EU AI Act Technical Compliance
The engineering half of AI Act compliance: 23Minds inventories and classifies your AI systems, writes the technical documentation, produces the testing evidence and turns logging, traceability and human oversight into architecture your team actually runs.
Entry packageEU AI Act Gap Analysisfrom EUR 5,6001 AI system · up to 4 weeks from scopingWhat is includedKnow which obligations apply
Risk classification of the system decides what the Act asks of you; the analysis names it.
Gaps as a 30-60-90 plan
Every gap against the technical requirements comes with an action and a date.
Evidence, not assurances
Inventory, documentation and test evidence in the form an auditor can read.
23Minds delivers the technical side of EU AI Act compliance for organizations that build, buy or deploy AI systems.
Show the full summary
The service inventories every AI system in use, classifies each one against the Act's risk tiers, writes the technical documentation the current obligations require, and produces adversarial-testing evidence that stands up to an audit. Logging, traceability and human oversight count as architectural requirements with named owners and working implementations, not as promises in a policy document. The engagement ends with a gap analysis and a costed remediation roadmap, plus an AI literacy plan that feeds directly into training for the people who operate these systems. Engineers, not lawyers, do this work: the team builds the technical evidence and works alongside your legal counsel or a partner law firm, which owns the legal interpretation and sign-off.
What makes this service defensible.
- Technical scope, stated plainly
Documentation, logging, human oversight and testing evidence; legal opinion is out of scope and named as such.
- Price set before work starts
Classification, inventory, gap analysis and action map; the price is fixed once the scope is agreed, four weeks.
- Polish-first
Written for organizations answering to Polish and EU regulators, in Polish first.
- Eligible for BUR / KFS co-funding
Consulting services qualify under operator rules in Poland.
The process, phase by phase.
Pick the way in that fits your budget and timing.
Every practice has a free first step, an entry package with a written deliverable and its price listed here, and a full project or retainer quoted after a first call. Once the scope is agreed, the price is fixed, with no hidden costs.
- 1Step 1 · Free
Intro call or self-assessment
60 minutes · 1 engineer · no obligation
FreeTalk to an engineerShow details
- Intro call with an engineer, or the online self-assessment
- A written next step within one business day
- No obligation and no sales deck
- Recommended2Step 2 · Entry package
EU AI Act Gap Analysis
1 AI system · up to 4 weeks from scoping
from EUR 5,600 netThe price is fixed once the scope is agreed on the intro call, no hidden costs; extras only from the Not included list.
Ask for this packageShow details
- Risk classification of one AI system
- Inventory of the system and its data flows
- Gap analysis against the technical requirements
- 30-60-90 day action map
- Not included: Legal opinion and representation before authorities, full Annex IV technical documentation, third-party conformity assessment, high-risk systems in the provider role.
- Eligible for BUR / KFS co-funding, subject to operator rules
- 3Step 3 · Project or retainer
Full scope, quoted after a first call
Full scope · phased delivery · quoted per phase
from EUR 18,700 net, quoted after a first callStart the conversationShow details
- Full technical compliance program for one system
- Documentation and adversarial test evidence
- Logging and human oversight design
The situations that bring teams to this service.
- Nobody can produce a list of the AI systems your organization actually runs, let alone their risk classification
- A client, tender or auditor asked for AI Act technical documentation and there is nothing written down
- Your systems log business events but not the model decisions, inputs and versions that traceability requires
Show the other problems (2)
- Human oversight exists on a slide but no interface, role or escalation path implements it in production
- Legal counsel gave you the obligations and the engineering team has no idea what to build in response
- Product startups whose AI feature was just classified as high-risk by a customer's procurement questionnaire
- Software houses and system integrators who must hand clients AI Act documentation for what they deliver
- Corporate and public-sector teams deploying purchased AI systems and carrying deployer obligations they did not write
- Regulated organizations in finance, health, HR, education and critical infrastructure with audit deadlines in front of them
- Compliance leads, CISOs, CTOs and heads of legal who need technical artifacts their counsel can sign
Where this goes wrong, and what we do about it.
1. Documentation written once, true for a weekWhat stays with you: documentation generated from the codebase where possible, with a named owner and a trigger tied to releases
What happensTechnical documentation gets produced as a project deliverable, signed off and stored. The system then changes, as systems do, and nothing regenerates the document. A year later the file describes an architecture that no longer exists, which is worse than having none, because it is presented as evidence.
What we do about itWe derive the parts that can be derived from the repository, so they change when the system changes, and we keep the narrative parts short enough that updating them is realistic. Then we set the review trigger to a release, not a date.
2. Logs exist and a decision cannot be reconstructedWhat stays with you: one historical decision reconstructed in full, plus the gaps we closed to make it possible
What happensLogging was designed for debugging, so it records what the service did, not what it decided or on what basis. When someone asks why this applicant got this answer in March, the honest reply is that the inputs, the model version and the prompt are no longer recoverable. The obligation is about traceability, and traceability is not the same thing as observability.
What we do about itWe check whether a single past decision can be rebuilt end to end, and where it cannot, we add what is missing: version pinning, input capture with the right retention, and a record of the human step. We prove it by reconstructing a real decision from last month.
3. Human oversight that cannot say noWhat stays with you: documented override path with its measured cost, and evidence it has been exercised at least once
What happensA person is placed in the loop and the process gives them neither the time nor the standing to overrule. They approve because approving is the only path that does not stop the queue. On paper there is oversight, in practice there is a signature, and the difference matters exactly when it is tested.
What we do about itWe check what happens when the human disagrees: whether there is a route, how long it takes, and whether anyone has ever used it. Where the route does not exist we design it, and where the workload makes review impossible we say that plainly rather than certifying it.
Deliverables, not deliverable-shaped slides.
- AI system inventory with owners, purpose, data flows, model and vendor per system
- Risk classification per system against the Act's tiers, with the reasoning written out for audit and legal review
- Technical documentation pack per in-scope system, structured to the Act's requirements
- Logging, traceability and human oversight specification, with the architectural changes needed to meet it
- Evaluation evidence file drawn from quality evaluation and code security review of the system, where required
- Gap analysis and costed remediation roadmap, plus an AI literacy plan mapped to roles
Questions procurement teams ask.
Guides that lead to this service.
Talk to an engineer.
Describe where you are with EU AI Act technical compliance. A reply within one business day.