AI Act technical compliance sprint
Your lawyer decides which duties apply. We implement them in your systems: AI notices in the chatbot, content marking, a register of systems, documentation and a workshop for the team. A short fixed-scope project: 5–10 working days, indicative price from PLN 6,000 net.
What applies today, and what is still to come
The EU’s Digital Omnibus package of amendments, in force since 27 July 2026, deferred the obligations for high-risk systems to 2027. That is the change that made the headlines — and the one most often read as meaning nothing need be done until 2027. The deferral covers only one part of the regulation. The transparency duties towards users, the existing prohibited practices and the AI literacy duty apply regardless of it.
| Date | What it covers |
|---|---|
| in force2 February 2025 | Prohibited practices (Article 5, except the two prohibitions added by the Digital Omnibus — see the 2 December 2026 row) and the AI literacy duty (Article 4). |
| in force2 August 2025 | Obligations for providers of general-purpose AI (GPAI) models, plus governance rules and penalties. GPAI models are those with significant generality that can perform a wide range of tasks well and can be integrated into many different systems or applications, excluding models used for research, development or prototyping activities before they are placed on the market. |
| in force2 August 2026 | Transparency obligations (Article 50), different for different roles. Providers of systems that interact with people (chatbots and voicebots, for example) design them so people know they are dealing with AI. Providers of systems that generate content mark it so software can recognise it (systems placed on the market before 2 August 2026 have until 2 December 2026). Deployers, meaning anyone who uses AI systems under their authority (companies and public bodies, for example), except for personal, non-professional use, disclose in specified cases, such as deepfakes and AI-generated text on matters of public interest. |
| from2 December 2026 | Two new Article 5 prohibitions added by the Digital Omnibus: specified practices involving AI systems that generate or manipulate non-consensual intimate content or child sexual abuse material (subject to the provision’s conditions and exceptions). The existing Article 5 prohibitions have applied unchanged since 2 February 2025. |
| from2 December 2027 | Annex III high-risk systems — moved from 2 August 2026 by the Digital Omnibus. This is the change that got the coverage. |
| from2 August 2028 | High-risk systems embedded in regulated products (Annex I) — moved from 2 August 2027. |
Verified 9 October 2026. This area moves quickly — two of the dates above were deferred after the regulation came into force. Confirm them with your own lawyer before making decisions on them.
Who Article 50 reaches — and in which role
The transparency obligations are not one bundle "for anyone with a chatbot". The regulation splits them between the provider of a system and its deployer (anyone who uses the system under their authority, for example a company or a public body, except for personal, non-professional use). Which role you occupy is for your lawyer to establish. In outline:
- The provider of a system intended to interact with people designs it so that users know they are dealing with AI, unless that is obvious. If you built or substantially adapted the chatbot, that role may be yours.
- The provider of a system that generates content marks that content in a machine-readable way, so other software can recognise it as AI-generated. Generative systems placed on the market before 2 August 2026 have until 2 December 2026.
- The deployer has separate duties in specific cases: deepfakes, AI-generated text published on matters of public interest, and systems that recognise emotions or sort people into categories from biometric data (such as a face or voice), among others.
The sprint implements the duties your lawyer has assigned to your role. Where that assessment does not exist yet, the register of systems from the first step is the material it can be made from.
What the sprint covers
The sprint is engineering work with a fixed, pre-agreed scope, usually delivered in 5–10 working days. We do the engineering: systems, integrations, documentation and whatever has to be demonstrable afterwards.
1. A register of AI systems
What is in use, by whom, in which process, on what data and to which vendor that data flows — including the tools teams adopted on their own initiative, which are rarely written down anywhere. The register records the facts — system, use, data, vendor — and leaves the legal role (provider or deployer) for your counsel to assign; prepared that way, it is the foundation for their opinion.
2. Transparency implemented (Article 50)
Within the scope your lawyer sets: notices in the chatbot or voicebot interface, marking of AI-generated content — visible where required, readable by software where the provider role requires it — and documentation of how it works. We do not change the AI model itself. We change what the user sees, the workflow and the information that describes the content (metadata).
3. Technical documentation and a record for inspections
A description of each system: what it does, on what data, its limitations and versions. Plus an agreed, minimal record of what the system did, designed to hold only necessary data, with a fixed set of fields, a defined retention period, access control and no default archive of full conversations. This is evidence, not an Article 50 or Article 4 duty; you decide its scope knowingly.
4. AI-literacy workshop (Article 4)
A workshop for the team on the tools that actually run in your company: where the AI gets things wrong, which data must not go into which tool and which approved route handles data that needs a legal basis, and when a system has to be stopped. Documented with an attendance list and its scope, because Article 4 requires measures you can evidence. It is not a standalone course — it is part of the implementation.
Cost and timing
Instead of open-ended consulting hours: a scope agreed up front and a fixed price for a concrete implementation.
- Delivery: 5–10 working days from the moment access to the systems is confirmed.
- Indicative price: PLN 6,000 to PLN 15,000 net. The exact figure and scope are settled after a free 30-minute call on which AI Act duties may apply to your company — they depend on the number of systems and integrations and on what your lawyer has assigned to your role.
- Out of scope: legal advice and classification of systems, a full GDPR assessment, rebuilding the product, and human oversight for high-risk systems (Article 14 — a high-risk duty deferred to 2 December 2027 for Annex III systems and to 2 August 2028 for systems embedded in Annex I products; we implement it separately where your lawyer concludes it is required).
For companies that want to stay compliant over time we offer post-implementation care from PLN 1,500 a month: a quarterly refresh of the register, a review of new tools and a record of changes — within an agreed cap of hours and systems, during business hours, with no promise of 24/7 availability.
Where our role ends and your lawyer's begins
This boundary matters more than usual here, so we state it before you let us into your systems.
- We do not provide legal advice. We do not opine on which role you occupy or whether your system is high-risk, and we do not interpret the regulation. This page is not legal advice either. If you have no counsel, we can recommend specialists.
- We do the engineering. The register of systems, notices and content marking in the interfaces, technical documentation, the agreed inspection record, the team workshop — the material any compliance assessment rests on.
- We work from your lawyer's conclusions. Once the role and the scope of obligations are settled, we translate them into concrete changes to the systems. If your lawyer concludes that a system needs human oversight or additional documentation, we implement that as a separately priced stage.
A separate boundary is the one between the AI Act and the GDPR. They are two independent sets of rules to be satisfied in parallel: the GDPR governs personal data whatever the technology, the AI Act governs AI systems, including ones that process no personal data at all. The sprint points out where they meet; the role split and the data flow themselves are set out under security and GDPR. Nor is this the only boundary — the full set of things we will not build and the conditions under which we advise against a project are collected on what we don’t do.
What to prepare for the call
Thirty minutes is enough if a few answers are ready on your side. We do not ask for real data from your systems or conversation samples — they are not needed at this stage.
- Which AI tools run in your company today — including the ones teams set up themselves.
- Whether any of them talk to customers or publish content externally.
- Whether you already have a lawyer's view of your role and duties — and if not, who will commission it.
- Who on your side owns these systems once the sprint is over.
Frequently asked questions
The high-risk deadline moved to 2027 — do we have time?
For the high-risk obligations, yes: 2 December 2027 for Annex III systems. But the deferral covers only that part. Transparency obligations (Article 50) have applied since 2 August 2026, the existing prohibited practices and the AI literacy duty (Article 4) since 2 February 2025, the two new prohibitions the Omnibus added to Article 5 from 2 December 2026, and the general-purpose model rules since 2 August 2025. "Nothing to do until 2027" is the most common wrong conclusion drawn from the coverage of the delay.
How does this service differ from legal advice?
Legal advice tells you which role you occupy (provider of the AI system, or deployer, meaning anyone who uses it under their authority — for example a company or a public body — except for personal, non-professional use), which provisions apply to you and what risk they carry. The sprint, a short technical project with a fixed scope, implements those conclusions in your systems: interface notices, content marking, a register of systems, documentation and team training. The lawyer sets the scope of the obligations — we carry it out and document it. Neither replaces the other.
We only use off-the-shelf tools like ChatGPT. Does the AI Act apply to us?
Most likely yes, as a deployer — a different and usually much lighter set of obligations than a provider carries. The AI literacy duty (Article 4) covers people operating a system on your behalf regardless of who built it. The duty to tell people they are interacting with AI (Article 50(1)) sits with the provider of the system — if you built or substantially adapted the chatbot yourself, that role may be yours; if you use a ready-made product, check with your lawyer who is responsible and what the vendor already does. Separate deployer duties under Article 50 cover cases such as deepfakes and AI-generated text published on matters of public interest.
What do we get at the end of the sprint?
A register of AI systems (the facts about each system, its use and data flow, with the legal role entered by your counsel), the transparency mechanisms implemented in your systems within the scope agreed with your lawyer (notices, content marking), technical documentation, an agreed, minimal record of what the system did in case of an inspection, and a delivered and documented AI-literacy workshop for the team. All of it in a form you can show a lawyer or a supervisory authority.
Do we have to record every conversation with the AI?
No. Neither Article 50 nor Article 4 imposes a general duty to record the instructions given to the AI and its answers. We design the record of the system's actions as optional evidence — with an agreed, minimal set of fields, a retention period, access control, and no default archive of full conversation contents. Full contents can contain personal and confidential data, so collecting them is a separate decision that needs a GDPR basis.
Does the AI literacy duty mean mandatory certified training?
No. Since the July 2026 amendment, Article 4 requires taking measures that support the development of AI literacy, accounting for knowledge, experience and context of use — not guaranteeing a particular level for each individual, and not any specific certificate. What matters in practice is that the people operating a system understand what it does, where it gets things wrong, and when to stop it. We document the workshop with an attendance list and its scope, because an undocumented measure is hard to evidence later.
Do you help with GDPR as well?
The AI Act and the GDPR overlap but are separate sets of rules: the GDPR governs personal data, the AI Act governs AI systems, including ones that process no personal data at all. The sprint flags where the two meet and designs the inspection record so it holds only the data it needs. A full GDPR assessment is separate work.
Sources
The dates and scopes above rest on the text of the regulation and the changes made by the EU’s Digital Omnibus package, in force since 27 July 2026. Verified 9 October 2026. Current texts:
- AI Act — consolidated text as at 27 July 2026 (EUR-Lex) — the amended version the table above rests on.
- European Commission — FAQ on the Article 50 transparency obligations — the source for the provider/deployer split and for the 2 December 2026 date for generative systems placed on the market before 2 August 2026.
- Regulation (EU) 2024/1689 — original text
Start with a 30-minute review
A free call, after which you know which AI systems you actually run, which of today's obligations may reach you, and what sprint scope makes sense.
Free 20–30-minute call. Write or call, and we’ll reply with two time slots.
Free 30-minute AI systems review
The message goes straight to our mailbox. If you would rather e-mail or call, both are above.
Thank you — your message has arrived.
We usually reply the same working day, at the latest the next one.
Information on data processing
The controller of your data is Actum Krzysztof Ploch, ul. Irzykowskiego 3/15, 01-317 Warsaw, Poland, contact@ploch.ai. We process the data from the form to reply to your message and — if you ask for one — to prepare an offer (Art. 6(1)(b) GDPR: steps prior to a contract, at your request), and in our legitimate interest in handling correspondence and protecting the form from spam (Art. 6(1)(f) GDPR).
The message goes to our mailbox and is not stored in any database on the site's server. The recipients of the data are the hosting provider and the e-mail provider. Solely to limit the number of submissions, we record a hash of the IP address on every attempt to send, and — if you have JavaScript enabled — already from the moment you start filling in the form. The hash does not reveal the address; the key needed to compute it never leaves the server. We keep the hash for one hour after the last use, and once that hour has passed it is deleted at one of the next uses of the form by anyone. We keep correspondence for as long as needed to handle the matter and thereafter until any related claims become time-barred.
You have the right to access, rectify, erase and port your data, to restrict its processing, to object to processing based on legitimate interest, and to lodge a complaint with the President of the Personal Data Protection Office (UODO). Providing data is voluntary, but without an e-mail address we cannot reply. Details are in the privacy policy.
Last updated: