30 Minutes

You describe what AI your business uses. We give you a rough sense of where you stand and whether a formal assessment is warranted.

Assessment,
One To Three Weeks

Assessment, One To Three Weeks

System inventory, classification, gap analysis and a written report with a prioritised plan.

Remediation, Scoped
From The Report

Remediation, Scoped From The Report

Policies written, oversight designed, documentation built, training delivered. You can do this yourself with the report, or we can do it.

Review

Review

Obligations and deadlines change. We can review annually, or when you deploy something new.

Why Work With Us

We're Certified, Not Just Advising On It

ISO 42001:2023 and ISO 27001:2022, independently audited.

We Build AI As Well

Governance advice from people who only write policies tends to be impractical. We know what's actually achievable because we deliver AI systems.

Plain English

The report is written for your board, not for lawyers.

Proportionate To Your Size

Most SMEs need far less than they fear. We'll tell you when something doesn't apply to you.

Independent of every vendor

We don't resell AI platforms or compliance software.

Why Work With Us

Find out where you actually stand

A 30-minute conversation about what AI your business uses and what that means for your obligations. No jargon, no scaremongering.

We respond within 24 hours · Your data stays private and GDPR compliant.

Frequently Asked Questions

AI Consulting Frequently Asked Questions

Probably in some form, if you use AI at all. The duties for businesses using AI tools are much lighter than for those building them, and most obligations depend on what the AI is used for. An AI risk assessment establishes which apply to you specifically.

A structured review of the AI your business uses, classifying each system by risk level under the EU AI Act, mapping the resulting obligations, and identifying what's missing. It produces a written report with a prioritised action plan.

They vary by obligation and some have moved. Prohibited practices have applied since February 2025, and transparency duties since August 2026. High-risk obligations for standalone systems were deferred to December 2027. Our guide sets out the full timeline EU AI Act Ireland

The UK isn't bound by it, but UK businesses placing AI systems on the EU market, or whose AI output is used in the EU, can still fall within scope. We can assess that.

For many small businesses using a handful of off-the-shelf AI tools, a checklist and some policies are sufficient. A formal assessment is worth it when you're building AI, using it in recruitment or credit decisions, or when clients are asking for assurances. We'll tell you which situation you're in on the first call.

No. Certification is awarded by accredited certification bodies, not consultants. We hold the certification ourselves and can tell you what the process involved, but achieving it is a separate undertaking with a certification body.

No. We advise on practical AI compliance: what to document, how to design oversight, what policies to put in place. For a formal legal opinion on your obligations, you'd want a solicitor, and we work alongside them regularly.